Fix query and API bugs: 403 for non-owners, page bounds, lifecycle filters, cover fallback, race-safe inserts, async album delete

backend/Core/Musify.Application/Likes/GetLikedTracks.cs

@@ -6,6 +6,7 @@ using Musify.Application.Shared;
 using Musify.Application.Tracks.Responses;
 using X.PagedList;
 using X.PagedList.EF;
+using Musify.Domain.ValueObjects;
 
 namespace Musify.Application.Likes;
 
@@ -24,7 +25,7 @@ public class GetLikedTracksQueryHandler(IDatabase database)
             .AsNoTracking()
             .Include(like => like.Track.Owner)
             .Include(like => like.Track.Tags)
-            .Where(like => like.UserId == request.UserId);
+            .Where(like => like.UserId == request.UserId && like.Track.LifeCycleStatus == LifeCycleStatus.Active);
 
         var totalCount = await likesQuery.CountAsync(cancellationToken);
 

backend/Core/Musify.Application/Likes/ToggleTrackLike.cs

@@ -3,6 +3,7 @@ using Mediator;
 using Microsoft.EntityFrameworkCore;
 using Microsoft.Extensions.Logging;
 using Musify.Application.Contracts;
+using Musify.Application.Shared;
 using Musify.Domain.Entities;
 
 namespace Musify.Application.Likes;
@@ -45,7 +46,11 @@ public class ToggleTrackLikeCommandHandler(
             nowLiked = true;
         }
 
-        await database.SaveChangesAsync(cancellationToken);
+        // A concurrent double click can hit the unique index; the outcome is already in place, so treat it as a no-op.
+        var saved = await database.TrySaveChangesAsync(
+            AppErrors.Conflict("TrackLike.Duplicate", "Track is already liked."), cancellationToken);
+        if (saved.IsError)
+            return true;
 
         logger.LogInformation("User {UserId} {Action} track {TrackId}",
             request.UserId, nowLiked ? "liked" : "unliked", request.TrackId);