Fix query and API bugs: 403 for non-owners, page bounds, lifecycle filters, cover fallback, race-safe inserts, async album delete

backend/Core/Musify.Application/Mixes/GetMixesByUserId.cs

@@ -21,14 +21,28 @@ public class GetMixesByUserIdQueryHandler(IDatabase database)
             .OrderBy(mix => mix.Position)
             .ToListAsync(cancellationToken);
 
+        var orderedItemsByMix = mixes.ToDictionary(
+            mix => mix.Id,
+            mix => mix.Items.OrderBy(item => item.Position).ToList());
+
+        var coverItems = orderedItemsByMix.Values
+            .SelectMany(items => items.Take(MixApplicationResponse.CoverItemCount))
+            .ToList();
+        var coverResponses = (await MixItemMapper.ToResponsesAsync(database, coverItems, cancellationToken))
+            .GroupBy(response => response.TrackId)
+            .ToDictionary(group => group.Key, group => group.First());
+
         var responses = new List<MixApplicationResponse>(mixes.Count);
         foreach (var mix in mixes)
         {
-            var orderedItems = mix.Items.OrderBy(item => item.Position).ToList();
-            var coverItems = await MixItemMapper.ToResponsesAsync(
-                database, orderedItems.Take(MixApplicationResponse.CoverItemCount).ToList(), cancellationToken);
+            var orderedItems = orderedItemsByMix[mix.Id];
+            var covers = orderedItems
+                .Take(MixApplicationResponse.CoverItemCount)
+                .Where(item => coverResponses.ContainsKey(item.TrackId))
+                .Select(item => coverResponses[item.TrackId])
+                .ToList();
 
-            responses.Add(new MixApplicationResponse(mix.Id, mix.Title, mix.Subtitle, orderedItems.Count, coverItems));
+            responses.Add(new MixApplicationResponse(mix.Id, mix.Title, mix.Subtitle, orderedItems.Count, covers));
         }
 
         return responses;

backend/Core/Musify.Application/Mixes/MixItemMapper.cs

@@ -2,6 +2,7 @@ using Microsoft.EntityFrameworkCore;
 using Musify.Application.Contracts;
 using Musify.Application.Mixes.Responses;
 using Musify.Domain.Entities;
+using Musify.Domain.ValueObjects;
 
 namespace Musify.Application.Mixes;
 
@@ -18,7 +19,7 @@ internal static class MixItemMapper
         var tracksById = await database.Tracks
             .AsNoTracking()
             .Include(track => track.Owner)
-            .Where(track => trackIds.Contains(track.Id))
+            .Where(track => trackIds.Contains(track.Id) && track.LifeCycleStatus == LifeCycleStatus.Active)
             .Select(track => new { Track = track, ListensCount = track.ListeningHistories.Count(l => l.IsCounted) })
             .ToDictionaryAsync(x => x.Track.Id, cancellationToken);