Fix query and API bugs: 403 for non-owners, page bounds, lifecycle filters, cover fallback, race-safe inserts, async album delete

backend/Core/Musify.Infrastructure/Persistence/Database.cs

@@ -1,3 +1,4 @@
+using ErrorOr;
 using MassTransit;
 using Microsoft.EntityFrameworkCore;
 using Microsoft.EntityFrameworkCore.Storage;
@@ -6,6 +7,7 @@ using Musify.Domain.Entities;
 using Musify.Domain.ValueObjects;
 using Musify.Infrastructure.Configuration;
 using Musify.Infrastructure.MassTransit.Sagas;
+using Npgsql;
 using AppIDatabase = Musify.Application.Contracts.IDatabase;
 
 namespace Musify.Infrastructure.Persistence;
@@ -82,9 +84,9 @@ public class Database(DatabaseConfiguration configuration)
             .OwnsOne(album => album.Pictures, pictures =>
             {
                 pictures.Property(p => p.OriginalName).HasColumnName("OriginalPictureName").HasMaxLength(64);
-                pictures.Property(p => p.SmallName).HasColumnName("SmallPictureName").HasMaxLength(64);
-                pictures.Property(p => p.MediumName).HasColumnName("MediumPictureName").HasMaxLength(64);
-                pictures.Property(p => p.LargeName).HasColumnName("LargePictureName").HasMaxLength(64);
+                pictures.Property(p => p.SmallName).HasColumnName("SmallPictureName").HasMaxLength(64).IsRequired(false);
+                pictures.Property(p => p.MediumName).HasColumnName("MediumPictureName").HasMaxLength(64).IsRequired(false);
+                pictures.Property(p => p.LargeName).HasColumnName("LargePictureName").HasMaxLength(64).IsRequired(false);
             });
         modelBuilder.Entity<Album>().Navigation(album => album.Pictures).IsRequired(false);
 
@@ -110,6 +112,10 @@ public class Database(DatabaseConfiguration configuration)
             .HasIndex(albumTrack => new { albumTrack.AlbumId, albumTrack.TrackId })
             .IsUnique();
 
+        modelBuilder.Entity<PlayListHasTrack>()
+            .HasIndex(playListTrack => new { playListTrack.PlayListId, playListTrack.TrackId })
+            .IsUnique();
+
         modelBuilder.Entity<Mix>()
             .HasIndex(mix => new { mix.UserId, mix.Position });
 
@@ -205,6 +211,19 @@ public class Database(DatabaseConfiguration configuration)
         return new DatabaseTransaction(transaction);
     }
 
+    public async Task<ErrorOr<Success>> TrySaveChangesAsync(Error onUniqueViolation, CancellationToken cancellationToken)
+    {
+        try
+        {
+            await SaveChangesAsync(cancellationToken);
+            return Result.Success;
+        }
+        catch (DbUpdateException exception) when (exception.InnerException is PostgresException { SqlState: PostgresErrorCodes.UniqueViolation })
+        {
+            return onUniqueViolation;
+        }
+    }
+
     private sealed class DatabaseTransaction(IDbContextTransaction inner) : IDatabaseTransaction
     {
         public Task CommitAsync(CancellationToken cancellationToken) =>

backend/Core/Musify.Infrastructure/Persistence/Migrations/20260924030938_PlayListTrackUnique.cs

@@ -0,0 +1,46 @@
+using Microsoft.EntityFrameworkCore.Migrations;
+
+#nullable disable
+
+namespace Musify.Infrastructure.Persistence.Migrations
+{
+    /// <inheritdoc />
+    public partial class PlayListTrackUnique : Migration
+    {
+        /// <inheritdoc />
+        protected override void Up(MigrationBuilder migrationBuilder)
+        {
+            // Remove duplicate rows (keeping the lowest position) before enforcing uniqueness.
+            migrationBuilder.Sql("""
+                DELETE FROM "PlayListHasTrack" a
+                USING "PlayListHasTrack" b
+                WHERE a."PlayListId" = b."PlayListId"
+                  AND a."TrackId" = b."TrackId"
+                  AND (a."Position", a."Id") > (b."Position", b."Id");
+                """);
+
+            migrationBuilder.DropIndex(
+                name: "IX_PlayListHasTrack_PlayListId",
+                table: "PlayListHasTrack");
+
+            migrationBuilder.CreateIndex(
+                name: "IX_PlayListHasTrack_PlayListId_TrackId",
+                table: "PlayListHasTrack",
+                columns: new[] { "PlayListId", "TrackId" },
+                unique: true);
+        }
+
+        /// <inheritdoc />
+        protected override void Down(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.DropIndex(
+                name: "IX_PlayListHasTrack_PlayListId_TrackId",
+                table: "PlayListHasTrack");
+
+            migrationBuilder.CreateIndex(
+                name: "IX_PlayListHasTrack_PlayListId",
+                table: "PlayListHasTrack",
+                column: "PlayListId");
+        }
+    }
+}

backend/Core/Musify.Infrastructure/Persistence/Migrations/DatabaseModelSnapshot.cs

@@ -417,10 +417,11 @@ namespace Musify.Infrastructure.Persistence.Migrations
 
                     b.HasKey("Id");
 
-                    b.HasIndex("PlayListId");
-
                     b.HasIndex("TrackId");
 
+                    b.HasIndex("PlayListId", "TrackId")
+                        .IsUnique();
+
                     b.ToTable("PlayListHasTrack");
                 });
 
@@ -790,13 +791,11 @@ namespace Musify.Infrastructure.Persistence.Migrations
                                 .HasColumnType("uuid");
 
                             b1.Property<string>("LargeName")
-                                .IsRequired()
                                 .HasMaxLength(64)
                                 .HasColumnType("character varying(64)")
                                 .HasColumnName("LargePictureName");
 
                             b1.Property<string>("MediumName")
-                                .IsRequired()
                                 .HasMaxLength(64)
                                 .HasColumnType("character varying(64)")
                                 .HasColumnName("MediumPictureName");
@@ -808,7 +807,6 @@ namespace Musify.Infrastructure.Persistence.Migrations
                                 .HasColumnName("OriginalPictureName");
 
                             b1.Property<string>("SmallName")
-                                .IsRequired()
                                 .HasMaxLength(64)
                                 .HasColumnType("character varying(64)")
                                 .HasColumnName("SmallPictureName");