v3: the tests learn to expect trouble, and seven bugs they now catch are fixed — a review of the two test-suite commits found them written mostly for the happy path; each fix below comes with the test that fails without it. Infinite scroll: a later page that failed turned loadingMore back off, which made a new IntersectionObserver, which reports a sentinel still in view at once — so an offline feed asked again as fast as the request could fail, on Search, Index, the followed feeds, user dumps and user playlists alike. useInfiniteScroll now waits 1s, 2s, 4s… up to 30s while the sentinel stays put, counted from the last load so re-renders don't restart it, and asks at once again when the sentinel leaves the view or is pushed down by new items; the fake observer in src/test can report an element in view on observe(), as a browser's does. Playlist covers: the row was updated and playlist_updated sent before the file was written, so a client fetching image?v=<new> in between cached the old cover (or a 404) under the new URL for an hour, and a failed write left image_mime set with no file behind it. The file now goes in first, written beside and renamed over, and only then does the row change. Playlist order: the server wanted every member named, but GET hides private dumps the requester can't see, so a playlist holding someone else's dump that went private — or one a moderator reorders around the owner's private dumps — could never be reordered. The requester now orders what they can see and hidden members keep their slots; the visibility rule lives in api/lib/playlist-members.ts, shared by GET, reorder and the socket. playlist_dumps_updated also sent every member's id, private ones included, to a public playlist's whole audience; each viewer now gets the ids they can see, plus a dumpCount of all members so playlist cards keep the server's count. File dumps: replacing the file and changing visibility took two requests, so a failed second one left the new file live under the old visibility; PUT /api/dumps/:id/file takes isPrivate and applies both in one UPDATE, and it now broadcasts like any edit (it sent nothing, so other viewers never saw a new title). Notifications: one that arrived while the list was loading was dropped, then marked read by the read-all after the load, so it never showed; it's kept and merged in, once. Ranges: bytes=0-0,5-6 got a 416; several ranges, another unit or an unparseable header are ignored now and the whole file sent with a 200, as RFC 9110 allows — the old test asserted the 416.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

api/services/dump-service.ts

@@ -522,6 +522,9 @@ export async function replaceFileDump(
   comment: string | undefined,
   title?: string,
   categoryIds?: string[],
+  // Left out, visibility stays as it is. Taken here rather than by a second
+  // request so a new file and a change of visibility land together.
+  isPrivate?: boolean,
 ): Promise<Dump> {
   assertFileDumpText(title, comment);
   if (!isAllowedMime(file.type)) {
@@ -556,9 +559,10 @@ export async function replaceFileDump(
   const newSlug = finalTitle !== dump.title
     ? makeSlug(finalTitle, dumpId)
     : dump.slug;
+  const finalPrivate = isPrivate ?? dump.isPrivate;
   try {
     db.prepare(
-      `UPDATE dumps SET title = ?, slug = ?, file_name = ?, file_mime = ?, file_size = ?, comment = ?, updated_at = ? WHERE id = ?;`,
+      `UPDATE dumps SET title = ?, slug = ?, file_name = ?, file_mime = ?, file_size = ?, comment = ?, is_private = ?, updated_at = ? WHERE id = ?;`,
     ).run(
       finalTitle,
       newSlug ?? null,
@@ -566,6 +570,7 @@ export async function replaceFileDump(
       file.type,
       file.size,
       comment ?? null,
+      finalPrivate ? 1 : 0,
       now.toISOString(),
       dumpId,
     );
@@ -589,7 +594,7 @@ export async function replaceFileDump(
     linkAttachments(comment, dumpId);
   }
   relinkBacklinks("dump_comment", dumpId, dumpId, comment ?? "");
-  return {
+  const updatedDump: Dump = {
     ...dump,
     title: finalTitle,
     slug: newSlug,
@@ -597,8 +602,13 @@ export async function replaceFileDump(
     fileMime: file.type,
     fileSize: file.size,
     comment,
+    isPrivate: finalPrivate,
     updatedAt: now,
   };
+  if (updatedDump.isPrivate && !dump.isPrivate) broadcastDumpDeleted(dumpId);
+  else if (!updatedDump.isPrivate) broadcastDumpUpdated(updatedDump);
+  if (dump.isPrivate && !updatedDump.isPrivate) broadcastNewDump(updatedDump);
+  return updatedDump;
 }
 
 export function getDumpsByUser(

api/services/playlist-service.ts

@@ -28,6 +28,10 @@ import {
 } from "./notification-service.ts";
 import { makeSlug, UUID_RE } from "../lib/slugify.ts";
 import { linkAttachments } from "./attachment-service.ts";
+import {
+  isMemberVisibleTo,
+  type PlaylistMember,
+} from "../lib/playlist-members.ts";
 
 const PLAYLIST_SELECT = `p.*, u.username as owner_username,
    (SELECT COUNT(*) FROM playlist_dumps pd WHERE pd.playlist_id = p.id) as dump_count
@@ -89,9 +93,6 @@ export function getPlaylist(
     throw new APIException(APIErrorCode.NOT_FOUND, 404, "Playlist not found");
   }
 
-  const isOwner = requestingUserId === playlist.userId;
-
-  // For public playlists (or when viewed by non-owner), filter out private dumps
   const rows = db.prepare(
     `SELECT ${DUMP_COLUMNS_ALIASED},
        (SELECT COUNT(*) FROM comments WHERE dump_id = d.id AND deleted = 0) as comment_count
@@ -103,8 +104,9 @@ export function getPlaylist(
   ).all(playlist.id, requestingUserId ?? "");
 
   const dumps: Dump[] = rows.filter(isDumpRow).map(dumpRowToApi);
-  // Owners always see their own private dumps; strip them for non-owners regardless
-  const visibleDumps = isOwner ? dumps : dumps.filter((d) => !d.isPrivate);
+  const visibleDumps = dumps.filter((d) =>
+    isMemberVisibleTo(d, playlist, requestingUserId)
+  );
 
   return { ...playlist, dumps: visibleDumps };
 }
@@ -225,9 +227,9 @@ export function deletePlaylist(
   broadcastPlaylistDeleted(playlist.id, playlist.userId, playlist.isPublic);
 }
 
-export function setPlaylistImage(
+/** The playlist, if the requester may edit it; 404 or 403 otherwise. */
+export function getEditablePlaylist(
   playlistId: string,
-  imageMime: string,
   requestingUserId: string,
   canModerate: boolean,
 ): Playlist {
@@ -235,6 +237,21 @@ export function setPlaylistImage(
   if (playlist.userId !== requestingUserId && !canModerate) {
     throw new APIException(APIErrorCode.UNAUTHORIZED, 403, "Forbidden");
   }
+  return playlist;
+}
+
+// Call once the image file is in place: this is what announces it.
+export function setPlaylistImage(
+  playlistId: string,
+  imageMime: string,
+  requestingUserId: string,
+  canModerate: boolean,
+): Playlist {
+  const playlist = getEditablePlaylist(
+    playlistId,
+    requestingUserId,
+    canModerate,
+  );
   // A new cover is an edit: bumping updated_at also moves the `?v=` the
   // client puts on the image URL, so a cached old cover isn't shown.
   db.prepare(
@@ -292,8 +309,7 @@ export function addDumpToPlaylist(
     throw err;
   }
 
-  const dumpIds = getCurrentDumpIds(playlist.id);
-  broadcastPlaylistDumpsUpdated(playlist, dumpIds);
+  broadcastPlaylistDumpsUpdated(playlist, getCurrentMembers(playlist.id));
 
   // Followers can't open a private dump, even the owner's own.
   if (playlist.isPublic && !dump.is_private) {
@@ -322,8 +338,7 @@ export function removeDumpFromPlaylist(
     `DELETE FROM playlist_dumps WHERE playlist_id = ? AND dump_id = ?;`,
   ).run(playlist.id, dumpId);
 
-  const dumpIds = getCurrentDumpIds(playlist.id);
-  broadcastPlaylistDumpsUpdated(playlist, dumpIds);
+  broadcastPlaylistDumpsUpdated(playlist, getCurrentMembers(playlist.id));
 }
 
 export function reorderPlaylist(
@@ -338,14 +353,20 @@ export function reorderPlaylist(
     throw new APIException(APIErrorCode.UNAUTHORIZED, 403, "Forbidden");
   }
 
-  const currentIds = getCurrentDumpIds(playlist.id);
-  const currentSet = new Set(currentIds);
+  // The requester orders what they can see — the playlist as GET gives it to
+  // them. A member hidden from them (someone else's dump that went private,
+  // or the owner's private dumps for a moderator) can't be named, so it
+  // keeps its slot and the visible ones are reordered around it.
+  const members = getCurrentMembers(playlist.id);
+  const visibleIds = members
+    .filter((m) => isMemberVisibleTo(m, playlist, requestingUserId))
+    .map((m) => m.id);
   const newSet = new Set(dumpIds);
 
   if (
     dumpIds.length !== newSet.size ||
-    currentSet.size !== newSet.size ||
-    !currentIds.every((id) => newSet.has(id))
+    visibleIds.length !== newSet.size ||
+    !visibleIds.every((id) => newSet.has(id))
   ) {
     throw new APIException(
       APIErrorCode.BAD_REQUEST,
@@ -354,14 +375,18 @@ export function reorderPlaylist(
     );
   }
 
+  let next = 0;
+  const order = members.map((m) =>
+    isMemberVisibleTo(m, playlist, requestingUserId) ? dumpIds[next++] : m.id
+  );
   const update = db.prepare(
     `UPDATE playlist_dumps SET position = ? WHERE playlist_id = ? AND dump_id = ?;`,
   );
-  for (let i = 0; i < dumpIds.length; i++) {
-    update.run(i, playlist.id, dumpIds[i]);
+  for (let i = 0; i < order.length; i++) {
+    update.run(i, playlist.id, order[i]);
   }
 
-  broadcastPlaylistDumpsUpdated(playlist, dumpIds);
+  broadcastPlaylistDumpsUpdated(playlist, getCurrentMembers(playlist.id));
 }
 
 export function getPlaylistMembershipsForDump(
@@ -420,9 +445,17 @@ export function getPlaylistImageInfo(
     : undefined;
 }
 
-function getCurrentDumpIds(playlistId: string): string[] {
+function getCurrentMembers(playlistId: string): PlaylistMember[] {
   const rows = db.prepare(
-    `SELECT dump_id FROM playlist_dumps WHERE playlist_id = ? ORDER BY position ASC;`,
-  ).all(playlistId) as Array<{ dump_id: string }>;
-  return rows.map((r) => r.dump_id);
+    `SELECT pd.dump_id, d.is_private, d.user_id
+     FROM playlist_dumps pd INNER JOIN dumps d ON d.id = pd.dump_id
+     WHERE pd.playlist_id = ? ORDER BY pd.position ASC;`,
+  ).all(playlistId) as Array<
+    { dump_id: string; is_private: number; user_id: string }
+  >;
+  return rows.map((r) => ({
+    id: r.dump_id,
+    isPrivate: Boolean(r.is_private),
+    userId: r.user_id,
+  }));
 }

api/services/ws-service.ts

@@ -8,6 +8,10 @@ import type {
   ServerToClientMessage,
   User,
 } from "../model/interfaces.ts";
+import {
+  isMemberVisibleTo,
+  type PlaylistMember,
+} from "../lib/playlist-members.ts";
 
 export interface WsClient {
   socket: WebSocket;
@@ -200,15 +204,23 @@ export function broadcastPlaylistDeleted(
   });
 }
 
+// Each viewer gets the members they can see, as GET would list them: the ids
+// of private dumps don't go out to the whole audience of a public playlist.
 export function broadcastPlaylistDumpsUpdated(
   playlist: Playlist,
-  dumpIds: string[],
+  members: PlaylistMember[],
 ): void {
-  sendToPlaylistAudience(playlist, {
-    type: "playlist_dumps_updated",
-    playlistId: playlist.id,
-    dumpIds,
-  });
+  for (const client of clients) {
+    if (!playlist.isPublic && client.userId !== playlist.userId) continue;
+    send(client.socket, {
+      type: "playlist_dumps_updated",
+      playlistId: playlist.id,
+      dumpIds: members
+        .filter((m) => isMemberVisibleTo(m, playlist, client.userId))
+        .map((m) => m.id),
+      dumpCount: members.length,
+    });
+  }
 }
 
 export function broadcastUserUpdated(