Fix query and API bugs: 403 for non-owners, page bounds, lifecycle filters, cover fallback, race-safe inserts, async album delete

backend/Core/Musify.Application/Albums/AddTrackToAlbum.cs

@@ -3,6 +3,7 @@ using Mediator;
 using Microsoft.EntityFrameworkCore;
 using Microsoft.Extensions.Logging;
 using Musify.Application.Contracts;
+using Musify.Application.Shared;
 using Musify.Domain.Entities;
 
 namespace Musify.Application.Albums;
@@ -21,48 +22,30 @@ public class AddTrackToAlbumCommandHandler(
             .AsNoTracking()
             .SingleOrDefaultAsync(a => a.Id == request.AlbumId, cancellationToken);
         if (album == null)
-        {
-            logger.LogInformation("Album {AlbumId} not found", request.AlbumId);
-            return Error.NotFound();
-        }
+            return AppErrors.NotFound("Album", request.AlbumId);
 
         if (album.OwnerUserId != request.UserId)
-        {
-            logger.LogWarning("User {UserId} is not the owner of album {AlbumId}", request.UserId, request.AlbumId);
-            return Error.Unauthorized();
-        }
+            return AppErrors.Forbidden("Album", request.AlbumId);
 
         var track = await database.Tracks
             .AsNoTracking()
             .SingleOrDefaultAsync(t => t.Id == request.TrackId, cancellationToken);
         if (track == null)
-        {
-            logger.LogInformation("Track {TrackId} not found", request.TrackId);
-            return Error.NotFound(description: $"Track {request.TrackId} not found");
-        }
+            return AppErrors.NotFound("Track", request.TrackId);
 
         if (track.OwnerUserId != request.UserId)
-        {
-            logger.LogWarning("User {UserId} does not own track {TrackId}", request.UserId, request.TrackId);
-            return Error.Unauthorized();
-        }
+            return AppErrors.Forbidden("Track", request.TrackId);
 
         var alreadyAdded = await database.AlbumHasTracks
             .AsNoTracking()
             .AnyAsync(albumTrack => albumTrack.AlbumId == request.AlbumId && albumTrack.TrackId == request.TrackId, cancellationToken);
         if (alreadyAdded)
-        {
-            logger.LogInformation("Track {TrackId} already in album {AlbumId}", request.TrackId, request.AlbumId);
-            return Error.Conflict(description: "Track is already in the album.");
-        }
+            return AlreadyInAlbum;
 
-        var albumTracksQuery = database.AlbumHasTracks
-            .Where(albumTrack => albumTrack.AlbumId == request.AlbumId);
-
-        var hasTracks = await albumTracksQuery.AnyAsync(cancellationToken);
-        var nextTrackNumber = hasTracks
-            ? await albumTracksQuery.MaxAsync(albumTrack => albumTrack.TrackNumber, cancellationToken) + 1
-            : 1;
+        // Album track numbers are user-visible, so they start at 1.
+        var nextTrackNumber = (await database.AlbumHasTracks
+            .Where(albumTrack => albumTrack.AlbumId == request.AlbumId)
+            .MaxAsync(albumTrack => (int?)albumTrack.TrackNumber, cancellationToken) ?? 0) + 1;
 
         await database.AlbumHasTracks.AddAsync(new AlbumHasTrack
         {
@@ -71,11 +54,15 @@ public class AddTrackToAlbumCommandHandler(
             TrackNumber = nextTrackNumber
         }, cancellationToken);
 
-        await database.SaveChangesAsync(cancellationToken);
+        var saved = await database.TrySaveChangesAsync(AlreadyInAlbum, cancellationToken);
+        if (saved.IsError)
+            return saved;
 
         logger.LogInformation("Added track {TrackId} to album {AlbumId} as number {TrackNumber}",
             request.TrackId, request.AlbumId, nextTrackNumber);
 
-        return new Success();
+        return Result.Success;
     }
+
+    private static Error AlreadyInAlbum => AppErrors.Conflict("Album.TrackAlreadyAdded", "Track is already in the album.");
 }

backend/Core/Musify.Application/Albums/CreateAlbum.cs

@@ -57,13 +57,7 @@ public class CreateAlbumCommandHandler(
             NormalizedTitle = title.ToUpperInvariant(),
             Description = request.Description,
             ReleaseYear = request.ReleaseYear,
-            Pictures = new AlbumPictures
-            {
-                OriginalName = intent.ObjectName,
-                SmallName = intent.ObjectName,
-                MediumName = intent.ObjectName,
-                LargeName = intent.ObjectName
-            }
+            Pictures = AlbumPictures.Pending(intent.ObjectName)
         };
 
         await database.Albums.AddAsync(album, cancellationToken);

backend/Core/Musify.Application/Albums/DeleteAlbum.cs

@@ -3,6 +3,9 @@ using Mediator;
 using Microsoft.EntityFrameworkCore;
 using Microsoft.Extensions.Logging;
 using Musify.Application.Contracts;
+using Musify.Application.Events;
+using Musify.Application.Shared;
+using Musify.Domain.ValueObjects;
 
 namespace Musify.Application.Albums;
 
@@ -11,39 +14,27 @@ public record DeleteAlbumCommand(long UserId, Guid AlbumId)
 
 public class DeleteAlbumCommandHandler(
     IDatabase database,
+    IEventBus eventBus,
     ILogger<DeleteAlbumCommandHandler> logger)
     : ICommandHandler<DeleteAlbumCommand, ErrorOr<Success>>
 {
     public async ValueTask<ErrorOr<Success>> Handle(DeleteAlbumCommand request, CancellationToken cancellationToken)
     {
         var album = await database.Albums
-            .SingleOrDefaultAsync(a => a.Id == request.AlbumId, cancellationToken);
+            .SingleOrDefaultAsync(a => a.Id == request.AlbumId && a.LifeCycleStatus == LifeCycleStatus.Active, cancellationToken);
         if (album == null)
-        {
-            logger.LogDebug("Album {AlbumId} not found", request.AlbumId);
-            return Error.NotFound();
-        }
+            return AppErrors.NotFound("Album", request.AlbumId);
 
         if (album.OwnerUserId != request.UserId)
-        {
-            logger.LogWarning("Album {AlbumId} does not belong to user {UserId}", request.AlbumId, request.UserId);
-            return Error.Unauthorized();
-        }
+            return AppErrors.Forbidden("Album", request.AlbumId);
 
-        database.Albums.Remove(album);
+        album.LifeCycleStatus = LifeCycleStatus.Removing;
 
-        try
-        {
-            await database.SaveChangesAsync(cancellationToken);
-        }
-        catch (Exception exception)
-        {
-            logger.LogError(exception, "Failed to delete album {AlbumId}", request.AlbumId);
-            return Error.Failure(description: $"Failed to delete album {request.AlbumId}");
-        }
+        await eventBus.PublishAsync(new DeleteAlbumEvent(album.Id, request.UserId), cancellationToken);
+        await database.SaveChangesAsync(cancellationToken);
 
-        logger.LogInformation("Deleted album {AlbumId} for user {UserId}", request.AlbumId, request.UserId);
+        logger.LogInformation("Marked album {AlbumId} of user {UserId} as removing", request.AlbumId, request.UserId);
 
-        return new Success();
+        return Result.Success;
     }
 }

backend/Core/Musify.Application/Albums/GetAlbumById.cs

@@ -3,6 +3,7 @@ using Mediator;
 using Microsoft.EntityFrameworkCore;
 using Musify.Application.Albums.Responses;
 using Musify.Application.Contracts;
+using Musify.Domain.ValueObjects;
 
 namespace Musify.Application.Albums;
 
@@ -16,7 +17,7 @@ public class GetAlbumByIdQueryHandler(IDatabase database)
     {
         var album = await database.Albums
             .AsNoTracking()
-            .Where(a => a.Id == request.Id)
+            .Where(a => a.Id == request.Id && a.LifeCycleStatus == LifeCycleStatus.Active)
             .Select(a => new
             {
                 Album = a,

backend/Core/Musify.Application/Albums/GetAlbumCover.cs

@@ -4,6 +4,8 @@ using Microsoft.EntityFrameworkCore;
 using MimeMapping;
 using Musify.Application.Configuration;
 using Musify.Application.Contracts;
+using Musify.Application.Shared;
+using Musify.Domain.ValueObjects;
 
 namespace Musify.Application.Albums;
 
@@ -20,14 +22,15 @@ public class GetAlbumCoverQueryHandler(
 {
     public async ValueTask<ErrorOr<AlbumCoverLocation>> Handle(GetAlbumCoverQuery request, CancellationToken cancellationToken)
     {
-        var pictures = await database.Albums.AsNoTracking()
-            .Where(a => a.Id == request.AlbumId)
-            .Select(a => a.Pictures)
+        var owned = await database.Albums.AsNoTracking()
+            .Where(e => e.Id == request.AlbumId && e.LifeCycleStatus == LifeCycleStatus.Active)
+            .Select(e => new { OwnerUserId = e.OwnerUserId, e.Pictures })
             .SingleOrDefaultAsync(cancellationToken);
 
-        if (pictures == null)
-            return Error.NotFound();
+        if (owned?.Pictures == null)
+            return AppErrors.NotFound("AlbumCover", request.AlbumId);
 
+        var pictures = owned.Pictures;
         var routes = albumConfiguration.Routes;
         var (name, key) = request.Size.ToLowerInvariant() switch
         {
@@ -36,8 +39,15 @@ public class GetAlbumCoverQueryHandler(
             _ => (pictures.MediumName, BuildKey(routes.BuildMediumPicturePath, pictures.MediumName))
         };
 
+        // The resized files only exist once processing has finished; until then serve the original.
         if (string.IsNullOrEmpty(name) || string.IsNullOrEmpty(key))
-            return Error.NotFound();
+        {
+            name = pictures.OriginalName;
+            key = string.IsNullOrEmpty(name) ? null : routes.BuildOriginalPicturePath(owned.OwnerUserId, name);
+        }
+
+        if (string.IsNullOrEmpty(name) || string.IsNullOrEmpty(key))
+            return AppErrors.NotFound("AlbumCover", request.AlbumId);
 
         var contentType = MimeUtility.GetMimeMapping(name);
         return new AlbumCoverLocation(storageConfiguration.Bucket, key, contentType);

backend/Core/Musify.Application/Albums/GetAlbumTracks.cs

@@ -6,6 +6,7 @@ using Musify.Application.Shared;
 using Musify.Application.Tracks.Responses;
 using X.PagedList;
 using X.PagedList.EF;
+using Musify.Domain.ValueObjects;
 
 namespace Musify.Application.Albums;
 
@@ -22,7 +23,7 @@ public class GetAlbumTracksQueryHandler(IDatabase database)
     {
         var albumExists = await database.Albums
             .AsNoTracking()
-            .AnyAsync(album => album.Id == request.AlbumId, cancellationToken);
+            .AnyAsync(album => album.Id == request.AlbumId && album.LifeCycleStatus == LifeCycleStatus.Active, cancellationToken);
         if (!albumExists)
             return Error.NotFound();
 
@@ -30,7 +31,7 @@ public class GetAlbumTracksQueryHandler(IDatabase database)
             .AsNoTracking()
             .Include(albumTrack => albumTrack.Track.Owner)
             .Include(albumTrack => albumTrack.Track.Tags)
-            .Where(albumTrack => albumTrack.AlbumId == request.AlbumId);
+            .Where(albumTrack => albumTrack.AlbumId == request.AlbumId && albumTrack.Track.LifeCycleStatus == LifeCycleStatus.Active);
 
         var totalCount = await tracksQuery.CountAsync(cancellationToken);
 

backend/Core/Musify.Application/Albums/GetAlbums.cs

@@ -4,6 +4,7 @@ using Microsoft.EntityFrameworkCore;
 using Musify.Application.Albums.Responses;
 using Musify.Application.Contracts;
 using X.PagedList.EF;
+using Musify.Domain.ValueObjects;
 
 namespace Musify.Application.Albums;
 
@@ -17,7 +18,7 @@ public class GetAlbumsQueryHandler(IDatabase database)
     {
         var albumsQuery = database.Albums
             .AsNoTracking()
-            .AsQueryable();
+            .Where(album => album.LifeCycleStatus == LifeCycleStatus.Active);
 
         if (!string.IsNullOrEmpty(request.Title))
         {

backend/Core/Musify.Application/Albums/GetAlbumsByUserId.cs

@@ -6,6 +6,7 @@ using Musify.Application.Contracts;
 using Musify.Application.Shared;
 using X.PagedList;
 using X.PagedList.EF;
+using Musify.Domain.ValueObjects;
 
 namespace Musify.Application.Albums;
 
@@ -25,7 +26,7 @@ public class GetAlbumsByUserIdQueryHandler(IDatabase database)
 
         var albumsQuery = database.Albums
             .AsNoTracking()
-            .Where(album => album.OwnerUserId == request.UserId);
+            .Where(album => album.OwnerUserId == request.UserId && album.LifeCycleStatus == LifeCycleStatus.Active);
 
         var totalCount = await albumsQuery.CountAsync(cancellationToken);
 

backend/Core/Musify.Application/Albums/GetRecentlyListenedAlbums.cs

@@ -3,6 +3,7 @@ using Mediator;
 using Microsoft.EntityFrameworkCore;
 using Musify.Application.Albums.Responses;
 using Musify.Application.Contracts;
+using Musify.Domain.ValueObjects;
 
 namespace Musify.Application.Albums;
 
@@ -38,7 +39,7 @@ public class GetRecentlyListenedAlbumsQueryHandler(IDatabase database)
 
         var albums = await database.Albums
             .AsNoTracking()
-            .Where(album => albumIds.Contains(album.Id))
+            .Where(album => albumIds.Contains(album.Id) && album.LifeCycleStatus == LifeCycleStatus.Active)
             .Select(album => new
             {
                 Album = album,

backend/Core/Musify.Application/Albums/RemoveTrackFromAlbum.cs

@@ -3,6 +3,7 @@ using Mediator;
 using Microsoft.EntityFrameworkCore;
 using Microsoft.Extensions.Logging;
 using Musify.Application.Contracts;
+using Musify.Application.Shared;
 
 namespace Musify.Application.Albums;
 
@@ -20,16 +21,10 @@ public class RemoveTrackFromAlbumCommandHandler(
             .AsNoTracking()
             .SingleOrDefaultAsync(a => a.Id == request.AlbumId, cancellationToken);
         if (album == null)
-        {
-            logger.LogInformation("Album {AlbumId} not found", request.AlbumId);
-            return Error.NotFound();
-        }
+            return AppErrors.NotFound("Album", request.AlbumId);
 
         if (album.OwnerUserId != request.UserId)
-        {
-            logger.LogWarning("User {UserId} is not the owner of album {AlbumId}", request.UserId, request.AlbumId);
-            return Error.Unauthorized();
-        }
+            return AppErrors.Forbidden("Album", request.AlbumId);
 
         var albumTracks = await database.AlbumHasTracks
             .Where(albumTrack => albumTrack.AlbumId == request.AlbumId)

backend/Core/Musify.Application/Albums/UpdateAlbum.cs

@@ -45,7 +45,7 @@ public class UpdateAlbumCommandHandler(
         if (album.OwnerUserId != request.UserId)
         {
             logger.LogWarning("Album {AlbumId} does not belong to user {UserId}", request.AlbumId, request.UserId);
-            return Error.Unauthorized();
+            return AppErrors.Forbidden("Album", request.AlbumId);
         }
 
         var title = request.Title.Trim();
@@ -67,13 +67,7 @@ public class UpdateAlbumCommandHandler(
                 return validation.Errors;
 
             pictureIntent = validation.Value;
-            album.Pictures = new AlbumPictures
-            {
-                OriginalName = pictureIntent.ObjectName,
-                SmallName = pictureIntent.ObjectName,
-                MediumName = pictureIntent.ObjectName,
-                LargeName = pictureIntent.ObjectName
-            };
+            album.Pictures = AlbumPictures.Pending(pictureIntent.ObjectName);
             finalPictureKey = albumConfiguration.Routes.BuildOriginalPicturePath(request.UserId, pictureIntent.ObjectName);
         }
 

backend/Core/Musify.Application/Contracts/IDatabase.cs

@@ -1,3 +1,4 @@
+using ErrorOr;
 using Microsoft.EntityFrameworkCore;
 using Musify.Domain.Entities;
 
@@ -38,4 +39,6 @@ public interface IDatabase
     public Task<IDatabaseTransaction> BeginTransactionAsync(System.Data.IsolationLevel isolationLevel, CancellationToken cancellationToken);
 
     public Task<int> SaveChangesAsync(CancellationToken cancellationToken);
+
+    public Task<ErrorOr<Success>> TrySaveChangesAsync(Error onUniqueViolation, CancellationToken cancellationToken);
 }

backend/Core/Musify.Application/Contracts/IStorageService.cs

@@ -2,7 +2,7 @@ namespace Musify.Application.Contracts;
 
 public interface IStorageService
 {
-    public Task<Stream> GetFileAsync(string bucket, string key, CancellationToken cancellationToken);
+    public Task<Stream?> GetFileAsync(string bucket, string key, CancellationToken cancellationToken);
 
     public Task<ObjectMetaData?> HeadObjectAsync(string bucket, string key, CancellationToken cancellationToken);
 

backend/Core/Musify.Application/Events/DeleteAlbumEvent.cs

@@ -0,0 +1,5 @@
+namespace Musify.Application.Events;
+
+public record DeleteAlbumEvent(
+    Guid AlbumId,
+    long UserId);

backend/Core/Musify.Application/Genres/GetGenres.cs

@@ -16,7 +16,7 @@ public class GetGenresQueryHandler(IDatabase database)
     {
         var rows = await database.TrackTags
             .AsNoTracking()
-            .Where(tag => database.UserHasTracks.Any(userTrack => userTrack.TrackId == tag.TrackId))
+            .Where(tag => database.UserHasTracks.Any(userTrack => userTrack.TrackId == tag.TrackId && userTrack.Track.LifeCycleStatus == LifeCycleStatus.Active))
             .GroupBy(tag => tag.Tag)
             .Select(group => new { Genre = group.Key, TrackCount = group.Select(tag => tag.TrackId).Distinct().Count() })
             .ToListAsync(cancellationToken);

backend/Core/Musify.Application/Likes/GetLikedTracks.cs

@@ -6,6 +6,7 @@ using Musify.Application.Shared;
 using Musify.Application.Tracks.Responses;
 using X.PagedList;
 using X.PagedList.EF;
+using Musify.Domain.ValueObjects;
 
 namespace Musify.Application.Likes;
 
@@ -24,7 +25,7 @@ public class GetLikedTracksQueryHandler(IDatabase database)
             .AsNoTracking()
             .Include(like => like.Track.Owner)
             .Include(like => like.Track.Tags)
-            .Where(like => like.UserId == request.UserId);
+            .Where(like => like.UserId == request.UserId && like.Track.LifeCycleStatus == LifeCycleStatus.Active);
 
         var totalCount = await likesQuery.CountAsync(cancellationToken);
 

backend/Core/Musify.Application/Likes/ToggleTrackLike.cs

@@ -3,6 +3,7 @@ using Mediator;
 using Microsoft.EntityFrameworkCore;
 using Microsoft.Extensions.Logging;
 using Musify.Application.Contracts;
+using Musify.Application.Shared;
 using Musify.Domain.Entities;
 
 namespace Musify.Application.Likes;
@@ -45,7 +46,11 @@ public class ToggleTrackLikeCommandHandler(
             nowLiked = true;
         }
 
-        await database.SaveChangesAsync(cancellationToken);
+        // A concurrent double click can hit the unique index; the outcome is already in place, so treat it as a no-op.
+        var saved = await database.TrySaveChangesAsync(
+            AppErrors.Conflict("TrackLike.Duplicate", "Track is already liked."), cancellationToken);
+        if (saved.IsError)
+            return true;
 
         logger.LogInformation("User {UserId} {Action} track {TrackId}",
             request.UserId, nowLiked ? "liked" : "unliked", request.TrackId);

backend/Core/Musify.Application/Mixes/GetMixesByUserId.cs

@@ -21,14 +21,28 @@ public class GetMixesByUserIdQueryHandler(IDatabase database)
             .OrderBy(mix => mix.Position)
             .ToListAsync(cancellationToken);
 
+        var orderedItemsByMix = mixes.ToDictionary(
+            mix => mix.Id,
+            mix => mix.Items.OrderBy(item => item.Position).ToList());
+
+        var coverItems = orderedItemsByMix.Values
+            .SelectMany(items => items.Take(MixApplicationResponse.CoverItemCount))
+            .ToList();
+        var coverResponses = (await MixItemMapper.ToResponsesAsync(database, coverItems, cancellationToken))
+            .GroupBy(response => response.TrackId)
+            .ToDictionary(group => group.Key, group => group.First());
+
         var responses = new List<MixApplicationResponse>(mixes.Count);
         foreach (var mix in mixes)
         {
-            var orderedItems = mix.Items.OrderBy(item => item.Position).ToList();
-            var coverItems = await MixItemMapper.ToResponsesAsync(
-                database, orderedItems.Take(MixApplicationResponse.CoverItemCount).ToList(), cancellationToken);
+            var orderedItems = orderedItemsByMix[mix.Id];
+            var covers = orderedItems
+                .Take(MixApplicationResponse.CoverItemCount)
+                .Where(item => coverResponses.ContainsKey(item.TrackId))
+                .Select(item => coverResponses[item.TrackId])
+                .ToList();
 
-            responses.Add(new MixApplicationResponse(mix.Id, mix.Title, mix.Subtitle, orderedItems.Count, coverItems));
+            responses.Add(new MixApplicationResponse(mix.Id, mix.Title, mix.Subtitle, orderedItems.Count, covers));
         }
 
         return responses;

backend/Core/Musify.Application/Mixes/MixItemMapper.cs

@@ -2,6 +2,7 @@ using Microsoft.EntityFrameworkCore;
 using Musify.Application.Contracts;
 using Musify.Application.Mixes.Responses;
 using Musify.Domain.Entities;
+using Musify.Domain.ValueObjects;
 
 namespace Musify.Application.Mixes;
 
@@ -18,7 +19,7 @@ internal static class MixItemMapper
         var tracksById = await database.Tracks
             .AsNoTracking()
             .Include(track => track.Owner)
-            .Where(track => trackIds.Contains(track.Id))
+            .Where(track => trackIds.Contains(track.Id) && track.LifeCycleStatus == LifeCycleStatus.Active)
             .Select(track => new { Track = track, ListensCount = track.ListeningHistories.Count(l => l.IsCounted) })
             .ToDictionaryAsync(x => x.Track.Id, cancellationToken);
 

backend/Core/Musify.Application/PlayLists/AddTrackToPlayList.cs

@@ -3,6 +3,7 @@ using Mediator;
 using Microsoft.EntityFrameworkCore;
 using Microsoft.Extensions.Logging;
 using Musify.Application.Contracts;
+using Musify.Application.Shared;
 using Musify.Domain.Entities;
 
 namespace Musify.Application.PlayLists;
@@ -18,44 +19,30 @@ public class AddTrackToPlayListCommandHandler(
     public async ValueTask<ErrorOr<Success>> Handle(AddTrackToPlayListCommand request, CancellationToken cancellationToken)
     {
         var playList = await database.PlayLists
+            .AsNoTracking()
             .SingleOrDefaultAsync(pl => pl.Id == request.PlayListId, cancellationToken);
         if (playList == null)
-        {
-            logger.LogInformation("Playlist {PlayListId} not found", request.PlayListId);
-            return Error.NotFound();
-        }
+            return AppErrors.NotFound("PlayList", request.PlayListId);
 
         if (playList.UserId != request.UserId)
-        {
-            logger.LogWarning("User {UserId} is not the owner of playlist {PlayListId}", request.UserId, request.PlayListId);
-            return Error.Unauthorized();
-        }
+            return AppErrors.Forbidden("PlayList", request.PlayListId);
 
         var trackExists = await database.Tracks
             .AsNoTracking()
             .AnyAsync(t => t.Id == request.TrackId, cancellationToken);
         if (!trackExists)
-        {
-            logger.LogInformation("Track {TrackId} not found", request.TrackId);
-            return Error.NotFound(description: $"Track {request.TrackId} not found");
-        }
+            return AppErrors.NotFound("Track", request.TrackId);
 
         var alreadyAdded = await database.PlayListHasTracks
             .AsNoTracking()
             .AnyAsync(plt => plt.PlayListId == request.PlayListId && plt.TrackId == request.TrackId, cancellationToken);
         if (alreadyAdded)
-        {
-            logger.LogInformation("Track {TrackId} already in playlist {PlayListId}", request.TrackId, request.PlayListId);
-            return Error.Conflict(description: "Track is already in the playlist.");
-        }
+            return AlreadyInPlayList;
 
-        var playListTracksQuery = database.PlayListHasTracks
-            .Where(plt => plt.PlayListId == request.PlayListId);
-
-        var hasTracks = await playListTracksQuery.AnyAsync(cancellationToken);
-        var nextPosition = hasTracks
-            ? await playListTracksQuery.MaxAsync(plt => plt.Position, cancellationToken) + 1
-            : 0;
+        // Playlist positions are internal indexes, so they start at 0.
+        var nextPosition = (await database.PlayListHasTracks
+            .Where(plt => plt.PlayListId == request.PlayListId)
+            .MaxAsync(plt => (int?)plt.Position, cancellationToken) ?? -1) + 1;
 
         await database.PlayListHasTracks.AddAsync(new PlayListHasTrack
         {
@@ -64,11 +51,15 @@ public class AddTrackToPlayListCommandHandler(
             Position = nextPosition
         }, cancellationToken);
 
-        await database.SaveChangesAsync(cancellationToken);
+        var saved = await database.TrySaveChangesAsync(AlreadyInPlayList, cancellationToken);
+        if (saved.IsError)
+            return saved;
 
         logger.LogInformation("Added track {TrackId} to playlist {PlayListId} at position {Position}",
             request.TrackId, request.PlayListId, nextPosition);
 
-        return new Success();
+        return Result.Success;
     }
+
+    private static Error AlreadyInPlayList => AppErrors.Conflict("PlayList.TrackAlreadyAdded", "Track is already in the playlist.");
 }

backend/Core/Musify.Application/PlayLists/CreatePlayList.cs

@@ -53,7 +53,7 @@ public class CreatePlayListCommandHandler(
         var playList = new PlayList
         {
             UserId = request.UserId,
-            Name = request.Name,
+            Name = request.Name.Trim(),
             NormalizedName = request.Name.Trim().ToUpperInvariant(),
             Description = string.IsNullOrWhiteSpace(request.Description) ? null : request.Description.Trim(),
             Pictures = resolvedPictures.Pictures,
@@ -97,13 +97,7 @@ public class CreatePlayListCommandHandler(
         if (validation.IsError)
             return validation.Errors;
 
-        return new ResolvedPlayListPictures(new PlayListPictures
-        {
-            OriginalName = validation.Value.ObjectName,
-            SmallName = validation.Value.ObjectName,
-            MediumName = validation.Value.ObjectName,
-            LargeName = validation.Value.ObjectName
-        }, validation.Value);
+        return new ResolvedPlayListPictures(PlayListPictures.Pending(validation.Value.ObjectName), validation.Value);
     }
 
     private async Task<ErrorOr<Success>> PublishCreatePlayListEventAsync(

backend/Core/Musify.Application/PlayLists/DeletePlayList.cs

@@ -3,6 +3,7 @@ using Mediator;
 using Microsoft.EntityFrameworkCore;
 using Microsoft.Extensions.Logging;
 using Musify.Application.Contracts;
+using Musify.Application.Shared;
 using Musify.Application.Events;
 using Musify.Domain.ValueObjects;
 
@@ -29,7 +30,7 @@ public class DeletePlayListCommandHandler(
         if (playList.UserId != request.UserId)
         {
             logger.LogWarning("Playlist {PlayListId} does not belong to user {UserId}", request.PlayListId, request.UserId);
-            return Error.Unauthorized();
+            return AppErrors.Forbidden("PlayList", request.PlayListId);
         }
 
         playList.LifeCycleStatus = LifeCycleStatus.Removing;

backend/Core/Musify.Application/PlayLists/GetPlayListById.cs

@@ -17,7 +17,7 @@ public class GetPlayListByIdQueryHandler(IDatabase database)
     {
         var entry = await database.PlayLists
             .AsNoTracking()
-            .Where(p => p.Id == request.Id)
+            .Where(p => p.Id == request.Id && p.LifeCycleStatus == LifeCycleStatus.Active)
             .Select(p => new
             {
                 PlayList = p,

backend/Core/Musify.Application/PlayLists/GetPlayListCover.cs

@@ -4,6 +4,8 @@ using Microsoft.EntityFrameworkCore;
 using MimeMapping;
 using Musify.Application.Configuration;
 using Musify.Application.Contracts;
+using Musify.Application.Shared;
+using Musify.Domain.ValueObjects;
 
 namespace Musify.Application.PlayLists;
 
@@ -20,14 +22,15 @@ public class GetPlayListCoverQueryHandler(
 {
     public async ValueTask<ErrorOr<PlayListCoverLocation>> Handle(GetPlayListCoverQuery request, CancellationToken cancellationToken)
     {
-        var pictures = await database.PlayLists.AsNoTracking()
-            .Where(p => p.Id == request.PlayListId)
-            .Select(p => p.Pictures)
+        var owned = await database.PlayLists.AsNoTracking()
+            .Where(e => e.Id == request.PlayListId && e.LifeCycleStatus == LifeCycleStatus.Active)
+            .Select(e => new { OwnerUserId = e.UserId, e.Pictures })
             .SingleOrDefaultAsync(cancellationToken);
 
-        if (pictures == null)
-            return Error.NotFound();
+        if (owned?.Pictures == null)
+            return AppErrors.NotFound("PlayListCover", request.PlayListId);
 
+        var pictures = owned.Pictures;
         var routes = playListConfiguration.Routes;
         var (name, key) = request.Size.ToLowerInvariant() switch
         {
@@ -36,8 +39,15 @@ public class GetPlayListCoverQueryHandler(
             _ => (pictures.MediumName, BuildKey(routes.BuildMediumPicturePath, pictures.MediumName))
         };
 
+        // The resized files only exist once processing has finished; until then serve the original.
         if (string.IsNullOrEmpty(name) || string.IsNullOrEmpty(key))
-            return Error.NotFound();
+        {
+            name = pictures.OriginalName;
+            key = string.IsNullOrEmpty(name) ? null : routes.BuildOriginalPicturePath(owned.OwnerUserId, name);
+        }
+
+        if (string.IsNullOrEmpty(name) || string.IsNullOrEmpty(key))
+            return AppErrors.NotFound("PlayListCover", request.PlayListId);
 
         var contentType = MimeUtility.GetMimeMapping(name);
         return new PlayListCoverLocation(storageConfiguration.Bucket, key, contentType);

backend/Core/Musify.Application/PlayLists/GetPlayListTracks.cs

@@ -26,6 +26,7 @@ public class GetPlayListTracksQueryHandler(IDatabase database)
             .AsNoTracking()
             .AnyAsync(
                 p => p.Id == request.PlayListId
+                    && p.LifeCycleStatus == LifeCycleStatus.Active
                     && (p.Visibility == PlaylistVisibility.Public || p.UserId == request.ViewerId),
                 cancellationToken);
         if (!playListExists)
@@ -35,7 +36,7 @@ public class GetPlayListTracksQueryHandler(IDatabase database)
             .AsNoTracking()
             .Include(plt => plt.Track.Owner)
             .Include(plt => plt.Track.Tags)
-            .Where(plt => plt.PlayListId == request.PlayListId);
+            .Where(plt => plt.PlayListId == request.PlayListId && plt.Track.LifeCycleStatus == LifeCycleStatus.Active);
 
         var totalCount = await tracksQuery.CountAsync(cancellationToken);
 

backend/Core/Musify.Application/PlayLists/GetPlayListsByUserId.cs

@@ -26,6 +26,7 @@ public class GetPlayListsByUserIdQueryHandler(IDatabase database)
         var playListsQuery = database.PlayLists
             .AsNoTracking()
             .Where(p => p.UserId == request.UserId
+                && p.LifeCycleStatus == LifeCycleStatus.Active
                 && (p.Visibility == PlaylistVisibility.Public || p.UserId == request.ViewerId));
 
         if (!string.IsNullOrEmpty(request.Name))
@@ -38,7 +39,7 @@ public class GetPlayListsByUserIdQueryHandler(IDatabase database)
 
         var pagedEntities = await playListsQuery
             .OrderBy(p => p.CreatedAt)
-            .Where(p => p.LifeCycleStatus == LifeCycleStatus.Active)
+            .ThenBy(p => p.Id)
             .Select(p => new
             {
                 PlayList = p,

backend/Core/Musify.Application/PlayLists/RemoveTrackFromPlayList.cs

@@ -3,6 +3,7 @@ using Mediator;
 using Microsoft.EntityFrameworkCore;
 using Microsoft.Extensions.Logging;
 using Musify.Application.Contracts;
+using Musify.Application.Shared;
 
 namespace Musify.Application.PlayLists;
 
@@ -17,32 +18,33 @@ public class RemoveTrackFromPlayListCommandHandler(
     public async ValueTask<ErrorOr<Success>> Handle(RemoveTrackFromPlayListCommand request, CancellationToken cancellationToken)
     {
         var playList = await database.PlayLists
+            .AsNoTracking()
             .SingleOrDefaultAsync(pl => pl.Id == request.PlayListId, cancellationToken);
         if (playList == null)
-        {
-            logger.LogInformation("Playlist {PlayListId} not found", request.PlayListId);
-            return Error.NotFound();
-        }
+            return AppErrors.NotFound("PlayList", request.PlayListId);
 
         if (playList.UserId != request.UserId)
-        {
-            logger.LogWarning("User {UserId} is not the owner of playlist {PlayListId}", request.UserId, request.PlayListId);
-            return Error.Unauthorized();
-        }
+            return AppErrors.Forbidden("PlayList", request.PlayListId);
 
-        var link = await database.PlayListHasTracks
-            .SingleOrDefaultAsync(plt => plt.PlayListId == request.PlayListId && plt.TrackId == request.TrackId, cancellationToken);
+        var playListTracks = await database.PlayListHasTracks
+            .Where(plt => plt.PlayListId == request.PlayListId)
+            .OrderBy(plt => plt.Position)
+            .ToListAsync(cancellationToken);
+
+        var link = playListTracks.SingleOrDefault(plt => plt.TrackId == request.TrackId);
         if (link == null)
-        {
-            logger.LogInformation("Track {TrackId} not in playlist {PlayListId}", request.TrackId, request.PlayListId);
-            return Error.NotFound(description: "Track is not in the playlist.");
-        }
+            return Error.NotFound("PlayList.TrackNotFound", "Track is not in the playlist.");
 
         database.PlayListHasTracks.Remove(link);
+
+        var position = 0;
+        foreach (var remaining in playListTracks.Where(plt => plt.Id != link.Id))
+            remaining.Position = position++;
+
         await database.SaveChangesAsync(cancellationToken);
 
         logger.LogInformation("Removed track {TrackId} from playlist {PlayListId}", request.TrackId, request.PlayListId);
 
-        return new Success();
+        return Result.Success;
     }
 }

backend/Core/Musify.Application/PlayLists/UpdatePlayList.cs

@@ -44,18 +44,18 @@ public class UpdatePlayListCommandHandler(
         if (playListEntity.UserId != request.UserId)
         {
             logger.LogWarning("User {UserId} is not the owner of playlist {PlayListId}", request.UserId, request.PlayListId);
-            return Error.Unauthorized();
+            return AppErrors.Forbidden("PlayList", request.PlayListId);
         }
 
         if (!string.IsNullOrWhiteSpace(request.NewName))
         {
-            playListEntity.Name = request.NewName;
+            playListEntity.Name = request.NewName.Trim();
             playListEntity.NormalizedName = request.NewName.Trim().ToUpperInvariant();
         }
 
-        if (!string.IsNullOrWhiteSpace(request.NewDescription))
+        if (request.NewDescription != null)
         {
-            playListEntity.Description = request.NewDescription;
+            playListEntity.Description = string.IsNullOrWhiteSpace(request.NewDescription) ? null : request.NewDescription.Trim();
         }
 
         if (request.NewVisibility.HasValue)
@@ -75,13 +75,7 @@ public class UpdatePlayListCommandHandler(
                 return validation.Errors;
 
             pictureIntent = validation.Value;
-            playListEntity.Pictures = new PlayListPictures
-            {
-                OriginalName = pictureIntent.ObjectName,
-                SmallName = pictureIntent.ObjectName,
-                MediumName = pictureIntent.ObjectName,
-                LargeName = pictureIntent.ObjectName
-            };
+            playListEntity.Pictures = PlayListPictures.Pending(pictureIntent.ObjectName);
             finalPictureKey = playListConfiguration.Routes.BuildOriginalPicturePath(request.UserId, pictureIntent.ObjectName);
         }
 

backend/Core/Musify.Application/Shared/AppErrors.cs

@@ -0,0 +1,15 @@
+using ErrorOr;
+
+namespace Musify.Application.Shared;
+
+public static class AppErrors
+{
+    public static Error NotFound(string entity, object id) =>
+        Error.NotFound($"{entity}.NotFound", $"{entity} {id} was not found.");
+
+    public static Error Forbidden(string entity, object id) =>
+        Error.Forbidden($"{entity}.Forbidden", $"You do not have permission to modify {entity} {id}.");
+
+    public static Error Conflict(string code, string description) =>
+        Error.Conflict(code, description);
+}

backend/Core/Musify.Application/Shared/Pagination.cs

@@ -0,0 +1,6 @@
+namespace Musify.Application.Shared;
+
+public record PageRequest(int PageNumber = 1, int PageSize = 20)
+{
+    public const int MaxPageSize = 100;
+}

backend/Core/Musify.Application/Tracks/DeleteTrack.cs

@@ -3,6 +3,7 @@ using Mediator;
 using Microsoft.EntityFrameworkCore;
 using Microsoft.Extensions.Logging;
 using Musify.Application.Contracts;
+using Musify.Application.Shared;
 using Musify.Application.Events;
 using Musify.Domain.ValueObjects;
 
@@ -31,7 +32,7 @@ public class DeleteTrackCommandHandler(
         if (track.OwnerUserId != request.UserId)
         {
             logger.LogWarning("User {UserId} unauthorized to delete track {TrackId}", request.UserId, request.TrackId);
-            return Error.Unauthorized();
+            return AppErrors.Forbidden("Track", request.TrackId);
         }
 
         if (track.Audio.IsInProgress)

backend/Core/Musify.Application/Tracks/GetLastTrackListenedByUserId.cs

@@ -1,29 +1,26 @@
-using ErrorOr;
 using Mediator;
 using Microsoft.EntityFrameworkCore;
 using Musify.Application.Contracts;
 using Musify.Application.Tracks.Responses;
+using Musify.Domain.ValueObjects;
 
 namespace Musify.Application.Tracks;
 
-public record GetLastTrackListenedByUserIdQuery(long UserId) : IQuery<ErrorOr<TrackApplicationResponse>>;
+public record GetLastTrackListenedByUserIdQuery(long UserId) : IQuery<TrackApplicationResponse?>;
 
 public class GetLastTrackListenedByUserIdQueryHandler(IDatabase database)
-    : IQueryHandler<GetLastTrackListenedByUserIdQuery, ErrorOr<TrackApplicationResponse>>
+    : IQueryHandler<GetLastTrackListenedByUserIdQuery, TrackApplicationResponse?>
 {
-    public async ValueTask<ErrorOr<TrackApplicationResponse>> Handle(GetLastTrackListenedByUserIdQuery query, CancellationToken cancellationToken)
+    public async ValueTask<TrackApplicationResponse?> Handle(GetLastTrackListenedByUserIdQuery query, CancellationToken cancellationToken)
     {
-        var track = await database.ListeningHistories
+        return await database.ListeningHistories
             .AsNoTracking()
             .Include(t => t.Track.Owner)
             .Include(t => t.Track.Tags)
-            .Where(t => t.UserId == query.UserId)
+            .Where(t => t.UserId == query.UserId && t.IsCounted && t.Track.LifeCycleStatus == LifeCycleStatus.Active)
             .OrderByDescending(t => t.ListenedAt)
+            .ThenBy(t => t.Id)
             .Select(t => TrackApplicationResponse.FromEntity(t.Track, t.Track.ListeningHistories.Count(l => l.IsCounted)))
             .FirstOrDefaultAsync(cancellationToken);
-
-        return track == null
-            ? Error.NotFound("Track.NotFound", "No track found for the given user ID.")
-            : track;
     }
 }

backend/Core/Musify.Application/Tracks/GetListeningHistory.cs

@@ -2,6 +2,7 @@ using Mediator;
 using Microsoft.EntityFrameworkCore;
 using Musify.Application.Contracts;
 using Musify.Application.Tracks.Responses;
+using Musify.Domain.ValueObjects;
 
 namespace Musify.Application.Tracks;
 
@@ -28,11 +29,12 @@ public class GetListeningHistoryQueryHandler(
             .AsNoTracking()
             .Include(t => t.Owner)
             .Include(t => t.Tags)
-            .Where(t => recentTrackIds.Contains(t.Id))
+            .Where(t => recentTrackIds.Contains(t.Id) && t.LifeCycleStatus == LifeCycleStatus.Active)
             .Select(t => new { t.Id, Track = t, ListensCount = t.ListeningHistories.Count(l => l.IsCounted) })
             .ToDictionaryAsync(t => t.Id, cancellationToken);
 
         return recentTrackIds
+            .Where(id => tracksById.ContainsKey(id))
             .Select(id => tracksById[id])
             .Select(t => TrackApplicationResponse.FromEntity(t.Track, t.ListensCount));
     }

backend/Core/Musify.Application/Tracks/GetTrackById.cs

@@ -3,6 +3,7 @@ using Mediator;
 using Microsoft.EntityFrameworkCore;
 using Musify.Application.Contracts;
 using Musify.Application.Tracks.Responses;
+using Musify.Domain.ValueObjects;
 
 namespace Musify.Application.Tracks;
 
@@ -17,7 +18,7 @@ public class GetTrackByIdQueryHandler(IDatabase database)
         var entity = await database.Tracks.AsNoTracking()
             .Include(t => t.Owner)
             .Include(t => t.Tags)
-            .Where(t => t.Id == request.TrackId)
+            .Where(t => t.Id == request.TrackId && t.LifeCycleStatus == LifeCycleStatus.Active)
             .Select(t => new { Track = t, ListensCount = t.ListeningHistories.Count(l => l.IsCounted) })
             .SingleOrDefaultAsync(cancellationToken);
 

backend/Core/Musify.Application/Tracks/GetTrackStream.cs

@@ -6,6 +6,7 @@ using Musify.Application.Configuration;
 using Musify.Application.Contracts;
 using Musify.Application.Services;
 using Musify.Application.Tracks.Responses;
+using Musify.Domain.ValueObjects;
 
 namespace Musify.Application.Tracks;
 
@@ -26,7 +27,7 @@ public class GetTrackStreamQueryHandler(
             return Error.Unauthorized(description: "Sign in to stream music, or ask an administrator to enable anonymous listening.");
 
         var track = await database.Tracks.AsNoTracking()
-            .Where(t => t.Id == request.TrackId)
+            .Where(t => t.Id == request.TrackId && t.LifeCycleStatus == LifeCycleStatus.Active)
             .Select(t => new { t.Id, t.Audio })
             .SingleOrDefaultAsync(cancellationToken);
 

backend/Core/Musify.Application/Tracks/GetTracks.cs

@@ -20,7 +20,7 @@ public class GetTracksQueryHandler(IDatabase database)
             .AsNoTracking()
             .Include(ut => ut.Track.Owner)
             .Include(ut => ut.Track.Tags)
-            .AsQueryable();
+            .Where(ut => ut.Track.LifeCycleStatus == LifeCycleStatus.Active);
 
         if (!string.IsNullOrEmpty(request.Name))
         {

backend/Core/Musify.Application/Tracks/GetTracksByUserId.cs

@@ -6,6 +6,7 @@ using Musify.Application.Shared;
 using Musify.Application.Tracks.Responses;
 using X.PagedList;
 using X.PagedList.EF;
+using Musify.Domain.ValueObjects;
 
 namespace Musify.Application.Tracks;
 
@@ -21,14 +22,11 @@ public class GetTracksByUserIdQueryHandler(IDatabase database)
 {
     public async ValueTask<ErrorOr<PaginatedResponse<TrackApplicationResponse>>> Handle(GetTracksByUserIdQuery request, CancellationToken cancellationToken)
     {
-        var pageNumber = request.PageNumber < 1 ? 1 : request.PageNumber;
-        var pageSize = request.PageSize < 1 ? 10 : request.PageSize;
-
         var tracksQuery = database.UserHasTracks
             .AsNoTracking()
             .Include(ut => ut.Track.Owner)
             .Include(ut => ut.Track.Tags)
-            .Where(p => p.UserId == request.UserId);
+            .Where(p => p.UserId == request.UserId && p.Track.LifeCycleStatus == LifeCycleStatus.Active);
 
         if (!string.IsNullOrEmpty(request.Name))
         {
@@ -41,7 +39,7 @@ public class GetTracksByUserIdQueryHandler(IDatabase database)
         var pagedEntities = await tracksQuery
             .OrderBy(t => t.Track.CreatedAt)
             .Select(t => new { t.Track, ListensCount = t.Track.ListeningHistories.Count(l => l.IsCounted) })
-            .ToPagedListAsync(pageNumber, pageSize, totalCount, cancellationToken);
+            .ToPagedListAsync(request.PageNumber, request.PageSize, totalCount, cancellationToken);
 
         var pagedTracks = new StaticPagedList<TrackApplicationResponse>(
             pagedEntities.Select(x => TrackApplicationResponse.FromEntity(x.Track, x.ListensCount)),

backend/Core/Musify.Application/Users/FollowUser.cs

@@ -3,6 +3,7 @@ using Mediator;
 using Microsoft.EntityFrameworkCore;
 using Microsoft.Extensions.Logging;
 using Musify.Application.Contracts;
+using Musify.Application.Shared;
 using Musify.Domain.Entities;
 
 namespace Musify.Application.Users;
@@ -40,7 +41,11 @@ public class FollowUserCommandHandler(
             FollowedId = request.FollowedId
         }, cancellationToken);
 
-        await database.SaveChangesAsync(cancellationToken);
+        // A concurrent double click can hit the unique index; already following is a successful no-op.
+        var saved = await database.TrySaveChangesAsync(
+            AppErrors.Conflict("UserFollow.Duplicate", "Already following this user."), cancellationToken);
+        if (saved.IsError)
+            return Result.Success;
 
         logger.LogInformation("User {FollowerId} followed user {FollowedId}", request.FollowerId, request.FollowedId);
 

backend/Core/Musify.Application/Users/GetListeningStats.cs

@@ -39,6 +39,9 @@ public class GetListeningStatsQueryHandler(IDatabase database)
         var listenedDateSet = listenedDates.ToHashSet();
         var streakDays = 0;
         var day = DateTime.UtcNow.Date;
+        if (!listenedDateSet.Contains(day))
+            day = day.AddDays(-1);
+
         while (listenedDateSet.Contains(day))
         {
             streakDays++;

backend/Core/Musify.Domain/ValueObjects/AlbumPictures.cs

@@ -7,12 +7,11 @@ public class AlbumPictures
     [Required]
     public required string OriginalName { get; set; }
 
-    [Required]
-    public required string SmallName { get; set; }
+    public string? SmallName { get; set; }
 
-    [Required]
-    public required string MediumName { get; set; }
+    public string? MediumName { get; set; }
 
-    [Required]
-    public required string LargeName { get; set; }
+    public string? LargeName { get; set; }
+
+    public static AlbumPictures Pending(string originalName) => new() { OriginalName = originalName };
 }

backend/Core/Musify.Domain/ValueObjects/PlayListPictures.cs

@@ -7,12 +7,11 @@ public class PlayListPictures
     [Required]
     public required string OriginalName { get; set; }
 
-    [Required]
-    public required string SmallName { get; set; }
+    public string? SmallName { get; set; }
 
-    [Required]
-    public required string MediumName { get; set; }
+    public string? MediumName { get; set; }
 
-    [Required]
-    public required string LargeName { get; set; }
+    public string? LargeName { get; set; }
+
+    public static PlayListPictures Pending(string originalName) => new() { OriginalName = originalName };
 }

backend/Core/Musify.Infrastructure/MassTransit/Activities/Albums/DeleteAlbumFromDbActivity.cs

@@ -0,0 +1,35 @@
+using MassTransit;
+using Microsoft.EntityFrameworkCore;
+using Microsoft.Extensions.Logging;
+using Musify.Application.Contracts;
+using Musify.Infrastructure.MassTransit.Arguments;
+
+namespace Musify.Infrastructure.MassTransit.Activities.Albums;
+
+internal class DeleteAlbumFromDbActivity(
+    IDatabase database,
+    ILogger<DeleteAlbumFromDbActivity> logger)
+    : IExecuteActivity<DeleteAlbumFromDbArguments>
+{
+    public const string ExecuteEndpointName = "delete-album-from-db";
+
+    public async Task<ExecutionResult> Execute(ExecuteContext<DeleteAlbumFromDbArguments> executeContext)
+    {
+        var album = await database.Albums
+            .SingleOrDefaultAsync(p => p.Id == executeContext.Arguments.AlbumId, executeContext.CancellationToken);
+
+        if (album == null)
+        {
+            logger.LogInformation(
+                "Album {AlbumId} not found while deleting from DB, skipping",
+                executeContext.Arguments.AlbumId);
+            return executeContext.Completed();
+        }
+
+        database.Albums.Remove(album);
+        await database.SaveChangesAsync(executeContext.CancellationToken);
+
+        logger.LogInformation("Deleted album {AlbumId} from DB", album.Id);
+        return executeContext.Completed();
+    }
+}

backend/Core/Musify.Infrastructure/MassTransit/Activities/Albums/MarkAlbumAsRemovingActivity.cs

@@ -0,0 +1,36 @@
+using MassTransit;
+using Microsoft.EntityFrameworkCore;
+using Microsoft.Extensions.Logging;
+using Musify.Application.Contracts;
+using Musify.Domain.ValueObjects;
+using Musify.Infrastructure.MassTransit.Arguments;
+
+namespace Musify.Infrastructure.MassTransit.Activities.Albums;
+
+internal class MarkAlbumAsRemovingActivity(
+    IDatabase database,
+    ILogger<MarkAlbumAsRemovingActivity> logger)
+    : IExecuteActivity<MarkAlbumAsRemovingArguments>
+{
+    public const string ExecuteEndpointName = "mark-album-as-removing";
+
+    public async Task<ExecutionResult> Execute(ExecuteContext<MarkAlbumAsRemovingArguments> executeContext)
+    {
+        var album = await database.Albums
+            .SingleOrDefaultAsync(p => p.Id == executeContext.Arguments.AlbumId, executeContext.CancellationToken);
+
+        if (album == null)
+        {
+            logger.LogInformation(
+                "Album {AlbumId} not found while marking as removing, skipping",
+                executeContext.Arguments.AlbumId);
+            return executeContext.Completed();
+        }
+
+        album.LifeCycleStatus = LifeCycleStatus.Removing;
+        await database.SaveChangesAsync(executeContext.CancellationToken);
+
+        logger.LogInformation("Marked album {AlbumId} as removing", album.Id);
+        return executeContext.Completed();
+    }
+}

backend/Core/Musify.Infrastructure/MassTransit/Activities/Files/DownloadFileFromBucketActivity.cs

@@ -23,7 +23,8 @@ internal class DownloadFileFromBucketActivity(
             using var fileStream = await storageHandler.GetFileAsync(
                 executeContext.Arguments.Bucket,
                 executeContext.Arguments.Key,
-                executeContext.CancellationToken);
+                executeContext.CancellationToken)
+                ?? throw new FileNotFoundException($"Object {executeContext.Arguments.Bucket}/{executeContext.Arguments.Key} was not found.");
 
             var destinationDirectory = Path.GetDirectoryName(destinationPath);
             if (!string.IsNullOrWhiteSpace(destinationDirectory))

backend/Core/Musify.Infrastructure/MassTransit/Arguments/DeleteAlbumFromDbArguments.cs

@@ -0,0 +1,4 @@
+namespace Musify.Infrastructure.MassTransit.Arguments;
+
+internal record DeleteAlbumFromDbArguments(
+    Guid AlbumId);

backend/Core/Musify.Infrastructure/MassTransit/Arguments/MarkAlbumAsRemovingArguments.cs

@@ -0,0 +1,4 @@
+namespace Musify.Infrastructure.MassTransit.Arguments;
+
+internal record MarkAlbumAsRemovingArguments(
+    Guid AlbumId);

backend/Core/Musify.Infrastructure/MassTransit/Consumers/DeleteAlbumConsumer.cs

@@ -0,0 +1,24 @@
+using MassTransit;
+using Musify.Application.Events;
+using Musify.Infrastructure.MassTransit.RoutingSlip.Builders;
+
+namespace Musify.Infrastructure.MassTransit.Consumers;
+
+public class DeleteAlbumConsumer(
+    IBus bus,
+    DeleteAlbumRoutingSlipBuilder routingSlipBuilder)
+    : IConsumer<DeleteAlbumEvent>
+{
+    public async Task Consume(ConsumeContext<DeleteAlbumEvent> consumeContext)
+    {
+        var routingSlip = (await routingSlipBuilder
+                .BuildAsync(
+                    consumeContext.Message.AlbumId,
+                    consumeContext.Message.UserId,
+                    consumeContext.CorrelationId,
+                    consumeContext.CancellationToken))
+            .Build();
+
+        await bus.Execute(routingSlip);
+    }
+}

backend/Core/Musify.Infrastructure/MassTransit/DependencyInjection/MassTransitDependencyInjection.Registration.cs

@@ -22,6 +22,7 @@ public static partial class MassTransitDependencyInjection
         services.AddScoped<PictureWorkflowRoutingSlipBuilder>();
         services.AddScoped<DeleteTrackRoutingSlipBuilder>();
         services.AddScoped<DeletePlayListRoutingSlipBuilder>();
+        services.AddScoped<DeleteAlbumRoutingSlipBuilder>();
         services.AddScoped<CreateTrackRoutingSlipBuilder>();
         services.AddScoped<PlayListPictureSourceRoutingSlipBuilder>();
         services.AddScoped<AlbumPictureSourceRoutingSlipBuilder>();
@@ -35,6 +36,7 @@ public static partial class MassTransitDependencyInjection
         options.AddConsumer<UpdateTrackAudioConsumer>();
         options.AddConsumer<DeleteTrackConsumer>();
         options.AddConsumer<DeletePlayListConsumer>();
+        options.AddConsumer<DeleteAlbumConsumer>();
         options.AddConsumer<CreateTrackConsumer>();
         options.AddConsumer<CreatePlayListConsumer>();
         options.AddConsumer<UpdatePlayListPictureSourceConsumer>();
@@ -58,6 +60,8 @@ public static partial class MassTransitDependencyInjection
         options.AddExecuteActivity<MarkTrackAsFailedActivity, MarkTrackAsFailedArguments>();
         options.AddExecuteActivity<MarkPlayListAsFailedActivity, MarkPlayListAsFailedArguments>();
         options.AddExecuteActivity<MarkAlbumAsFailedActivity, MarkAlbumAsFailedArguments>();
+        options.AddExecuteActivity<MarkAlbumAsRemovingActivity, MarkAlbumAsRemovingArguments>();
+        options.AddExecuteActivity<DeleteAlbumFromDbActivity, DeleteAlbumFromDbArguments>();
         options.AddExecuteActivity<PublishAlbumPictureProcessingEventActivity, PublishAlbumPictureProcessingEventArguments>();
 
         options.AddActivity<ResizePictureActivity, ResizePictureLocalArguments, ResizePictureLog>();

backend/Core/Musify.Infrastructure/MassTransit/Logs/UpdateAlbumPictureLog.cs

@@ -3,6 +3,6 @@ namespace Musify.Infrastructure.MassTransit.Logs;
 public record UpdateAlbumPictureLog(
     Guid AlbumId,
     string PreviousOriginalPictureKey,
-    string PreviousSmallPictureKey,
-    string PreviousMediumPictureKey,
-    string PreviousLargePictureKey);
+    string? PreviousSmallPictureKey,
+    string? PreviousMediumPictureKey,
+    string? PreviousLargePictureKey);

backend/Core/Musify.Infrastructure/MassTransit/Logs/UpdatePlayListPictureLog.cs

@@ -3,6 +3,6 @@ namespace Musify.Infrastructure.MassTransit.Logs;
 public record UpdatePlayListPictureLog(
     Guid PlayListId,
     string PreviousOriginalPictureKey,
-    string PreviousSmallPictureKey,
-    string PreviousMediumPictureKey,
-    string PreviousLargePictureKey);
+    string? PreviousSmallPictureKey,
+    string? PreviousMediumPictureKey,
+    string? PreviousLargePictureKey);

backend/Core/Musify.Infrastructure/MassTransit/RoutingSlip/ActivityNames.cs

@@ -9,6 +9,8 @@ internal static class ActivityNames
     internal const string MarkPlayListAsFailed = "MarkPlayListAsFailed";
     internal const string DeletePlayListFromDb = "DeletePlayListFromDb";
     internal const string MarkAlbumAsFailed = "MarkAlbumAsFailed";
+    internal const string MarkAlbumAsRemoving = "MarkAlbumAsRemoving";
+    internal const string DeleteAlbumFromDb = "DeleteAlbumFromDb";
 
     internal const string GenerateAudioWorkflowPaths = "GenerateAudioWorkflowPaths";
     internal const string GeneratePictureWorkflowPaths = "GeneratePictureWorkflowPaths";
@@ -55,4 +57,7 @@ internal static class ActivityNames
     internal const string RemovePlayListLargePicture = "RemovePlayListLargePicture";
 
     internal const string RemoveAlbumOriginalPicture = "RemoveAlbumOriginalPicture";
+    internal const string RemoveAlbumSmallPicture = "RemoveAlbumSmallPicture";
+    internal const string RemoveAlbumMediumPicture = "RemoveAlbumMediumPicture";
+    internal const string RemoveAlbumLargePicture = "RemoveAlbumLargePicture";
 }

backend/Core/Musify.Infrastructure/MassTransit/RoutingSlip/Builders/DeleteAlbumRoutingSlipBuilder.cs

@@ -0,0 +1,93 @@
+using MassTransit;
+using MassTransit.Courier.Contracts;
+using Microsoft.EntityFrameworkCore;
+using Musify.Application.Configuration;
+using Musify.Application.Contracts;
+using Musify.Infrastructure.MassTransit.Activities.Files;
+using Musify.Infrastructure.MassTransit.Activities.Albums;
+using Musify.Infrastructure.MassTransit.Arguments;
+using Musify.Infrastructure.MassTransit.Consumers;
+
+namespace Musify.Infrastructure.MassTransit.RoutingSlip.Builders;
+
+public class DeleteAlbumRoutingSlipBuilder(
+    IDatabase database,
+    AlbumConfiguration albumConfiguration,
+    ApplicationStorageConfiguration storageConfiguration)
+{
+    public async Task<RoutingSlipBuilder> BuildAsync(
+        Guid albumId,
+        long userId,
+        Guid? correlationId,
+        CancellationToken cancellationToken)
+    {
+        var routingSlipBuilder = new RoutingSlipBuilder(NewId.NextGuid());
+        routingSlipBuilder.AddVariable(RoutingSlipVariableNames.Workflow.CorrelationId, correlationId ?? Guid.Empty);
+
+        routingSlipBuilder.AddSubscription(
+            EndpointHelper.BuildConsumerUri(RoutingSlipCleanUpConsumer.QueueName),
+            RoutingSlipEvents.Completed | RoutingSlipEvents.Faulted);
+
+        var album = await database.Albums
+            .AsNoTracking()
+            .SingleOrDefaultAsync(p => p.Id == albumId, cancellationToken);
+
+        routingSlipBuilder.AddActivity(
+            ActivityNames.MarkAlbumAsRemoving,
+            EndpointHelper.BuildExecuteActivityUri(MarkAlbumAsRemovingActivity.ExecuteEndpointName),
+            new MarkAlbumAsRemovingArguments(albumId));
+
+        if (album?.Pictures != null)
+        {
+            var bucket = storageConfiguration.Bucket;
+            var routes = albumConfiguration.Routes;
+
+            if (album.Pictures.OriginalName is { } originalName)
+            {
+                routingSlipBuilder.AddActivity(
+                    ActivityNames.RemoveAlbumOriginalPicture,
+                    EndpointHelper.BuildExecuteActivityUri(RemoveFileFromBucketActivity.ExecuteEndpointName),
+                    new RemoveFileFromBucketArguments(
+                        bucket,
+                        routes.BuildOriginalPicturePath(userId, originalName)));
+            }
+
+            if (album.Pictures.SmallName is { } smallName)
+            {
+                routingSlipBuilder.AddActivity(
+                    ActivityNames.RemoveAlbumSmallPicture,
+                    EndpointHelper.BuildExecuteActivityUri(RemoveFileFromBucketActivity.ExecuteEndpointName),
+                    new RemoveFileFromBucketArguments(
+                        bucket,
+                        routes.BuildSmallPicturePath(smallName)));
+            }
+
+            if (album.Pictures.MediumName is { } mediumName)
+            {
+                routingSlipBuilder.AddActivity(
+                    ActivityNames.RemoveAlbumMediumPicture,
+                    EndpointHelper.BuildExecuteActivityUri(RemoveFileFromBucketActivity.ExecuteEndpointName),
+                    new RemoveFileFromBucketArguments(
+                        bucket,
+                        routes.BuildMediumPicturePath(mediumName)));
+            }
+
+            if (album.Pictures.LargeName is { } largeName)
+            {
+                routingSlipBuilder.AddActivity(
+                    ActivityNames.RemoveAlbumLargePicture,
+                    EndpointHelper.BuildExecuteActivityUri(RemoveFileFromBucketActivity.ExecuteEndpointName),
+                    new RemoveFileFromBucketArguments(
+                        bucket,
+                        routes.BuildLargePicturePath(largeName)));
+            }
+        }
+
+        routingSlipBuilder.AddActivity(
+            ActivityNames.DeleteAlbumFromDb,
+            EndpointHelper.BuildExecuteActivityUri(DeleteAlbumFromDbActivity.ExecuteEndpointName),
+            new DeleteAlbumFromDbArguments(albumId));
+
+        return routingSlipBuilder;
+    }
+}

backend/Core/Musify.Infrastructure/Persistence/Database.cs

@@ -1,3 +1,4 @@
+using ErrorOr;
 using MassTransit;
 using Microsoft.EntityFrameworkCore;
 using Microsoft.EntityFrameworkCore.Storage;
@@ -6,6 +7,7 @@ using Musify.Domain.Entities;
 using Musify.Domain.ValueObjects;
 using Musify.Infrastructure.Configuration;
 using Musify.Infrastructure.MassTransit.Sagas;
+using Npgsql;
 using AppIDatabase = Musify.Application.Contracts.IDatabase;
 
 namespace Musify.Infrastructure.Persistence;
@@ -82,9 +84,9 @@ public class Database(DatabaseConfiguration configuration)
             .OwnsOne(album => album.Pictures, pictures =>
             {
                 pictures.Property(p => p.OriginalName).HasColumnName("OriginalPictureName").HasMaxLength(64);
-                pictures.Property(p => p.SmallName).HasColumnName("SmallPictureName").HasMaxLength(64);
-                pictures.Property(p => p.MediumName).HasColumnName("MediumPictureName").HasMaxLength(64);
-                pictures.Property(p => p.LargeName).HasColumnName("LargePictureName").HasMaxLength(64);
+                pictures.Property(p => p.SmallName).HasColumnName("SmallPictureName").HasMaxLength(64).IsRequired(false);
+                pictures.Property(p => p.MediumName).HasColumnName("MediumPictureName").HasMaxLength(64).IsRequired(false);
+                pictures.Property(p => p.LargeName).HasColumnName("LargePictureName").HasMaxLength(64).IsRequired(false);
             });
         modelBuilder.Entity<Album>().Navigation(album => album.Pictures).IsRequired(false);
 
@@ -110,6 +112,10 @@ public class Database(DatabaseConfiguration configuration)
             .HasIndex(albumTrack => new { albumTrack.AlbumId, albumTrack.TrackId })
             .IsUnique();
 
+        modelBuilder.Entity<PlayListHasTrack>()
+            .HasIndex(playListTrack => new { playListTrack.PlayListId, playListTrack.TrackId })
+            .IsUnique();
+
         modelBuilder.Entity<Mix>()
             .HasIndex(mix => new { mix.UserId, mix.Position });
 
@@ -205,6 +211,19 @@ public class Database(DatabaseConfiguration configuration)
         return new DatabaseTransaction(transaction);
     }
 
+    public async Task<ErrorOr<Success>> TrySaveChangesAsync(Error onUniqueViolation, CancellationToken cancellationToken)
+    {
+        try
+        {
+            await SaveChangesAsync(cancellationToken);
+            return Result.Success;
+        }
+        catch (DbUpdateException exception) when (exception.InnerException is PostgresException { SqlState: PostgresErrorCodes.UniqueViolation })
+        {
+            return onUniqueViolation;
+        }
+    }
+
     private sealed class DatabaseTransaction(IDbContextTransaction inner) : IDatabaseTransaction
     {
         public Task CommitAsync(CancellationToken cancellationToken) =>

backend/Core/Musify.Infrastructure/Persistence/Migrations/20260924030938_PlayListTrackUnique.cs

@@ -0,0 +1,46 @@
+using Microsoft.EntityFrameworkCore.Migrations;
+
+#nullable disable
+
+namespace Musify.Infrastructure.Persistence.Migrations
+{
+    /// <inheritdoc />
+    public partial class PlayListTrackUnique : Migration
+    {
+        /// <inheritdoc />
+        protected override void Up(MigrationBuilder migrationBuilder)
+        {
+            // Remove duplicate rows (keeping the lowest position) before enforcing uniqueness.
+            migrationBuilder.Sql("""
+                DELETE FROM "PlayListHasTrack" a
+                USING "PlayListHasTrack" b
+                WHERE a."PlayListId" = b."PlayListId"
+                  AND a."TrackId" = b."TrackId"
+                  AND (a."Position", a."Id") > (b."Position", b."Id");
+                """);
+
+            migrationBuilder.DropIndex(
+                name: "IX_PlayListHasTrack_PlayListId",
+                table: "PlayListHasTrack");
+
+            migrationBuilder.CreateIndex(
+                name: "IX_PlayListHasTrack_PlayListId_TrackId",
+                table: "PlayListHasTrack",
+                columns: new[] { "PlayListId", "TrackId" },
+                unique: true);
+        }
+
+        /// <inheritdoc />
+        protected override void Down(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.DropIndex(
+                name: "IX_PlayListHasTrack_PlayListId_TrackId",
+                table: "PlayListHasTrack");
+
+            migrationBuilder.CreateIndex(
+                name: "IX_PlayListHasTrack_PlayListId",
+                table: "PlayListHasTrack",
+                column: "PlayListId");
+        }
+    }
+}

backend/Core/Musify.Infrastructure/Persistence/Migrations/DatabaseModelSnapshot.cs

@@ -417,10 +417,11 @@ namespace Musify.Infrastructure.Persistence.Migrations
 
                     b.HasKey("Id");
 
-                    b.HasIndex("PlayListId");
-
                     b.HasIndex("TrackId");
 
+                    b.HasIndex("PlayListId", "TrackId")
+                        .IsUnique();
+
                     b.ToTable("PlayListHasTrack");
                 });
 
@@ -790,13 +791,11 @@ namespace Musify.Infrastructure.Persistence.Migrations
                                 .HasColumnType("uuid");
 
                             b1.Property<string>("LargeName")
-                                .IsRequired()
                                 .HasMaxLength(64)
                                 .HasColumnType("character varying(64)")
                                 .HasColumnName("LargePictureName");
 
                             b1.Property<string>("MediumName")
-                                .IsRequired()
                                 .HasMaxLength(64)
                                 .HasColumnType("character varying(64)")
                                 .HasColumnName("MediumPictureName");
@@ -808,7 +807,6 @@ namespace Musify.Infrastructure.Persistence.Migrations
                                 .HasColumnName("OriginalPictureName");
 
                             b1.Property<string>("SmallName")
-                                .IsRequired()
                                 .HasMaxLength(64)
                                 .HasColumnType("character varying(64)")
                                 .HasColumnName("SmallPictureName");

backend/Core/Musify.Infrastructure/Services/StorageService.cs

@@ -15,7 +15,7 @@ public class StorageService(IDatabase database, IAmazonS3 amazonS3, ILogger<Stor
     InfrastructureStorageConfiguration storageClientConfiguration)
     : IStorageService
 {
-    public async Task<Stream> GetFileAsync(string bucket, string key, CancellationToken cancellationToken)
+    public async Task<Stream?> GetFileAsync(string bucket, string key, CancellationToken cancellationToken)
     {
         var request = new GetObjectRequest
         {
@@ -29,6 +29,11 @@ public class StorageService(IDatabase database, IAmazonS3 amazonS3, ILogger<Stor
             logger.LogDebug("Retrieved file from S3 {Bucket}/{Key}", bucket, key);
             return response.ResponseStream;
         }
+        catch (AmazonS3Exception exception) when (exception.ErrorCode == "NoSuchKey")
+        {
+            logger.LogDebug("File not found in S3 {Bucket}/{Key}", bucket, key);
+            return null;
+        }
         catch (Exception exception)
         {
             logger.LogError(exception, "Failed to get file from S3 {Bucket}/{Key}", bucket, key);

backend/Hosts/Musify.Api/Endpoints/AlbumEndpoints.cs

@@ -6,6 +6,7 @@ using Musify.Api.Filters;
 using Musify.Application.Albums;
 using Musify.Application.Albums.Responses;
 using Musify.Application.Contracts;
+using Musify.Api.Models;
 using Musify.Application.Shared;
 using Musify.Application.Tracks.Responses;
 
@@ -13,12 +14,15 @@ namespace Musify.Api.Endpoints;
 
 public static class AlbumEndpoints
 {
+    private const int MaxRecentAlbumsLimit = 50;
+
     public static IEndpointRouteBuilder MapAlbumEndpoints(this IEndpointRouteBuilder app)
     {
         var group = app.MapGroup("/albums")
             .WithTags("Albums");
 
         group.MapGet("/", GetAlbums)
+            .AddEndpointFilter<ValidationFilter<PageQuery>>()
             .WithName("GetAlbums")
             .WithSummary("Get Paginated Albums, Optionally Filtered By Title.")
             .Produces<AlbumsSearchResponse>();
@@ -30,6 +34,7 @@ public static class AlbumEndpoints
             .Produces(StatusCodes.Status404NotFound);
 
         group.MapGet("/users/{userId}", GetAlbumsByUserId)
+            .AddEndpointFilter<ValidationFilter<PageQuery>>()
             .WithName("GetAlbumsByUserId")
             .WithSummary("Get Paginated Albums For A User.")
             .Produces<PaginatedResponse<AlbumApplicationResponse>>()
@@ -43,6 +48,7 @@ public static class AlbumEndpoints
             .Produces(StatusCodes.Status401Unauthorized);
 
         group.MapGet("/{albumId}/tracks", GetAlbumTracks)
+            .AddEndpointFilter<ValidationFilter<PageQuery>>()
             .WithName("GetAlbumTracks")
             .WithSummary("Get The Tracks Of An Album Ordered By Track Number.")
             .Produces<PaginatedResponse<TrackApplicationResponse>>()
@@ -82,6 +88,7 @@ public static class AlbumEndpoints
             .Produces<AlbumApplicationResponse>()
             .ProducesValidationProblem()
             .Produces(StatusCodes.Status401Unauthorized)
+            .Produces(StatusCodes.Status403Forbidden)
             .Produces(StatusCodes.Status404NotFound);
 
         group.MapDelete("/{albumId}", DeleteAlbum)
@@ -90,6 +97,7 @@ public static class AlbumEndpoints
             .RequireAuthorization()
             .Produces(StatusCodes.Status204NoContent)
             .Produces(StatusCodes.Status401Unauthorized)
+            .Produces(StatusCodes.Status403Forbidden)
             .Produces(StatusCodes.Status404NotFound);
 
         group.MapPost("/{albumId}/tracks/{trackId}", AddTrackToAlbum)
@@ -98,6 +106,7 @@ public static class AlbumEndpoints
             .RequireAuthorization()
             .Produces(StatusCodes.Status204NoContent)
             .Produces(StatusCodes.Status401Unauthorized)
+            .Produces(StatusCodes.Status403Forbidden)
             .Produces(StatusCodes.Status404NotFound)
             .Produces(StatusCodes.Status409Conflict);
 
@@ -107,6 +116,7 @@ public static class AlbumEndpoints
             .RequireAuthorization()
             .Produces(StatusCodes.Status204NoContent)
             .Produces(StatusCodes.Status401Unauthorized)
+            .Produces(StatusCodes.Status403Forbidden)
             .Produces(StatusCodes.Status404NotFound);
 
         return app;
@@ -116,10 +126,9 @@ public static class AlbumEndpoints
         IMediator mediator,
         CancellationToken cancellationToken,
         string? title,
-        int pageNumber = 1,
-        int pageSize = 10)
+        [AsParameters] PageQuery page)
     {
-        var result = await mediator.Send(new GetAlbumsQuery(title, pageNumber, pageSize), cancellationToken);
+        var result = await mediator.Send(new GetAlbumsQuery(title, page.PageNumber, page.PageSize), cancellationToken);
         return result.ToHttpResult();
     }
 
@@ -136,10 +145,9 @@ public static class AlbumEndpoints
         IMediator mediator,
         long userId,
         CancellationToken cancellationToken,
-        int pageNumber = 1,
-        int pageSize = 10)
+        [AsParameters] PageQuery page)
     {
-        var result = await mediator.Send(new GetAlbumsByUserIdQuery(userId, pageNumber, pageSize), cancellationToken);
+        var result = await mediator.Send(new GetAlbumsByUserIdQuery(userId, page.PageNumber, page.PageSize), cancellationToken);
         return result.ToHttpResult();
     }
 
@@ -149,6 +157,14 @@ public static class AlbumEndpoints
         CancellationToken cancellationToken,
         int limit = 12)
     {
+        if (limit is < 1 or > MaxRecentAlbumsLimit)
+        {
+            return Results.ValidationProblem(new Dictionary<string, string[]>
+            {
+                [nameof(limit)] = [$"'{nameof(limit)}' must be between 1 and {MaxRecentAlbumsLimit}."]
+            });
+        }
+
         var result = await mediator.Send(new GetRecentlyListenedAlbumsQuery(currentUser.RequiredId, limit), cancellationToken);
         return result.ToHttpResult();
     }
@@ -157,10 +173,9 @@ public static class AlbumEndpoints
         IMediator mediator,
         Guid albumId,
         CancellationToken cancellationToken,
-        int pageNumber = 1,
-        int pageSize = 50)
+        [AsParameters] PageQuery page)
     {
-        var result = await mediator.Send(new GetAlbumTracksQuery(albumId, pageNumber, pageSize), cancellationToken);
+        var result = await mediator.Send(new GetAlbumTracksQuery(albumId, page.PageNumber, page.PageSize), cancellationToken);
         return result.ToHttpResult();
     }
 
@@ -178,6 +193,9 @@ public static class AlbumEndpoints
 
         var location = result.Value;
         var stream = await storageService.GetFileAsync(location.Bucket, location.Key, cancellationToken);
+        if (stream == null)
+            return Results.NotFound();
+
         response.Headers.CacheControl = "public, max-age=31536000, immutable";
         return Results.Stream(stream, location.ContentType);
     }

backend/Hosts/Musify.Api/Endpoints/LikeEndpoints.cs

@@ -3,8 +3,10 @@ using Musify.Api.Authentication;
 using Musify.Api.DataTransferObjects.Likes;
 using Musify.Api.Extensions;
 using Musify.Application.Likes;
+using Musify.Api.Models;
 using Musify.Application.Shared;
 using Musify.Application.Tracks.Responses;
+using Musify.Api.Filters;
 
 namespace Musify.Api.Endpoints;
 
@@ -17,6 +19,7 @@ public static class LikeEndpoints
             .RequireAuthorization();
 
         group.MapGet("/", GetLikedTracks)
+            .AddEndpointFilter<ValidationFilter<PageQuery>>()
             .WithName("GetLikedTracks")
             .WithSummary("Get The Current User'S Liked Tracks.")
             .Produces<PaginatedResponse<TrackApplicationResponse>>()
@@ -36,10 +39,9 @@ public static class LikeEndpoints
         IMediator mediator,
         CurrentUser currentUser,
         CancellationToken cancellationToken,
-        int pageNumber = 1,
-        int pageSize = 10)
+        [AsParameters] PageQuery page)
     {
-        var result = await mediator.Send(new GetLikedTracksQuery(currentUser.RequiredId, pageNumber, pageSize), cancellationToken);
+        var result = await mediator.Send(new GetLikedTracksQuery(currentUser.RequiredId, page.PageNumber, page.PageSize), cancellationToken);
         return result.ToHttpResult();
     }
 

backend/Hosts/Musify.Api/Endpoints/PlayListEndpoints.cs

@@ -6,6 +6,7 @@ using Musify.Api.Filters;
 using Musify.Application.Contracts;
 using Musify.Application.PlayLists;
 using Musify.Application.PlayLists.Responses;
+using Musify.Api.Models;
 using Musify.Application.Shared;
 using Musify.Application.Tracks;
 using Musify.Application.Tracks.Responses;
@@ -26,11 +27,13 @@ public static class PlayListEndpoints
             .Produces(StatusCodes.Status404NotFound);
 
         group.MapGet("/users/{userId}", GetPlayListsByUserId)
+            .AddEndpointFilter<ValidationFilter<PageQuery>>()
             .WithName("GetPlayListsByUserId")
             .WithSummary("Get Paginated PlayLists For A User. Private PlayLists Are Only Returned To Their Owner.")
             .Produces<PaginatedResponse<PlayListApplicationResponse>>();
 
         group.MapGet("/{playlistId}/tracks", GetPlayListTracks)
+            .AddEndpointFilter<ValidationFilter<PageQuery>>()
             .WithName("GetPlayListTracks")
             .WithSummary("Get Paginated Tracks Of A PlayList.")
             .Produces<PaginatedResponse<TrackApplicationResponse>>()
@@ -60,6 +63,7 @@ public static class PlayListEndpoints
             .Produces<PlayListApplicationResponse>()
             .ProducesValidationProblem()
             .Produces(StatusCodes.Status401Unauthorized)
+            .Produces(StatusCodes.Status403Forbidden)
             .Produces(StatusCodes.Status404NotFound);
 
         group.MapDelete("/{playlistId}", DeletePlayList)
@@ -68,6 +72,7 @@ public static class PlayListEndpoints
             .RequireAuthorization()
             .Produces(StatusCodes.Status204NoContent)
             .Produces(StatusCodes.Status401Unauthorized)
+            .Produces(StatusCodes.Status403Forbidden)
             .Produces(StatusCodes.Status404NotFound);
 
         group.MapPost("/upload-picture", RequestPlayListPictureUpload)
@@ -86,6 +91,7 @@ public static class PlayListEndpoints
             .RequireAuthorization()
             .Produces<TrackApplicationResponse>(StatusCodes.Status201Created)
             .Produces(StatusCodes.Status401Unauthorized)
+            .Produces(StatusCodes.Status403Forbidden)
             .Produces(StatusCodes.Status404NotFound)
             .Produces(StatusCodes.Status409Conflict);
 
@@ -95,6 +101,7 @@ public static class PlayListEndpoints
             .RequireAuthorization()
             .Produces(StatusCodes.Status204NoContent)
             .Produces(StatusCodes.Status401Unauthorized)
+            .Produces(StatusCodes.Status403Forbidden)
             .Produces(StatusCodes.Status404NotFound);
 
         return app;
@@ -116,10 +123,9 @@ public static class PlayListEndpoints
         long userId,
         CancellationToken cancellationToken,
         string? name,
-        int pageNumber = 1,
-        int pageSize = 10)
+        [AsParameters] PageQuery page)
     {
-        var result = await mediator.Send(new GetPlayListsByUserIdQuery(userId, name, pageNumber, pageSize, currentUser.Id), cancellationToken);
+        var result = await mediator.Send(new GetPlayListsByUserIdQuery(userId, name, page.PageNumber, page.PageSize, currentUser.Id), cancellationToken);
         return result.ToHttpResult();
     }
 
@@ -128,10 +134,9 @@ public static class PlayListEndpoints
         CurrentUser currentUser,
         Guid playlistId,
         CancellationToken cancellationToken,
-        int pageNumber = 1,
-        int pageSize = 10)
+        [AsParameters] PageQuery page)
     {
-        var result = await mediator.Send(new GetPlayListTracksQuery(playlistId, pageNumber, pageSize, currentUser.Id), cancellationToken);
+        var result = await mediator.Send(new GetPlayListTracksQuery(playlistId, page.PageNumber, page.PageSize, currentUser.Id), cancellationToken);
         return result.ToHttpResult();
     }
 
@@ -149,6 +154,9 @@ public static class PlayListEndpoints
 
         var location = result.Value;
         var stream = await storageService.GetFileAsync(location.Bucket, location.Key, cancellationToken);
+        if (stream == null)
+            return Results.NotFound();
+
         response.Headers.CacheControl = "public, max-age=31536000, immutable";
         return Results.Stream(stream, location.ContentType);
     }

backend/Hosts/Musify.Api/Endpoints/TrackEndpoints.cs

@@ -4,6 +4,7 @@ using Musify.Api.DataTransferObjects.Tracks;
 using Musify.Api.Extensions;
 using Musify.Api.Filters;
 using Musify.Application.Contracts;
+using Musify.Api.Models;
 using Musify.Application.Shared;
 using Musify.Application.Tracks;
 using Musify.Application.Tracks.Responses;
@@ -19,6 +20,7 @@ public static class TrackEndpoints
             .WithTags("Tracks");
 
         group.MapGet("/", GetTracks)
+            .AddEndpointFilter<ValidationFilter<PageQuery>>()
             .WithName("GetTracks")
             .WithSummary("Get Paginated Tracks, Optionally Filtered By Name And Genre.")
             .Produces<TracksSearchResponse>()
@@ -52,6 +54,7 @@ public static class TrackEndpoints
             .Produces(StatusCodes.Status404NotFound);
 
         group.MapGet("/users/{userId}", GetTracksByUserId)
+            .AddEndpointFilter<ValidationFilter<PageQuery>>()
             .WithName("GetTracksByUserId")
             .WithSummary("Get Paginated Tracks For A User.")
             .Produces<PaginatedResponse<TrackApplicationResponse>>();
@@ -73,6 +76,7 @@ public static class TrackEndpoints
             .RequireAuthorization()
             .Produces(StatusCodes.Status204NoContent)
             .Produces(StatusCodes.Status401Unauthorized)
+            .Produces(StatusCodes.Status403Forbidden)
             .Produces(StatusCodes.Status404NotFound)
             .Produces(StatusCodes.Status409Conflict);
 
@@ -95,8 +99,7 @@ public static class TrackEndpoints
         CancellationToken cancellationToken,
         string? name,
         string? genre,
-        int pageNumber = 1,
-        int pageSize = 10)
+        [AsParameters] PageQuery page)
     {
         Genre? parsedGenre = null;
         if (!string.IsNullOrWhiteSpace(genre))
@@ -112,7 +115,7 @@ public static class TrackEndpoints
             parsedGenre = value;
         }
 
-        var result = await mediator.Send(new GetTracksQuery(name, pageNumber, pageSize, parsedGenre), cancellationToken);
+        var result = await mediator.Send(new GetTracksQuery(name, page.PageNumber, page.PageSize, parsedGenre), cancellationToken);
         return result.ToHttpResult();
     }
 
@@ -139,6 +142,9 @@ public static class TrackEndpoints
 
         var location = result.Value;
         var stream = await storageService.GetFileAsync(location.Bucket, location.Key, cancellationToken);
+        if (stream == null)
+            return Results.NotFound();
+
         response.Headers.CacheControl = "public, max-age=31536000, immutable";
         return Results.Stream(stream, location.ContentType);
     }
@@ -171,10 +177,9 @@ public static class TrackEndpoints
         long userId,
         CancellationToken cancellationToken,
         string? name,
-        int pageNumber = 1,
-        int pageSize = 10)
+        [AsParameters] PageQuery page)
     {
-        var result = await mediator.Send(new GetTracksByUserIdQuery(userId, name, pageNumber, pageSize), cancellationToken);
+        var result = await mediator.Send(new GetTracksByUserIdQuery(userId, name, page.PageNumber, page.PageSize), cancellationToken);
         return result.ToHttpResult();
     }
 

backend/Hosts/Musify.Api/Endpoints/UserEndpoints.cs

@@ -1,11 +1,13 @@
 using Mediator;
 using Musify.Api.Authentication;
 using Musify.Api.Extensions;
+using Musify.Api.Models;
 using Musify.Application.Shared;
 using Musify.Application.Tracks;
 using Musify.Application.Tracks.Responses;
 using Musify.Application.Users;
 using Musify.Application.Users.Responses;
+using Musify.Api.Filters;
 
 namespace Musify.Api.Endpoints;
 
@@ -17,6 +19,7 @@ public static class UserEndpoints
             .WithTags("Users");
 
         group.MapGet("/", GetUsers)
+            .AddEndpointFilter<ValidationFilter<PageQuery>>()
             .WithName("GetUsers")
             .WithSummary("Get Paginated Users.")
             .Produces<PaginatedResponse<UserSummaryResponse>>();
@@ -45,7 +48,7 @@ public static class UserEndpoints
             .WithName("GetLastTrackListenedByUserId")
             .WithSummary("Get The Last Track A User Listened To.")
             .Produces<TrackApplicationResponse>()
-            .Produces(StatusCodes.Status404NotFound);
+            .Produces(StatusCodes.Status204NoContent);
 
         group.MapGet("/{id}/profile", GetUserProfile)
             .WithName("GetUserProfile")
@@ -54,6 +57,7 @@ public static class UserEndpoints
             .Produces(StatusCodes.Status404NotFound);
 
         group.MapGet("/{id}/followers", GetFollowers)
+            .AddEndpointFilter<ValidationFilter<PageQuery>>()
             .WithName("GetUserFollowers")
             .WithSummary("Get The Users Following A User. Visible To The User And To Mutual Followers.")
             .Produces<PaginatedResponse<UserSummaryResponse>>()
@@ -61,6 +65,7 @@ public static class UserEndpoints
             .Produces(StatusCodes.Status404NotFound);
 
         group.MapGet("/{id}/following", GetFollowing)
+            .AddEndpointFilter<ValidationFilter<PageQuery>>()
             .WithName("GetUserFollowing")
             .WithSummary("Get The Users A User Follows.")
             .Produces<PaginatedResponse<UserSummaryResponse>>()
@@ -97,10 +102,9 @@ public static class UserEndpoints
         CurrentUser currentUser,
         CancellationToken cancellationToken,
         string? usernameSearch,
-        int pageNumber = 1,
-        int pageSize = 10)
+        [AsParameters] PageQuery page)
     {
-        var result = await mediator.Send(new GetUsersQuery(pageNumber, pageSize, usernameSearch, currentUser.Id), cancellationToken);
+        var result = await mediator.Send(new GetUsersQuery(page.PageNumber, page.PageSize, usernameSearch, currentUser.Id), cancellationToken);
         return result.ToHttpResult();
     }
 
@@ -138,8 +142,8 @@ public static class UserEndpoints
         long id,
         CancellationToken cancellationToken)
     {
-        var result = await mediator.Send(new GetLastTrackListenedByUserIdQuery(id), cancellationToken);
-        return result.ToHttpResult();
+        var track = await mediator.Send(new GetLastTrackListenedByUserIdQuery(id), cancellationToken);
+        return track == null ? Results.NoContent() : Results.Ok(track);
     }
 
     private static async Task<IResult> GetUserProfile(
@@ -157,10 +161,9 @@ public static class UserEndpoints
         CurrentUser currentUser,
         long id,
         CancellationToken cancellationToken,
-        int pageNumber = 1,
-        int pageSize = 20)
+        [AsParameters] PageQuery page)
     {
-        var result = await mediator.Send(new GetUserFollowersQuery(currentUser.Id, id, pageNumber, pageSize), cancellationToken);
+        var result = await mediator.Send(new GetUserFollowersQuery(currentUser.Id, id, page.PageNumber, page.PageSize), cancellationToken);
         return result.ToHttpResult();
     }
 
@@ -169,10 +172,9 @@ public static class UserEndpoints
         CurrentUser currentUser,
         long id,
         CancellationToken cancellationToken,
-        int pageNumber = 1,
-        int pageSize = 20)
+        [AsParameters] PageQuery page)
     {
-        var result = await mediator.Send(new GetUserFollowingQuery(currentUser.Id, id, pageNumber, pageSize), cancellationToken);
+        var result = await mediator.Send(new GetUserFollowingQuery(currentUser.Id, id, page.PageNumber, page.PageSize), cancellationToken);
         return result.ToHttpResult();
     }
 

backend/Hosts/Musify.Api/Extensions/ErrorOrHttpExtensions.cs

@@ -28,10 +28,10 @@ public static class ErrorOrHttpExtensions
         var error = errors[0];
         return error.Type switch
         {
-            ErrorType.NotFound => Results.NotFound(error.Description),
+            ErrorType.NotFound => Results.Problem(error.Description, statusCode: StatusCodes.Status404NotFound),
             ErrorType.Unauthorized => Results.Unauthorized(),
-            ErrorType.Forbidden => Results.StatusCode(StatusCodes.Status403Forbidden),
-            ErrorType.Conflict => Results.Conflict(error.Description),
+            ErrorType.Forbidden => Results.Problem(error.Description, statusCode: StatusCodes.Status403Forbidden),
+            ErrorType.Conflict => Results.Problem(error.Description, statusCode: StatusCodes.Status409Conflict),
             _ => Results.Problem(error.Description)
         };
     }

backend/Hosts/Musify.Api/Models/PageQuery.cs

@@ -0,0 +1,9 @@
+using Microsoft.AspNetCore.Mvc;
+using Musify.Application.Shared;
+
+namespace Musify.Api.Models;
+
+/// <summary>Query-string binding for <see cref="PageRequest"/>, keeping the camelCase parameter names of the API.</summary>
+public record PageQuery(
+    [property: FromQuery(Name = "pageNumber")] int PageNumber = 1,
+    [property: FromQuery(Name = "pageSize")] int PageSize = 20);

backend/Hosts/Musify.Api/Validators/PageQueryValidator.cs

@@ -0,0 +1,17 @@
+using FluentValidation;
+using Musify.Api.Models;
+using Musify.Application.Shared;
+
+namespace Musify.Api.Validators;
+
+public sealed class PageQueryValidator : AbstractValidator<PageQuery>
+{
+    public PageQueryValidator()
+    {
+        RuleFor(x => x.PageNumber)
+            .GreaterThanOrEqualTo(1);
+
+        RuleFor(x => x.PageSize)
+            .InclusiveBetween(1, PageRequest.MaxPageSize);
+    }
+}

backend/Hosts/Musify.Api/Validators/PlayLists/CreatePlayListRequestValidator.cs

@@ -13,5 +13,8 @@ public sealed class CreatePlayListRequestValidator : AbstractValidator<CreatePla
 
         RuleFor(x => x.Description)
             .MaximumLength(256);
+
+        RuleFor(x => x.Visibility)
+            .IsInEnum();
     }
 }

backend/Hosts/Musify.Api/Validators/PlayLists/UpdatePlayListRequestValidator.cs

@@ -15,5 +15,9 @@ public sealed class UpdatePlayListRequestValidator : AbstractValidator<UpdatePla
         RuleFor(x => x.NewDescription)
             .MaximumLength(256)
             .When(x => x.NewDescription != null);
+
+        RuleFor(x => x.NewVisibility)
+            .IsInEnum()
+            .When(x => x.NewVisibility != null);
     }
 }

backend/Tests/Musify.Api.Tests/Endpoints/AlbumEndpointsTests.cs

@@ -95,7 +95,7 @@ public sealed class AlbumEndpointsTests(ApiTestFixture fixture)
     }
 
     [Fact]
-    public async Task DeleteAlbum_NotTheOwner_ReturnsUnauthorized()
+    public async Task DeleteAlbum_NotTheOwner_ReturnsForbidden()
     {
         var owner = await CreateUserAsync();
         var stranger = await CreateUserAsync();
@@ -106,7 +106,7 @@ public sealed class AlbumEndpointsTests(ApiTestFixture fixture)
 
         var response = await fixture.CreateAuthenticatedClient(stranger).DeleteAsync($"/albums/{created!.Id}", TestContext.Current.CancellationToken);
 
-        Assert.Equal(HttpStatusCode.Unauthorized, response.StatusCode);
+        Assert.Equal(HttpStatusCode.Forbidden, response.StatusCode);
     }
 
     [Fact]

backend/Tests/Musify.Api.Tests/Endpoints/UserEndpointsTests.cs

@@ -38,7 +38,8 @@ public sealed class UserEndpointsTests(ApiTestFixture fixture)
         {
             UserId = userId,
             TrackId = track.Id,
-            ListenedAt = listenedAt
+            ListenedAt = listenedAt,
+            IsCounted = true
         });
         await database.SaveChangesAsync(TestContext.Current.CancellationToken);
     }
@@ -94,7 +95,7 @@ public sealed class UserEndpointsTests(ApiTestFixture fixture)
     }
 
     [Fact]
-    public async Task GetLastTrackListenedByUserId_NoHistory_ReturnsNotFound()
+    public async Task GetLastTrackListenedByUserId_NoHistory_ReturnsNoContent()
     {
         var client = fixture.CreateAnonymousClient();
         var userId = Random.Shared.NextInt64(1, long.MaxValue);
@@ -102,6 +103,39 @@ public sealed class UserEndpointsTests(ApiTestFixture fixture)
 
         var response = await client.GetAsync($"/users/{userId}/last-listened-track", TestContext.Current.CancellationToken);
 
-        Assert.Equal(HttpStatusCode.NotFound, response.StatusCode);
+        Assert.Equal(HttpStatusCode.NoContent, response.StatusCode);
+    }
+
+    [Theory]
+    [InlineData("pageSize=0")]
+    [InlineData("pageSize=101")]
+    [InlineData("pageNumber=0")]
+    public async Task GetUsers_InvalidPaging_ReturnsBadRequest(string query)
+    {
+        var client = fixture.CreateAnonymousClient();
+
+        var response = await client.GetAsync($"/users?{query}", TestContext.Current.CancellationToken);
+
+        Assert.Equal(HttpStatusCode.BadRequest, response.StatusCode);
+    }
+
+    [Fact]
+    public async Task GetListeningStats_AnotherUser_ReturnsForbidden()
+    {
+        var userId = await fixture.SeedUserAsync();
+        var other = await fixture.SeedUserAsync();
+        var client = fixture.CreateAuthenticatedClient(userId);
+
+        var response = await client.GetAsync($"/users/{other}/listening-stats", TestContext.Current.CancellationToken);
+
+        Assert.Equal(HttpStatusCode.Forbidden, response.StatusCode);
+    }
+
+    [Fact]
+    public async Task GetListeningStats_Anonymous_ReturnsUnauthorized()
+    {
+        var response = await fixture.CreateAnonymousClient().GetAsync("/users/1/listening-stats", TestContext.Current.CancellationToken);
+
+        Assert.Equal(HttpStatusCode.Unauthorized, response.StatusCode);
     }
 }

backend/Tests/Musify.Application.Tests/Albums/AddTrackToAlbumCommandHandlerTests.cs

@@ -39,7 +39,7 @@ public sealed class AddTrackToAlbumCommandHandlerTests : HandlerTestBase
     }
 
     [Fact]
-    public async Task Handle_NotOwner_ReturnsUnauthorized()
+    public async Task Handle_NotOwner_ReturnsForbidden()
     {
         var owner = TestEntities.User(1, "owner");
         var stranger = TestEntities.User(2, "stranger");
@@ -49,7 +49,7 @@ public sealed class AddTrackToAlbumCommandHandlerTests : HandlerTestBase
 
         var result = await CreateHandler().Handle(new AddTrackToAlbumCommand(stranger.Id, album.Id, track.Id), TestContext.Current.CancellationToken);
 
-        Assert.Equal(ErrorType.Unauthorized, result.FirstError.Type);
+        Assert.Equal(ErrorType.Forbidden, result.FirstError.Type);
     }
 
     [Fact]
@@ -65,7 +65,7 @@ public sealed class AddTrackToAlbumCommandHandlerTests : HandlerTestBase
     }
 
     [Fact]
-    public async Task Handle_TrackOwnedByAnotherUser_ReturnsUnauthorized()
+    public async Task Handle_TrackOwnedByAnotherUser_ReturnsForbidden()
     {
         var owner = TestEntities.User(1, "owner");
         var otherOwner = TestEntities.User(2, "other");
@@ -75,7 +75,7 @@ public sealed class AddTrackToAlbumCommandHandlerTests : HandlerTestBase
 
         var result = await CreateHandler().Handle(new AddTrackToAlbumCommand(owner.Id, album.Id, foreignTrack.Id), TestContext.Current.CancellationToken);
 
-        Assert.Equal(ErrorType.Unauthorized, result.FirstError.Type);
+        Assert.Equal(ErrorType.Forbidden, result.FirstError.Type);
     }
 
     [Fact]

backend/Tests/Musify.Application.Tests/Albums/DeleteAlbumCommandHandlerTests.cs

@@ -1,16 +1,21 @@
 using ErrorOr;
 using Musify.Application.Albums;
+using Musify.Application.Contracts;
 using Musify.Application.Tests.TestSupport;
+using Musify.Domain.ValueObjects;
+using NSubstitute;
 using Xunit;
 
 namespace Musify.Application.Tests.Albums;
 
 public sealed class DeleteAlbumCommandHandlerTests : HandlerTestBase
 {
-    private DeleteAlbumCommandHandler CreateHandler() => new(Database, NoOpLogger<DeleteAlbumCommandHandler>());
+    private readonly IEventBus eventBus = Substitute.For<IEventBus>();
+
+    private DeleteAlbumCommandHandler CreateHandler() => new(Database, eventBus, NoOpLogger<DeleteAlbumCommandHandler>());
 
     [Fact]
-    public async Task Handle_Owner_RemovesAlbum()
+    public async Task Handle_Owner_MarksAlbumAsRemoving()
     {
         var owner = TestEntities.User();
         var album = TestEntities.Album(owner.Id);
@@ -19,7 +24,10 @@ public sealed class DeleteAlbumCommandHandlerTests : HandlerTestBase
         var result = await CreateHandler().Handle(new DeleteAlbumCommand(owner.Id, album.Id), TestContext.Current.CancellationToken);
 
         Assert.False(result.IsError);
-        Assert.Null(await Database.Albums.FindAsync([album.Id], TestContext.Current.CancellationToken));
+        var stored = await Database.Albums.FindAsync([album.Id], TestContext.Current.CancellationToken);
+        Assert.NotNull(stored);
+        Assert.Equal(LifeCycleStatus.Removing, stored.LifeCycleStatus);
+        await eventBus.Received(1).PublishAsync(Arg.Any<Musify.Application.Events.DeleteAlbumEvent>(), Arg.Any<CancellationToken>());
     }
 
     [Fact]
@@ -31,7 +39,7 @@ public sealed class DeleteAlbumCommandHandlerTests : HandlerTestBase
     }
 
     [Fact]
-    public async Task Handle_NotOwner_ReturnsUnauthorizedAndKeepsAlbum()
+    public async Task Handle_NotOwner_ReturnsForbiddenAndKeepsAlbum()
     {
         var owner = TestEntities.User(1, "owner");
         var stranger = TestEntities.User(2, "stranger");
@@ -40,7 +48,7 @@ public sealed class DeleteAlbumCommandHandlerTests : HandlerTestBase
 
         var result = await CreateHandler().Handle(new DeleteAlbumCommand(stranger.Id, album.Id), TestContext.Current.CancellationToken);
 
-        Assert.Equal(ErrorType.Unauthorized, result.FirstError.Type);
+        Assert.Equal(ErrorType.Forbidden, result.FirstError.Type);
         Assert.NotNull(await Database.Albums.FindAsync([album.Id], TestContext.Current.CancellationToken));
     }
 }

backend/Tests/Musify.Application.Tests/Albums/GetAlbumCoverQueryHandlerTests.cs

@@ -34,4 +34,19 @@ public sealed class GetAlbumCoverQueryHandlerTests : HandlerTestBase
 
         Assert.Equal(ErrorType.NotFound, result.FirstError.Type);
     }
+
+    [Fact]
+    public async Task Handle_PicturesStillProcessing_FallsBackToTheOriginal()
+    {
+        var owner = TestEntities.User();
+        var album = TestEntities.Album(owner.Id, pictures: Musify.Domain.ValueObjects.AlbumPictures.Pending("original.png"));
+        await SeedAsync(owner, album);
+
+        var result = await CreateHandler().Handle(new GetAlbumCoverQuery(album.Id, "small"), TestContext.Current.CancellationToken);
+
+        Assert.False(result.IsError);
+        Assert.Contains($"{owner.Id}", result.Value.Key);
+        Assert.EndsWith("original.png", result.Value.Key);
+        Assert.Equal("image/png", result.Value.ContentType);
+    }
 }

backend/Tests/Musify.Application.Tests/Albums/RemoveTrackFromAlbumCommandHandlerTests.cs

@@ -46,7 +46,7 @@ public sealed class RemoveTrackFromAlbumCommandHandlerTests : HandlerTestBase
     }
 
     [Fact]
-    public async Task Handle_NotOwner_ReturnsUnauthorized()
+    public async Task Handle_NotOwner_ReturnsForbidden()
     {
         var owner = TestEntities.User(1, "owner");
         var stranger = TestEntities.User(2, "stranger");
@@ -55,7 +55,7 @@ public sealed class RemoveTrackFromAlbumCommandHandlerTests : HandlerTestBase
 
         var result = await CreateHandler().Handle(new RemoveTrackFromAlbumCommand(stranger.Id, album.Id, Guid.NewGuid()), TestContext.Current.CancellationToken);
 
-        Assert.Equal(ErrorType.Unauthorized, result.FirstError.Type);
+        Assert.Equal(ErrorType.Forbidden, result.FirstError.Type);
     }
 
     [Fact]

backend/Tests/Musify.Application.Tests/Albums/UpdateAlbumCommandHandlerTests.cs

@@ -77,7 +77,7 @@ public sealed class UpdateAlbumCommandHandlerTests : HandlerTestBase
     }
 
     [Fact]
-    public async Task Handle_NotOwner_ReturnsUnauthorized()
+    public async Task Handle_NotOwner_ReturnsForbidden()
     {
         var owner = TestEntities.User(1, "owner");
         var stranger = TestEntities.User(2, "stranger");
@@ -88,6 +88,6 @@ public sealed class UpdateAlbumCommandHandlerTests : HandlerTestBase
 
         var result = await CreateHandler().Handle(command, TestContext.Current.CancellationToken);
 
-        Assert.Equal(ErrorType.Unauthorized, result.FirstError.Type);
+        Assert.Equal(ErrorType.Forbidden, result.FirstError.Type);
     }
 }

backend/Tests/Musify.Application.Tests/PlayLists/AddTrackToPlayListCommandHandlerTests.cs

@@ -53,7 +53,7 @@ public sealed class AddTrackToPlayListCommandHandlerTests : HandlerTestBase
     }
 
     [Fact]
-    public async Task Handle_NotOwner_ReturnsUnauthorized()
+    public async Task Handle_NotOwner_ReturnsForbidden()
     {
         var owner = TestEntities.User(1, "owner");
         var stranger = TestEntities.User(2, "stranger");
@@ -62,7 +62,7 @@ public sealed class AddTrackToPlayListCommandHandlerTests : HandlerTestBase
 
         var result = await CreateHandler().Handle(new AddTrackToPlayListCommand(stranger.Id, playList.Id, Guid.NewGuid()), TestContext.Current.CancellationToken);
 
-        Assert.Equal(ErrorType.Unauthorized, result.FirstError.Type);
+        Assert.Equal(ErrorType.Forbidden, result.FirstError.Type);
     }
 
     [Fact]
@@ -89,4 +89,18 @@ public sealed class AddTrackToPlayListCommandHandlerTests : HandlerTestBase
 
         Assert.Equal(ErrorType.Conflict, result.FirstError.Type);
     }
+
+    [Fact]
+    public async Task TrySaveChangesAsync_DuplicatePlayListTrack_MapsTheUniqueViolationToTheGivenError()
+    {
+        var owner = TestEntities.User();
+        var playList = TestEntities.PlayList(owner.Id);
+        var track = TestEntities.Track(owner);
+        await SeedAsync(owner, playList, track, new PlayListHasTrack { PlayListId = playList.Id, TrackId = track.Id, Position = 0 });
+        Database.PlayListHasTracks.Add(new PlayListHasTrack { PlayListId = playList.Id, TrackId = track.Id, Position = 1 });
+
+        var result = await Database.TrySaveChangesAsync(Error.Conflict("Test.Duplicate", "duplicate"), TestContext.Current.CancellationToken);
+
+        Assert.Equal("Test.Duplicate", result.FirstError.Code);
+    }
 }

backend/Tests/Musify.Application.Tests/PlayLists/DeletePlayListCommandHandlerTests.cs

@@ -39,7 +39,7 @@ public sealed class DeletePlayListCommandHandlerTests : HandlerTestBase
     }
 
     [Fact]
-    public async Task Handle_NotOwner_ReturnsUnauthorized()
+    public async Task Handle_NotOwner_ReturnsForbidden()
     {
         var owner = TestEntities.User(1, "owner");
         var stranger = TestEntities.User(2, "stranger");
@@ -48,6 +48,6 @@ public sealed class DeletePlayListCommandHandlerTests : HandlerTestBase
 
         var result = await CreateHandler().Handle(new DeletePlayListCommand(stranger.Id, playList.Id), TestContext.Current.CancellationToken);
 
-        Assert.Equal(ErrorType.Unauthorized, result.FirstError.Type);
+        Assert.Equal(ErrorType.Forbidden, result.FirstError.Type);
     }
 }

backend/Tests/Musify.Application.Tests/PlayLists/RemoveTrackFromPlayListCommandHandlerTests.cs

@@ -33,7 +33,7 @@ public sealed class RemoveTrackFromPlayListCommandHandlerTests : HandlerTestBase
     }
 
     [Fact]
-    public async Task Handle_NotOwner_ReturnsUnauthorized()
+    public async Task Handle_NotOwner_ReturnsForbidden()
     {
         var owner = TestEntities.User(1, "owner");
         var stranger = TestEntities.User(2, "stranger");
@@ -42,7 +42,7 @@ public sealed class RemoveTrackFromPlayListCommandHandlerTests : HandlerTestBase
 
         var result = await CreateHandler().Handle(new RemoveTrackFromPlayListCommand(stranger.Id, playList.Id, Guid.NewGuid()), TestContext.Current.CancellationToken);
 
-        Assert.Equal(ErrorType.Unauthorized, result.FirstError.Type);
+        Assert.Equal(ErrorType.Forbidden, result.FirstError.Type);
     }
 
     [Fact]
@@ -56,4 +56,26 @@ public sealed class RemoveTrackFromPlayListCommandHandlerTests : HandlerTestBase
 
         Assert.Equal(ErrorType.NotFound, result.FirstError.Type);
     }
+
+    [Fact]
+    public async Task Handle_TrackInTheMiddle_RenumbersTheRemainingTracks()
+    {
+        var owner = TestEntities.User();
+        var playList = TestEntities.PlayList(owner.Id);
+        var first = TestEntities.Track(owner, "First");
+        var second = TestEntities.Track(owner, "Second");
+        var third = TestEntities.Track(owner, "Third");
+        await SeedAsync(
+            owner, playList, first, second, third,
+            new PlayListHasTrack { PlayListId = playList.Id, TrackId = first.Id, Position = 0 },
+            new PlayListHasTrack { PlayListId = playList.Id, TrackId = second.Id, Position = 1 },
+            new PlayListHasTrack { PlayListId = playList.Id, TrackId = third.Id, Position = 2 });
+
+        var result = await CreateHandler().Handle(new RemoveTrackFromPlayListCommand(owner.Id, playList.Id, second.Id), TestContext.Current.CancellationToken);
+
+        Assert.False(result.IsError);
+        var remaining = Database.PlayListHasTracks.OrderBy(link => link.Position).ToList();
+        Assert.Equal([first.Id, third.Id], remaining.Select(link => link.TrackId));
+        Assert.Equal([0, 1], remaining.Select(link => link.Position));
+    }
 }

backend/Tests/Musify.Application.Tests/PlayLists/UpdatePlayListCommandHandlerTests.cs

@@ -48,7 +48,7 @@ public sealed class UpdatePlayListCommandHandlerTests : HandlerTestBase
     }
 
     [Fact]
-    public async Task Handle_NotOwner_ReturnsUnauthorized()
+    public async Task Handle_NotOwner_ReturnsForbidden()
     {
         var owner = TestEntities.User(1, "owner");
         var stranger = TestEntities.User(2, "stranger");
@@ -59,7 +59,7 @@ public sealed class UpdatePlayListCommandHandlerTests : HandlerTestBase
 
         var result = await CreateHandler().Handle(command, TestContext.Current.CancellationToken);
 
-        Assert.Equal(ErrorType.Unauthorized, result.FirstError.Type);
+        Assert.Equal(ErrorType.Forbidden, result.FirstError.Type);
     }
 
     [Fact]
@@ -93,7 +93,7 @@ public sealed class UpdatePlayListCommandHandlerTests : HandlerTestBase
     }
 
     [Fact]
-    public async Task Handle_BlankNameAndDescription_LeavesThemUnchanged()
+    public async Task Handle_BlankName_LeavesItUnchangedAndBlankDescriptionClearsIt()
     {
         var owner = TestEntities.User();
         var playList = TestEntities.PlayList(owner.Id, "Original Name", "Original description");
@@ -105,7 +105,7 @@ public sealed class UpdatePlayListCommandHandlerTests : HandlerTestBase
 
         Assert.False(result.IsError);
         Assert.Equal("Original Name", result.Value.Name);
-        Assert.Equal("Original description", result.Value.Description);
+        Assert.Null(result.Value.Description);
     }
 
     [Fact]
@@ -126,7 +126,7 @@ public sealed class UpdatePlayListCommandHandlerTests : HandlerTestBase
         var result = await CreateHandler().Handle(command, TestContext.Current.CancellationToken);
 
         Assert.False(result.IsError);
-        Assert.Equal("new-cover.webp", result.Value.SmallImageKeyName);
+        Assert.Null(result.Value.SmallImageKeyName);
         var stored = await Database.PlayLists.FindAsync([playList.Id], TestContext.Current.CancellationToken);
         Assert.NotNull(stored);
         Assert.Equal("new-cover.webp", stored.Pictures?.OriginalName);

backend/Tests/Musify.Application.Tests/TestSupport/TestDatabase.cs

@@ -1,3 +1,4 @@
+using ErrorOr;
 using Microsoft.Data.Sqlite;
 using Microsoft.EntityFrameworkCore;
 using Musify.Application.Contracts;
@@ -79,6 +80,10 @@ public sealed class TestDatabase : DbContext, IDatabase
             .HasIndex(albumTrack => new { albumTrack.AlbumId, albumTrack.TrackId })
             .IsUnique();
 
+        modelBuilder.Entity<PlayListHasTrack>()
+            .HasIndex(playListTrack => new { playListTrack.PlayListId, playListTrack.TrackId })
+            .IsUnique();
+
         modelBuilder.Entity<Mix>()
             .HasIndex(mix => new { mix.UserId, mix.Position });
 
@@ -164,6 +169,19 @@ public sealed class TestDatabase : DbContext, IDatabase
         return new SqliteDatabaseTransaction(transaction);
     }
 
+    public async Task<ErrorOr<Success>> TrySaveChangesAsync(Error onUniqueViolation, CancellationToken cancellationToken)
+    {
+        try
+        {
+            await SaveChangesAsync(cancellationToken);
+            return Result.Success;
+        }
+        catch (DbUpdateException exception) when (exception.InnerException is SqliteException { SqliteErrorCode: 19 })
+        {
+            return onUniqueViolation;
+        }
+    }
+
     public override async ValueTask DisposeAsync()
     {
         await base.DisposeAsync();

backend/Tests/Musify.Application.Tests/Tracks/DeleteTrackCommandHandlerTests.cs

@@ -39,7 +39,7 @@ public sealed class DeleteTrackCommandHandlerTests : HandlerTestBase
     }
 
     [Fact]
-    public async Task Handle_NotOwner_ReturnsUnauthorized()
+    public async Task Handle_NotOwner_ReturnsForbidden()
     {
         var owner = TestEntities.User(1, "owner");
         var stranger = TestEntities.User(2, "stranger");
@@ -48,7 +48,7 @@ public sealed class DeleteTrackCommandHandlerTests : HandlerTestBase
 
         var result = await CreateHandler().Handle(new DeleteTrackCommand(stranger.Id, track.Id), TestContext.Current.CancellationToken);
 
-        Assert.Equal(ErrorType.Unauthorized, result.FirstError.Type);
+        Assert.Equal(ErrorType.Forbidden, result.FirstError.Type);
     }
 
     [Fact]

backend/Tests/Musify.Application.Tests/Tracks/GetLastTrackListenedByUserIdQueryHandlerTests.cs

@@ -1,4 +1,3 @@
-using ErrorOr;
 using Musify.Application.Tests.TestSupport;
 using Musify.Application.Tracks;
 using Xunit;
@@ -22,18 +21,18 @@ public sealed class GetLastTrackListenedByUserIdQueryHandlerTests : HandlerTestB
 
         var result = await CreateHandler().Handle(new GetLastTrackListenedByUserIdQuery(owner.Id), TestContext.Current.CancellationToken);
 
-        Assert.False(result.IsError);
-        Assert.Equal("Newer listen", result.Value.Title);
+        Assert.NotNull(result);
+        Assert.Equal("Newer listen", result.Title);
     }
 
     [Fact]
-    public async Task Handle_NoHistory_ReturnsNotFound()
+    public async Task Handle_NoHistory_ReturnsNull()
     {
         var owner = TestEntities.User();
         await SeedAsync(owner);
 
         var result = await CreateHandler().Handle(new GetLastTrackListenedByUserIdQuery(owner.Id), TestContext.Current.CancellationToken);
 
-        Assert.Equal(ErrorType.NotFound, result.FirstError.Type);
+        Assert.Null(result);
     }
 }

backend/Tests/Musify.Application.Tests/Tracks/GetTracksByUserIdQueryHandlerTests.cs

@@ -27,19 +27,4 @@ public sealed class GetTracksByUserIdQueryHandlerTests : HandlerTestBase
         var track = Assert.Single(result.Value.Items);
         Assert.Equal("Mine", track.Title);
     }
-
-    [Theory]
-    [InlineData(0, 1)]
-    [InlineData(-5, 1)]
-    public async Task Handle_NonPositivePageNumber_FallsBackToFirstPage(int requestedPageNumber, int expectedPageNumber)
-    {
-        var owner = TestEntities.User();
-        var track = TestEntities.Track(owner);
-        await SeedAsync(owner, track, new UserHasTrack { UserId = owner.Id, TrackId = track.Id });
-
-        var result = await CreateHandler().Handle(new GetTracksByUserIdQuery(owner.Id, Name: null, PageNumber: requestedPageNumber, PageSize: 10), TestContext.Current.CancellationToken);
-
-        Assert.False(result.IsError);
-        Assert.Equal(expectedPageNumber, result.Value.PageNumber);
-    }
 }

backend/Tests/Musify.Application.Tests/Users/GetListeningStatsQueryHandlerTests.cs

@@ -102,7 +102,7 @@ public sealed class GetListeningStatsQueryHandlerTests : HandlerTestBase
     }
 
     [Fact]
-    public async Task Handle_NoListenToday_StreakIsZero()
+    public async Task Handle_ListenedYesterdayButNotToday_StreakIsStillAlive()
     {
         var user = TestEntities.User();
         var track = TestEntities.Track(user);
@@ -112,6 +112,20 @@ public sealed class GetListeningStatsQueryHandlerTests : HandlerTestBase
 
         var result = await CreateHandler().Handle(new GetListeningStatsQuery(user.Id), TestContext.Current.CancellationToken);
 
+        Assert.Equal(1, result.StreakDays);
+    }
+
+    [Fact]
+    public async Task Handle_NoListenTodayOrYesterday_StreakIsZero()
+    {
+        var user = TestEntities.User();
+        var track = TestEntities.Track(user);
+        await SeedAsync(
+            user, track,
+            TestEntities.ListeningHistory(user.Id, track.Id, DateTime.UtcNow.AddDays(-2)));
+
+        var result = await CreateHandler().Handle(new GetListeningStatsQuery(user.Id), TestContext.Current.CancellationToken);
+
         Assert.Equal(0, result.StreakDays);
     }
 }

backend/Tests/Musify.Infrastructure.Tests/Services/StorageServiceTests.cs

@@ -42,12 +42,21 @@ public sealed class StorageServiceTests(InfrastructureTestFixture fixture) : IAs
         await service.UploadFileAsync(new MemoryStream(content), "text/plain", InfrastructureTestFixture.S3Bucket, key, TestContext.Current.CancellationToken);
 
         await using var stream = await service.GetFileAsync(InfrastructureTestFixture.S3Bucket, key, TestContext.Current.CancellationToken);
+        Assert.NotNull(stream);
         using var reader = new StreamReader(stream, Encoding.UTF8);
         var readBack = await reader.ReadToEndAsync(TestContext.Current.CancellationToken);
 
         Assert.Equal("hello seaweedfs", readBack);
     }
 
+    [Fact]
+    public async Task GetFileAsync_MissingObject_ReturnsNull()
+    {
+        var stream = await service.GetFileAsync(InfrastructureTestFixture.S3Bucket, $"tests/{Guid.NewGuid():N}/missing.txt", TestContext.Current.CancellationToken);
+
+        Assert.Null(stream);
+    }
+
     [Fact]
     public async Task HeadObjectAsync_ExistingObject_ReturnsMetadata()
     {