Fix query and API bugs: 403 for non-owners, page bounds, lifecycle filters, cover fallback, race-safe inserts, async album delete

backend/Tests/Musify.Application.Tests/Albums/AddTrackToAlbumCommandHandlerTests.cs

@@ -39,7 +39,7 @@ public sealed class AddTrackToAlbumCommandHandlerTests : HandlerTestBase
     }
 
     [Fact]
-    public async Task Handle_NotOwner_ReturnsUnauthorized()
+    public async Task Handle_NotOwner_ReturnsForbidden()
     {
         var owner = TestEntities.User(1, "owner");
         var stranger = TestEntities.User(2, "stranger");
@@ -49,7 +49,7 @@ public sealed class AddTrackToAlbumCommandHandlerTests : HandlerTestBase
 
         var result = await CreateHandler().Handle(new AddTrackToAlbumCommand(stranger.Id, album.Id, track.Id), TestContext.Current.CancellationToken);
 
-        Assert.Equal(ErrorType.Unauthorized, result.FirstError.Type);
+        Assert.Equal(ErrorType.Forbidden, result.FirstError.Type);
     }
 
     [Fact]
@@ -65,7 +65,7 @@ public sealed class AddTrackToAlbumCommandHandlerTests : HandlerTestBase
     }
 
     [Fact]
-    public async Task Handle_TrackOwnedByAnotherUser_ReturnsUnauthorized()
+    public async Task Handle_TrackOwnedByAnotherUser_ReturnsForbidden()
     {
         var owner = TestEntities.User(1, "owner");
         var otherOwner = TestEntities.User(2, "other");
@@ -75,7 +75,7 @@ public sealed class AddTrackToAlbumCommandHandlerTests : HandlerTestBase
 
         var result = await CreateHandler().Handle(new AddTrackToAlbumCommand(owner.Id, album.Id, foreignTrack.Id), TestContext.Current.CancellationToken);
 
-        Assert.Equal(ErrorType.Unauthorized, result.FirstError.Type);
+        Assert.Equal(ErrorType.Forbidden, result.FirstError.Type);
     }
 
     [Fact]

backend/Tests/Musify.Application.Tests/Albums/DeleteAlbumCommandHandlerTests.cs

@@ -1,16 +1,21 @@
 using ErrorOr;
 using Musify.Application.Albums;
+using Musify.Application.Contracts;
 using Musify.Application.Tests.TestSupport;
+using Musify.Domain.ValueObjects;
+using NSubstitute;
 using Xunit;
 
 namespace Musify.Application.Tests.Albums;
 
 public sealed class DeleteAlbumCommandHandlerTests : HandlerTestBase
 {
-    private DeleteAlbumCommandHandler CreateHandler() => new(Database, NoOpLogger<DeleteAlbumCommandHandler>());
+    private readonly IEventBus eventBus = Substitute.For<IEventBus>();
+
+    private DeleteAlbumCommandHandler CreateHandler() => new(Database, eventBus, NoOpLogger<DeleteAlbumCommandHandler>());
 
     [Fact]
-    public async Task Handle_Owner_RemovesAlbum()
+    public async Task Handle_Owner_MarksAlbumAsRemoving()
     {
         var owner = TestEntities.User();
         var album = TestEntities.Album(owner.Id);
@@ -19,7 +24,10 @@ public sealed class DeleteAlbumCommandHandlerTests : HandlerTestBase
         var result = await CreateHandler().Handle(new DeleteAlbumCommand(owner.Id, album.Id), TestContext.Current.CancellationToken);
 
         Assert.False(result.IsError);
-        Assert.Null(await Database.Albums.FindAsync([album.Id], TestContext.Current.CancellationToken));
+        var stored = await Database.Albums.FindAsync([album.Id], TestContext.Current.CancellationToken);
+        Assert.NotNull(stored);
+        Assert.Equal(LifeCycleStatus.Removing, stored.LifeCycleStatus);
+        await eventBus.Received(1).PublishAsync(Arg.Any<Musify.Application.Events.DeleteAlbumEvent>(), Arg.Any<CancellationToken>());
     }
 
     [Fact]
@@ -31,7 +39,7 @@ public sealed class DeleteAlbumCommandHandlerTests : HandlerTestBase
     }
 
     [Fact]
-    public async Task Handle_NotOwner_ReturnsUnauthorizedAndKeepsAlbum()
+    public async Task Handle_NotOwner_ReturnsForbiddenAndKeepsAlbum()
     {
         var owner = TestEntities.User(1, "owner");
         var stranger = TestEntities.User(2, "stranger");
@@ -40,7 +48,7 @@ public sealed class DeleteAlbumCommandHandlerTests : HandlerTestBase
 
         var result = await CreateHandler().Handle(new DeleteAlbumCommand(stranger.Id, album.Id), TestContext.Current.CancellationToken);
 
-        Assert.Equal(ErrorType.Unauthorized, result.FirstError.Type);
+        Assert.Equal(ErrorType.Forbidden, result.FirstError.Type);
         Assert.NotNull(await Database.Albums.FindAsync([album.Id], TestContext.Current.CancellationToken));
     }
 }

backend/Tests/Musify.Application.Tests/Albums/GetAlbumCoverQueryHandlerTests.cs

@@ -34,4 +34,19 @@ public sealed class GetAlbumCoverQueryHandlerTests : HandlerTestBase
 
         Assert.Equal(ErrorType.NotFound, result.FirstError.Type);
     }
+
+    [Fact]
+    public async Task Handle_PicturesStillProcessing_FallsBackToTheOriginal()
+    {
+        var owner = TestEntities.User();
+        var album = TestEntities.Album(owner.Id, pictures: Musify.Domain.ValueObjects.AlbumPictures.Pending("original.png"));
+        await SeedAsync(owner, album);
+
+        var result = await CreateHandler().Handle(new GetAlbumCoverQuery(album.Id, "small"), TestContext.Current.CancellationToken);
+
+        Assert.False(result.IsError);
+        Assert.Contains($"{owner.Id}", result.Value.Key);
+        Assert.EndsWith("original.png", result.Value.Key);
+        Assert.Equal("image/png", result.Value.ContentType);
+    }
 }

backend/Tests/Musify.Application.Tests/Albums/RemoveTrackFromAlbumCommandHandlerTests.cs

@@ -46,7 +46,7 @@ public sealed class RemoveTrackFromAlbumCommandHandlerTests : HandlerTestBase
     }
 
     [Fact]
-    public async Task Handle_NotOwner_ReturnsUnauthorized()
+    public async Task Handle_NotOwner_ReturnsForbidden()
     {
         var owner = TestEntities.User(1, "owner");
         var stranger = TestEntities.User(2, "stranger");
@@ -55,7 +55,7 @@ public sealed class RemoveTrackFromAlbumCommandHandlerTests : HandlerTestBase
 
         var result = await CreateHandler().Handle(new RemoveTrackFromAlbumCommand(stranger.Id, album.Id, Guid.NewGuid()), TestContext.Current.CancellationToken);
 
-        Assert.Equal(ErrorType.Unauthorized, result.FirstError.Type);
+        Assert.Equal(ErrorType.Forbidden, result.FirstError.Type);
     }
 
     [Fact]

backend/Tests/Musify.Application.Tests/Albums/UpdateAlbumCommandHandlerTests.cs

@@ -77,7 +77,7 @@ public sealed class UpdateAlbumCommandHandlerTests : HandlerTestBase
     }
 
     [Fact]
-    public async Task Handle_NotOwner_ReturnsUnauthorized()
+    public async Task Handle_NotOwner_ReturnsForbidden()
     {
         var owner = TestEntities.User(1, "owner");
         var stranger = TestEntities.User(2, "stranger");
@@ -88,6 +88,6 @@ public sealed class UpdateAlbumCommandHandlerTests : HandlerTestBase
 
         var result = await CreateHandler().Handle(command, TestContext.Current.CancellationToken);
 
-        Assert.Equal(ErrorType.Unauthorized, result.FirstError.Type);
+        Assert.Equal(ErrorType.Forbidden, result.FirstError.Type);
     }
 }