v3: the tests learn to expect trouble, and seven bugs they now catch are fixed — a review of the two test-suite commits found them written mostly for the happy path; each fix below comes with the test that fails without it. Infinite scroll: a later page that failed turned loadingMore back off, which made a new IntersectionObserver, which reports a sentinel still in view at once — so an offline feed asked again as fast as the request could fail, on Search, Index, the followed feeds, user dumps and user playlists alike. useInfiniteScroll now waits 1s, 2s, 4s… up to 30s while the sentinel stays put, counted from the last load so re-renders don't restart it, and asks at once again when the sentinel leaves the view or is pushed down by new items; the fake observer in src/test can report an element in view on observe(), as a browser's does. Playlist covers: the row was updated and playlist_updated sent before the file was written, so a client fetching image?v=<new> in between cached the old cover (or a 404) under the new URL for an hour, and a failed write left image_mime set with no file behind it. The file now goes in first, written beside and renamed over, and only then does the row change. Playlist order: the server wanted every member named, but GET hides private dumps the requester can't see, so a playlist holding someone else's dump that went private — or one a moderator reorders around the owner's private dumps — could never be reordered. The requester now orders what they can see and hidden members keep their slots; the visibility rule lives in api/lib/playlist-members.ts, shared by GET, reorder and the socket. playlist_dumps_updated also sent every member's id, private ones included, to a public playlist's whole audience; each viewer now gets the ids they can see, plus a dumpCount of all members so playlist cards keep the server's count. File dumps: replacing the file and changing visibility took two requests, so a failed second one left the new file live under the old visibility; PUT /api/dumps/:id/file takes isPrivate and applies both in one UPDATE, and it now broadcasts like any edit (it sent nothing, so other viewers never saw a new title). Notifications: one that arrived while the list was loading was dropped, then marked read by the read-all after the load, so it never showed; it's kept and merged in, once. Ranges: bytes=0-0,5-6 got a 416; several ranges, another unit or an unparseable header are ignored now and the whole file sent with a 200, as RFC 9110 allows — the old test asserted the 416.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

api/test/ws.test.ts

@@ -6,6 +6,7 @@ import {
   createUser,
   db,
   formWithFile,
+  get,
   insertComment,
   insertDump,
   insertPlaylist,
@@ -543,3 +544,89 @@ wsTest("a password change closes the user's sockets", async (connect) => {
   assertExists(res.body.data.token);
   assertFalse(res.body.data.token === user.token);
 });
+
+wsTest(
+  "playlist_dumps_updated lists only what each viewer can see",
+  async (connect) => {
+    const owner = await createUser();
+    const author = await createUser();
+    const other = await createUser();
+    const pl = insertPlaylist({ userId: owner.id });
+    const pub = insertDump({ userId: owner.id });
+    const mine = insertDump({ userId: owner.id, isPrivate: true });
+    const theirs = insertDump({ userId: author.id, isPrivate: true });
+    // Rows straight in: the dumps are private now, as if they went private after
+    // being added.
+    for (const [i, d] of [pub, mine, theirs].entries()) {
+      db.prepare(
+        `INSERT INTO playlist_dumps (playlist_id, dump_id, position, added_at)
+       VALUES (?, ?, ?, ?);`,
+      ).run(pl.id, d.id, i, new Date().toISOString());
+    }
+    const o = await connect(owner);
+    const a = await connect(author);
+    const x = await connect(other);
+    const anon = await connect();
+
+    const added = insertDump({ userId: owner.id });
+    await post(`/api/playlists/${pl.id}/dumps/${added.id}`, {
+      auth: owner.auth,
+    });
+    // The owner sees their own private dump but not the author's; the author,
+    // not being the owner, sees neither private one; nor does anyone else.
+    assertEquals((await o.next("playlist_dumps_updated")).dumpIds, [
+      added.id,
+      pub.id,
+      mine.id,
+    ]);
+    for (const c of [a, x, anon]) {
+      const msg = await c.next("playlist_dumps_updated");
+      assertEquals(msg.dumpIds, [added.id, pub.id]);
+      // The count is the playlist's, as its dumpCount gives it to everyone.
+      assertEquals(msg.dumpCount, 4);
+    }
+  },
+);
+
+wsTest(
+  "a new playlist cover is on disk by the time it's announced",
+  async (connect) => {
+    const owner = await createUser();
+    const pl = insertPlaylist({ userId: owner.id });
+    const c = await connect();
+    const cover = new Uint8Array([...PNG, 9, 9, 9]);
+    const upload = post(`/api/playlists/${pl.id}/image`, {
+      auth: owner.auth,
+      form: formWithFile(cover),
+    });
+    // Fetch the image the moment the socket says it changed, as a client would.
+    const msg = await c.next("playlist_updated");
+    const served = await get(
+      `/api/playlists/${pl.id}/image?v=${msg.playlist.updatedAt}`,
+    );
+    assertEquals(served.status, 200);
+    assertEquals(served.bytes, cover);
+    assertEquals((await upload).status, 200);
+  },
+);
+
+wsTest(
+  "replacing a dump's file is broadcast like any edit",
+  async (connect) => {
+    const owner = await createUser();
+    const other = await createUser();
+    const { id } = insertDump({ userId: owner.id, fileName: "a.txt" });
+    const x = await connect(other);
+    const replace = (fields: Record<string, string>) =>
+      put(`/api/dumps/${id}/file`, {
+        auth: owner.auth,
+        form: formWithFile(PNG, "b.png", "image/png", fields),
+      });
+    await replace({ title: "New title" });
+    assertEquals((await x.next("dump_updated")).dump.title, "New title");
+    await replace({ isPrivate: "true" });
+    assertEquals((await x.next("dump_deleted")).dumpId, id);
+    await replace({ isPrivate: "false" });
+    assertEquals((await x.next("dump_created")).dump.id, id);
+  },
+);