v3: the tests learn to expect trouble, and seven bugs they now catch are fixed — a review of the two test-suite commits found them written mostly for the happy path; each fix below comes with the test that fails without it. Infinite scroll: a later page that failed turned loadingMore back off, which made a new IntersectionObserver, which reports a sentinel still in view at once — so an offline feed asked again as fast as the request could fail, on Search, Index, the followed feeds, user dumps and user playlists alike. useInfiniteScroll now waits 1s, 2s, 4s… up to 30s while the sentinel stays put, counted from the last load so re-renders don't restart it, and asks at once again when the sentinel leaves the view or is pushed down by new items; the fake observer in src/test can report an element in view on observe(), as a browser's does. Playlist covers: the row was updated and playlist_updated sent before the file was written, so a client fetching image?v=<new> in between cached the old cover (or a 404) under the new URL for an hour, and a failed write left image_mime set with no file behind it. The file now goes in first, written beside and renamed over, and only then does the row change. Playlist order: the server wanted every member named, but GET hides private dumps the requester can't see, so a playlist holding someone else's dump that went private — or one a moderator reorders around the owner's private dumps — could never be reordered. The requester now orders what they can see and hidden members keep their slots; the visibility rule lives in api/lib/playlist-members.ts, shared by GET, reorder and the socket. playlist_dumps_updated also sent every member's id, private ones included, to a public playlist's whole audience; each viewer now gets the ids they can see, plus a dumpCount of all members so playlist cards keep the server's count. File dumps: replacing the file and changing visibility took two requests, so a failed second one left the new file live under the old visibility; PUT /api/dumps/:id/file takes isPrivate and applies both in one UPDATE, and it now broadcasts like any edit (it sent nothing, so other viewers never saw a new title). Notifications: one that arrived while the list was loading was dropped, then marked read by the read-all after the load, so it never showed; it's kept and merged in, once. Ranges: bytes=0-0,5-6 got a 416; several ranges, another unit or an unparseable header are ignored now and the whole file sent with a 200, as RFC 9110 allows — the old test asserted the 416.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

api/test/playlists.test.ts

@@ -11,6 +11,7 @@ import {
   post,
   put,
   test,
+  TEST_DIR,
 } from "./helpers.ts";
 import { assert, assertEquals, assertMatch } from "@std/assert";
 
@@ -303,3 +304,145 @@ test("playlist images: upload and serve", async () => {
   assertEquals(served.status, 200);
   assertEquals(served.bytes, PNG);
 });
+
+test("playlist images: a failed write leaves the row and the old cover alone", async () => {
+  const owner = await createUser();
+  const { id } = insertPlaylist({ userId: owner.id });
+  const dir = `${TEST_DIR}/uploads/playlist-images`;
+  const row = () =>
+    db.prepare(`SELECT image_mime, updated_at FROM playlists WHERE id = ?;`)
+      .get(id) as { image_mime: string | null; updated_at: string | null };
+
+  // No cover yet, and the write fails (a directory sits where the file goes):
+  // the playlist mustn't claim a cover it hasn't got.
+  await Deno.mkdir(`${dir}/${id}/blocker`, { recursive: true });
+  try {
+    const failed = await post(`/api/playlists/${id}/image`, {
+      auth: owner.auth,
+      form: formWithFile(PNG),
+    });
+    assertEquals(failed.status, 500);
+    assertEquals(row(), { image_mime: null, updated_at: null });
+    assertEquals((await get(`/api/playlists/${id}/image`)).status, 404);
+  } finally {
+    await Deno.remove(`${dir}/${id}`, { recursive: true });
+  }
+
+  // With a cover in place, a failed replacement keeps serving the old one
+  // under the old version, and leaves no stray temporary file behind.
+  await post(`/api/playlists/${id}/image`, {
+    auth: owner.auth,
+    form: formWithFile(PNG),
+  });
+  const before = row();
+  await Deno.chmod(dir, 0o555);
+  try {
+    const failed = await post(`/api/playlists/${id}/image`, {
+      auth: owner.auth,
+      form: formWithFile(new Uint8Array([...PNG, 0])),
+    });
+    assertEquals(failed.status, 500);
+  } finally {
+    await Deno.chmod(dir, 0o755);
+  }
+  assertEquals(row(), before);
+  assertEquals((await get(`/api/playlists/${id}/image`)).bytes, PNG);
+  const left = [...Deno.readDirSync(dir)]
+    .map((e) => e.name)
+    .filter((name) => name.startsWith(id));
+  assertEquals(left, [id]);
+});
+
+test("playlist images: a replaced cover is served under the new version", async () => {
+  const owner = await createUser();
+  const { id } = insertPlaylist({ userId: owner.id });
+  const first = await post(`/api/playlists/${id}/image`, {
+    auth: owner.auth,
+    form: formWithFile(PNG),
+  });
+  await new Promise((r) => setTimeout(r, 5)); // a distinct updated_at
+  const other = new Uint8Array([...PNG, 1, 2, 3]);
+  const second = await post(`/api/playlists/${id}/image`, {
+    auth: owner.auth,
+    form: formWithFile(other),
+  });
+  assert(second.body.data.updatedAt !== first.body.data.updatedAt);
+  assertEquals((await get(`/api/playlists/${id}/image`)).bytes, other);
+});
+
+test("reorder: someone else's dump that went private keeps its slot", async () => {
+  const owner = await createUser();
+  const author = await createUser();
+  const { id } = insertPlaylist({ userId: owner.id });
+  const a = insertDump({ userId: owner.id });
+  const theirs = insertDump({ userId: author.id });
+  const b = insertDump({ userId: owner.id });
+  // Each add goes on top: the order is b, theirs, a.
+  for (const d of [a, theirs, b]) {
+    await post(`/api/playlists/${id}/dumps/${d.id}`, { auth: owner.auth });
+  }
+  await put(`/api/dumps/${theirs.id}`, {
+    auth: author.auth,
+    json: { isPrivate: true },
+  });
+  // The owner can't see it, so can't name it: what they see is theirs to order.
+  assertEquals(ids(await get(`/api/playlists/${id}`, { auth: owner.auth })), [
+    b.id,
+    a.id,
+  ]);
+  const res = await put(`/api/playlists/${id}/order`, {
+    auth: owner.auth,
+    json: { dumpIds: [a.id, b.id] },
+  });
+  assertEquals(res.status, 200);
+  assertEquals(ids(await get(`/api/playlists/${id}`, { auth: owner.auth })), [
+    a.id,
+    b.id,
+  ]);
+  // The hidden one hasn't moved, and comes back where it was if made public.
+  await put(`/api/dumps/${theirs.id}`, {
+    auth: author.auth,
+    json: { isPrivate: false },
+  });
+  assertEquals(ids(await get(`/api/playlists/${id}`)), [a.id, theirs.id, b.id]);
+  // Naming a hidden id is still not the list the requester sees.
+  await put(`/api/dumps/${theirs.id}`, {
+    auth: author.auth,
+    json: { isPrivate: true },
+  });
+  assertEquals(
+    (await put(`/api/playlists/${id}/order`, {
+      auth: owner.auth,
+      json: { dumpIds: [a.id, theirs.id, b.id] },
+    })).status,
+    400,
+  );
+});
+
+test("reorder: a moderator orders around the owner's private dumps", async () => {
+  const owner = await createUser();
+  const mod = await createUser({ role: "moderator" });
+  const { id } = insertPlaylist({ userId: owner.id });
+  const a = insertDump({ userId: owner.id });
+  const priv = insertDump({ userId: owner.id, isPrivate: true });
+  const b = insertDump({ userId: owner.id });
+  for (const d of [a, priv, b]) {
+    await post(`/api/playlists/${id}/dumps/${d.id}`, { auth: owner.auth });
+  }
+  assertEquals(ids(await get(`/api/playlists/${id}`, { auth: mod.auth })), [
+    b.id,
+    a.id,
+  ]);
+  assertEquals(
+    (await put(`/api/playlists/${id}/order`, {
+      auth: mod.auth,
+      json: { dumpIds: [a.id, b.id] },
+    })).status,
+    200,
+  );
+  assertEquals(ids(await get(`/api/playlists/${id}`, { auth: owner.auth })), [
+    a.id,
+    priv.id,
+    b.id,
+  ]);
+});