Fix query and API bugs: 403 for non-owners, page bounds, lifecycle filters, cover fallback, race-safe inserts, async album delete

2026-09-24 05:14:05 +02:00
parent ab388e6ad6
commit 0e3576922f
90 changed files with 2083 additions and 322 deletions
@@ -45,7 +45,7 @@ public class UpdateAlbumCommandHandler(
        if (album.OwnerUserId != request.UserId)
        {
            logger.LogWarning("Album {AlbumId} does not belong to user {UserId}", request.AlbumId, request.UserId);
-            return Error.Unauthorized();
+            return AppErrors.Forbidden("Album", request.AlbumId);
        }

        var title = request.Title.Trim();
@@ -67,13 +67,7 @@ public class UpdateAlbumCommandHandler(
                return validation.Errors;

            pictureIntent = validation.Value;
-            album.Pictures = new AlbumPictures
-            {
-                OriginalName = pictureIntent.ObjectName,
-                SmallName = pictureIntent.ObjectName,
-                MediumName = pictureIntent.ObjectName,
-                LargeName = pictureIntent.ObjectName
-            };
+            album.Pictures = AlbumPictures.Pending(pictureIntent.ObjectName);
            finalPictureKey = albumConfiguration.Routes.BuildOriginalPicturePath(request.UserId, pictureIntent.ObjectName);
        }