Fix query and API bugs: 403 for non-owners, page bounds, lifecycle filters, cover fallback, race-safe inserts, async album delete

backend/Core/Musify.Application/Albums/GetAlbumCover.cs

@@ -4,6 +4,8 @@ using Microsoft.EntityFrameworkCore;
 using MimeMapping;
 using Musify.Application.Configuration;
 using Musify.Application.Contracts;
+using Musify.Application.Shared;
+using Musify.Domain.ValueObjects;
 
 namespace Musify.Application.Albums;
 
@@ -20,14 +22,15 @@ public class GetAlbumCoverQueryHandler(
 {
     public async ValueTask<ErrorOr<AlbumCoverLocation>> Handle(GetAlbumCoverQuery request, CancellationToken cancellationToken)
     {
-        var pictures = await database.Albums.AsNoTracking()
-            .Where(a => a.Id == request.AlbumId)
-            .Select(a => a.Pictures)
+        var owned = await database.Albums.AsNoTracking()
+            .Where(e => e.Id == request.AlbumId && e.LifeCycleStatus == LifeCycleStatus.Active)
+            .Select(e => new { OwnerUserId = e.OwnerUserId, e.Pictures })
             .SingleOrDefaultAsync(cancellationToken);
 
-        if (pictures == null)
-            return Error.NotFound();
+        if (owned?.Pictures == null)
+            return AppErrors.NotFound("AlbumCover", request.AlbumId);
 
+        var pictures = owned.Pictures;
         var routes = albumConfiguration.Routes;
         var (name, key) = request.Size.ToLowerInvariant() switch
         {
@@ -36,8 +39,15 @@ public class GetAlbumCoverQueryHandler(
             _ => (pictures.MediumName, BuildKey(routes.BuildMediumPicturePath, pictures.MediumName))
         };
 
+        // The resized files only exist once processing has finished; until then serve the original.
         if (string.IsNullOrEmpty(name) || string.IsNullOrEmpty(key))
-            return Error.NotFound();
+        {
+            name = pictures.OriginalName;
+            key = string.IsNullOrEmpty(name) ? null : routes.BuildOriginalPicturePath(owned.OwnerUserId, name);
+        }
+
+        if (string.IsNullOrEmpty(name) || string.IsNullOrEmpty(key))
+            return AppErrors.NotFound("AlbumCover", request.AlbumId);
 
         var contentType = MimeUtility.GetMimeMapping(name);
         return new AlbumCoverLocation(storageConfiguration.Bucket, key, contentType);