Fix query and API bugs: 403 for non-owners, page bounds, lifecycle filters, cover fallback, race-safe inserts, async album delete

backend/Hosts/Musify.Api/Validators/PageQueryValidator.cs

@@ -0,0 +1,17 @@
+using FluentValidation;
+using Musify.Api.Models;
+using Musify.Application.Shared;
+
+namespace Musify.Api.Validators;
+
+public sealed class PageQueryValidator : AbstractValidator<PageQuery>
+{
+    public PageQueryValidator()
+    {
+        RuleFor(x => x.PageNumber)
+            .GreaterThanOrEqualTo(1);
+
+        RuleFor(x => x.PageSize)
+            .InclusiveBetween(1, PageRequest.MaxPageSize);
+    }
+}

backend/Hosts/Musify.Api/Validators/PlayLists/CreatePlayListRequestValidator.cs

@@ -13,5 +13,8 @@ public sealed class CreatePlayListRequestValidator : AbstractValidator<CreatePla
 
         RuleFor(x => x.Description)
             .MaximumLength(256);
+
+        RuleFor(x => x.Visibility)
+            .IsInEnum();
     }
 }

backend/Hosts/Musify.Api/Validators/PlayLists/UpdatePlayListRequestValidator.cs

@@ -15,5 +15,9 @@ public sealed class UpdatePlayListRequestValidator : AbstractValidator<UpdatePla
         RuleFor(x => x.NewDescription)
             .MaximumLength(256)
             .When(x => x.NewDescription != null);
+
+        RuleFor(x => x.NewVisibility)
+            .IsInEnum()
+            .When(x => x.NewVisibility != null);
     }
 }