v3: code quality pass, various bug fixes

api/routes/users.ts

@@ -9,8 +9,10 @@ import {
   type PaginatedData,
 } from "../model/interfaces.ts";
 
-import { createJWT, verifyJWT, verifyPassword } from "../lib/jwt.ts";
+import { createJWT, verifyPassword } from "../lib/jwt.ts";
 import { type AuthContext, authMiddleware } from "../middleware/auth.ts";
+import { parseOptionalAuth } from "../lib/auth.ts";
+import { parsePagination } from "../lib/pagination.ts";
 import {
   createUser,
   getUserById,
@@ -19,6 +21,7 @@ import {
   updateUser,
 } from "../services/user-service.ts";
 import { redeemInvite, validateInvite } from "../services/invite-service.ts";
+import { broadcastUserUpdated } from "../services/ws-service.ts";
 import {
   getDumpsByUser,
   getVotedDumpsByUser,
@@ -47,7 +50,11 @@ router.post("/register", async (ctx) => {
   const user = await createUser(body, inviterId);
 
   // Mark invite as used only after the user row is committed
-  redeemInvite(body.inviteToken);
+  try {
+    await redeemInvite(body.inviteToken);
+  } catch (err) {
+    console.error("[register] redeemInvite failed (user created):", err);
+  }
 
   const authToken = await createJWT({
     userId: user.id,
@@ -55,10 +62,11 @@ router.post("/register", async (ctx) => {
     isAdmin: user.isAdmin,
   });
 
+  const { passwordHash: _, ...publicUser } = user;
   ctx.response.status = 201;
   ctx.response.body = {
     success: true,
-    data: { token: authToken, user },
+    data: { token: authToken, user: publicUser },
   };
 });
 
@@ -92,11 +100,12 @@ router.post("/login", async (ctx) => {
       isAdmin: user.isAdmin,
     });
 
+    const { passwordHash: _, ...publicUser } = user;
     ctx.response.body = {
       success: true,
       data: {
         token,
-        user,
+        user: publicUser,
       },
     };
   } catch (err) {
@@ -146,6 +155,7 @@ router.patch("/me", authMiddleware, async (ctx: AuthContext) => {
   }
   const updated = await updateUser(ctx.state.user.userId, body);
   const { passwordHash: _, ...publicUser } = updated;
+  broadcastUserUpdated(publicUser);
   ctx.response.body = { success: true, data: publicUser };
 });
 
@@ -166,17 +176,7 @@ router.get("/by-id/:userId", (ctx) => {
 // Followed playlists for a user (public only)
 router.get("/:username/followed-playlists", (ctx) => {
   const user = getUserByUsername(ctx.params.username);
-  const page = Math.max(
-    1,
-    parseInt(ctx.request.url.searchParams.get("page") ?? "1") || 1,
-  );
-  const limit = Math.min(
-    Math.max(
-      1,
-      parseInt(ctx.request.url.searchParams.get("limit") ?? "20") || 20,
-    ),
-    100,
-  );
+  const { page, limit } = parsePagination(ctx.request.url.searchParams);
   const { items, total } = getFollowedPlaylistsByUser(user.id, page, limit);
   ctx.response.body = {
     success: true,
@@ -191,23 +191,8 @@ router.get("/:username/followed-playlists", (ctx) => {
 // Playlists by user (optional auth: include private only if requester === owner)
 router.get("/:username/playlists", async (ctx) => {
   const user = getUserByUsername(ctx.params.username);
-  let requestingUserId: string | null = null;
-  const authHeader = ctx.request.headers.get("Authorization");
-  if (authHeader?.startsWith("Bearer ")) {
-    const payload = await verifyJWT(authHeader.substring(7));
-    if (payload) requestingUserId = payload.userId;
-  }
-  const page = Math.max(
-    1,
-    parseInt(ctx.request.url.searchParams.get("page") ?? "1") || 1,
-  );
-  const limit = Math.min(
-    Math.max(
-      1,
-      parseInt(ctx.request.url.searchParams.get("limit") ?? "20") || 20,
-    ),
-    100,
-  );
+  const requestingUserId = await parseOptionalAuth(ctx);
+  const { page, limit } = parsePagination(ctx.request.url.searchParams);
   const { items, total } = listPlaylistsByUser(
     user.id,
     requestingUserId,
@@ -234,23 +219,8 @@ router.get("/:username", (ctx) => {
 // Dumps posted by user (optional auth: owner sees their private dumps)
 router.get("/:username/dumps", async (ctx) => {
   const user = getUserByUsername(ctx.params.username);
-  let requestingUserId: string | null = null;
-  const authHeader = ctx.request.headers.get("Authorization");
-  if (authHeader?.startsWith("Bearer ")) {
-    const payload = await verifyJWT(authHeader.substring(7));
-    if (payload) requestingUserId = payload.userId;
-  }
-  const page = Math.max(
-    1,
-    parseInt(ctx.request.url.searchParams.get("page") ?? "1") || 1,
-  );
-  const limit = Math.min(
-    Math.max(
-      1,
-      parseInt(ctx.request.url.searchParams.get("limit") ?? "20") || 20,
-    ),
-    100,
-  );
+  const requestingUserId = await parseOptionalAuth(ctx);
+  const { page, limit } = parsePagination(ctx.request.url.searchParams);
   const includePrivate = requestingUserId === user.id;
   const { items, total } = getDumpsByUser(user.id, page, limit, includePrivate);
   ctx.response.body = {
@@ -266,23 +236,8 @@ router.get("/:username/dumps", async (ctx) => {
 // Dumps upvoted by user (optional auth: hide private dump entries for non-owners)
 router.get("/:username/votes", async (ctx) => {
   const user = getUserByUsername(ctx.params.username);
-  let requestingUserId: string | null = null;
-  const authHeader = ctx.request.headers.get("Authorization");
-  if (authHeader?.startsWith("Bearer ")) {
-    const payload = await verifyJWT(authHeader.substring(7));
-    if (payload) requestingUserId = payload.userId;
-  }
-  const page = Math.max(
-    1,
-    parseInt(ctx.request.url.searchParams.get("page") ?? "1") || 1,
-  );
-  const limit = Math.min(
-    Math.max(
-      1,
-      parseInt(ctx.request.url.searchParams.get("limit") ?? "20") || 20,
-    ),
-    100,
-  );
+  const requestingUserId = await parseOptionalAuth(ctx);
+  const { page, limit } = parsePagination(ctx.request.url.searchParams);
   const { items, total } = getVotedDumpsByUser(
     user.id,
     page,