v3: api/ gets one layout rule and keeps to it, and whatever crosses the wire is defined once, in shared/ — api/model/interfaces.ts and src/model.ts declared the same 40 types by hand and had drifted: the error envelope, email required on one side and optional on the other, Invitee/InviteTreeEntry and LinkPreview/UrlPreviewResponse for one shape each. The validation limits, the role permissions, the chat length cap, the @mention pattern and the Bandcamp and YouTube player responses were copied too, behind "keep in sync" comments. shared/ now holds them once, one file per domain (api, category, chat, comment, dump, follow, mention, notification, permissions, player, playlist, search, user, validation, ws), and imports nothing from either half. The server sends Dates; the client reads Wire<T>, the same type with every Date an ISO string, and turns it back with src/utils/shared/deserialize.ts. APIErrorCode becomes a const object, since the frontend's erasableSyntaxOnly rejects an enum. The shared types showed two real gaps: the avatar upload and GET /api/users/me return the full self user and the frontend read them as public users, and a stored session may predate media tokens, so the client keeps it as its own Session type. The backend rule: each folder holds one kind of module, each file is named after its domain. routes/ parse and answer; services/ hold the logic and every SQL query (lib/auth.ts's token check moves to user-service); remote/ is the only place that fetches from other sites — the guarded fetch and the HTML scraping out of rich-content-service, public-address, the Bandcamp and YouTube resolvers, the link providers, the image proxy (fetch, checks and cache, out of routes/preview.ts) and the Twemoji glyphs (out of lib/site-icons.ts). model/ holds per table a row type, its guard and its mappers; validators/ the request guards; db/connection.ts the handle and transaction(), db/startup.ts the purges and default admin that db.ts ran on import, called at the same moment. Tests mirror the source one file per module, test/<layer>/<module>.test.ts, with shared/'s under shared/test/ (deno task test runs both); the test that covered the bandcamp and soundcloud providers together is two now, and the backend can() has its own, so 202 tests. deno lint src/ is clean too: window.* becomes globalThis.*, and test bodies and act() callbacks that never awaited lose their async. The README states the rule. No behaviour changes; the catalogues only move their source references.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

api/test/routes/follows.test.ts

@@ -0,0 +1,184 @@
+import {
+  type ApiResponse,
+  count,
+  createUser,
+  db,
+  del,
+  get,
+  insertCategory,
+  insertDump,
+  insertPlaylist,
+  post,
+  test,
+} from "../helpers.ts";
+import type { Dump } from "../../../shared/dump.ts";
+import type { FollowStatus } from "../../../shared/follow.ts";
+import type { PublicUser } from "../../../shared/user.ts";
+import type { PaginatedData } from "../../../shared/api.ts";
+import type { Playlist } from "../../../shared/playlist.ts";
+import { assertEquals, assertFalse } from "@std/assert";
+
+function titles(res: ApiResponse<PaginatedData<Dump>>): string[] {
+  return res.data.items.map((d) => d.title);
+}
+
+test("following users: status, idempotence, no self-follow, one notification", async () => {
+  const me = await createUser();
+  const them = await createUser();
+  assertEquals(
+    (await post(`/api/follows/users/${them.id}`, { auth: me.auth })).status,
+    204,
+  );
+  assertEquals(
+    (await post(`/api/follows/users/${them.id}`, { auth: me.auth })).status,
+    204,
+  );
+  assertEquals(
+    (await post(`/api/follows/users/${me.id}`, { auth: me.auth })).status,
+    400,
+  );
+  assertEquals(
+    (await get<FollowStatus>("/api/follows/status", { auth: me.auth })).data,
+    { followedUserIds: [them.id], followedPlaylistIds: [] },
+  );
+  // Unfollow and follow again: still just the one notification.
+  await del(`/api/follows/users/${them.id}`, { auth: me.auth });
+  assertEquals(
+    (await get<FollowStatus>("/api/follows/status", { auth: me.auth })).data
+      .followedUserIds,
+    [],
+  );
+  await post(`/api/follows/users/${them.id}`, { auth: me.auth });
+  assertEquals(
+    count(
+      `SELECT COUNT(*) as n FROM notifications WHERE user_id = ? AND type = 'user_followed';`,
+      them.id,
+    ),
+    1,
+  );
+  const list = await get<PaginatedData<PublicUser>>(
+    `/api/users/${me.username}/followed-users`,
+  );
+  assertEquals(list.data.items.map((u) => u.id), [
+    them.id,
+  ]);
+  assertFalse("email" in list.data.items[0]);
+});
+
+test("following playlists: public ones only, and not your own notification", async () => {
+  const owner = await createUser();
+  const me = await createUser();
+  const pub = insertPlaylist({ userId: owner.id });
+  const priv = insertPlaylist({ userId: owner.id, isPublic: false });
+  assertEquals(
+    (await post(`/api/follows/playlists/${pub.id}`, { auth: me.auth })).status,
+    204,
+  );
+  assertEquals(
+    (await post(`/api/follows/playlists/${priv.id}`, { auth: me.auth })).status,
+    403,
+  );
+  assertEquals(
+    (await post(`/api/follows/playlists/${crypto.randomUUID()}`, {
+      auth: me.auth,
+    })).status,
+    404,
+  );
+  await post(`/api/follows/playlists/${pub.id}`, { auth: owner.auth });
+  assertEquals(
+    count(
+      `SELECT COUNT(*) as n FROM notifications WHERE type = 'playlist_followed';`,
+    ),
+    1,
+  );
+  assertEquals(
+    (await get<PaginatedData<Playlist>>(
+      `/api/users/${me.username}/followed-playlists`,
+    )).data
+      .items[0].id,
+    pub.id,
+  );
+  await del(`/api/follows/playlists/${pub.id}`, { auth: me.auth });
+  assertEquals(
+    (await get<FollowStatus>("/api/follows/status", { auth: me.auth })).data
+      .followedPlaylistIds,
+    [],
+  );
+});
+
+test("followed-users feed: public dumps of the people I follow, newest first", async () => {
+  const me = await createUser();
+  const followed = await createUser();
+  const stranger = await createUser();
+  const music = insertCategory({ slug: "music" });
+  insertDump({
+    userId: followed.id,
+    title: "old",
+    createdAt: "2024-01-01T00:00:00Z",
+  });
+  const tagged = insertDump({
+    userId: followed.id,
+    title: "new",
+    createdAt: "2024-02-01T00:00:00Z",
+  });
+  db.prepare(
+    `INSERT INTO dump_categories (dump_id, category_id) VALUES (?, ?);`,
+  )
+    .run(tagged.id, music);
+  insertDump({ userId: followed.id, title: "private", isPrivate: true });
+  insertDump({ userId: stranger.id, title: "stranger" });
+  await post(`/api/follows/users/${followed.id}`, { auth: me.auth });
+
+  const feed = await get<PaginatedData<Dump>>("/api/follows/feed/users", {
+    auth: me.auth,
+  });
+  assertEquals(titles(feed), ["new", "old"]);
+  assertEquals(feed.data.items[0].categoryIds, [music]);
+  assertEquals(
+    titles(
+      await get("/api/follows/feed/users?category=music", { auth: me.auth }),
+    ),
+    ["new"],
+  );
+  // An unknown category filters everything out rather than nothing.
+  assertEquals(
+    (await get<PaginatedData<Dump>>("/api/follows/feed/users?category=nope", {
+      auth: me.auth,
+    })).data,
+    { items: [], hasMore: false },
+  );
+  assertEquals((await get("/api/follows/feed/users")).status, 401);
+});
+
+test("followed-playlists feed: each dump once, public playlists only", async () => {
+  const me = await createUser();
+  const owner = await createUser();
+  const p1 = insertPlaylist({ userId: owner.id });
+  const p2 = insertPlaylist({ userId: owner.id });
+  const d = insertDump({ userId: owner.id, title: "shared" });
+  const priv = insertDump({
+    userId: owner.id,
+    title: "private",
+    isPrivate: true,
+  });
+  for (const p of [p1, p2]) {
+    await post(`/api/follows/playlists/${p.id}`, { auth: me.auth });
+    await post(`/api/playlists/${p.id}/dumps/${d.id}`, { auth: owner.auth });
+  }
+  await post(`/api/playlists/${p1.id}/dumps/${priv.id}`, { auth: owner.auth });
+  const feed = await get<PaginatedData<Dump>>("/api/follows/feed/playlists", {
+    auth: me.auth,
+  });
+  assertEquals(titles(feed), ["shared"]);
+  assertEquals(feed.data.items.length, 1);
+
+  // A playlist gone private drops out of the feed.
+  db.prepare(`UPDATE playlists SET is_public = 0;`).run();
+  assertEquals(
+    (await get<PaginatedData<Dump>>("/api/follows/feed/playlists", {
+      auth: me.auth,
+    })).data
+      .items.length,
+    0,
+  );
+});