v3: api/ gets one layout rule and keeps to it, and whatever crosses the wire is defined once, in shared/ — api/model/interfaces.ts and src/model.ts declared the same 40 types by hand and had drifted: the error envelope, email required on one side and optional on the other, Invitee/InviteTreeEntry and LinkPreview/UrlPreviewResponse for one shape each. The validation limits, the role permissions, the chat length cap, the @mention pattern and the Bandcamp and YouTube player responses were copied too, behind "keep in sync" comments. shared/ now holds them once, one file per domain (api, category, chat, comment, dump, follow, mention, notification, permissions, player, playlist, search, user, validation, ws), and imports nothing from either half. The server sends Dates; the client reads Wire<T>, the same type with every Date an ISO string, and turns it back with src/utils/shared/deserialize.ts. APIErrorCode becomes a const object, since the frontend's erasableSyntaxOnly rejects an enum. The shared types showed two real gaps: the avatar upload and GET /api/users/me return the full self user and the frontend read them as public users, and a stored session may predate media tokens, so the client keeps it as its own Session type. The backend rule: each folder holds one kind of module, each file is named after its domain. routes/ parse and answer; services/ hold the logic and every SQL query (lib/auth.ts's token check moves to user-service); remote/ is the only place that fetches from other sites — the guarded fetch and the HTML scraping out of rich-content-service, public-address, the Bandcamp and YouTube resolvers, the link providers, the image proxy (fetch, checks and cache, out of routes/preview.ts) and the Twemoji glyphs (out of lib/site-icons.ts). model/ holds per table a row type, its guard and its mappers; validators/ the request guards; db/connection.ts the handle and transaction(), db/startup.ts the purges and default admin that db.ts ran on import, called at the same moment. Tests mirror the source one file per module, test/<layer>/<module>.test.ts, with shared/'s under shared/test/ (deno task test runs both); the test that covered the bandcamp and soundcloud providers together is two now, and the backend can() has its own, so 202 tests. deno lint src/ is clean too: window.* becomes globalThis.*, and test bodies and act() callbacks that never awaited lose their async. The README states the rule. No behaviour changes; the catalogues only move their source references.
All checks were successful
Build and Publish Docker Image / build-and-push (push) Successful in 50s
All checks were successful
Build and Publish Docker Image / build-and-push (push) Successful in 50s
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
khannurien
465
api/test/routes/playlists.test.ts
Normal file
465
api/test/routes/playlists.test.ts
Normal file
@@ -0,0 +1,465 @@
|
||||
import {
|
||||
type ApiResponse,
|
||||
count,
|
||||
createUser,
|
||||
db,
|
||||
del,
|
||||
formWithFile,
|
||||
get,
|
||||
insertDump,
|
||||
insertPlaylist,
|
||||
PNG,
|
||||
post,
|
||||
put,
|
||||
test,
|
||||
TEST_DIR,
|
||||
} from "../helpers.ts";
|
||||
import type { PaginatedData } from "../../../shared/api.ts";
|
||||
import type {
|
||||
Playlist,
|
||||
PlaylistMembership,
|
||||
PlaylistWithDumps,
|
||||
} from "../../../shared/playlist.ts";
|
||||
import { assert, assertEquals, assertMatch } from "@std/assert";
|
||||
|
||||
function ids(res: ApiResponse<PlaylistWithDumps>): string[] {
|
||||
return res.data.dumps.map((d) => d.id);
|
||||
}
|
||||
|
||||
test("POST /api/playlists creates; GET finds it by id or slug", async () => {
|
||||
const user = await createUser();
|
||||
const res = await post<Playlist>("/api/playlists", {
|
||||
auth: user.auth,
|
||||
json: { title: "Road Trip", description: "songs", isPublic: true },
|
||||
});
|
||||
assertEquals(res.status, 201);
|
||||
const { id, slug } = res.data;
|
||||
assertMatch(slug ?? "", /^road-trip-/);
|
||||
assertEquals(
|
||||
(await get<PlaylistWithDumps>(`/api/playlists/${id}`)).data.title,
|
||||
"Road Trip",
|
||||
);
|
||||
const bySlug = await get<PlaylistWithDumps>(`/api/playlists/${slug}`);
|
||||
assertEquals(bySlug.data.id, id);
|
||||
assertEquals(bySlug.data.ownerUsername, user.username);
|
||||
assertEquals(bySlug.data.dumps, []);
|
||||
assertEquals(
|
||||
(await post("/api/playlists", { auth: user.auth, json: { title: "" } }))
|
||||
.status,
|
||||
400,
|
||||
);
|
||||
assertEquals(
|
||||
(await post("/api/playlists", { json: { title: "x", isPublic: true } }))
|
||||
.status,
|
||||
401,
|
||||
);
|
||||
});
|
||||
|
||||
test("private playlists are the owner's alone", async () => {
|
||||
const owner = await createUser();
|
||||
const other = await createUser();
|
||||
const { id } = insertPlaylist({ userId: owner.id, isPublic: false });
|
||||
assertEquals((await get(`/api/playlists/${id}`)).status, 404);
|
||||
assertEquals(
|
||||
(await get(`/api/playlists/${id}`, { auth: other.auth })).status,
|
||||
404,
|
||||
);
|
||||
assertEquals(
|
||||
(await get(`/api/playlists/${id}`, { auth: owner.auth })).status,
|
||||
200,
|
||||
);
|
||||
insertPlaylist({ userId: owner.id });
|
||||
const path = `/api/users/${owner.username}/playlists`;
|
||||
assertEquals((await get<PaginatedData<Playlist>>(path)).data.items.length, 1);
|
||||
assertEquals(
|
||||
(await get<PaginatedData<Playlist>>(path, { auth: owner.auth })).data.items
|
||||
.length,
|
||||
2,
|
||||
);
|
||||
});
|
||||
|
||||
test("adding dumps: newest on top, no duplicates, only dumps you can see", async () => {
|
||||
const owner = await createUser();
|
||||
const other = await createUser();
|
||||
const { id } = insertPlaylist({ userId: owner.id });
|
||||
const a = insertDump({ userId: owner.id, title: "a" });
|
||||
const b = insertDump({ userId: other.id, title: "b" });
|
||||
const theirs = insertDump({ userId: other.id, isPrivate: true });
|
||||
|
||||
assertEquals(
|
||||
(await post(`/api/playlists/${id}/dumps/${a.id}`, { auth: owner.auth }))
|
||||
.status,
|
||||
204,
|
||||
);
|
||||
assertEquals(
|
||||
(await post(`/api/playlists/${id}/dumps/${b.id}`, { auth: owner.auth }))
|
||||
.status,
|
||||
204,
|
||||
);
|
||||
assertEquals(ids(await get(`/api/playlists/${id}`)), [b.id, a.id]);
|
||||
assertEquals(
|
||||
(await post(`/api/playlists/${id}/dumps/${a.id}`, { auth: owner.auth }))
|
||||
.status,
|
||||
409,
|
||||
);
|
||||
assertEquals(
|
||||
(await post(`/api/playlists/${id}/dumps/${theirs.id}`, {
|
||||
auth: owner.auth,
|
||||
})).status,
|
||||
404,
|
||||
);
|
||||
assertEquals(
|
||||
(await post(`/api/playlists/${id}/dumps/${crypto.randomUUID()}`, {
|
||||
auth: owner.auth,
|
||||
}))
|
||||
.status,
|
||||
404,
|
||||
);
|
||||
assertEquals(
|
||||
(await post(`/api/playlists/${id}/dumps/${a.id}`, { auth: other.auth }))
|
||||
.status,
|
||||
403,
|
||||
);
|
||||
assertEquals(
|
||||
(await get<PlaylistWithDumps>(`/api/playlists/${id}`)).data.dumpCount,
|
||||
2,
|
||||
);
|
||||
});
|
||||
|
||||
test("a public playlist hides its private dumps from everyone but their owner", async () => {
|
||||
const owner = await createUser();
|
||||
const { id } = insertPlaylist({ userId: owner.id });
|
||||
const pub = insertDump({ userId: owner.id });
|
||||
const priv = insertDump({ userId: owner.id, isPrivate: true });
|
||||
for (const d of [pub, priv]) {
|
||||
await post(`/api/playlists/${id}/dumps/${d.id}`, { auth: owner.auth });
|
||||
}
|
||||
assertEquals(ids(await get(`/api/playlists/${id}`)), [pub.id]);
|
||||
assertEquals(
|
||||
ids(await get(`/api/playlists/${id}`, { auth: owner.auth })).length,
|
||||
2,
|
||||
);
|
||||
});
|
||||
|
||||
test("reorder: must name exactly the current members", async () => {
|
||||
const owner = await createUser();
|
||||
const { id } = insertPlaylist({ userId: owner.id });
|
||||
const [a, b, c] = [1, 2, 3].map(() => insertDump({ userId: owner.id }));
|
||||
for (const d of [a, b, c]) {
|
||||
await post(`/api/playlists/${id}/dumps/${d.id}`, { auth: owner.auth });
|
||||
}
|
||||
const order = [a.id, c.id, b.id];
|
||||
assertEquals(
|
||||
(await put(`/api/playlists/${id}/order`, {
|
||||
auth: owner.auth,
|
||||
json: { dumpIds: order },
|
||||
}))
|
||||
.status,
|
||||
200,
|
||||
);
|
||||
assertEquals(ids(await get(`/api/playlists/${id}`)), order);
|
||||
for (const dumpIds of [[a.id, b.id], [a.id, b.id, crypto.randomUUID()]]) {
|
||||
assertEquals(
|
||||
(await put(`/api/playlists/${id}/order`, {
|
||||
auth: owner.auth,
|
||||
json: { dumpIds },
|
||||
}))
|
||||
.status,
|
||||
400,
|
||||
JSON.stringify(dumpIds),
|
||||
);
|
||||
}
|
||||
// A dump added after reordering still lands on top.
|
||||
const d = insertDump({ userId: owner.id });
|
||||
await post(`/api/playlists/${id}/dumps/${d.id}`, { auth: owner.auth });
|
||||
assertEquals(ids(await get(`/api/playlists/${id}`))[0], d.id);
|
||||
});
|
||||
|
||||
test("reorder: a list naming a member twice is not the current members", async () => {
|
||||
const owner = await createUser();
|
||||
const { id } = insertPlaylist({ userId: owner.id });
|
||||
const [a, b] = [1, 2].map(() => insertDump({ userId: owner.id }));
|
||||
for (const d of [a, b]) {
|
||||
await post(`/api/playlists/${id}/dumps/${d.id}`, { auth: owner.auth });
|
||||
}
|
||||
const res = await put(`/api/playlists/${id}/order`, {
|
||||
auth: owner.auth,
|
||||
json: { dumpIds: [a.id, b.id, a.id] },
|
||||
});
|
||||
assertEquals(res.status, 400);
|
||||
});
|
||||
|
||||
test("removing a dump; updating; deleting", async () => {
|
||||
const owner = await createUser();
|
||||
const other = await createUser();
|
||||
const mod = await createUser({ role: "moderator" });
|
||||
const { id } = insertPlaylist({ userId: owner.id, title: "Old" });
|
||||
const a = insertDump({ userId: owner.id });
|
||||
await post(`/api/playlists/${id}/dumps/${a.id}`, { auth: owner.auth });
|
||||
assertEquals(
|
||||
(await del(`/api/playlists/${id}/dumps/${a.id}`, { auth: other.auth }))
|
||||
.status,
|
||||
403,
|
||||
);
|
||||
assertEquals(
|
||||
(await del(`/api/playlists/${id}/dumps/${a.id}`, { auth: owner.auth }))
|
||||
.status,
|
||||
204,
|
||||
);
|
||||
assertEquals(ids(await get(`/api/playlists/${id}`)), []);
|
||||
|
||||
assertEquals(
|
||||
(await put(`/api/playlists/${id}`, {
|
||||
auth: other.auth,
|
||||
json: { title: "x" },
|
||||
})).status,
|
||||
403,
|
||||
);
|
||||
const updated = await put<Playlist>(`/api/playlists/${id}`, {
|
||||
auth: owner.auth,
|
||||
json: { title: "New", description: "d", isPublic: false },
|
||||
});
|
||||
assertEquals(updated.data.title, "New");
|
||||
assertMatch(updated.data.slug ?? "", /^new-/);
|
||||
assertEquals(updated.data.isPublic, false);
|
||||
const cleared = await put<Playlist>(`/api/playlists/${id}`, {
|
||||
auth: owner.auth,
|
||||
json: { description: null },
|
||||
});
|
||||
assertEquals(cleared.data.description, undefined);
|
||||
assertEquals(cleared.data.title, "New");
|
||||
|
||||
assertEquals(
|
||||
(await del(`/api/playlists/${id}`, { auth: other.auth })).status,
|
||||
403,
|
||||
);
|
||||
assertEquals(
|
||||
(await del(`/api/playlists/${id}`, { auth: mod.auth })).status,
|
||||
204,
|
||||
);
|
||||
assertEquals(
|
||||
(await get(`/api/playlists/${id}`, { auth: owner.auth })).status,
|
||||
404,
|
||||
);
|
||||
assertEquals(count(`SELECT COUNT(*) as n FROM playlist_dumps;`), 0);
|
||||
});
|
||||
|
||||
test("memberships: which of my playlists hold this dump", async () => {
|
||||
const owner = await createUser();
|
||||
const other = await createUser();
|
||||
const p1 = insertPlaylist({ userId: owner.id, title: "has" });
|
||||
insertPlaylist({ userId: owner.id, title: "hasnt" });
|
||||
insertPlaylist({ userId: other.id, title: "theirs" });
|
||||
const d = insertDump({ userId: owner.id });
|
||||
await post(`/api/playlists/${p1.id}/dumps/${d.id}`, { auth: owner.auth });
|
||||
const res = await get<PlaylistMembership[]>(
|
||||
`/api/playlists/by-dump/${d.id}/memberships`,
|
||||
{
|
||||
auth: owner.auth,
|
||||
},
|
||||
);
|
||||
const byTitle = Object.fromEntries(
|
||||
res.data.map((
|
||||
m: { playlist: { title: string }; hasDump: boolean },
|
||||
) => [
|
||||
m.playlist.title,
|
||||
m.hasDump,
|
||||
]),
|
||||
);
|
||||
assertEquals(byTitle, { has: true, hasnt: false });
|
||||
});
|
||||
|
||||
test("adding to a followed public playlist notifies followers, private dumps excepted", async () => {
|
||||
const owner = await createUser();
|
||||
const follower = await createUser();
|
||||
const { id } = insertPlaylist({ userId: owner.id, title: "Mix" });
|
||||
await post(`/api/follows/playlists/${id}`, { auth: follower.auth });
|
||||
db.exec(`DELETE FROM notifications;`); // the follow notified the owner
|
||||
const priv = insertDump({ userId: owner.id, isPrivate: true });
|
||||
await post(`/api/playlists/${id}/dumps/${priv.id}`, { auth: owner.auth });
|
||||
assertEquals(count(`SELECT COUNT(*) as n FROM notifications;`), 0);
|
||||
const pub = insertDump({ userId: owner.id, title: "Song" });
|
||||
await post(`/api/playlists/${id}/dumps/${pub.id}`, { auth: owner.auth });
|
||||
const note = db.prepare(`SELECT user_id, type, data FROM notifications;`)
|
||||
.get() as {
|
||||
user_id: string;
|
||||
type: string;
|
||||
data: string;
|
||||
};
|
||||
assertEquals(note.user_id, follower.id);
|
||||
assertEquals(note.type, "playlist_dump_added");
|
||||
assertEquals(JSON.parse(note.data), {
|
||||
dumpId: pub.id,
|
||||
dumpTitle: "Song",
|
||||
playlistId: id,
|
||||
playlistTitle: "Mix",
|
||||
});
|
||||
});
|
||||
|
||||
test("playlist images: upload and serve", async () => {
|
||||
const owner = await createUser();
|
||||
const other = await createUser();
|
||||
const { id, slug } = insertPlaylist({ userId: owner.id });
|
||||
assertEquals((await get(`/api/playlists/${id}/image`)).status, 404);
|
||||
assertEquals(
|
||||
(await post(`/api/playlists/${id}/image`, {
|
||||
auth: other.auth,
|
||||
form: formWithFile(PNG),
|
||||
}))
|
||||
.status,
|
||||
403,
|
||||
);
|
||||
const res = await post<Playlist>(`/api/playlists/${slug}/image`, {
|
||||
auth: owner.auth,
|
||||
form: formWithFile(PNG),
|
||||
});
|
||||
assertEquals(res.status, 200);
|
||||
assertEquals(res.data.imageMime, "image/png");
|
||||
// A new cover counts as an edit, so image URLs versioned on it change.
|
||||
assert(res.data.updatedAt);
|
||||
const served = await get(`/api/playlists/${slug}/image`);
|
||||
assertEquals(served.status, 200);
|
||||
assertEquals(served.bytes, PNG);
|
||||
});
|
||||
|
||||
test("playlist images: a failed write leaves the row and the old cover alone", async () => {
|
||||
const owner = await createUser();
|
||||
const { id } = insertPlaylist({ userId: owner.id });
|
||||
const dir = `${TEST_DIR}/uploads/playlist-images`;
|
||||
const row = () =>
|
||||
db.prepare(`SELECT image_mime, updated_at FROM playlists WHERE id = ?;`)
|
||||
.get(id) as { image_mime: string | null; updated_at: string | null };
|
||||
|
||||
// No cover yet, and the write fails (a directory sits where the file goes):
|
||||
// the playlist mustn't claim a cover it hasn't got.
|
||||
await Deno.mkdir(`${dir}/${id}/blocker`, { recursive: true });
|
||||
try {
|
||||
const failed = await post(`/api/playlists/${id}/image`, {
|
||||
auth: owner.auth,
|
||||
form: formWithFile(PNG),
|
||||
});
|
||||
assertEquals(failed.status, 500);
|
||||
assertEquals(row(), { image_mime: null, updated_at: null });
|
||||
assertEquals((await get(`/api/playlists/${id}/image`)).status, 404);
|
||||
} finally {
|
||||
await Deno.remove(`${dir}/${id}`, { recursive: true });
|
||||
}
|
||||
|
||||
// With a cover in place, a failed replacement keeps serving the old one
|
||||
// under the old version, and leaves no stray temporary file behind.
|
||||
await post(`/api/playlists/${id}/image`, {
|
||||
auth: owner.auth,
|
||||
form: formWithFile(PNG),
|
||||
});
|
||||
const before = row();
|
||||
await Deno.chmod(dir, 0o555);
|
||||
try {
|
||||
const failed = await post(`/api/playlists/${id}/image`, {
|
||||
auth: owner.auth,
|
||||
form: formWithFile(new Uint8Array([...PNG, 0])),
|
||||
});
|
||||
assertEquals(failed.status, 500);
|
||||
} finally {
|
||||
await Deno.chmod(dir, 0o755);
|
||||
}
|
||||
assertEquals(row(), before);
|
||||
assertEquals((await get(`/api/playlists/${id}/image`)).bytes, PNG);
|
||||
const left = [...Deno.readDirSync(dir)]
|
||||
.map((e) => e.name)
|
||||
.filter((name) => name.startsWith(id));
|
||||
assertEquals(left, [id]);
|
||||
});
|
||||
|
||||
test("playlist images: a replaced cover is served under the new version", async () => {
|
||||
const owner = await createUser();
|
||||
const { id } = insertPlaylist({ userId: owner.id });
|
||||
const first = await post<Playlist>(`/api/playlists/${id}/image`, {
|
||||
auth: owner.auth,
|
||||
form: formWithFile(PNG),
|
||||
});
|
||||
await new Promise((r) => setTimeout(r, 5)); // a distinct updated_at
|
||||
const other = new Uint8Array([...PNG, 1, 2, 3]);
|
||||
const second = await post<Playlist>(`/api/playlists/${id}/image`, {
|
||||
auth: owner.auth,
|
||||
form: formWithFile(other),
|
||||
});
|
||||
assert(second.data.updatedAt !== first.data.updatedAt);
|
||||
assertEquals((await get(`/api/playlists/${id}/image`)).bytes, other);
|
||||
});
|
||||
|
||||
test("reorder: someone else's dump that went private keeps its slot", async () => {
|
||||
const owner = await createUser();
|
||||
const author = await createUser();
|
||||
const { id } = insertPlaylist({ userId: owner.id });
|
||||
const a = insertDump({ userId: owner.id });
|
||||
const theirs = insertDump({ userId: author.id });
|
||||
const b = insertDump({ userId: owner.id });
|
||||
// Each add goes on top: the order is b, theirs, a.
|
||||
for (const d of [a, theirs, b]) {
|
||||
await post(`/api/playlists/${id}/dumps/${d.id}`, { auth: owner.auth });
|
||||
}
|
||||
await put(`/api/dumps/${theirs.id}`, {
|
||||
auth: author.auth,
|
||||
json: { isPrivate: true },
|
||||
});
|
||||
// The owner can't see it, so can't name it: what they see is theirs to order.
|
||||
assertEquals(ids(await get(`/api/playlists/${id}`, { auth: owner.auth })), [
|
||||
b.id,
|
||||
a.id,
|
||||
]);
|
||||
const res = await put(`/api/playlists/${id}/order`, {
|
||||
auth: owner.auth,
|
||||
json: { dumpIds: [a.id, b.id] },
|
||||
});
|
||||
assertEquals(res.status, 200);
|
||||
assertEquals(ids(await get(`/api/playlists/${id}`, { auth: owner.auth })), [
|
||||
a.id,
|
||||
b.id,
|
||||
]);
|
||||
// The hidden one hasn't moved, and comes back where it was if made public.
|
||||
await put(`/api/dumps/${theirs.id}`, {
|
||||
auth: author.auth,
|
||||
json: { isPrivate: false },
|
||||
});
|
||||
assertEquals(ids(await get(`/api/playlists/${id}`)), [a.id, theirs.id, b.id]);
|
||||
// Naming a hidden id is still not the list the requester sees.
|
||||
await put(`/api/dumps/${theirs.id}`, {
|
||||
auth: author.auth,
|
||||
json: { isPrivate: true },
|
||||
});
|
||||
assertEquals(
|
||||
(await put(`/api/playlists/${id}/order`, {
|
||||
auth: owner.auth,
|
||||
json: { dumpIds: [a.id, theirs.id, b.id] },
|
||||
})).status,
|
||||
400,
|
||||
);
|
||||
});
|
||||
|
||||
test("reorder: a moderator orders around the owner's private dumps", async () => {
|
||||
const owner = await createUser();
|
||||
const mod = await createUser({ role: "moderator" });
|
||||
const { id } = insertPlaylist({ userId: owner.id });
|
||||
const a = insertDump({ userId: owner.id });
|
||||
const priv = insertDump({ userId: owner.id, isPrivate: true });
|
||||
const b = insertDump({ userId: owner.id });
|
||||
for (const d of [a, priv, b]) {
|
||||
await post(`/api/playlists/${id}/dumps/${d.id}`, { auth: owner.auth });
|
||||
}
|
||||
assertEquals(ids(await get(`/api/playlists/${id}`, { auth: mod.auth })), [
|
||||
b.id,
|
||||
a.id,
|
||||
]);
|
||||
assertEquals(
|
||||
(await put(`/api/playlists/${id}/order`, {
|
||||
auth: mod.auth,
|
||||
json: { dumpIds: [a.id, b.id] },
|
||||
})).status,
|
||||
200,
|
||||
);
|
||||
assertEquals(ids(await get(`/api/playlists/${id}`, { auth: owner.auth })), [
|
||||
a.id,
|
||||
priv.id,
|
||||
b.id,
|
||||
]);
|
||||
});
|
||||
Reference in New Issue
Block a user