From 48ed84b7bd2a7706bce9c939e1550a16c561917c Mon Sep 17 00:00:00 2001 From: REDCODE Date: Sat, 11 Jul 2026 17:20:34 +0200 Subject: [PATCH 01/50] feat: add SearchDropdown typeahead component New SearchDropdown component that provides a live typeahead dropdown in the navbar searching both cosplayers (persons) and albums. - Fires API calls on every keystroke (no debounce) to existing /api/person and /api/album - Version counter discards stale responses - Minimum 2 characters before searching - Keyboard navigation (arrows, enter, escape) - Blur delay for click-to-navigate - Thumbnail support with fallback avatars/icons - Loading and empty states --- .../Components/Shared/SearchDropdown.razor | 221 ++++++++++++++++++ .../Shared/SearchDropdown.razor.css | 82 +++++++ 2 files changed, 303 insertions(+) create mode 100644 MilkStream.Client/Components/Shared/SearchDropdown.razor create mode 100644 MilkStream.Client/Components/Shared/SearchDropdown.razor.css diff --git a/MilkStream.Client/Components/Shared/SearchDropdown.razor b/MilkStream.Client/Components/Shared/SearchDropdown.razor new file mode 100644 index 0000000..28b8594 --- /dev/null +++ b/MilkStream.Client/Components/Shared/SearchDropdown.razor @@ -0,0 +1,221 @@ +@using Butter.Dtos.Album +@using Butter.Dtos.Person +@using Microsoft.Extensions.Options +@using MilkStream.Client.Services + +@namespace MilkStream.Client.Components.Shared + +@inject PersonService PersonSvc +@inject AlbumService AlbumSvc +@inject NavigationManager Nav +@inject IOptions ServiceOptions +@inject LoginService LoginSvc + +
+
+ + +
+ + @if (_showDropdown) + { +
+ @if (_isSearching) + { +
+ Searching... +
+ } + else if (_persons.Count == 0 && _albums.Count == 0) + { +
+ No results found +
+ } + else + { + @if (_persons.Count > 0) + { +
Cosplayers
+ @{ var pi = 0; } + @foreach (var person in _persons) + { + var idx = pi; + + @if (person.ProfileAssetId.HasValue) + { + + } + else + { +
@person.Name[..1].ToUpper()
+ } +
+
@person.Name
+
+ + pi++; + } + } + + @if (_albums.Count > 0) + { +
Albums
+ @{ var ai = _persons.Count; } + @foreach (var album in _albums) + { + var idx = ai; + + @if (album.CoverAssetId.HasValue) + { + + } + else + { +
+ } +
+
@album.Name
+ @if (!string.IsNullOrEmpty(album.PersonName)) + { + @album.PersonName + } +
+ + ai++; + } + } + } +
+ } +
+ +@code { + string _query = string.Empty; + List _persons = []; + List _albums = []; + bool _isSearching; + bool _showDropdown; + int _searchVersion; + int _selectedIndex = -1; + CancellationTokenSource? _blurCts; + + string ApiBase => ServiceOptions.Value.BaseUrl.TrimEnd('/'); + string Token => LoginSvc.AuthInfo?.Token ?? string.Empty; + string TokenParam => string.IsNullOrEmpty(Token) ? "" : $"?token={Token}"; + + string ThumbUrl(Guid id) => $"{ApiBase}/api/media/thumb/{id}{TokenParam}"; + + async Task OnInput(ChangeEventArgs e) + { + _query = e.Value?.ToString() ?? string.Empty; + + if (_query.Length < 2) + { + _persons = []; + _albums = []; + _showDropdown = false; + _selectedIndex = -1; + return; + } + + var version = ++_searchVersion; + _isSearching = true; + _selectedIndex = -1; + + var personTask = PersonSvc.GetAllAsync(page: 0, pageSize: 5, search: _query); + var albumTask = AlbumSvc.GetAlbumsAsync(page: 0, pageSize: 5, search: _query); + await Task.WhenAll(personTask, albumTask); + + if (version != _searchVersion) return; + + _persons = personTask.Result ?? []; + _albums = albumTask.Result ?? []; + _isSearching = false; + _showDropdown = true; + } + + async Task OnSearchClick() + { + var total = _persons.Count + _albums.Count; + if (total == 0) return; + + if (_selectedIndex >= 0 && _selectedIndex < _persons.Count) + Nav.NavigateTo($"/cosplayer/{_persons[_selectedIndex].Id}"); + else if (_selectedIndex >= _persons.Count && _selectedIndex < total) + Nav.NavigateTo($"/albums/{_albums[_selectedIndex - _persons.Count].Id}"); + else if (_persons.Count > 0) + Nav.NavigateTo($"/cosplayer/{_persons[0].Id}"); + else if (_albums.Count > 0) + Nav.NavigateTo($"/albums/{_albums[0].Id}"); + } + + void OnFocus() + { + _blurCts?.Cancel(); + if (_query.Length >= 2 && (_persons.Count > 0 || _albums.Count > 0)) + _showDropdown = true; + } + + async Task OnBlur() + { + _blurCts?.Cancel(); + _blurCts = new CancellationTokenSource(); + var token = _blurCts.Token; + try + { + await Task.Delay(150, token); + _showDropdown = false; + } + catch (OperationCanceledException) + { + } + } + + void OnKeyDown(KeyboardEventArgs e) + { + var total = _persons.Count + _albums.Count; + if (total == 0) return; + + switch (e.Key) + { + case "ArrowDown": + _selectedIndex = _selectedIndex >= total - 1 ? 0 : _selectedIndex + 1; + break; + case "ArrowUp": + _selectedIndex = _selectedIndex <= 0 ? total - 1 : _selectedIndex - 1; + break; + case "Enter": + if (_selectedIndex < 0) _selectedIndex = 0; + if (_selectedIndex < _persons.Count) + Nav.NavigateTo($"/cosplayer/{_persons[_selectedIndex].Id}"); + else + Nav.NavigateTo($"/albums/{_albums[_selectedIndex - _persons.Count].Id}"); + break; + case "Escape": + _showDropdown = false; + _selectedIndex = -1; + break; + } + } + + void OnItemHover(int index) + { + _selectedIndex = index; + } +} diff --git a/MilkStream.Client/Components/Shared/SearchDropdown.razor.css b/MilkStream.Client/Components/Shared/SearchDropdown.razor.css new file mode 100644 index 0000000..b1b7348 --- /dev/null +++ b/MilkStream.Client/Components/Shared/SearchDropdown.razor.css @@ -0,0 +1,82 @@ +.search-dropdown-menu { + position: absolute; + top: 100%; + left: 0; + right: 0; + z-index: 1030; + max-height: 400px; + overflow-y: auto; + background: var(--bs-body-bg, #fff); + border: 1px solid var(--bs-border-color, #dee2e6); + border-radius: 0.375rem; + box-shadow: 0 0.5rem 1rem rgba(0, 0, 0, 0.15); + margin-top: 0.25rem; +} + +.search-dropdown-header { + padding: 0.375rem 0.75rem; + font-size: 0.75rem; + font-weight: 600; + color: var(--bs-secondary-color, #6c757d); + text-transform: uppercase; + letter-spacing: 0.05em; +} + +.search-dropdown-item { + display: flex; + align-items: center; + gap: 0.5rem; + padding: 0.375rem 0.75rem; + text-decoration: none; + color: var(--bs-body-color, #212529); + cursor: pointer; + transition: background 0.1s; +} + +.search-dropdown-item:hover, +.search-dropdown-item.active { + background: var(--bs-tertiary-bg, #e9ecef); + color: var(--bs-body-color, #212529); +} + +.search-dropdown-item.disabled { + cursor: default; + justify-content: center; + padding: 0.75rem; +} + +.search-dropdown-thumb { + width: 32px; + height: 32px; + border-radius: 50%; + object-fit: cover; + flex-shrink: 0; +} + +.search-dropdown-fallback { + width: 32px; + height: 32px; + border-radius: 50%; + background: var(--accent, #0d6efd); + color: #fff; + display: flex; + align-items: center; + justify-content: center; + font-size: 0.75rem; + font-weight: 700; + flex-shrink: 0; +} + +.search-dropdown-fallback .bi { + font-size: 1rem; +} + +.search-dropdown-item-title { + font-size: 0.875rem; + line-height: 1.25; +} + +.search-dropdown-item small { + font-size: 0.75rem; + line-height: 1.2; +} -- 2.54.0 From e772e6d2b948dcd9465566b0bc376274cff733cc Mon Sep 17 00:00:00 2001 From: REDCODE Date: Sat, 11 Jul 2026 17:20:47 +0200 Subject: [PATCH 02/50] feat: wire SearchDropdown into NavMenu Replace static search input markup in NavMenu with the new SearchDropdown typeahead component. --- MilkStream.Client/Components/Layout/NavMenu.razor | 10 +--------- 1 file changed, 1 insertion(+), 9 deletions(-) diff --git a/MilkStream.Client/Components/Layout/NavMenu.razor b/MilkStream.Client/Components/Layout/NavMenu.razor index 80c8757..402f894 100644 --- a/MilkStream.Client/Components/Layout/NavMenu.razor +++ b/MilkStream.Client/Components/Layout/NavMenu.razor @@ -36,15 +36,7 @@ } else {
-
- - -
+
for search-dropdown-container - Replace @{} variable blocks with IndexOf() calls (invalid inside @if) - Remove leftover pi++ and ai++ incrementers --- MilkStream.Client/Components/Shared/SearchDropdown.razor | 8 ++------ 1 file changed, 2 insertions(+), 6 deletions(-) diff --git a/MilkStream.Client/Components/Shared/SearchDropdown.razor b/MilkStream.Client/Components/Shared/SearchDropdown.razor index 28b8594..752f3b0 100644 --- a/MilkStream.Client/Components/Shared/SearchDropdown.razor +++ b/MilkStream.Client/Components/Shared/SearchDropdown.razor @@ -48,10 +48,9 @@ @if (_persons.Count > 0) {
Cosplayers
- @{ var pi = 0; } @foreach (var person in _persons) { - var idx = pi; + var idx = _persons.IndexOf(person); @@ -67,17 +66,15 @@
@person.Name
- pi++; } } @if (_albums.Count > 0) {
Albums
- @{ var ai = _persons.Count; } @foreach (var album in _albums) { - var idx = ai; + var idx = _persons.Count + _albums.IndexOf(album); @@ -97,7 +94,6 @@ } - ai++; } } } -- 2.54.0 From bc72243c3e6ab1ac80a87c2b4c98267a4abc5546 Mon Sep 17 00:00:00 2001 From: REDCODE Date: Sat, 11 Jul 2026 17:26:13 +0200 Subject: [PATCH 04/50] style: use rounded-square thumbnails for album results Album covers now show as rounded squares (border-radius: 0.375rem) while cosplayer profile pics remain circular, improving visual differentiation between result types. --- .../Components/Shared/SearchDropdown.razor | 4 ++-- .../Shared/SearchDropdown.razor.css | 20 +++++++++++++++++++ 2 files changed, 22 insertions(+), 2 deletions(-) diff --git a/MilkStream.Client/Components/Shared/SearchDropdown.razor b/MilkStream.Client/Components/Shared/SearchDropdown.razor index 752f3b0..fb0ac27 100644 --- a/MilkStream.Client/Components/Shared/SearchDropdown.razor +++ b/MilkStream.Client/Components/Shared/SearchDropdown.razor @@ -80,11 +80,11 @@ @onmouseenter="() => OnItemHover(idx)"> @if (album.CoverAssetId.HasValue) { - + } else { -
+
}
@album.Name
diff --git a/MilkStream.Client/Components/Shared/SearchDropdown.razor.css b/MilkStream.Client/Components/Shared/SearchDropdown.razor.css index b1b7348..f9f1da9 100644 --- a/MilkStream.Client/Components/Shared/SearchDropdown.razor.css +++ b/MilkStream.Client/Components/Shared/SearchDropdown.razor.css @@ -53,6 +53,14 @@ flex-shrink: 0; } +.search-dropdown-thumb-rounded { + width: 32px; + height: 32px; + border-radius: 0.375rem; + object-fit: cover; + flex-shrink: 0; +} + .search-dropdown-fallback { width: 32px; height: 32px; @@ -67,6 +75,18 @@ flex-shrink: 0; } +.search-dropdown-fallback-rounded { + width: 32px; + height: 32px; + border-radius: 0.375rem; + background: var(--accent, #0d6efd); + color: #fff; + display: flex; + align-items: center; + justify-content: center; + flex-shrink: 0; +} + .search-dropdown-fallback .bi { font-size: 1rem; } -- 2.54.0 From fc50aec9967d68444c2b615b4375baa7894a95b8 Mon Sep 17 00:00:00 2001 From: REDCODE Date: Sat, 11 Jul 2026 17:28:48 +0200 Subject: [PATCH 05/50] feat: make search dropdown headers selectable with keyboard and mouse Refactor SearchDropdown to use a flat item list for unified keyboard navigation. Section headers (Cosplayers/Albums) are now clickable links that navigate to the respective list page with the search query as a ?search= parameter. --- .../Components/Shared/SearchDropdown.razor | 195 +++++++++++++----- .../Shared/SearchDropdown.razor.css | 10 + 2 files changed, 155 insertions(+), 50 deletions(-) diff --git a/MilkStream.Client/Components/Shared/SearchDropdown.razor b/MilkStream.Client/Components/Shared/SearchDropdown.razor index fb0ac27..c55bcf7 100644 --- a/MilkStream.Client/Components/Shared/SearchDropdown.razor +++ b/MilkStream.Client/Components/Shared/SearchDropdown.razor @@ -37,7 +37,7 @@ Searching...
} - else if (_persons.Count == 0 && _albums.Count == 0) + else if (_items.Count == 0) {
No results found @@ -45,56 +45,62 @@ } else { - @if (_persons.Count > 0) + var index = 0; + @foreach (var item in _items) { -
Cosplayers
- @foreach (var person in _persons) + var idx = index; + var active = idx == _selectedIndex ? "active" : ""; + + @if (item.Kind is SearchItemKind.HeaderPerson or SearchItemKind.HeaderAlbum) { - var idx = _persons.IndexOf(person); - - @if (person.ProfileAssetId.HasValue) + @item.Label + + } + else if (item.Kind == SearchItemKind.Person) + { + + @if (item.ImageId.HasValue) { - + } else { -
@person.Name[..1].ToUpper()
+
@item.Label[..1].ToUpper()
}
-
@person.Name
+
@item.Label
 } - } - - @if (_albums.Count > 0) - { -
Albums
- @foreach (var album in _albums) + else { - var idx = _persons.Count + _albums.IndexOf(album); - - @if (album.CoverAssetId.HasValue) + @if (item.ImageId.HasValue) { - + } else {
}
-
@album.Name
- @if (!string.IsNullOrEmpty(album.PersonName)) +
@item.Label
+ @if (!string.IsNullOrEmpty(item.Subtitle)) { - @album.PersonName + @item.Subtitle }
} + + index++; } }
@@ -103,8 +109,7 @@ @code { string _query = string.Empty; - List _persons = []; - List _albums = []; + List _items = []; bool _isSearching; bool _showDropdown; int _searchVersion; @@ -123,8 +128,7 @@ if (_query.Length < 2) { - _persons = []; - _albums = []; + _items = []; _showDropdown = false; _selectedIndex = -1; return; @@ -140,31 +144,69 @@ if (version != _searchVersion) return; - _persons = personTask.Result ?? []; - _albums = albumTask.Result ?? []; + BuildItems(personTask.Result ?? [], albumTask.Result ?? []); _isSearching = false; _showDropdown = true; } + void BuildItems(List persons, List albums) + { + _items = []; + + if (persons.Count > 0) + { + _items.Add(new SearchItem + { + Kind = SearchItemKind.HeaderPerson, + Label = "Cosplayers", + Url = $"/cosplayers?search={Uri.EscapeDataString(_query)}" + }); + foreach (var p in persons) + { + _items.Add(new SearchItem + { + Kind = SearchItemKind.Person, + Label = p.Name, + Url = $"/cosplayer/{p.Id}", + ImageId = p.ProfileAssetId + }); + } + } + + if (albums.Count > 0) + { + _items.Add(new SearchItem + { + Kind = SearchItemKind.HeaderAlbum, + Label = "Albums", + Url = $"/albums?search={Uri.EscapeDataString(_query)}" + }); + foreach (var a in albums) + { + _items.Add(new SearchItem + { + Kind = SearchItemKind.Album, + Label = a.Name, + Url = $"/albums/{a.Id}", + ImageId = a.CoverAssetId, + Subtitle = a.PersonName + }); + } + } + } + async Task OnSearchClick() { - var total = _persons.Count + _albums.Count; - if (total == 0) return; + if (_items.Count == 0) return; - if (_selectedIndex >= 0 && _selectedIndex < _persons.Count) - Nav.NavigateTo($"/cosplayer/{_persons[_selectedIndex].Id}"); - else if (_selectedIndex >= _persons.Count && _selectedIndex < total) - Nav.NavigateTo($"/albums/{_albums[_selectedIndex - _persons.Count].Id}"); - else if (_persons.Count > 0) - Nav.NavigateTo($"/cosplayer/{_persons[0].Id}"); - else if (_albums.Count > 0) - Nav.NavigateTo($"/albums/{_albums[0].Id}"); + var target = _selectedIndex >= 0 ? _items[_selectedIndex] : _items[0]; + Nav.NavigateTo(target.Url); } void OnFocus() { _blurCts?.Cancel(); - if (_query.Length >= 2 && (_persons.Count > 0 || _albums.Count > 0)) + if (_query.Length >= 2 && _items.Count > 0) _showDropdown = true; } @@ -185,23 +227,19 @@ void OnKeyDown(KeyboardEventArgs e) { - var total = _persons.Count + _albums.Count; - if (total == 0) return; + if (_items.Count == 0) return; switch (e.Key) { case "ArrowDown": - _selectedIndex = _selectedIndex >= total - 1 ? 0 : _selectedIndex + 1; + _selectedIndex = _selectedIndex >= _items.Count - 1 ? 0 : _selectedIndex + 1; break; case "ArrowUp": - _selectedIndex = _selectedIndex <= 0 ? total - 1 : _selectedIndex - 1; + _selectedIndex = _selectedIndex <= 0 ? _items.Count - 1 : _selectedIndex - 1; break; case "Enter": if (_selectedIndex < 0) _selectedIndex = 0; - if (_selectedIndex < _persons.Count) - Nav.NavigateTo($"/cosplayer/{_persons[_selectedIndex].Id}"); - else - Nav.NavigateTo($"/albums/{_albums[_selectedIndex - _persons.Count].Id}"); + Nav.NavigateTo(_items[_selectedIndex].Url); break; case "Escape": _showDropdown = false; @@ -214,4 +252,61 @@ { _selectedIndex = index; } + + /// + /// Represents a single item in the search dropdown menu. + /// + sealed class SearchItem + { + /// + /// Gets or sets the type of search item. + /// + public SearchItemKind Kind { get; init; } + + /// + /// Gets or sets the display label. + /// + public string Label { get; init; } = string.Empty; + + /// + /// Gets or sets the navigation URL. + /// + public string Url { get; init; } = string.Empty; + + /// + /// Gets or sets the optional thumbnail image asset ID. + /// + public Guid? ImageId { get; init; } + + /// + /// Gets or sets an optional subtitle (e.g. person name for albums). + /// + public string? Subtitle { get; init; } + } + + /// + /// Categorizes a search dropdown item. + /// + enum SearchItemKind + { + /// + /// "Cosplayers" section header. + /// + HeaderPerson, + + /// + /// "Albums" section header. + /// + HeaderAlbum, + + /// + /// A cosplayer result. + /// + Person, + + /// + /// An album result. + /// + Album + } } diff --git a/MilkStream.Client/Components/Shared/SearchDropdown.razor.css b/MilkStream.Client/Components/Shared/SearchDropdown.razor.css index f9f1da9..1069d4f 100644 --- a/MilkStream.Client/Components/Shared/SearchDropdown.razor.css +++ b/MilkStream.Client/Components/Shared/SearchDropdown.razor.css @@ -14,12 +14,22 @@ } .search-dropdown-header { + display: block; padding: 0.375rem 0.75rem; font-size: 0.75rem; font-weight: 600; color: var(--bs-secondary-color, #6c757d); text-transform: uppercase; letter-spacing: 0.05em; + text-decoration: none; + cursor: pointer; + transition: background 0.1s, color 0.1s; +} + +.search-dropdown-header:hover, +.search-dropdown-header.active { + background: var(--bs-tertiary-bg, #e9ecef); + color: var(--bs-body-color, #212529); } .search-dropdown-item { -- 2.54.0 From 0b8c435f7cb47457faa5bf38b3f66bedd5a7b190 Mon Sep 17 00:00:00 2001 From: REDCODE Date: Sat, 11 Jul 2026 17:28:51 +0200 Subject: [PATCH 06/50] feat: parse ?search= query param on Cosplayers and Albums pages Headers in the search dropdown navigate to the respective list page with the search query pre-filled via ?search= parameter. Both pages now parse this parameter on initialization. --- MilkStream.Client/Components/Pages/Albums.razor | 13 +++++++++++++ MilkStream.Client/Components/Pages/Cosplayers.razor | 13 +++++++++++++ 2 files changed, 26 insertions(+) diff --git a/MilkStream.Client/Components/Pages/Albums.razor b/MilkStream.Client/Components/Pages/Albums.razor index 1f513b5..a73f6f1 100644 --- a/MilkStream.Client/Components/Pages/Albums.razor +++ b/MilkStream.Client/Components/Pages/Albums.razor @@ -103,6 +103,19 @@ await jsRuntime.InvokeVoidAsync("masonryObserver.unlockBodyScroll"); _loggedUserChangedHandler = (_, _) => StateHasChanged(); loginService.LoggedUserChanged += _loggedUserChangedHandler; + ParseSearchQuery(); + } + + void ParseSearchQuery() { + var uri = navigationManager.Uri; + var qIdx = uri.IndexOf('?'); + if (qIdx < 0) return; + foreach (var part in uri[(qIdx + 1)..].Split('&')) + { + var kv = part.Split('=', 2); + if (kv.Length == 2 && kv[0] == "search") + searchQuery = Uri.UnescapeDataString(kv[1].Replace("+", " ")); + } } void SetMasonry() => viewMode = "masonry"; diff --git a/MilkStream.Client/Components/Pages/Cosplayers.razor b/MilkStream.Client/Components/Pages/Cosplayers.razor index 2e85d5c..7458989 100644 --- a/MilkStream.Client/Components/Pages/Cosplayers.razor +++ b/MilkStream.Client/Components/Pages/Cosplayers.razor @@ -85,6 +85,19 @@ protected override async Task OnInitializedAsync() { loginService.LoggedUserChanged += OnLoggedUserChanged; + ParseSearchQuery(); + } + + void ParseSearchQuery() { + var uri = navigationManager.Uri; + var qIdx = uri.IndexOf('?'); + if (qIdx < 0) return; + foreach (var part in uri[(qIdx + 1)..].Split('&')) + { + var kv = part.Split('=', 2); + if (kv.Length == 2 && kv[0] == "search") + searchQuery = Uri.UnescapeDataString(kv[1].Replace("+", " ")); + } } void OnLoggedUserChanged(object? _, UserInfoDto? _2) => StateHasChanged(); -- 2.54.0 From e02466771ad2a41c371982fbf9833daa07af6284 Mon Sep 17 00:00:00 2001 From: REDCODE Date: Sat, 11 Jul 2026 17:30:17 +0200 Subject: [PATCH 07/50] fix: pressing enter with nothing selected does nothing --- MilkStream.Client/Components/Shared/SearchDropdown.razor | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/MilkStream.Client/Components/Shared/SearchDropdown.razor b/MilkStream.Client/Components/Shared/SearchDropdown.razor index c55bcf7..d06f6d6 100644 --- a/MilkStream.Client/Components/Shared/SearchDropdown.razor +++ b/MilkStream.Client/Components/Shared/SearchDropdown.razor @@ -197,10 +197,9 @@ async Task OnSearchClick() { - if (_items.Count == 0) return; + if (_items.Count == 0 || _selectedIndex < 0) return; - var target = _selectedIndex >= 0 ? _items[_selectedIndex] : _items[0]; - Nav.NavigateTo(target.Url); + Nav.NavigateTo(_items[_selectedIndex].Url); } void OnFocus() @@ -238,7 +237,7 @@ _selectedIndex = _selectedIndex <= 0 ? _items.Count - 1 : _selectedIndex - 1; break; case "Enter": - if (_selectedIndex < 0) _selectedIndex = 0; + if (_selectedIndex < 0) return; Nav.NavigateTo(_items[_selectedIndex].Url); break; case "Escape": -- 2.54.0 From f2059e0dd71ec583a5d123d005669e9ba1be423b Mon Sep 17 00:00:00 2001 From: REDCODE Date: Sat, 11 Jul 2026 17:34:04 +0200 Subject: [PATCH 08/50] fix: move query param parsing to OnParametersSet OnInitializedAsync only fires once per component lifetime, so re-navigating to the same page with a different ?search= value wouldn't re-parse. OnParametersSet fires on every parameter change, covering both initial load and subsequent navigations. --- MilkStream.Client/Components/Pages/Albums.razor | 3 +++ MilkStream.Client/Components/Pages/Cosplayers.razor | 3 +++ 2 files changed, 6 insertions(+) diff --git a/MilkStream.Client/Components/Pages/Albums.razor b/MilkStream.Client/Components/Pages/Albums.razor index a73f6f1..21d32b6 100644 --- a/MilkStream.Client/Components/Pages/Albums.razor +++ b/MilkStream.Client/Components/Pages/Albums.razor @@ -103,6 +103,9 @@ await jsRuntime.InvokeVoidAsync("masonryObserver.unlockBodyScroll"); _loggedUserChangedHandler = (_, _) => StateHasChanged(); loginService.LoggedUserChanged += _loggedUserChangedHandler; + } + + protected override void OnParametersSet() { ParseSearchQuery(); } diff --git a/MilkStream.Client/Components/Pages/Cosplayers.razor b/MilkStream.Client/Components/Pages/Cosplayers.razor index 7458989..6a2038a 100644 --- a/MilkStream.Client/Components/Pages/Cosplayers.razor +++ b/MilkStream.Client/Components/Pages/Cosplayers.razor @@ -85,6 +85,9 @@ protected override async Task OnInitializedAsync() { loginService.LoggedUserChanged += OnLoggedUserChanged; + } + + protected override void OnParametersSet() { ParseSearchQuery(); } -- 2.54.0 From 5fba560bec8d9966d2cb08a7bf7692c0336458f3 Mon Sep 17 00:00:00 2001 From: REDCODE Date: Sat, 11 Jul 2026 17:38:51 +0200 Subject: [PATCH 09/50] fix: parse search query before await in Albums OnInitializedAsync Blazor triggers an early render when OnInitializedAsync has a true await (masonryObserver.unlockBodyScroll). By that point searchQuery was still null, so the grid briefly loaded unfiltered results and a stale response could overwrite the correct filtered results. ParseSearchQuery must run before the await to ensure the first render passes the correct search query to AlbumGrid. --- MilkStream.Client/Components/Pages/Albums.razor | 1 + 1 file changed, 1 insertion(+) diff --git a/MilkStream.Client/Components/Pages/Albums.razor b/MilkStream.Client/Components/Pages/Albums.razor index 21d32b6..531b1aa 100644 --- a/MilkStream.Client/Components/Pages/Albums.razor +++ b/MilkStream.Client/Components/Pages/Albums.razor @@ -100,6 +100,7 @@ }; protected override async Task OnInitializedAsync() { + ParseSearchQuery(); await jsRuntime.InvokeVoidAsync("masonryObserver.unlockBodyScroll"); _loggedUserChangedHandler = (_, _) => StateHasChanged(); loginService.LoggedUserChanged += _loggedUserChangedHandler; -- 2.54.0 From c5ba90202ddaa287b37f48f7e4c85afa4b683817 Mon Sep 17 00:00:00 2001 From: REDCODE Date: Sat, 11 Jul 2026 17:44:13 +0200 Subject: [PATCH 10/50] style: add chevron-right indicator to search dropdown headers Shows a right-pointing arrow on section headers (Cosplayers/Albums) to visually signal they are clickable and navigate to the list page. The arrow subtly moves right on hover for extra affordance. --- .../Components/Shared/SearchDropdown.razor | 3 ++- .../Components/Shared/SearchDropdown.razor.css | 16 +++++++++++++++- 2 files changed, 17 insertions(+), 2 deletions(-) diff --git a/MilkStream.Client/Components/Shared/SearchDropdown.razor b/MilkStream.Client/Components/Shared/SearchDropdown.razor index d06f6d6..f2f6746 100644 --- a/MilkStream.Client/Components/Shared/SearchDropdown.razor +++ b/MilkStream.Client/Components/Shared/SearchDropdown.razor @@ -56,7 +56,8 @@ - @item.Label + @item.Label + } else if (item.Kind == SearchItemKind.Person) diff --git a/MilkStream.Client/Components/Shared/SearchDropdown.razor.css b/MilkStream.Client/Components/Shared/SearchDropdown.razor.css index 1069d4f..1a9705b 100644 --- a/MilkStream.Client/Components/Shared/SearchDropdown.razor.css +++ b/MilkStream.Client/Components/Shared/SearchDropdown.razor.css @@ -14,7 +14,9 @@ } .search-dropdown-header { - display: block; + display: flex; + align-items: center; + justify-content: space-between; padding: 0.375rem 0.75rem; font-size: 0.75rem; font-weight: 600; @@ -26,6 +28,18 @@ transition: background 0.1s, color 0.1s; } +.search-dropdown-header .bi { + font-size: 0.7rem; + opacity: 0.5; + transition: opacity 0.1s, transform 0.1s; +} + +.search-dropdown-header:hover .bi, +.search-dropdown-header.active .bi { + opacity: 0.8; + transform: translateX(1px); +} + .search-dropdown-header:hover, .search-dropdown-header.active { background: var(--bs-tertiary-bg, #e9ecef); -- 2.54.0 From faa8e93d55914c6d8824252f5611791e0eddca73 Mon Sep 17 00:00:00 2001 From: REDCODE Date: Sat, 11 Jul 2026 18:03:17 +0200 Subject: [PATCH 11/50] fix: use case-insensitive ILike search for persons and albums Replace EF Core Contains() with EF.Functions.ILike() which translates to PostgreSQL ILIKE for case-insensitive matching. Searching 'alice', 'Alice', or 'ALICE' now returns the same results. --- Lactose/Repositories/AlbumRepository.cs | 2 +- Lactose/Repositories/PersonRepository.cs | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/Lactose/Repositories/AlbumRepository.cs b/Lactose/Repositories/AlbumRepository.cs index 4d59d5a..8e19864 100644 --- a/Lactose/Repositories/AlbumRepository.cs +++ b/Lactose/Repositories/AlbumRepository.cs @@ -29,7 +29,7 @@ public class AlbumRepository(LactoseDbContext context) : IAlbumRepository { .Include(a => a.CoverAsset) .Include(a => a.PersonOwner) .Include(a => a.Assets)!.ThenInclude(a => a.SharedWith) - .Where(x => x.Title.Contains(query)); + .Where(x => EF.Functions.ILike(x.Title, $"%{query}%")); if (unassigned) albumsQuery = albumsQuery.Where(a => a.PersonOwnerId == null); diff --git a/Lactose/Repositories/PersonRepository.cs b/Lactose/Repositories/PersonRepository.cs index 26fdcf7..f85f03d 100644 --- a/Lactose/Repositories/PersonRepository.cs +++ b/Lactose/Repositories/PersonRepository.cs @@ -76,7 +76,7 @@ public class PersonRepository(LactoseDbContext context) : IPersonRepository { // Apply search filter if (!string.IsNullOrEmpty(query)) - peopleQuery = peopleQuery.Where(p => p.Name.Contains(query)); + peopleQuery = peopleQuery.Where(p => EF.Functions.ILike(p.Name, $"%{query}%")); // Apply sorting IOrderedQueryable ordered = sortBy?.ToLower() switch -- 2.54.0 From 7ea72e13ac66f5e70f97f7483af011ab57df35a4 Mon Sep 17 00:00:00 2001 From: REDCODE Date: Sat, 11 Jul 2026 18:09:57 +0200 Subject: [PATCH 12/50] style: use Bootstrap dropdown-menu and dropdown-item classes Match styling of the user profile dropdown in the navbar by using Bootstrap's native .dropdown-menu and .dropdown-item classes instead of custom classes. Keep only custom positioning, thumbnail sizing, and the clickable header styles. --- .../Components/Shared/SearchDropdown.razor | 12 ++--- .../Shared/SearchDropdown.razor.css | 46 +++---------------- 2 files changed, 13 insertions(+), 45 deletions(-) diff --git a/MilkStream.Client/Components/Shared/SearchDropdown.razor b/MilkStream.Client/Components/Shared/SearchDropdown.razor index f2f6746..7be603c 100644 --- a/MilkStream.Client/Components/Shared/SearchDropdown.razor +++ b/MilkStream.Client/Components/Shared/SearchDropdown.razor @@ -30,16 +30,16 @@ @if (_showDropdown) { -
+
@if (_isSearching) { -
+
Searching...
} else if (_items.Count == 0) { -
+
No results found
} @@ -53,7 +53,7 @@ @if (item.Kind is SearchItemKind.HeaderPerson or SearchItemKind.HeaderAlbum) { - @item.Label @@ -62,7 +62,7 @@ } else if (item.Kind == SearchItemKind.Person) { - @if (item.ImageId.HasValue) @@ -80,7 +80,7 @@ } else { - @if (item.ImageId.HasValue) diff --git a/MilkStream.Client/Components/Shared/SearchDropdown.razor.css b/MilkStream.Client/Components/Shared/SearchDropdown.razor.css index 1a9705b..351bf37 100644 --- a/MilkStream.Client/Components/Shared/SearchDropdown.razor.css +++ b/MilkStream.Client/Components/Shared/SearchDropdown.razor.css @@ -3,29 +3,20 @@ top: 100%; left: 0; right: 0; - z-index: 1030; max-height: 400px; overflow-y: auto; - background: var(--bs-body-bg, #fff); - border: 1px solid var(--bs-border-color, #dee2e6); - border-radius: 0.375rem; - box-shadow: 0 0.5rem 1rem rgba(0, 0, 0, 0.15); margin-top: 0.25rem; } .search-dropdown-header { - display: flex; + display: flex !important; align-items: center; justify-content: space-between; - padding: 0.375rem 0.75rem; - font-size: 0.75rem; - font-weight: 600; - color: var(--bs-secondary-color, #6c757d); text-transform: uppercase; + font-size: 0.75rem !important; + font-weight: 600 !important; letter-spacing: 0.05em; - text-decoration: none; - cursor: pointer; - transition: background 0.1s, color 0.1s; + color: var(--bs-secondary-color, #6c757d) !important; } .search-dropdown-header .bi { @@ -40,33 +31,10 @@ transform: translateX(1px); } -.search-dropdown-header:hover, -.search-dropdown-header.active { - background: var(--bs-tertiary-bg, #e9ecef); - color: var(--bs-body-color, #212529); -} - -.search-dropdown-item { - display: flex; +.search-dropdown-item-flex { + display: flex !important; align-items: center; gap: 0.5rem; - padding: 0.375rem 0.75rem; - text-decoration: none; - color: var(--bs-body-color, #212529); - cursor: pointer; - transition: background 0.1s; -} - -.search-dropdown-item:hover, -.search-dropdown-item.active { - background: var(--bs-tertiary-bg, #e9ecef); - color: var(--bs-body-color, #212529); -} - -.search-dropdown-item.disabled { - cursor: default; - justify-content: center; - padding: 0.75rem; } .search-dropdown-thumb { @@ -120,7 +88,7 @@ line-height: 1.25; } -.search-dropdown-item small { +.dropdown-item small { font-size: 0.75rem; line-height: 1.2; } -- 2.54.0 From 3b05061a317bdb4b243f08b0228d183ab0e72bdc Mon Sep 17 00:00:00 2001 From: REDCODE Date: Sat, 11 Jul 2026 18:15:04 +0200 Subject: [PATCH 13/50] fix: override Bootstrap dropdown-menu display:none Bootstrap's .dropdown-menu sets display:none. Add display:block to .search-dropdown-menu to make the search dropdown visible. --- MilkStream.Client/Components/Shared/SearchDropdown.razor.css | 1 + 1 file changed, 1 insertion(+) diff --git a/MilkStream.Client/Components/Shared/SearchDropdown.razor.css b/MilkStream.Client/Components/Shared/SearchDropdown.razor.css index 351bf37..4ac8e8a 100644 --- a/MilkStream.Client/Components/Shared/SearchDropdown.razor.css +++ b/MilkStream.Client/Components/Shared/SearchDropdown.razor.css @@ -1,4 +1,5 @@ .search-dropdown-menu { + display: block; position: absolute; top: 100%; left: 0; -- 2.54.0 From b9fd5e172c358a8ec196f2c3227c08d3b848739d Mon Sep 17 00:00:00 2001 From: REDCODE Date: Sat, 11 Jul 2026 18:33:51 +0200 Subject: [PATCH 14/50] test: add endpoint tests for refresh token, albums, curator auth levels Add HTTP endpoint tests covering: - Refresh token endpoint (empty body, valid, auth failures) - Album GET by ID (rng user, admin, non-existent) - Album search (rng user, admin) - User get all and profile update (rng user, admin) - Stats endpoint (admin, curator, rng user 403) - Tag search and create (admin, rng user 403) - Asset search (rng user, anonymous) - Curator-level CRUD permissions (person, album, stats succeed; user creation and settings access 403) - Cleanup of curator test user --- Lactose/WepApiTest.http | 388 ++++++++++++++++++++++++++++++++++++++++ 1 file changed, 388 insertions(+) diff --git a/Lactose/WepApiTest.http b/Lactose/WepApiTest.http index 2b4d343..aa47626 100644 --- a/Lactose/WepApiTest.http +++ b/Lactose/WepApiTest.http @@ -476,3 +476,391 @@ Accept: application/json client.assert(response.status === 404) }); %} + +### Create curator user as admin +< {% + client.global.set("rngCurator", $random.alphabetic(15)); + client.global.set("rngCuratorPwd", "test" + $random.alphabetic(5)); +%} + +PUT {{WepApiTest_HostAddress}}/api/user +Authorization: Bearer {{admin_token}} +Content-Type: application/json + +{ + "username": "{{rngCurator}}", + "email": "{{rngCurator}}@redcode.com", + "password": "{{rngCuratorPwd}}", + "accessLevel": 2 +} + +> {% + client.global.set("curatorUserId", jsonPath(response.body, "$")); + client.test("Create curator user as admin", function () { + client.assert(response.status === 200) + }); +%} + +### Login as curator +POST {{WepApiTest_HostAddress}}/api/auth/login +Content-Type: application/json + +{ + "identifier": "{{rngCurator}}", + "password": "{{rngCuratorPwd}}" +} + +> {% + client.global.set("curator_token", jsonPath(response.body, "$.token")); + client.test("Login as curator", function () { + client.assert(response.status === 200) + }); +%} + +### Login again to get fresh token for subsequent tests +POST {{WepApiTest_HostAddress}}/api/auth/login +Content-Type: application/json + +{ + "identifier": "{{rngUser}}", + "password": "{{rngPassword}}" +} + +> {% + client.global.set("auth_token", jsonPath(response.body, "$.token")); + client.global.set("refresh_token", jsonPath(response.body, "$.refreshToken")); + client.global.set("user_id", jsonPath(response.body, "$.userId")); + client.test("Re-login rng user for refresh test", function () { + client.assert(response.status === 200) + }); +%} + +### Refresh token with empty body (should be 400) +POST {{WepApiTest_HostAddress}}/api/auth/refresh +Content-Type: application/json + +{ + "userId": "", + "refreshToken": "" +} + +> {% + client.test("Refresh token with empty body returns 400", function () { + client.assert(response.status === 400) + }); +%} + +### Refresh token with valid data +POST {{WepApiTest_HostAddress}}/api/auth/refresh +Content-Type: application/json + +{ + "userId": "{{user_id}}", + "refreshToken": "{{refresh_token}}" +} + +> {% + client.global.set("auth_token", jsonPath(response.body, "$.token")); + client.test("Refresh token with valid data", function () { + client.assert(response.status === 200) + client.assert(jsonPath(response.body, "$.token") != null) + }); +%} + +### Get all albums as rng user +GET {{WepApiTest_HostAddress}}/api/album +Authorization: Bearer {{auth_token}} + +> {% + client.test("Get all albums as rng user", function () { + client.assert(response.status === 200) + }); +%} + +### Get all albums as admin +GET {{WepApiTest_HostAddress}}/api/album +Authorization: Bearer {{admin_token}} + +> {% + client.test("Get all albums as admin", function () { + client.assert(response.status === 200) + }); +%} + +### Search albums as admin +GET {{WepApiTest_HostAddress}}/api/album?search=test&pageSize=5 +Authorization: Bearer {{admin_token}} + +> {% + client.test("Search albums as admin", function () { + client.assert(response.status === 200) + }); +%} + +### Create album for GET-by-ID and bulk tests +PUT {{WepApiTest_HostAddress}}/api/album +Authorization: Bearer {{admin_token}} +Content-Type: application/json + +{ + "name": "Album for GET-by-ID test" +} + +> {% + client.global.set("testAlbumId2", jsonPath(response.body, "$")); + client.test("Create album for GET-by-ID test", function () { + client.assert(response.status === 200) + }); +%} + +### Get album by ID as rng user +GET {{WepApiTest_HostAddress}}/api/album/{{testAlbumId2}} +Authorization: Bearer {{auth_token}} + +> {% + client.test("Get album by ID as rng user", function () { + client.assert(response.status === 200 || response.status === 404) + }); +%} + +### Get album by ID as admin +GET {{WepApiTest_HostAddress}}/api/album/{{testAlbumId2}} +Authorization: Bearer {{admin_token}} + +> {% + client.test("Get album by ID as admin", function () { + client.assert(response.status === 200) + client.assert(jsonPath(response.body, "$.id") != null) + }); +%} + +### Get non-existent album (should 404) +GET {{WepApiTest_HostAddress}}/api/album/00000000-0000-0000-0000-000000000000 +Authorization: Bearer {{admin_token}} + +> {% + client.test("Get non-existent album", function () { + client.assert(response.status === 404) + }); +%} + +### Delete album for GET-by-ID test +DELETE {{WepApiTest_HostAddress}}/api/album/{{testAlbumId2}} +Authorization: Bearer {{admin_token}} + +> {% + client.test("Delete album for GET-by-ID test", function () { + client.assert(response.status === 200) + }); +%} + +### Get all users as admin +GET {{WepApiTest_HostAddress}}/api/user +Authorization: Bearer {{admin_token}} + +> {% + client.test("Get all users as admin", function () { + client.assert(response.status === 200) + }); +%} + +### Get all users as rng user (should be 403) +GET {{WepApiTest_HostAddress}}/api/user +Authorization: Bearer {{auth_token}} + +> {% + client.test("Get all users as rng user should 403", function () { + client.assert(response.status === 403) + }); +%} + +### Update own profile as rng user +POST {{WepApiTest_HostAddress}}/api/user/update +Authorization: Bearer {{auth_token}} +Content-Type: application/json + +{ + "username": "{{rngUser}}" +} + +> {% + client.test("Update own profile as rng user", function () { + client.assert(response.status === 200) + }); +%} + +### Get stats as admin +GET {{WepApiTest_HostAddress}}/api/stats +Authorization: Bearer {{admin_token}} + +> {% + client.test("Get stats as admin", function () { + client.assert(response.status === 200) + }); +%} + +### Get stats as rng user (should be 403) +GET {{WepApiTest_HostAddress}}/api/stats +Authorization: Bearer {{auth_token}} + +> {% + client.test("Get stats as rng user should 403", function () { + client.assert(response.status === 403) + }); +%} + +### Search tags as admin +GET {{WepApiTest_HostAddress}}/api/tag?search=test&pageSize=5 +Authorization: Bearer {{admin_token}} + +> {% + client.test("Search tags as admin", function () { + client.assert(response.status === 200) + }); +%} + +### Create tag as rng user (should be 403) +PUT {{WepApiTest_HostAddress}}/api/tag +Authorization: Bearer {{auth_token}} +Content-Type: application/json + +{ + "name": "hacker-tag" +} + +> {% + client.test("Create tag as rng user should 403", function () { + client.assert(response.status === 403) + }); +%} + +### Search assets as rng user +GET {{WepApiTest_HostAddress}}/api/asset?page=0&pageSize=5 +Authorization: Bearer {{auth_token}} + +> {% + client.test("Search assets as rng user", function () { + client.assert(response.status === 200) + }); +%} + +### Search assets as anonymous +GET {{WepApiTest_HostAddress}}/api/asset?page=0&pageSize=5 + +> {% + client.test("Search assets as anonymous", function () { + client.assert(response.status === 200) + }); +%} + +### Create person as curator (should succeed) +< {% + client.global.set("curatorPerson", $random.alphabetic(15)); +%} + +PUT {{WepApiTest_HostAddress}}/api/person +Authorization: Bearer {{curator_token}} +Content-Type: application/json + +{ + "name": "{{curatorPerson}}" +} + +> {% + client.global.set("curatorPersonId", jsonPath(response.body, "$")); + client.test("Create person as curator", function () { + client.assert(response.status === 200) + }); +%} + +### Delete person as curator (should succeed) +DELETE {{WepApiTest_HostAddress}}/api/person/{{curatorPersonId}} +Authorization: Bearer {{curator_token}} + +> {% + client.test("Delete person as curator", function () { + client.assert(response.status === 200) + }); +%} + +### Create album as curator (should succeed) +< {% + client.global.set("curatorAlbum", $random.alphabetic(15)); +%} + +PUT {{WepApiTest_HostAddress}}/api/album +Authorization: Bearer {{curator_token}} +Content-Type: application/json + +{ + "name": "{{curatorAlbum}}" +} + +> {% + client.global.set("curatorAlbumId", jsonPath(response.body, "$")); + client.test("Create album as curator", function () { + client.assert(response.status === 200) + }); +%} + +### Delete album as curator (should succeed) +DELETE {{WepApiTest_HostAddress}}/api/album/{{curatorAlbumId}} +Authorization: Bearer {{curator_token}} + +> {% + client.test("Delete album as curator", function () { + client.assert(response.status === 200) + }); +%} + +### Get stats as curator (should succeed) +GET {{WepApiTest_HostAddress}}/api/stats +Authorization: Bearer {{curator_token}} + +> {% + client.test("Get stats as curator", function () { + client.assert(response.status === 200) + }); +%} + +### Create user as curator (should be 403) +< {% + client.global.set("curatorUserCreate", $random.alphabetic(10)); +%} + +PUT {{WepApiTest_HostAddress}}/api/user +Authorization: Bearer {{curator_token}} +Content-Type: application/json + +{ + "username": "{{curatorUserCreate}}", + "email": "{{curatorUserCreate}}@redcode.com", + "password": "test1234", + "accessLevel": 0 +} + +> {% + client.test("Create user as curator should 403", function () { + client.assert(response.status === 403) + }); +%} + +### Get settings as curator (should be 403) +GET {{WepApiTest_HostAddress}}/api/settings +Authorization: Bearer {{curator_token}} + +> {% + client.test("Get settings as curator should 403", function () { + client.assert(response.status === 403) + }); +%} + +### Delete curator user as admin +DELETE {{WepApiTest_HostAddress}}/api/user/{{curatorUserId}} +Authorization: Bearer {{admin_token}} + +> {% + client.test("Delete curator user as admin", function () { + client.assert(response.status === 200) + }); +%} -- 2.54.0 From f626228c2f782d7833f19ef1bdb9595b26e45e35 Mon Sep 17 00:00:00 2001 From: REDCODE Date: Sat, 11 Jul 2026 18:38:06 +0200 Subject: [PATCH 15/50] fix: return 401 Unauthorized when user data is null in PersonController PersonController.GetAll used uid!.Value which throws NRE if authService.GetUserData returns null (e.g. claims present but user not found). Return 401 Unauthorized instead of crashing. --- Lactose/Controllers/PersonController.cs | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/Lactose/Controllers/PersonController.cs b/Lactose/Controllers/PersonController.cs index 4b16cba..1dd1af1 100644 --- a/Lactose/Controllers/PersonController.cs +++ b/Lactose/Controllers/PersonController.cs @@ -75,13 +75,15 @@ public class PersonController( var uid = authService.GetUserData(User)?.Id; var accessLevel = authService.GetUserData(User)?.AccessLevel ?? EAccessLevel.User; + if (uid == null) return Unauthorized(); + var people = personRepository.SearchQuery( pagedSearch.Search ?? string.Empty, pagedSearch.Page, pagedSearch.PageSize, pagedSearch.SortBy, pagedSearch.SortAsc, - uid!.Value, + uid.Value, accessLevel ).Select(p => p.ToPersonPreviewDto()) .ToList(); -- 2.54.0 From 2249e0fb2ebccb9bbca6e1a752c830ae753bef55 Mon Sep 17 00:00:00 2001 From: REDCODE Date: Sat, 11 Jul 2026 18:42:10 +0200 Subject: [PATCH 16/50] fix: allow anonymous search for persons and albums GET /api/person and GET /api/album should not require authentication. Anonymous users are treated as EAccessLevel.User, so they only see publicly shared content. PersonController.GetAll uses uid ?? default instead of uid!.Value to handle null uid safely. --- Lactose/Controllers/AlbumController.cs | 1 + Lactose/Controllers/PersonController.cs | 5 ++--- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/Lactose/Controllers/AlbumController.cs b/Lactose/Controllers/AlbumController.cs index 32a6375..3e5323e 100644 --- a/Lactose/Controllers/AlbumController.cs +++ b/Lactose/Controllers/AlbumController.cs @@ -75,6 +75,7 @@ public class AlbumController( /// Pagination, search, sort, and filter parameters. /// A list of album previews accessible to the user. [HttpGet] + [AllowAnonymous] public ActionResult> Search([FromQuery] AlbumSearchParametersDto pagingOptions) { var uid = authService.GetUserData(User)?.Id; var accessLevel = authService.GetUserData(User)?.AccessLevel ?? EAccessLevel.User; diff --git a/Lactose/Controllers/PersonController.cs b/Lactose/Controllers/PersonController.cs index 1dd1af1..2d7653a 100644 --- a/Lactose/Controllers/PersonController.cs +++ b/Lactose/Controllers/PersonController.cs @@ -71,19 +71,18 @@ public class PersonController( /// Pagination, search, and sort parameters. /// A paginated list of person previews. [HttpGet] + [AllowAnonymous] public ActionResult> GetAll([FromQuery] PersonSearchParametersDto pagedSearch) { var uid = authService.GetUserData(User)?.Id; var accessLevel = authService.GetUserData(User)?.AccessLevel ?? EAccessLevel.User; - if (uid == null) return Unauthorized(); - var people = personRepository.SearchQuery( pagedSearch.Search ?? string.Empty, pagedSearch.Page, pagedSearch.PageSize, pagedSearch.SortBy, pagedSearch.SortAsc, - uid.Value, + uid ?? default, accessLevel ).Select(p => p.ToPersonPreviewDto()) .ToList(); -- 2.54.0 From 02c62d0dd801358fd291d007fc5b6af7c2e14c08 Mon Sep 17 00:00:00 2001 From: REDCODE Date: Sat, 11 Jul 2026 18:42:13 +0200 Subject: [PATCH 17/50] test: add anonymous search tests for persons and albums --- Lactose/WepApiTest.http | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) diff --git a/Lactose/WepApiTest.http b/Lactose/WepApiTest.http index aa47626..b753cc7 100644 --- a/Lactose/WepApiTest.http +++ b/Lactose/WepApiTest.http @@ -192,6 +192,15 @@ Authorization: Bearer {{admin_token}} }); %} +### Get all people as anonymous +GET {{WepApiTest_HostAddress}}/api/person + +> {% + client.test("Get all people as anonymous", function () { + client.assert(response.status === 200) + }); +%} + ### Get all people as rng user GET {{WepApiTest_HostAddress}}/api/person Authorization: Bearer {{auth_token}} @@ -567,6 +576,15 @@ Content-Type: application/json }); %} +### Get all albums as anonymous +GET {{WepApiTest_HostAddress}}/api/album + +> {% + client.test("Get all albums as anonymous", function () { + client.assert(response.status === 200) + }); +%} + ### Get all albums as rng user GET {{WepApiTest_HostAddress}}/api/album Authorization: Bearer {{auth_token}} -- 2.54.0 From dda062d959831bee62efb40b364fe884cd131d39 Mon Sep 17 00:00:00 2001 From: REDCODE Date: Sat, 11 Jul 2026 18:46:10 +0200 Subject: [PATCH 18/50] fix: materialize person search query before client-side visibility filter The nested Any() through SharedWith navigation cannot be translated to SQL by EF Core. Apply the same pattern as GetAllVisible and AlbumController.Search: materialize server-side (search, sort, pagination), then filter by visibility in memory. --- Lactose/Repositories/PersonRepository.cs | 30 ++++++++++++++---------- 1 file changed, 17 insertions(+), 13 deletions(-) diff --git a/Lactose/Repositories/PersonRepository.cs b/Lactose/Repositories/PersonRepository.cs index f85f03d..ce48cea 100644 --- a/Lactose/Repositories/PersonRepository.cs +++ b/Lactose/Repositories/PersonRepository.cs @@ -62,17 +62,9 @@ public class PersonRepository(LactoseDbContext context) : IPersonRepository { /// public IEnumerable SearchQuery(string query, int page = 0, int pageSize = 30, string? sortBy = null, bool sortAsc = true, Guid userId = default, EAccessLevel accessLevel = EAccessLevel.User) { IQueryable peopleQuery = context.People - .Include(p => p.Albums); - - // For regular users, only show people who have at least one album with visible assets - if (accessLevel == EAccessLevel.User) { - peopleQuery = peopleQuery.Where(p => p.Albums != null && p.Albums.Any(a => - a.Assets != null && a.Assets.Any(asset => asset.DeletedAt == null && ( - asset.IsPubliclyShared || - asset.OwnerId == userId || - (asset.SharedWith != null && asset.SharedWith.Any(u => u.Id == userId)) - )))); - } + .Include(p => p.Albums)! + .ThenInclude(a => a.Assets)! + .ThenInclude(a => a.SharedWith); // Apply search filter if (!string.IsNullOrEmpty(query)) @@ -86,9 +78,21 @@ public class PersonRepository(LactoseDbContext context) : IPersonRepository { _ => sortAsc ? peopleQuery.OrderBy(p => p.Name) : peopleQuery.OrderByDescending(p => p.Name), }; - return ordered + var result = ordered .Skip(page * pageSize) - .Take(pageSize); + .Take(pageSize) + .ToList(); + + // Filter by visibility client-side (the nested SharedWith.Any() cannot be translated to SQL) + if (accessLevel == EAccessLevel.User) + result = result.Where(p => p.Albums != null && p.Albums.Any(a => + a.Assets != null && a.Assets.Any(asset => asset.DeletedAt == null && ( + asset.IsPubliclyShared || + asset.OwnerId == userId || + (asset.SharedWith != null && asset.SharedWith.Any(u => u.Id == userId)) + )))).ToList(); + + return result; } /// -- 2.54.0 From 648531fcc42128585dba4ad36b0787af449c4f99 Mon Sep 17 00:00:00 2001 From: REDCODE Date: Sat, 11 Jul 2026 18:48:50 +0200 Subject: [PATCH 19/50] test: handle empty person search results gracefully The person search may return an empty array when the database has no publicly visible people. Only set personId when results exist. --- Lactose/WepApiTest.http | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/Lactose/WepApiTest.http b/Lactose/WepApiTest.http index b753cc7..db955fb 100644 --- a/Lactose/WepApiTest.http +++ b/Lactose/WepApiTest.http @@ -207,7 +207,8 @@ Authorization: Bearer {{auth_token}} Accept: application/json > {% - client.global.set("personId", jsonPath(response.body, "$[0].id")); + if (response.body.length > 0) + client.global.set("personId", jsonPath(response.body, "$[0].id")); client.test("Get all people as rng user", function () { client.assert(response.status === 200) }); -- 2.54.0 From fd46faec21072761254310064b9d82428a46ba1a Mon Sep 17 00:00:00 2001 From: REDCODE Date: Sat, 11 Jul 2026 18:50:17 +0200 Subject: [PATCH 20/50] test: set personId from admin search to ensure it's always populated Rng user may see no public people, leaving personId unset. Admin sees all people including test-created ones, so setting personId from the admin response ensures downstream tests have a valid reference. --- Lactose/WepApiTest.http | 2 ++ 1 file changed, 2 insertions(+) diff --git a/Lactose/WepApiTest.http b/Lactose/WepApiTest.http index db955fb..ae8a595 100644 --- a/Lactose/WepApiTest.http +++ b/Lactose/WepApiTest.http @@ -220,6 +220,8 @@ Authorization: Bearer {{admin_token}} Accept: application/json > {% + if (response.body.length > 0) + client.global.set("personId", jsonPath(response.body, "$[0].id")); client.test("Get all people as admin", function () { client.assert(response.status === 200) }); -- 2.54.0 From e27d63cf320133c9a6532865cb601b017045059e Mon Sep 17 00:00:00 2001 From: REDCODE Date: Sat, 11 Jul 2026 18:51:26 +0200 Subject: [PATCH 21/50] fix: restrict user list to admin only UserController.GetAll was missing [Authorize(Roles = Admin)], allowing any authenticated user to list all users. --- Lactose/Controllers/UserController.cs | 10 +--------- 1 file changed, 1 insertion(+), 9 deletions(-) diff --git a/Lactose/Controllers/UserController.cs b/Lactose/Controllers/UserController.cs index c2628b5..c620d70 100644 --- a/Lactose/Controllers/UserController.cs +++ b/Lactose/Controllers/UserController.cs @@ -97,18 +97,10 @@ namespace Lactose.Controllers { /// Gets all users. /// /// A list of all users. + [Authorize(Roles = "Admin")] [HttpGet] public ActionResult> GetAll() { logger.LogDebug("Sending Users list"); - LactoseAuthenticatedUser? authenticatedUser = authService.GetUserData(User); - - if (authenticatedUser == null) { - logger.LogWarning(@"Anonymous User hasn't enough permissions to create a User. it shouldn't be here"); - return Unauthorized("Unauthorized"); - } - - //TODO: Lower level of access should fill less information of users - //if (false) return Unauthorized(); return Ok(userRepository.GetAll().Select(u => u.ToGetUsersDto()).ToList()); } -- 2.54.0 From bef29f5b2268cdbc3582fef9544b5e81f69bafe6 Mon Sep 17 00:00:00 2001 From: REDCODE Date: Sat, 11 Jul 2026 18:52:54 +0200 Subject: [PATCH 22/50] test: add user id to profile update request body UserUpdateDto.Id is required. The test was sending only username, causing 400 Bad Request from model binding failure. --- Lactose/WepApiTest.http | 1 + 1 file changed, 1 insertion(+) diff --git a/Lactose/WepApiTest.http b/Lactose/WepApiTest.http index ae8a595..7701725 100644 --- a/Lactose/WepApiTest.http +++ b/Lactose/WepApiTest.http @@ -701,6 +701,7 @@ Authorization: Bearer {{auth_token}} Content-Type: application/json { + "id": "{{user_id}}", "username": "{{rngUser}}" } -- 2.54.0 From ca8119f356a33372a84eb83a1af93dc1bae1d665 Mon Sep 17 00:00:00 2001 From: REDCODE Date: Sat, 11 Jul 2026 18:54:05 +0200 Subject: [PATCH 23/50] fix: add [FromQuery] to TagController.GetAll parameter Complex type PagedSearchParametersDto needs [FromQuery] for GET requests, otherwise ASP.NET Core tries body binding and returns 415. --- Lactose/Controllers/TagController.cs | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Lactose/Controllers/TagController.cs b/Lactose/Controllers/TagController.cs index ddc5623..5b60d7c 100644 --- a/Lactose/Controllers/TagController.cs +++ b/Lactose/Controllers/TagController.cs @@ -67,7 +67,7 @@ public class TagController( /// Pagination and search parameters. /// A list of tags matching the search criteria. [HttpGet] - public ActionResult> GetAll(PagedSearchParametersDto pagedSearch) { + public ActionResult> GetAll([FromQuery] PagedSearchParametersDto pagedSearch) { pagedSearch.Search ??= string.Empty; if(pagedSearch.Page < 0) { return BadRequest("Page must be greater than 0"); } if(pagedSearch.PageSize < 0) { return BadRequest("PageSize must be greater than 0"); } -- 2.54.0 From 9e52cc235139b267608202d560cff5754eba96e7 Mon Sep 17 00:00:00 2001 From: REDCODE Date: Sat, 11 Jul 2026 18:55:15 +0200 Subject: [PATCH 24/50] fix: use zero-based page numbers in AssetController to match API convention AssetController.GetAll validated page >= 1 (one-based), inconsistent with PersonController and AlbumController which use zero-based pages. Adjust validation to page >= 0 and pass page + 1 to the repository which internally uses one-based. --- Lactose/Controllers/AssetController.cs | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/Lactose/Controllers/AssetController.cs b/Lactose/Controllers/AssetController.cs index b72f6ec..646f082 100644 --- a/Lactose/Controllers/AssetController.cs +++ b/Lactose/Controllers/AssetController.cs @@ -124,14 +124,14 @@ public class AssetController( return BadRequest(); } - if (searchOptionsDto.Page < 1 || searchOptionsDto.PageSize < 1) { + if (searchOptionsDto.Page < 0 || searchOptionsDto.PageSize < 1) { logger.LogWarning("Invalid pagination parameters provided"); return BadRequest(); } var assets = assetRepository.GetAssets( searchOptionsDto.Type, from, to, searchOptionsDto.Random, searchOptionsDto.Seed, - searchOptionsDto.Page, searchOptionsDto.PageSize, out int total + searchOptionsDto.Page + 1, searchOptionsDto.PageSize, out int total ); logger.LogTrace( -- 2.54.0 From 8dd5e7158f69f487ba575326fe9cd43895d592ea Mon Sep 17 00:00:00 2001 From: REDCODE Date: Sat, 11 Jul 2026 19:00:53 +0200 Subject: [PATCH 25/50] test: fix curator user access level from Admin (2) to Curator (1) EAccessLevel enum: User=0, Curator=1, Admin=2. The test created the curator user with accessLevel=2 (Admin), making curator_token an admin token, which broke the 'Create user as curator should 403' test. --- Lactose/WepApiTest.http | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Lactose/WepApiTest.http b/Lactose/WepApiTest.http index 7701725..d84fab7 100644 --- a/Lactose/WepApiTest.http +++ b/Lactose/WepApiTest.http @@ -503,7 +503,7 @@ Content-Type: application/json "username": "{{rngCurator}}", "email": "{{rngCurator}}@redcode.com", "password": "{{rngCuratorPwd}}", - "accessLevel": 2 + "accessLevel": 1 } > {% -- 2.54.0 From 851cdfa92445c6323726ed392ec49f86311d9787 Mon Sep 17 00:00:00 2001 From: REDCODE Date: Sat, 11 Jul 2026 19:02:58 +0200 Subject: [PATCH 26/50] test: restructure WepApiTest.http with three clearly separated users MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The test file now creates three distinct users at the start: - admin (seeded, admin/admin) - curator (created by admin, accessLevel=1) - user (registered via /api/auth/register, accessLevel=0) Each user has its own token variable (admin_token, curator_token, user_token) and ID variable (admin_id, curator_id, user_id). Sections are organized: Setup → Auth → User CRUD → Person → Album → Tag → Asset → Stats → Settings → Cleanup. All endpoints are tested at each appropriate authorization level: admin (full access), curator (elevated access), user (own data only), and anonymous (public data only). --- Lactose/WepApiTest.http | 1803 +++++++++++++++++----------------- Lactose/http-client.env.json | 6 +- 2 files changed, 919 insertions(+), 890 deletions(-) diff --git a/Lactose/WepApiTest.http b/Lactose/WepApiTest.http index d84fab7..ea5b125 100644 --- a/Lactose/WepApiTest.http +++ b/Lactose/WepApiTest.http @@ -1,888 +1,915 @@ -@WepApiTest_HostAddress = http://localhost:5162 - -### -# @name Register rng user -< {% - client.global.set("rngUser", $random.alphabetic(15)); - client.global.set("rngEmail", $random.alphabetic(5) + "@redcode.com"); - client.global.set("rngPassword", "test" + $random.alphabetic(5)); -%} - -POST {{WepApiTest_HostAddress}}/api/auth/register -Content-Type: application/json - -{ - "username": "{{rngUser}}", - "email": "{{rngEmail}}", - "password": "{{rngPassword}}" -} - -> {% - client.test("Register rng user", function () { - client.assert(response.status === 200) - }); -%} - -### Login rng user - -POST {{WepApiTest_HostAddress}}/api/auth/login -Content-Type: application/json - -{ - "identifier": "{{rngUser}}", - "password": "{{rngPassword}}" -} - -> {% - client.global.set("auth_token", jsonPath(response.body, "$.token")); - client.test("Login rng user", function () { - client.assert(response.status === 200) - //client.assert(jsonPath(response.body, "$.success") != true,jsonPath(response.body, "$.errorMessage")??"null") - }); -%} - - -### API Authenticated Empty (wrong route should 404) -POST {{WepApiTest_HostAddress}}/api/auth -Content-Type: application/json - -{} - -> {% - client.test("API Authenticated Empty", function () { - client.assert(response.status === 404) - }); -%} - -### API Rng User Authenticated (correct route) -POST {{WepApiTest_HostAddress}}/api/auth/login -Authorization: Bearer {{auth_token}} -Accept: application/json -Content-Type: application/json - -{"identifier": "{{rngUser}}", "password": "{{rngPassword}}"} - -> {% - client.test("API Rng User Authenticated", function () { - client.assert(response.status === 200) - }); -%} - -### API Logout -POST {{WepApiTest_HostAddress}}/api/auth/logout -Authorization: Bearer {{auth_token}} -Accept: application/json - -> {% - client.test("API Logout", function () { - client.assert(response.status === 200) - }); -%} - -### API Login as admin -POST {{WepApiTest_HostAddress}}/api/auth/login -Content-Type: application/json - -{ - "identifier": "admin", - "password": "admin" -} - -> {% - client.global.set("admin_token", jsonPath(response.body, "$.token")); - client.test("Login as admin", function () { - client.assert(response.status === 200) - //client.assert(jsonPath(response.body, "$.success") != true,jsonPath(response.body, "$.errorMessage")??"null") - }); -%} - -### API Authenticated as admin -POST {{WepApiTest_HostAddress}}/api/auth/login -Authorization: Bearer {{admin_token}} -Accept: application/json -Content-Type: application/json - -{"identifier": "admin", "password": "admin"} - -> {% - client.test("API Authenticated as admin", function () { - client.assert(response.status === 200) - }); -%} - -### Try User create as rng user -PUT {{WepApiTest_HostAddress}}/api/user -Authorization: Bearer {{auth_token}} -Content-Type: application/json - -{ - "username": "thisUserShouldNotBeCreated", - "email": "nope@nope.cope", - "password": "qwertyu", - "accessLevel": 0 -} - -> {% - client.test("User create as rng user", function () { - client.assert(response.status === 403) - }); -%} - -### Try User create as admin -PUT {{WepApiTest_HostAddress}}/api/user -Authorization: Bearer {{admin_token}} -Accept: application/json -Content-Type: application/json - -{ - "username": "thisUserShouldBeCreated", - "email": "thisUserWillBeDeleted@gmai.com", - "password": "qwertyu", - "accessLevel": 1 -} - -> {% - client.global.set("createdUser", jsonPath(response.body, "$")); - client.test("User create as admin", function () { - client.assert(response.status === 200) - }); -%} - -### Try get the user as rng user -GET {{WepApiTest_HostAddress}}/api/user/{{createdUser}} -Authorization: Bearer {{auth_token}} -Accept: application/json - -//TODO: check what data is returned -> {% - client.test("Get the user as rng user", function () { - client.assert(response.status === 200) - }); -%} - -### Try get the user as admin -GET {{WepApiTest_HostAddress}}/api/user/{{createdUser}} -Authorization: Bearer {{admin_token}} -Accept: application/json - -//TODO: check what data is returned -> {% - client.test("Get the user as admin", function () { - client.assert(response.status === 200) - }); -%} - -### Try Delete user as rng user -DELETE {{WepApiTest_HostAddress}}/api/user/{{createdUser}} -Authorization: Bearer {{auth_token}} - -> {% - client.test("Delete user as rng user", function () { - client.assert(response.status === 403) - }); -%} - -### Delete created user -DELETE {{WepApiTest_HostAddress}}/api/user/{{createdUser}} -Authorization: Bearer {{admin_token}} - -> {% - client.test("Delete created user", function () { - client.assert(response.status === 200) - }); -%} - -### Get all people as anonymous -GET {{WepApiTest_HostAddress}}/api/person - -> {% - client.test("Get all people as anonymous", function () { - client.assert(response.status === 200) - }); -%} - -### Get all people as rng user -GET {{WepApiTest_HostAddress}}/api/person -Authorization: Bearer {{auth_token}} -Accept: application/json - -> {% - if (response.body.length > 0) - client.global.set("personId", jsonPath(response.body, "$[0].id")); - client.test("Get all people as rng user", function () { - client.assert(response.status === 200) - }); -%} - -### Get all people as admin -GET {{WepApiTest_HostAddress}}/api/person -Authorization: Bearer {{admin_token}} -Accept: application/json - -> {% - if (response.body.length > 0) - client.global.set("personId", jsonPath(response.body, "$[0].id")); - client.test("Get all people as admin", function () { - client.assert(response.status === 200) - }); -%} - -### Get person by ID as rng user -GET {{WepApiTest_HostAddress}}/api/person/{{personId}} -Authorization: Bearer {{auth_token}} -Accept: application/json - -> {% - client.test("Get person by ID as rng user", function () { - client.assert(response.status === 200 || response.status === 404) - }); -%} - -### Try update person as rng user (should be 403) -POST {{WepApiTest_HostAddress}}/api/person/{{personId}} -Authorization: Bearer {{auth_token}} -Content-Type: application/json - -{ - "name": "hacker_attempt", - "profileAssetId": null -} - -> {% - client.test("Try update person as rng user", function () { - client.assert(response.status === 403) - }); -%} - -### Try delete person as rng user (should be 403) -DELETE {{WepApiTest_HostAddress}}/api/person/{{personId}} -Authorization: Bearer {{auth_token}} - -> {% - client.test("Try delete person as rng user", function () { - client.assert(response.status === 403) - }); -%} - -### Create person as rng user (should be 403) -PUT {{WepApiTest_HostAddress}}/api/person -Authorization: Bearer {{auth_token}} -Content-Type: application/json - -{ - "name": "hacker_create", - "profileAssetId": null -} - -> {% - client.test("Create person as rng user", function () { - client.assert(response.status === 403) - }); -%} - -### Create person as admin -PUT {{WepApiTest_HostAddress}}/api/person -Authorization: Bearer {{admin_token}} -Content-Type: application/json - -{ - "name": "Test Cosplayer Created" -} - -> {% - client.global.set("createdPersonId", jsonPath(response.body, "$")); - client.test("Create person as admin", function () { - client.assert(response.status === 200) - client.assert(jsonPath(response.body, "$") != null) - }); -%} - -### Update created person name as admin -POST {{WepApiTest_HostAddress}}/api/person/{{createdPersonId}} -Authorization: Bearer {{admin_token}} -Content-Type: application/json - -{ - "name": "Updated via API Test", - "profileAssetId": null -} - -> {% - client.test("Update created person name as admin", function () { - client.assert(response.status === 200) - }); -%} - -### Get created person by ID as admin -GET {{WepApiTest_HostAddress}}/api/person/{{createdPersonId}} -Authorization: Bearer {{admin_token}} -Accept: application/json - -> {% - client.test("Get created person by ID as admin", function () { - client.assert(response.status === 200) - client.assert(jsonPath(response.body, "$.name") === "Updated via API Test") - }); -%} - -### Get non-existent person (should be 404) -GET {{WepApiTest_HostAddress}}/api/person/00000000-0000-0000-0000-000000000000 -Authorization: Bearer {{admin_token}} -Accept: application/json - -> {% - client.test("Get non-existent person", function () { - client.assert(response.status === 404) - }); -%} - -### Update non-existent person as admin (should be 404) -POST {{WepApiTest_HostAddress}}/api/person/00000000-0000-0000-0000-000000000000 -Authorization: Bearer {{admin_token}} -Content-Type: application/json - -{ - "name": "ghost" -} - -> {% - client.test("Update non-existent person", function () { - client.assert(response.status === 404) - }); -%} - -### Try bulk update person as rng user (should be 403) -POST {{WepApiTest_HostAddress}}/api/person -Authorization: Bearer {{auth_token}} -Content-Type: application/json - -{ - "ids": ["{{personId}}"], - "data": { "name": "hacker_bulk" } -} - -> {% - client.test("Bulk update person as rng user", function () { - client.assert(response.status === 403) - }); -%} - -### Bulk update created person as admin -POST {{WepApiTest_HostAddress}}/api/person -Authorization: Bearer {{admin_token}} -Content-Type: application/json - -{ - "ids": ["{{createdPersonId}}"], - "data": { "name": "Bulk Updated Person" } -} - -> {% - client.test("Bulk update person as admin", function () { - client.assert(response.status === 200) - }); -%} - -### Try bulk delete person as rng user (should be 403) -DELETE {{WepApiTest_HostAddress}}/api/person -Authorization: Bearer {{auth_token}} -Content-Type: application/json - -["{{createdPersonId}}"] - -> {% - client.test("Bulk delete person as rng user", function () { - client.assert(response.status === 403) - }); -%} - -### Create test album as admin -PUT {{WepApiTest_HostAddress}}/api/album -Authorization: Bearer {{admin_token}} -Content-Type: application/json - -{ - "name": "Test Album for E2E" -} - -> {% - client.global.set("testAlbumId", jsonPath(response.body, "$")); - client.test("Create test album as admin", function () { - client.assert(response.status === 200) - client.assert(jsonPath(response.body, "$") != null) - }); -%} - -### Assign test album to created person -POST {{WepApiTest_HostAddress}}/api/album/{{testAlbumId}} -Authorization: Bearer {{admin_token}} -Content-Type: application/json - -{ - "person": "{{createdPersonId}}" -} - -> {% - client.test("Assign album to person", function () { - client.assert(response.status === 200) - }); -%} - -### Update test album without removePerson field (should not affect person link) -POST {{WepApiTest_HostAddress}}/api/album/{{testAlbumId}} -Authorization: Bearer {{admin_token}} -Content-Type: application/json - -{ - "name": "Test Album Updated" -} - -> {% - client.test("Update album without removePerson", function () { - client.assert(response.status === 200) - }); -%} - -### Remove person assignment from test album -POST {{WepApiTest_HostAddress}}/api/album/{{testAlbumId}} -Authorization: Bearer {{admin_token}} -Content-Type: application/json - -{ - "removePerson": true -} - -> {% - client.test("Unlink person from album", function () { - client.assert(response.status === 200) - }); -%} - -### Delete test album -DELETE {{WepApiTest_HostAddress}}/api/album/{{testAlbumId}} -Authorization: Bearer {{admin_token}} - -> {% - client.test("Delete test album", function () { - client.assert(response.status === 200) - }); -%} - -### Delete created person as admin -DELETE {{WepApiTest_HostAddress}}/api/person/{{createdPersonId}} -Authorization: Bearer {{admin_token}} - -> {% - client.test("Delete created person as admin", function () { - client.assert(response.status === 200) - }); -%} - -### Verify created person is gone -GET {{WepApiTest_HostAddress}}/api/person/{{createdPersonId}} -Authorization: Bearer {{admin_token}} -Accept: application/json - -> {% - client.test("Verify created person is deleted", function () { - client.assert(response.status === 404) - }); -%} - -### Create curator user as admin -< {% - client.global.set("rngCurator", $random.alphabetic(15)); - client.global.set("rngCuratorPwd", "test" + $random.alphabetic(5)); -%} - -PUT {{WepApiTest_HostAddress}}/api/user -Authorization: Bearer {{admin_token}} -Content-Type: application/json - -{ - "username": "{{rngCurator}}", - "email": "{{rngCurator}}@redcode.com", - "password": "{{rngCuratorPwd}}", - "accessLevel": 1 -} - -> {% - client.global.set("curatorUserId", jsonPath(response.body, "$")); - client.test("Create curator user as admin", function () { - client.assert(response.status === 200) - }); -%} - -### Login as curator -POST {{WepApiTest_HostAddress}}/api/auth/login -Content-Type: application/json - -{ - "identifier": "{{rngCurator}}", - "password": "{{rngCuratorPwd}}" -} - -> {% - client.global.set("curator_token", jsonPath(response.body, "$.token")); - client.test("Login as curator", function () { - client.assert(response.status === 200) - }); -%} - -### Login again to get fresh token for subsequent tests -POST {{WepApiTest_HostAddress}}/api/auth/login -Content-Type: application/json - -{ - "identifier": "{{rngUser}}", - "password": "{{rngPassword}}" -} - -> {% - client.global.set("auth_token", jsonPath(response.body, "$.token")); - client.global.set("refresh_token", jsonPath(response.body, "$.refreshToken")); - client.global.set("user_id", jsonPath(response.body, "$.userId")); - client.test("Re-login rng user for refresh test", function () { - client.assert(response.status === 200) - }); -%} - -### Refresh token with empty body (should be 400) -POST {{WepApiTest_HostAddress}}/api/auth/refresh -Content-Type: application/json - -{ - "userId": "", - "refreshToken": "" -} - -> {% - client.test("Refresh token with empty body returns 400", function () { - client.assert(response.status === 400) - }); -%} - -### Refresh token with valid data -POST {{WepApiTest_HostAddress}}/api/auth/refresh -Content-Type: application/json - -{ - "userId": "{{user_id}}", - "refreshToken": "{{refresh_token}}" -} - -> {% - client.global.set("auth_token", jsonPath(response.body, "$.token")); - client.test("Refresh token with valid data", function () { - client.assert(response.status === 200) - client.assert(jsonPath(response.body, "$.token") != null) - }); -%} - -### Get all albums as anonymous -GET {{WepApiTest_HostAddress}}/api/album - -> {% - client.test("Get all albums as anonymous", function () { - client.assert(response.status === 200) - }); -%} - -### Get all albums as rng user -GET {{WepApiTest_HostAddress}}/api/album -Authorization: Bearer {{auth_token}} - -> {% - client.test("Get all albums as rng user", function () { - client.assert(response.status === 200) - }); -%} - -### Get all albums as admin -GET {{WepApiTest_HostAddress}}/api/album -Authorization: Bearer {{admin_token}} - -> {% - client.test("Get all albums as admin", function () { - client.assert(response.status === 200) - }); -%} - -### Search albums as admin -GET {{WepApiTest_HostAddress}}/api/album?search=test&pageSize=5 -Authorization: Bearer {{admin_token}} - -> {% - client.test("Search albums as admin", function () { - client.assert(response.status === 200) - }); -%} - -### Create album for GET-by-ID and bulk tests -PUT {{WepApiTest_HostAddress}}/api/album -Authorization: Bearer {{admin_token}} -Content-Type: application/json - -{ - "name": "Album for GET-by-ID test" -} - -> {% - client.global.set("testAlbumId2", jsonPath(response.body, "$")); - client.test("Create album for GET-by-ID test", function () { - client.assert(response.status === 200) - }); -%} - -### Get album by ID as rng user -GET {{WepApiTest_HostAddress}}/api/album/{{testAlbumId2}} -Authorization: Bearer {{auth_token}} - -> {% - client.test("Get album by ID as rng user", function () { - client.assert(response.status === 200 || response.status === 404) - }); -%} - -### Get album by ID as admin -GET {{WepApiTest_HostAddress}}/api/album/{{testAlbumId2}} -Authorization: Bearer {{admin_token}} - -> {% - client.test("Get album by ID as admin", function () { - client.assert(response.status === 200) - client.assert(jsonPath(response.body, "$.id") != null) - }); -%} - -### Get non-existent album (should 404) -GET {{WepApiTest_HostAddress}}/api/album/00000000-0000-0000-0000-000000000000 -Authorization: Bearer {{admin_token}} - -> {% - client.test("Get non-existent album", function () { - client.assert(response.status === 404) - }); -%} - -### Delete album for GET-by-ID test -DELETE {{WepApiTest_HostAddress}}/api/album/{{testAlbumId2}} -Authorization: Bearer {{admin_token}} - -> {% - client.test("Delete album for GET-by-ID test", function () { - client.assert(response.status === 200) - }); -%} - -### Get all users as admin -GET {{WepApiTest_HostAddress}}/api/user -Authorization: Bearer {{admin_token}} - -> {% - client.test("Get all users as admin", function () { - client.assert(response.status === 200) - }); -%} - -### Get all users as rng user (should be 403) -GET {{WepApiTest_HostAddress}}/api/user -Authorization: Bearer {{auth_token}} - -> {% - client.test("Get all users as rng user should 403", function () { - client.assert(response.status === 403) - }); -%} - -### Update own profile as rng user -POST {{WepApiTest_HostAddress}}/api/user/update -Authorization: Bearer {{auth_token}} -Content-Type: application/json - -{ - "id": "{{user_id}}", - "username": "{{rngUser}}" -} - -> {% - client.test("Update own profile as rng user", function () { - client.assert(response.status === 200) - }); -%} - -### Get stats as admin -GET {{WepApiTest_HostAddress}}/api/stats -Authorization: Bearer {{admin_token}} - -> {% - client.test("Get stats as admin", function () { - client.assert(response.status === 200) - }); -%} - -### Get stats as rng user (should be 403) -GET {{WepApiTest_HostAddress}}/api/stats -Authorization: Bearer {{auth_token}} - -> {% - client.test("Get stats as rng user should 403", function () { - client.assert(response.status === 403) - }); -%} - -### Search tags as admin -GET {{WepApiTest_HostAddress}}/api/tag?search=test&pageSize=5 -Authorization: Bearer {{admin_token}} - -> {% - client.test("Search tags as admin", function () { - client.assert(response.status === 200) - }); -%} - -### Create tag as rng user (should be 403) -PUT {{WepApiTest_HostAddress}}/api/tag -Authorization: Bearer {{auth_token}} -Content-Type: application/json - -{ - "name": "hacker-tag" -} - -> {% - client.test("Create tag as rng user should 403", function () { - client.assert(response.status === 403) - }); -%} - -### Search assets as rng user -GET {{WepApiTest_HostAddress}}/api/asset?page=0&pageSize=5 -Authorization: Bearer {{auth_token}} - -> {% - client.test("Search assets as rng user", function () { - client.assert(response.status === 200) - }); -%} - -### Search assets as anonymous -GET {{WepApiTest_HostAddress}}/api/asset?page=0&pageSize=5 - -> {% - client.test("Search assets as anonymous", function () { - client.assert(response.status === 200) - }); -%} - -### Create person as curator (should succeed) -< {% - client.global.set("curatorPerson", $random.alphabetic(15)); -%} - -PUT {{WepApiTest_HostAddress}}/api/person -Authorization: Bearer {{curator_token}} -Content-Type: application/json - -{ - "name": "{{curatorPerson}}" -} - -> {% - client.global.set("curatorPersonId", jsonPath(response.body, "$")); - client.test("Create person as curator", function () { - client.assert(response.status === 200) - }); -%} - -### Delete person as curator (should succeed) -DELETE {{WepApiTest_HostAddress}}/api/person/{{curatorPersonId}} -Authorization: Bearer {{curator_token}} - -> {% - client.test("Delete person as curator", function () { - client.assert(response.status === 200) - }); -%} - -### Create album as curator (should succeed) -< {% - client.global.set("curatorAlbum", $random.alphabetic(15)); -%} - -PUT {{WepApiTest_HostAddress}}/api/album -Authorization: Bearer {{curator_token}} -Content-Type: application/json - -{ - "name": "{{curatorAlbum}}" -} - -> {% - client.global.set("curatorAlbumId", jsonPath(response.body, "$")); - client.test("Create album as curator", function () { - client.assert(response.status === 200) - }); -%} - -### Delete album as curator (should succeed) -DELETE {{WepApiTest_HostAddress}}/api/album/{{curatorAlbumId}} -Authorization: Bearer {{curator_token}} - -> {% - client.test("Delete album as curator", function () { - client.assert(response.status === 200) - }); -%} - -### Get stats as curator (should succeed) -GET {{WepApiTest_HostAddress}}/api/stats -Authorization: Bearer {{curator_token}} - -> {% - client.test("Get stats as curator", function () { - client.assert(response.status === 200) - }); -%} - -### Create user as curator (should be 403) -< {% - client.global.set("curatorUserCreate", $random.alphabetic(10)); -%} - -PUT {{WepApiTest_HostAddress}}/api/user -Authorization: Bearer {{curator_token}} -Content-Type: application/json - -{ - "username": "{{curatorUserCreate}}", - "email": "{{curatorUserCreate}}@redcode.com", - "password": "test1234", - "accessLevel": 0 -} - -> {% - client.test("Create user as curator should 403", function () { - client.assert(response.status === 403) - }); -%} - -### Get settings as curator (should be 403) -GET {{WepApiTest_HostAddress}}/api/settings -Authorization: Bearer {{curator_token}} - -> {% - client.test("Get settings as curator should 403", function () { - client.assert(response.status === 403) - }); -%} - -### Delete curator user as admin -DELETE {{WepApiTest_HostAddress}}/api/user/{{curatorUserId}} -Authorization: Bearer {{admin_token}} - -> {% - client.test("Delete curator user as admin", function () { - client.assert(response.status === 200) - }); -%} +@WepApiTest_HostAddress = http://localhost:5162 + +# ============================================================================= +# SETUP — Create three users with distinct roles +# ============================================================================= + +### 1. Login as seeded admin +POST {{WepApiTest_HostAddress}}/api/auth/login +Content-Type: application/json + +{ + "identifier": "admin", + "password": "admin" +} + +> {% + client.global.set("admin_token", jsonPath(response.body, "$.token")); + client.global.set("admin_id", jsonPath(response.body, "$.userId")); + client.test("Login as seeded admin", function () { + client.assert(response.status === 200) + }); +%} + +### 2. Create curator user (admin only) +< {% + client.global.set("curatorName", $random.alphabetic(15)); + client.global.set("curatorPwd", "test" + $random.alphabetic(5)); +%} + +PUT {{WepApiTest_HostAddress}}/api/user +Authorization: Bearer {{admin_token}} +Content-Type: application/json + +{ + "username": "{{curatorName}}", + "email": "{{curatorName}}@redcode.com", + "password": "{{curatorPwd}}", + "accessLevel": 1 +} + +> {% + client.global.set("curator_id", jsonPath(response.body, "$")); + client.test("Create curator user as admin", function () { + client.assert(response.status === 200) + }); +%} + +### 3. Login as curator +POST {{WepApiTest_HostAddress}}/api/auth/login +Content-Type: application/json + +{ + "identifier": "{{curatorName}}", + "password": "{{curatorPwd}}" +} + +> {% + client.global.set("curator_token", jsonPath(response.body, "$.token")); + client.test("Login as curator", function () { + client.assert(response.status === 200) + }); +%} + +### 4. Register regular user +< {% + client.global.set("userName", $random.alphabetic(15)); + client.global.set("userEmail", $random.alphabetic(5) + "@redcode.com"); + client.global.set("userPwd", "test" + $random.alphabetic(5)); +%} + +POST {{WepApiTest_HostAddress}}/api/auth/register +Content-Type: application/json + +{ + "username": "{{userName}}", + "email": "{{userEmail}}", + "password": "{{userPwd}}" +} + +> {% + client.test("Register regular user", function () { + client.assert(response.status === 200) + }); +%} + +### 5. Login as regular user +POST {{WepApiTest_HostAddress}}/api/auth/login +Content-Type: application/json + +{ + "identifier": "{{userName}}", + "password": "{{userPwd}}" +} + +> {% + client.global.set("user_token", jsonPath(response.body, "$.token")); + client.global.set("user_refresh", jsonPath(response.body, "$.refreshToken")); + client.global.set("user_id", jsonPath(response.body, "$.userId")); + client.test("Login as regular user", function () { + client.assert(response.status === 200) + }); +%} + +# ============================================================================= +# AUTH TESTS +# ============================================================================= + +### 6. Wrong auth route should 404 +POST {{WepApiTest_HostAddress}}/api/auth +Content-Type: application/json + +{} + +> {% + client.test("Wrong auth route returns 404", function () { + client.assert(response.status === 404) + }); +%} + +### 7. Login with valid token (re-authentication) +POST {{WepApiTest_HostAddress}}/api/auth/login +Authorization: Bearer {{user_token}} +Content-Type: application/json + +{"identifier": "{{userName}}", "password": "{{userPwd}}"} + +> {% + client.test("Re-authenticate with valid token", function () { + client.assert(response.status === 200) + }); +%} + +### 8. Logout +POST {{WepApiTest_HostAddress}}/api/auth/logout +Authorization: Bearer {{user_token}} + +> {% + client.test("Logout", function () { + client.assert(response.status === 200) + }); +%} + +### 9. Re-login user after logout +POST {{WepApiTest_HostAddress}}/api/auth/login +Content-Type: application/json + +{ + "identifier": "{{userName}}", + "password": "{{userPwd}}" +} + +> {% + client.global.set("user_token", jsonPath(response.body, "$.token")); + client.global.set("user_refresh", jsonPath(response.body, "$.refreshToken")); + client.global.set("user_id", jsonPath(response.body, "$.userId")); + client.test("Re-login user after logout", function () { + client.assert(response.status === 200) + }); +%} + +### 10. Refresh token with empty body (should be 400) +POST {{WepApiTest_HostAddress}}/api/auth/refresh +Content-Type: application/json + +{ + "userId": "", + "refreshToken": "" +} + +> {% + client.test("Refresh token with empty body returns 400", function () { + client.assert(response.status === 400) + }); +%} + +### 11. Refresh token with valid data +POST {{WepApiTest_HostAddress}}/api/auth/refresh +Content-Type: application/json + +{ + "userId": "{{user_id}}", + "refreshToken": "{{user_refresh}}" +} + +> {% + client.global.set("user_token", jsonPath(response.body, "$.token")); + client.test("Refresh token with valid data", function () { + client.assert(response.status === 200) + client.assert(jsonPath(response.body, "$.token") != null) + }); +%} + +# ============================================================================= +# USER CRUD TESTS +# ============================================================================= + +### 12. Get all users as admin (should succeed) +GET {{WepApiTest_HostAddress}}/api/user +Authorization: Bearer {{admin_token}} + +> {% + client.test("Get all users as admin", function () { + client.assert(response.status === 200) + }); +%} + +### 13. Get all users as regular user (should 403) +GET {{WepApiTest_HostAddress}}/api/user +Authorization: Bearer {{user_token}} + +> {% + client.test("Get all users as regular user should 403", function () { + client.assert(response.status === 403) + }); +%} + +### 14. Get all users as curator (should 403) +GET {{WepApiTest_HostAddress}}/api/user +Authorization: Bearer {{curator_token}} + +> {% + client.test("Get all users as curator should 403", function () { + client.assert(response.status === 403) + }); +%} + +### 15. Create user as regular user (should 403) +< {% + client.global.set("userCreateAttempt", $random.alphabetic(10)); +%} + +PUT {{WepApiTest_HostAddress}}/api/user +Authorization: Bearer {{user_token}} +Content-Type: application/json + +{ + "username": "{{userCreateAttempt}}", + "email": "{{userCreateAttempt}}@redcode.com", + "password": "qwertyu", + "accessLevel": 0 +} + +> {% + client.test("Create user as regular user should 403", function () { + client.assert(response.status === 403) + }); +%} + +### 16. Create user as curator (should 403) +< {% + client.global.set("curatorCreateAttempt", $random.alphabetic(10)); +%} + +PUT {{WepApiTest_HostAddress}}/api/user +Authorization: Bearer {{curator_token}} +Content-Type: application/json + +{ + "username": "{{curatorCreateAttempt}}", + "email": "{{curatorCreateAttempt}}@redcode.com", + "password": "test1234", + "accessLevel": 0 +} + +> {% + client.test("Create user as curator should 403", function () { + client.assert(response.status === 403) + }); +%} + +### 17. Get own user profile as regular user +GET {{WepApiTest_HostAddress}}/api/user/{{user_id}} +Authorization: Bearer {{user_token}} + +> {% + client.test("Get own profile as regular user", function () { + client.assert(response.status === 200) + }); +%} + +### 18. Update own profile as regular user +POST {{WepApiTest_HostAddress}}/api/user/update +Authorization: Bearer {{user_token}} +Content-Type: application/json + +{ + "id": "{{user_id}}", + "username": "{{userName}}" +} + +> {% + client.test("Update own profile as regular user", function () { + client.assert(response.status === 200) + }); +%} + +# ============================================================================= +# PERSON TESTS +# ============================================================================= + +### 19. Create person as regular user (should 403) +PUT {{WepApiTest_HostAddress}}/api/person +Authorization: Bearer {{user_token}} +Content-Type: application/json + +{ + "name": "hacker_create" +} + +> {% + client.test("Create person as regular user should 403", function () { + client.assert(response.status === 403) + }); +%} + +### 20. Create person as curator (should succeed) +< {% + client.global.set("curatorPerson", $random.alphabetic(15)); +%} + +PUT {{WepApiTest_HostAddress}}/api/person +Authorization: Bearer {{curator_token}} +Content-Type: application/json + +{ + "name": "{{curatorPerson}}" +} + +> {% + client.global.set("curatorPersonId", jsonPath(response.body, "$")); + client.test("Create person as curator", function () { + client.assert(response.status === 200) + }); +%} + +### 21. Delete person as curator (cleanup) +DELETE {{WepApiTest_HostAddress}}/api/person/{{curatorPersonId}} +Authorization: Bearer {{curator_token}} + +> {% + client.test("Delete person as curator", function () { + client.assert(response.status === 200) + }); +%} + +### 22. Create test person as admin +PUT {{WepApiTest_HostAddress}}/api/person +Authorization: Bearer {{admin_token}} +Content-Type: application/json + +{ + "name": "Test Cosplayer Created" +} + +> {% + client.global.set("testPersonId", jsonPath(response.body, "$")); + client.test("Create test person as admin", function () { + client.assert(response.status === 200) + client.assert(jsonPath(response.body, "$") != null) + }); +%} + +### 23. Get all people as anonymous +GET {{WepApiTest_HostAddress}}/api/person + +> {% + client.test("Get all people as anonymous", function () { + client.assert(response.status === 200) + }); +%} + +### 24. Get all people as regular user +GET {{WepApiTest_HostAddress}}/api/person +Authorization: Bearer {{user_token}} + +> {% + client.test("Get all people as regular user", function () { + client.assert(response.status === 200) + }); +%} + +### 25. Get all people as curator +GET {{WepApiTest_HostAddress}}/api/person +Authorization: Bearer {{curator_token}} + +> {% + client.test("Get all people as curator", function () { + client.assert(response.status === 200) + }); +%} + +### 26. Get all people as admin +GET {{WepApiTest_HostAddress}}/api/person +Authorization: Bearer {{admin_token}} + +> {% + client.test("Get all people as admin", function () { + client.assert(response.status === 200) + }); +%} + +### 27. Get test person by ID as admin +GET {{WepApiTest_HostAddress}}/api/person/{{testPersonId}} +Authorization: Bearer {{admin_token}} + +> {% + client.test("Get test person by ID as admin", function () { + client.assert(response.status === 200) + client.assert(jsonPath(response.body, "$.name") === "Test Cosplayer Created") + }); +%} + +### 28. Get non-existent person (should 404) +GET {{WepApiTest_HostAddress}}/api/person/00000000-0000-0000-0000-000000000000 +Authorization: Bearer {{admin_token}} + +> {% + client.test("Get non-existent person", function () { + client.assert(response.status === 404) + }); +%} + +### 29. Update person as regular user (should 403) +POST {{WepApiTest_HostAddress}}/api/person/{{testPersonId}} +Authorization: Bearer {{user_token}} +Content-Type: application/json + +{ + "name": "hacker_attempt" +} + +> {% + client.test("Update person as regular user should 403", function () { + client.assert(response.status === 403) + }); +%} + +### 30. Update person as curator (should succeed) +POST {{WepApiTest_HostAddress}}/api/person/{{testPersonId}} +Authorization: Bearer {{curator_token}} +Content-Type: application/json + +{ + "name": "Updated by curator" +} + +> {% + client.test("Update person as curator", function () { + client.assert(response.status === 200) + }); +%} + +### 31. Update person as admin +POST {{WepApiTest_HostAddress}}/api/person/{{testPersonId}} +Authorization: Bearer {{admin_token}} +Content-Type: application/json + +{ + "name": "Updated via API Test" +} + +> {% + client.test("Update person as admin", function () { + client.assert(response.status === 200) + }); +%} + +### 32. Verify person name update +GET {{WepApiTest_HostAddress}}/api/person/{{testPersonId}} +Authorization: Bearer {{admin_token}} + +> {% + client.test("Verify person name update", function () { + client.assert(response.status === 200) + client.assert(jsonPath(response.body, "$.name") === "Updated via API Test") + }); +%} + +### 33. Update non-existent person (should 404) +POST {{WepApiTest_HostAddress}}/api/person/00000000-0000-0000-0000-000000000000 +Authorization: Bearer {{admin_token}} +Content-Type: application/json + +{ + "name": "ghost" +} + +> {% + client.test("Update non-existent person", function () { + client.assert(response.status === 404) + }); +%} + +### 34. Delete person as regular user (should 403) +DELETE {{WepApiTest_HostAddress}}/api/person/{{testPersonId}} +Authorization: Bearer {{user_token}} + +> {% + client.test("Delete person as regular user should 403", function () { + client.assert(response.status === 403) + }); +%} + +### 35. Bulk update person as regular user (should 403) +POST {{WepApiTest_HostAddress}}/api/person +Authorization: Bearer {{user_token}} +Content-Type: application/json + +{ + "ids": ["{{testPersonId}}"], + "data": { "name": "hacker_bulk" } +} + +> {% + client.test("Bulk update person as regular user should 403", function () { + client.assert(response.status === 403) + }); +%} + +### 36. Bulk update person as admin +POST {{WepApiTest_HostAddress}}/api/person +Authorization: Bearer {{admin_token}} +Content-Type: application/json + +{ + "ids": ["{{testPersonId}}"], + "data": { "name": "Bulk Updated Person" } +} + +> {% + client.test("Bulk update person as admin", function () { + client.assert(response.status === 200) + }); +%} + +### 37. Bulk delete person as regular user (should 403) +DELETE {{WepApiTest_HostAddress}}/api/person +Authorization: Bearer {{user_token}} +Content-Type: application/json + +["{{testPersonId}}"] + +> {% + client.test("Bulk delete person as regular user should 403", function () { + client.assert(response.status === 403) + }); +%} + +# ============================================================================= +# ALBUM TESTS +# ============================================================================= + +### 38. Create album as regular user (should 403) +< {% + client.global.set("albumHack", $random.alphabetic(10)); +%} + +PUT {{WepApiTest_HostAddress}}/api/album +Authorization: Bearer {{user_token}} +Content-Type: application/json + +{ + "name": "{{albumHack}}" +} + +> {% + client.test("Create album as regular user should 403", function () { + client.assert(response.status === 403) + }); +%} + +### 39. Create album as curator (should succeed) +< {% + client.global.set("curatorAlbum", $random.alphabetic(15)); +%} + +PUT {{WepApiTest_HostAddress}}/api/album +Authorization: Bearer {{curator_token}} +Content-Type: application/json + +{ + "name": "{{curatorAlbum}}" +} + +> {% + client.global.set("curatorAlbumId", jsonPath(response.body, "$")); + client.test("Create album as curator", function () { + client.assert(response.status === 200) + }); +%} + +### 40. Delete album as curator (cleanup) +DELETE {{WepApiTest_HostAddress}}/api/album/{{curatorAlbumId}} +Authorization: Bearer {{curator_token}} + +> {% + client.test("Delete album as curator", function () { + client.assert(response.status === 200) + }); +%} + +### 41. Create test album as admin +PUT {{WepApiTest_HostAddress}}/api/album +Authorization: Bearer {{admin_token}} +Content-Type: application/json + +{ + "name": "Test Album for E2E" +} + +> {% + client.global.set("testAlbumId", jsonPath(response.body, "$")); + client.test("Create test album as admin", function () { + client.assert(response.status === 200) + client.assert(jsonPath(response.body, "$") != null) + }); +%} + +### 42. Assign test album to test person +POST {{WepApiTest_HostAddress}}/api/album/{{testAlbumId}} +Authorization: Bearer {{admin_token}} +Content-Type: application/json + +{ + "person": "{{testPersonId}}" +} + +> {% + client.test("Assign album to person", function () { + client.assert(response.status === 200) + }); +%} + +### 43. Update album without removePerson field (should keep person link) +POST {{WepApiTest_HostAddress}}/api/album/{{testAlbumId}} +Authorization: Bearer {{admin_token}} +Content-Type: application/json + +{ + "name": "Test Album Updated" +} + +> {% + client.test("Update album without removePerson", function () { + client.assert(response.status === 200) + }); +%} + +### 44. Remove person assignment from album +POST {{WepApiTest_HostAddress}}/api/album/{{testAlbumId}} +Authorization: Bearer {{admin_token}} +Content-Type: application/json + +{ + "removePerson": true +} + +> {% + client.test("Unlink person from album", function () { + client.assert(response.status === 200) + }); +%} + +### 45. Get all albums as anonymous +GET {{WepApiTest_HostAddress}}/api/album + +> {% + client.test("Get all albums as anonymous", function () { + client.assert(response.status === 200) + }); +%} + +### 46. Get all albums as regular user +GET {{WepApiTest_HostAddress}}/api/album +Authorization: Bearer {{user_token}} + +> {% + client.test("Get all albums as regular user", function () { + client.assert(response.status === 200) + }); +%} + +### 47. Get all albums as curator +GET {{WepApiTest_HostAddress}}/api/album +Authorization: Bearer {{curator_token}} + +> {% + client.test("Get all albums as curator", function () { + client.assert(response.status === 200) + }); +%} + +### 48. Get all albums as admin +GET {{WepApiTest_HostAddress}}/api/album +Authorization: Bearer {{admin_token}} + +> {% + client.test("Get all albums as admin", function () { + client.assert(response.status === 200) + }); +%} + +### 49. Search albums as admin +GET {{WepApiTest_HostAddress}}/api/album?search=Test&pageSize=5 +Authorization: Bearer {{admin_token}} + +> {% + client.test("Search albums as admin", function () { + client.assert(response.status === 200) + }); +%} + +### 50. Get album by ID as admin +GET {{WepApiTest_HostAddress}}/api/album/{{testAlbumId}} +Authorization: Bearer {{admin_token}} + +> {% + client.test("Get album by ID as admin", function () { + client.assert(response.status === 200) + client.assert(jsonPath(response.body, "$.id") != null) + }); +%} + +### 51. Get non-existent album (should 404) +GET {{WepApiTest_HostAddress}}/api/album/00000000-0000-0000-0000-000000000000 +Authorization: Bearer {{admin_token}} + +> {% + client.test("Get non-existent album", function () { + client.assert(response.status === 404) + }); +%} + +### 52. Delete test album as admin +DELETE {{WepApiTest_HostAddress}}/api/album/{{testAlbumId}} +Authorization: Bearer {{admin_token}} + +> {% + client.test("Delete test album", function () { + client.assert(response.status === 200) + }); +%} + +# ============================================================================= +# TAG TESTS +# ============================================================================= + +### 53. Search tags as admin +GET {{WepApiTest_HostAddress}}/api/tag?search=test&pageSize=5 +Authorization: Bearer {{admin_token}} + +> {% + client.test("Search tags as admin", function () { + client.assert(response.status === 200) + }); +%} + +### 54. Create tag as regular user (should 403) +PUT {{WepApiTest_HostAddress}}/api/tag +Authorization: Bearer {{user_token}} +Content-Type: application/json + +{ + "name": "hacker-tag" +} + +> {% + client.test("Create tag as regular user should 403", function () { + client.assert(response.status === 403) + }); +%} + +### 55. Create tag as curator (should succeed) +< {% + client.global.set("e2eTag", $random.alphabetic(10)); +%} + +PUT {{WepApiTest_HostAddress}}/api/tag +Authorization: Bearer {{curator_token}} +Content-Type: application/json + +{ + "name": "e2e-{{e2eTag}}" +} + +> {% + client.test("Create tag as curator", function () { + client.assert(response.status === 200) + }); +%} + +# ============================================================================= +# ASSET TESTS +# ============================================================================= + +### 56. Search assets as regular user +GET {{WepApiTest_HostAddress}}/api/asset?page=0&pageSize=5 +Authorization: Bearer {{user_token}} + +> {% + client.test("Search assets as regular user", function () { + client.assert(response.status === 200) + }); +%} + +### 57. Search assets as anonymous +GET {{WepApiTest_HostAddress}}/api/asset?page=0&pageSize=5 + +> {% + client.test("Search assets as anonymous", function () { + client.assert(response.status === 200) + }); +%} + +# ============================================================================= +# STATS TESTS +# ============================================================================= + +### 58. Get stats as admin +GET {{WepApiTest_HostAddress}}/api/stats +Authorization: Bearer {{admin_token}} + +> {% + client.test("Get stats as admin", function () { + client.assert(response.status === 200) + }); +%} + +### 59. Get stats as curator +GET {{WepApiTest_HostAddress}}/api/stats +Authorization: Bearer {{curator_token}} + +> {% + client.test("Get stats as curator", function () { + client.assert(response.status === 200) + }); +%} + +### 60. Get stats as regular user (should 403) +GET {{WepApiTest_HostAddress}}/api/stats +Authorization: Bearer {{user_token}} + +> {% + client.test("Get stats as regular user should 403", function () { + client.assert(response.status === 403) + }); +%} + +# ============================================================================= +# SETTINGS TESTS +# ============================================================================= + +### 61. Get settings as admin +GET {{WepApiTest_HostAddress}}/api/settings +Authorization: Bearer {{admin_token}} + +> {% + client.test("Get settings as admin", function () { + client.assert(response.status === 200) + }); +%} + +### 62. Get settings as curator (should 403) +GET {{WepApiTest_HostAddress}}/api/settings +Authorization: Bearer {{curator_token}} + +> {% + client.test("Get settings as curator should 403", function () { + client.assert(response.status === 403) + }); +%} + +### 63. Get settings as regular user (should 403) +GET {{WepApiTest_HostAddress}}/api/settings +Authorization: Bearer {{user_token}} + +> {% + client.test("Get settings as regular user should 403", function () { + client.assert(response.status === 403) + }); +%} + +# ============================================================================= +# CLEANUP +# ============================================================================= + +### 64. Delete test person as admin +DELETE {{WepApiTest_HostAddress}}/api/person/{{testPersonId}} +Authorization: Bearer {{admin_token}} + +> {% + client.test("Delete test person as admin", function () { + client.assert(response.status === 200) + }); +%} + +### 65. Verify test person is deleted +GET {{WepApiTest_HostAddress}}/api/person/{{testPersonId}} +Authorization: Bearer {{admin_token}} + +> {% + client.test("Verify test person is deleted", function () { + client.assert(response.status === 404) + }); +%} + +### 66. Delete curator user as admin +DELETE {{WepApiTest_HostAddress}}/api/user/{{curator_id}} +Authorization: Bearer {{admin_token}} + +> {% + client.test("Delete curator user as admin", function () { + client.assert(response.status === 200) + }); +%} diff --git a/Lactose/http-client.env.json b/Lactose/http-client.env.json index fd2bb2f..3fa7391 100644 --- a/Lactose/http-client.env.json +++ b/Lactose/http-client.env.json @@ -1,6 +1,8 @@ { "dev": { - "rngUser": "preFilledValue", - "rngPassword": "preFilledValue" + "userName": "preFilledValue", + "userPwd": "preFilledValue", + "curatorName": "preFilledValue", + "curatorPwd": "preFilledValue" } } \ No newline at end of file -- 2.54.0 From 5a2f61d26157c97246c1d59a3a7a90ad5a7a6a9e Mon Sep 17 00:00:00 2001 From: REDCODE Date: Sat, 11 Jul 2026 20:35:56 +0200 Subject: [PATCH 27/50] perf: push visibility filter into SQL for PersonRepository queries Replace client-side visibility filtering with EF Core Any() subqueries in SearchQuery and GetAllVisible. This eliminates the cartesian product from the Include chain (Person -> Albums -> Assets -> SharedWith) and lets the database short-circuit the auth check with indexes. Adds null-forgiving operators (!) on navigation access in the query predicates. --- Lactose/Repositories/PersonRepository.cs | 55 ++++++++++-------------- 1 file changed, 22 insertions(+), 33 deletions(-) diff --git a/Lactose/Repositories/PersonRepository.cs b/Lactose/Repositories/PersonRepository.cs index ce48cea..4585ee3 100644 --- a/Lactose/Repositories/PersonRepository.cs +++ b/Lactose/Repositories/PersonRepository.cs @@ -30,18 +30,15 @@ public class PersonRepository(LactoseDbContext context) : IPersonRepository { if (accessLevel != EAccessLevel.User) return GetAll(); - var all = context.People - .Include(p => p.Albums)! - .ThenInclude(a => a.Assets)! - .ThenInclude(a => a.SharedWith) + return context.People + .Where(p => p.Albums!.Any(a => + a.Assets!.Any(asset => asset.DeletedAt == null && ( + asset.IsPubliclyShared || + asset.OwnerId == userId || + asset.SharedWith!.Any(u => u.Id == userId) + )) + )) .ToList(); - - return all.Where(p => p.Albums != null && p.Albums.Any(a => - a.Assets != null && a.Assets.Any(asset => asset.DeletedAt == null && ( - asset.IsPubliclyShared || - asset.OwnerId == userId || - (asset.SharedWith != null && asset.SharedWith.Any(u => u.Id == userId)) - )))); } /// @@ -61,38 +58,30 @@ public class PersonRepository(LactoseDbContext context) : IPersonRepository { /// public IEnumerable SearchQuery(string query, int page = 0, int pageSize = 30, string? sortBy = null, bool sortAsc = true, Guid userId = default, EAccessLevel accessLevel = EAccessLevel.User) { - IQueryable peopleQuery = context.People - .Include(p => p.Albums)! - .ThenInclude(a => a.Assets)! - .ThenInclude(a => a.SharedWith); + IQueryable peopleQuery = context.People; - // Apply search filter if (!string.IsNullOrEmpty(query)) peopleQuery = peopleQuery.Where(p => EF.Functions.ILike(p.Name, $"%{query}%")); - // Apply sorting + if (accessLevel == EAccessLevel.User) + peopleQuery = peopleQuery.Where(p => p.Albums!.Any(a => + a.Assets!.Any(asset => asset.DeletedAt == null && ( + asset.IsPubliclyShared || + asset.OwnerId == userId || + asset.SharedWith!.Any(u => u.Id == userId) + )) + )); + IOrderedQueryable ordered = sortBy?.ToLower() switch { "created" => sortAsc ? peopleQuery.OrderBy(p => p.CreatedAt) : peopleQuery.OrderByDescending(p => p.CreatedAt), - "albums" => sortAsc ? peopleQuery.OrderBy(p => p.Albums.Count) : peopleQuery.OrderByDescending(p => p.Albums.Count), - _ => sortAsc ? peopleQuery.OrderBy(p => p.Name) : peopleQuery.OrderByDescending(p => p.Name), + "albums" => sortAsc ? peopleQuery.OrderBy(p => p.Albums!.Count) : peopleQuery.OrderByDescending(p => p.Albums!.Count), + _ => sortAsc ? peopleQuery.OrderBy(p => p.Name) : peopleQuery.OrderByDescending(p => p.Name), }; - var result = ordered + return ordered .Skip(page * pageSize) - .Take(pageSize) - .ToList(); - - // Filter by visibility client-side (the nested SharedWith.Any() cannot be translated to SQL) - if (accessLevel == EAccessLevel.User) - result = result.Where(p => p.Albums != null && p.Albums.Any(a => - a.Assets != null && a.Assets.Any(asset => asset.DeletedAt == null && ( - asset.IsPubliclyShared || - asset.OwnerId == userId || - (asset.SharedWith != null && asset.SharedWith.Any(u => u.Id == userId)) - )))).ToList(); - - return result; + .Take(pageSize); } /// -- 2.54.0 From 837491fa4ad2281a759ddb823e2622547809ec4b Mon Sep 17 00:00:00 2001 From: REDCODE Date: Sat, 11 Jul 2026 20:36:33 +0200 Subject: [PATCH 28/50] fix: guard ILIKE filter in AlbumRepository.SearchQuery against null/empty query --- Lactose/Repositories/AlbumRepository.cs | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/Lactose/Repositories/AlbumRepository.cs b/Lactose/Repositories/AlbumRepository.cs index 8e19864..ee9214b 100644 --- a/Lactose/Repositories/AlbumRepository.cs +++ b/Lactose/Repositories/AlbumRepository.cs @@ -28,8 +28,10 @@ public class AlbumRepository(LactoseDbContext context) : IAlbumRepository { IQueryable albumsQuery = context.Albums .Include(a => a.CoverAsset) .Include(a => a.PersonOwner) - .Include(a => a.Assets)!.ThenInclude(a => a.SharedWith) - .Where(x => EF.Functions.ILike(x.Title, $"%{query}%")); + .Include(a => a.Assets)!.ThenInclude(a => a.SharedWith); + + if (!string.IsNullOrEmpty(query)) + albumsQuery = albumsQuery.Where(x => EF.Functions.ILike(x.Title, $"%{query}%")); if (unassigned) albumsQuery = albumsQuery.Where(a => a.PersonOwnerId == null); -- 2.54.0 From 41c262d157e16edbc42e0e739475d7f15aaef4c4 Mon Sep 17 00:00:00 2001 From: REDCODE Date: Sat, 11 Jul 2026 20:39:14 +0200 Subject: [PATCH 29/50] fix: restore Include(p => p.Albums) in PersonRepository queries The visibility subquery doesn't load the Albums navigation, so TotalAlbums in the mapper was always 0. Added back a lightweight Include(p => p.Albums) (without Assets/SharedWith chain) to both SearchQuery and GetAllVisible. --- Lactose/Repositories/PersonRepository.cs | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/Lactose/Repositories/PersonRepository.cs b/Lactose/Repositories/PersonRepository.cs index 4585ee3..d3d677b 100644 --- a/Lactose/Repositories/PersonRepository.cs +++ b/Lactose/Repositories/PersonRepository.cs @@ -31,6 +31,7 @@ public class PersonRepository(LactoseDbContext context) : IPersonRepository { return GetAll(); return context.People + .Include(p => p.Albums) .Where(p => p.Albums!.Any(a => a.Assets!.Any(asset => asset.DeletedAt == null && ( asset.IsPubliclyShared || @@ -58,7 +59,7 @@ public class PersonRepository(LactoseDbContext context) : IPersonRepository { /// public IEnumerable SearchQuery(string query, int page = 0, int pageSize = 30, string? sortBy = null, bool sortAsc = true, Guid userId = default, EAccessLevel accessLevel = EAccessLevel.User) { - IQueryable peopleQuery = context.People; + IQueryable peopleQuery = context.People.Include(p => p.Albums); if (!string.IsNullOrEmpty(query)) peopleQuery = peopleQuery.Where(p => EF.Functions.ILike(p.Name, $"%{query}%")); -- 2.54.0 From ee3511c09aabb3419468e14ecd07689135b1fe0b Mon Sep 17 00:00:00 2001 From: REDCODE Date: Sat, 11 Jul 2026 20:47:44 +0200 Subject: [PATCH 30/50] fix: paginate PersonRepository.SearchQuery by ID before loading albums Include + Skip/Take on a collection navigation can produce duplicate people when sorted by album count, because pagination operates on joined rows. Fix by selecting paged IDs first, then loading the full entities with Include for those IDs. --- Lactose/Repositories/PersonRepository.cs | 16 +++++++++++++--- 1 file changed, 13 insertions(+), 3 deletions(-) diff --git a/Lactose/Repositories/PersonRepository.cs b/Lactose/Repositories/PersonRepository.cs index d3d677b..5617cbb 100644 --- a/Lactose/Repositories/PersonRepository.cs +++ b/Lactose/Repositories/PersonRepository.cs @@ -59,7 +59,7 @@ public class PersonRepository(LactoseDbContext context) : IPersonRepository { /// public IEnumerable SearchQuery(string query, int page = 0, int pageSize = 30, string? sortBy = null, bool sortAsc = true, Guid userId = default, EAccessLevel accessLevel = EAccessLevel.User) { - IQueryable peopleQuery = context.People.Include(p => p.Albums); + IQueryable peopleQuery = context.People; if (!string.IsNullOrEmpty(query)) peopleQuery = peopleQuery.Where(p => EF.Functions.ILike(p.Name, $"%{query}%")); @@ -80,9 +80,19 @@ public class PersonRepository(LactoseDbContext context) : IPersonRepository { _ => sortAsc ? peopleQuery.OrderBy(p => p.Name) : peopleQuery.OrderByDescending(p => p.Name), }; - return ordered + var pagedIds = ordered + .Select(p => p.Id) .Skip(page * pageSize) - .Take(pageSize); + .Take(pageSize) + .ToList(); + + var pagedPeople = context.People + .Include(p => p.Albums) + .Where(p => pagedIds.Contains(p.Id)) + .ToList(); + + var idOrder = pagedIds.Select((id, i) => (id, i)).ToDictionary(x => x.id, x => x.i); + return [.. pagedPeople.OrderBy(p => idOrder.GetValueOrDefault(p.Id))]; } /// -- 2.54.0 From 324c1b1a1772709263b738871051c266827efcf0 Mon Sep 17 00:00:00 2001 From: REDCODE Date: Sun, 12 Jul 2026 14:46:57 +0200 Subject: [PATCH 31/50] fix: prevent duplicate @key errors across all list renderings Switch accumulating list storage to Dictionary to guarantee unique Blazor @key values when paginated data overlaps or races occur during sort/filter changes. - CosplayerGrid: Dictionary for people list - CosplayerDetail: Dictionary for albums - AlbumDetail: deduplicate album.Images at load time via dict - Home: deduplicate flatList rebuild via dict (keeps first occurrence) - AssetPicker: Distinct() on parameter list --- .../Components/Pages/AlbumDetail.razor | 16 +++++++++++++++ .../Components/Pages/CosplayerDetail.razor | 20 ++++++++++--------- MilkStream.Client/Components/Pages/Home.razor | 15 ++++++++------ .../Components/Shared/AssetPicker.razor | 3 ++- .../Components/Shared/CosplayerGrid.razor | 16 ++++++++------- 5 files changed, 47 insertions(+), 23 deletions(-) diff --git a/MilkStream.Client/Components/Pages/AlbumDetail.razor b/MilkStream.Client/Components/Pages/AlbumDetail.razor index 61497c4..be2b20b 100644 --- a/MilkStream.Client/Components/Pages/AlbumDetail.razor +++ b/MilkStream.Client/Components/Pages/AlbumDetail.razor @@ -225,6 +225,22 @@ selectMode = false; selectedImageIds.Clear(); album = await albumService.GetAlbumAsync(Id); + if (album != null) { + var seen = new Dictionary(); + var uniqueImages = new List(album.Images.Count); + var uniquePreviews = new List(album.AssetPreviews.Count); + for (var i = 0; i < album.Images.Count; i++) { + var id = album.Images[i]; + if (!seen.ContainsKey(id)) { + seen[id] = i; + uniqueImages.Add(id); + if (i < album.AssetPreviews.Count) + uniquePreviews.Add(album.AssetPreviews[i]); + } + } + album.Images = uniqueImages; + album.AssetPreviews = uniquePreviews; + } isLoading = false; } diff --git a/MilkStream.Client/Components/Pages/CosplayerDetail.razor b/MilkStream.Client/Components/Pages/CosplayerDetail.razor index e1f842a..94a13e5 100644 --- a/MilkStream.Client/Components/Pages/CosplayerDetail.razor +++ b/MilkStream.Client/Components/Pages/CosplayerDetail.razor @@ -72,7 +72,7 @@

Albums

- @if (allAlbums.Count > 0) { + @if (allAlbumsDict.Count > 0) {
- @if (allAlbums.Count > 0) { + @if (allAlbumsDict.Count > 0) { if (selectMode) {
- @if (allAlbums.Count > 0) { + @if (allAlbumsDict.Count > 0) {
- @foreach (var album in allAlbums) { + @foreach (var album in allAlbumsDict.Values) { bannerCoverUrls = []; // Infinite scroll - List allAlbums = []; + Dictionary allAlbumsDict = []; int currentAlbumPage; const int AlbumPageSize = 30; bool hasMoreAlbums = true; @@ -222,7 +222,7 @@ } protected override async Task OnAfterRenderAsync(bool firstRender) { - if (allAlbums.Count > 0 && dotNetRef == null) { + if (allAlbumsDict.Count > 0 && dotNetRef == null) { dotNetRef = DotNetObjectReference.Create(this); await jsRuntime.InvokeVoidAsync( "albumObserver.observeBottom", sentinelRef, dotNetRef @@ -232,13 +232,14 @@ async Task LoadPerson() { isLoading = true; - allAlbums.Clear(); + allAlbumsDict.Clear(); currentAlbumPage = 0; hasMoreAlbums = true; person = await personService.GetByIdAsync(Id); if (person?.Albums != null) { - allAlbums = person.Albums; + foreach (var a in person.Albums) + allAlbumsDict[a.Id] = a; hasMoreAlbums = person.Albums.Count >= AlbumPageSize; currentAlbumPage = 1; } @@ -261,7 +262,8 @@ var fresh = await personService.GetByIdAsync(Id, currentAlbumPage, AlbumPageSize); if (fresh?.Albums?.Count > 0) { - allAlbums.AddRange(fresh.Albums); + foreach (var a in fresh.Albums) + allAlbumsDict[a.Id] = a; currentAlbumPage++; } hasMoreAlbums = fresh?.Albums?.Count >= AlbumPageSize; diff --git a/MilkStream.Client/Components/Pages/Home.razor b/MilkStream.Client/Components/Pages/Home.razor index bad112e..e9de699 100644 --- a/MilkStream.Client/Components/Pages/Home.razor +++ b/MilkStream.Client/Components/Pages/Home.razor @@ -32,10 +32,8 @@ }
- @{ var idx = 0; } - @foreach (var page in allAssetPages) { - @foreach (var asset in page) { - var i = idx++; + @for (int i = 0; i < flatList.Count; i++) { + var asset = flatList[i];
@@ -75,7 +73,6 @@ }
} - }
@if (isLoadingMore) { @@ -242,7 +239,13 @@ StateHasChanged(); } - void RebuildFlatList() => flatList = allAssetPages.SelectMany(p => p).ToList(); + void RebuildFlatList() { + var seen = new Dictionary(); + foreach (var page in allAssetPages) + foreach (var asset in page) + seen.TryAdd(asset.Id, asset); + flatList = [.. seen.Values]; +} void OpenPreview(AssetPreviewDto asset, int index) { selectedAsset = asset; diff --git a/MilkStream.Client/Components/Shared/AssetPicker.razor b/MilkStream.Client/Components/Shared/AssetPicker.razor index 71e49c7..5a08196 100644 --- a/MilkStream.Client/Components/Shared/AssetPicker.razor +++ b/MilkStream.Client/Components/Shared/AssetPicker.razor @@ -1,5 +1,6 @@ @using Microsoft.Extensions.Options @using MilkStream.Client.Services +@using System.Linq @inject LoginService loginService @inject IOptions serviceOptions @@ -10,7 +11,7 @@
No assets in this album.
} else {
- @foreach (var id in AssetIds) { + @foreach (var id in AssetIds.Distinct()) {
diff --git a/MilkStream.Client/Components/Shared/CosplayerGrid.razor b/MilkStream.Client/Components/Shared/CosplayerGrid.razor index 3b9844d..b1be6db 100644 --- a/MilkStream.Client/Components/Shared/CosplayerGrid.razor +++ b/MilkStream.Client/Components/Shared/CosplayerGrid.razor @@ -15,7 +15,7 @@ @if (isLoading) { -} else if (people.Count == 0 && !hasMore) { +} else if (peopleDict.Count == 0 && !hasMore) { @if (loginService.IsLoggedIn) {

There are no cosplayers yet.

@@ -25,7 +25,7 @@ } else {
- @foreach (var person in people) { + @foreach (var person in peopleDict.Values) {
@@ -83,7 +83,7 @@ [Parameter] public EventCallback OnToggleSelection { get; set; } [Parameter] public int LoadVersion { get; set; } - List people = []; + Dictionary peopleDict = []; int currentPage = 0; bool hasMore = true; bool isLoading = true; @@ -120,7 +120,7 @@ } protected override async Task OnAfterRenderAsync(bool firstRender) { - if (people.Count > 0 && dotNetRef == null) { + if (peopleDict.Count > 0 && dotNetRef == null) { dotNetRef = DotNetObjectReference.Create(this); await jsRuntime.InvokeVoidAsync( "cosplayerObserver.observeBottom", sentinelRef, dotNetRef @@ -130,7 +130,7 @@ async Task Reload() { await DisposeObserver(); - people.Clear(); + peopleDict.Clear(); currentPage = 0; hasMore = true; isLoading = true; @@ -138,7 +138,8 @@ var items = await personService.GetAllAsync(0, 30, SearchQuery, SortBy, SortAsc); if (items?.Count > 0) { - people = items; + foreach (var p in items) + peopleDict[p.Id] = p; currentPage = 1; } hasMore = items?.Count == 30; @@ -153,7 +154,8 @@ var items = await personService.GetAllAsync(currentPage, 30, SearchQuery, SortBy, SortAsc); if (items?.Count > 0) { - people.AddRange(items); + foreach (var p in items) + peopleDict[p.Id] = p; currentPage++; } hasMore = items?.Count == 30; -- 2.54.0 From e333d0e9db944f1498ccfc87d4f94ce7cbd59c9f Mon Sep 17 00:00:00 2001 From: REDCODE Date: Sun, 12 Jul 2026 16:51:29 +0200 Subject: [PATCH 32/50] fix: filter album count by user visibility in person search - Add Person.TotalVisibleAlbums [NotMapped] populated by repository - Use visibility-aware album count in PersonMapper - Restructure PersonRepository.SearchQuery with two-step pagination for correct ordering and per-user album visibility filtering --- Lactose/Mapper/PersonMapper.cs | 2 +- Lactose/Models/Person.cs | 7 +++ Lactose/Repositories/PersonRepository.cs | 75 ++++++++++++++++++------ 3 files changed, 65 insertions(+), 19 deletions(-) diff --git a/Lactose/Mapper/PersonMapper.cs b/Lactose/Mapper/PersonMapper.cs index 6b2314f..7e35b79 100644 --- a/Lactose/Mapper/PersonMapper.cs +++ b/Lactose/Mapper/PersonMapper.cs @@ -41,7 +41,7 @@ public static class PersonMapper { ProfileCropX = person.ProfileCropX, ProfileCropY = person.ProfileCropY, ProfileCropZoom = person.ProfileCropZoom, - TotalAlbums = person.Albums?.Count ?? 0 + TotalAlbums = person.TotalVisibleAlbums }; private static AlbumPreviewDto ToAlbumPreviewDto(Album album) => new() { diff --git a/Lactose/Models/Person.cs b/Lactose/Models/Person.cs index 284e521..036d4de 100644 --- a/Lactose/Models/Person.cs +++ b/Lactose/Models/Person.cs @@ -50,6 +50,13 @@ public class Person { /// public float? ProfileCropZoom { get; set; } + /// + /// Gets or sets the number of albums visible to the current user. + /// Populated by — do not rely on this outside that context. + /// + [NotMapped] + public int TotalVisibleAlbums { get; set; } + #region Navigation Properties /// diff --git a/Lactose/Repositories/PersonRepository.cs b/Lactose/Repositories/PersonRepository.cs index 5617cbb..ce8decb 100644 --- a/Lactose/Repositories/PersonRepository.cs +++ b/Lactose/Repositories/PersonRepository.cs @@ -64,35 +64,74 @@ public class PersonRepository(LactoseDbContext context) : IPersonRepository { if (!string.IsNullOrEmpty(query)) peopleQuery = peopleQuery.Where(p => EF.Functions.ILike(p.Name, $"%{query}%")); + // Filter out people with no visible content for regular users if (accessLevel == EAccessLevel.User) - peopleQuery = peopleQuery.Where(p => p.Albums!.Any(a => - a.Assets!.Any(asset => asset.DeletedAt == null && ( - asset.IsPubliclyShared || - asset.OwnerId == userId || - asset.SharedWith!.Any(u => u.Id == userId) - )) - )); + peopleQuery = peopleQuery.Where(p => + p.Albums != null && p.Albums.Any(a => + a.Assets != null && a.Assets.Any(asset => asset.DeletedAt == null && ( + asset.IsPubliclyShared || + asset.OwnerId == userId || + (asset.SharedWith != null && asset.SharedWith.Any(u => u.Id == userId)) + )))); + // Apply sorting — use subquery counts for "albums" IOrderedQueryable ordered = sortBy?.ToLower() switch { - "created" => sortAsc ? peopleQuery.OrderBy(p => p.CreatedAt) : peopleQuery.OrderByDescending(p => p.CreatedAt), - "albums" => sortAsc ? peopleQuery.OrderBy(p => p.Albums!.Count) : peopleQuery.OrderByDescending(p => p.Albums!.Count), - _ => sortAsc ? peopleQuery.OrderBy(p => p.Name) : peopleQuery.OrderByDescending(p => p.Name), + "created" => sortAsc ? peopleQuery.OrderBy(p => p.CreatedAt) : peopleQuery.OrderByDescending(p => p.CreatedAt), + "albums" when accessLevel == EAccessLevel.User => sortAsc + ? peopleQuery.OrderBy(p => p.Albums!.Count(a => + a.Assets != null && a.Assets.Any(asset => asset.DeletedAt == null && ( + asset.IsPubliclyShared || + asset.OwnerId == userId || + (asset.SharedWith != null && asset.SharedWith.Any(u => u.Id == userId)) + )))) + : peopleQuery.OrderByDescending(p => p.Albums!.Count(a => + a.Assets != null && a.Assets.Any(asset => asset.DeletedAt == null && ( + asset.IsPubliclyShared || + asset.OwnerId == userId || + (asset.SharedWith != null && asset.SharedWith.Any(u => u.Id == userId)) + )))), + "albums" => sortAsc + ? peopleQuery.OrderBy(p => p.Albums!.Count) + : peopleQuery.OrderByDescending(p => p.Albums!.Count), + _ => sortAsc ? peopleQuery.OrderBy(p => p.Name) : peopleQuery.OrderByDescending(p => p.Name), }; - var pagedIds = ordered - .Select(p => p.Id) - .Skip(page * pageSize) + // Two-step pagination: first get the IDs in the correct order + var pageOffset = page * pageSize; + var personIds = ordered + .Skip(pageOffset) .Take(pageSize) + .Select(p => p.Id) .ToList(); - var pagedPeople = context.People - .Include(p => p.Albums) - .Where(p => pagedIds.Contains(p.Id)) + if (personIds.Count == 0) + return []; + + // Then load the scalar data + visible album count via subquery + var peopleWithCounts = context.People + .Where(p => personIds.Contains(p.Id)) + .Select(p => new { + Person = p, + Count = accessLevel == EAccessLevel.User + ? p.Albums!.Count(a => + a.Assets != null && a.Assets.Any(asset => asset.DeletedAt == null && ( + asset.IsPubliclyShared || + asset.OwnerId == userId || + (asset.SharedWith != null && asset.SharedWith.Any(u => u.Id == userId)) + ))) + : p.Albums!.Count + }) .ToList(); - var idOrder = pagedIds.Select((id, i) => (id, i)).ToDictionary(x => x.id, x => x.i); - return [.. pagedPeople.OrderBy(p => idOrder.GetValueOrDefault(p.Id))]; + // Reorder to match the paginated order and set TotalVisibleAlbums + return personIds + .Select(id => peopleWithCounts.First(x => x.Person.Id == id)) + .Select(x => { + x.Person.TotalVisibleAlbums = x.Count; + return x.Person; + }) + .ToList(); } /// -- 2.54.0 From c77096b0f92a388345e57e48b7d1cffd618ac951 Mon Sep 17 00:00:00 2001 From: REDCODE Date: Sun, 12 Jul 2026 17:18:17 +0200 Subject: [PATCH 33/50] refactor: project PersonPreviewDto directly in repository instead of [NotMapped] entity property Replace the TempData-like TotalVisibleAlbums [NotMapped] property on Person with a direct DTO projection in PersonRepository.SearchQuery. The repository now returns IEnumerable, computing the visibility-aware album count in the EF Core subquery and projecting only the needed columns. This avoids polluting the entity model with a context-dependent property. --- Lactose/Controllers/PersonController.cs | 3 +-- Lactose/Mapper/PersonMapper.cs | 2 +- Lactose/Models/Person.cs | 7 ------ Lactose/Repositories/IPersonRepository.cs | 5 +++-- Lactose/Repositories/PersonRepository.cs | 27 ++++++++++++----------- 5 files changed, 19 insertions(+), 25 deletions(-) diff --git a/Lactose/Controllers/PersonController.cs b/Lactose/Controllers/PersonController.cs index 2d7653a..2851624 100644 --- a/Lactose/Controllers/PersonController.cs +++ b/Lactose/Controllers/PersonController.cs @@ -84,8 +84,7 @@ public class PersonController( pagedSearch.SortAsc, uid ?? default, accessLevel - ).Select(p => p.ToPersonPreviewDto()) - .ToList(); + ).ToList(); return Ok(people); } diff --git a/Lactose/Mapper/PersonMapper.cs b/Lactose/Mapper/PersonMapper.cs index 7e35b79..6b2314f 100644 --- a/Lactose/Mapper/PersonMapper.cs +++ b/Lactose/Mapper/PersonMapper.cs @@ -41,7 +41,7 @@ public static class PersonMapper { ProfileCropX = person.ProfileCropX, ProfileCropY = person.ProfileCropY, ProfileCropZoom = person.ProfileCropZoom, - TotalAlbums = person.TotalVisibleAlbums + TotalAlbums = person.Albums?.Count ?? 0 }; private static AlbumPreviewDto ToAlbumPreviewDto(Album album) => new() { diff --git a/Lactose/Models/Person.cs b/Lactose/Models/Person.cs index 036d4de..284e521 100644 --- a/Lactose/Models/Person.cs +++ b/Lactose/Models/Person.cs @@ -50,13 +50,6 @@ public class Person { /// public float? ProfileCropZoom { get; set; } - /// - /// Gets or sets the number of albums visible to the current user. - /// Populated by — do not rely on this outside that context. - /// - [NotMapped] - public int TotalVisibleAlbums { get; set; } - #region Navigation Properties /// diff --git a/Lactose/Repositories/IPersonRepository.cs b/Lactose/Repositories/IPersonRepository.cs index af7988d..d73cd0f 100644 --- a/Lactose/Repositories/IPersonRepository.cs +++ b/Lactose/Repositories/IPersonRepository.cs @@ -1,3 +1,4 @@ +using Butter.Dtos.Person; using Lactose.Models; namespace Lactose.Repositories; @@ -64,8 +65,8 @@ public interface IPersonRepository : IDisposable { /// Whether to sort ascending. Default is true. /// The current user's ID for access-level filtering. /// The current user's access level. - /// A paginated list of people matching the query. - IEnumerable SearchQuery(string query, int page = 0, int pageSize = 30, string? sortBy = null, bool sortAsc = true, Guid userId = default, EAccessLevel accessLevel = EAccessLevel.User); + /// A paginated list of person previews matching the query. + IEnumerable SearchQuery(string query, int page = 0, int pageSize = 30, string? sortBy = null, bool sortAsc = true, Guid userId = default, EAccessLevel accessLevel = EAccessLevel.User); /// /// Finds multiple people by their IDs. diff --git a/Lactose/Repositories/PersonRepository.cs b/Lactose/Repositories/PersonRepository.cs index ce8decb..c34933a 100644 --- a/Lactose/Repositories/PersonRepository.cs +++ b/Lactose/Repositories/PersonRepository.cs @@ -1,3 +1,4 @@ +using Butter.Dtos.Person; using Butter.Types; using Lactose.Context; using Lactose.Models; @@ -58,7 +59,7 @@ public class PersonRepository(LactoseDbContext context) : IPersonRepository { public void Remove(Person person) => context.People.Remove(person); /// - public IEnumerable SearchQuery(string query, int page = 0, int pageSize = 30, string? sortBy = null, bool sortAsc = true, Guid userId = default, EAccessLevel accessLevel = EAccessLevel.User) { + public IEnumerable SearchQuery(string query, int page = 0, int pageSize = 30, string? sortBy = null, bool sortAsc = true, Guid userId = default, EAccessLevel accessLevel = EAccessLevel.User) { IQueryable peopleQuery = context.People; if (!string.IsNullOrEmpty(query)) @@ -109,11 +110,16 @@ public class PersonRepository(LactoseDbContext context) : IPersonRepository { return []; // Then load the scalar data + visible album count via subquery - var peopleWithCounts = context.People + var dtos = context.People .Where(p => personIds.Contains(p.Id)) - .Select(p => new { - Person = p, - Count = accessLevel == EAccessLevel.User + .Select(p => new PersonPreviewDto { + Id = p.Id, + Name = p.Name, + ProfileAssetId = p.ProfileAssetId, + ProfileCropX = p.ProfileCropX, + ProfileCropY = p.ProfileCropY, + ProfileCropZoom = p.ProfileCropZoom, + TotalAlbums = accessLevel == EAccessLevel.User ? p.Albums!.Count(a => a.Assets != null && a.Assets.Any(asset => asset.DeletedAt == null && ( asset.IsPubliclyShared || @@ -124,14 +130,9 @@ public class PersonRepository(LactoseDbContext context) : IPersonRepository { }) .ToList(); - // Reorder to match the paginated order and set TotalVisibleAlbums - return personIds - .Select(id => peopleWithCounts.First(x => x.Person.Id == id)) - .Select(x => { - x.Person.TotalVisibleAlbums = x.Count; - return x.Person; - }) - .ToList(); + // Reorder to match the paginated order + var orderMap = personIds.Select((id, i) => (id, i)).ToDictionary(x => x.id, x => x.i); + return [.. dtos.OrderBy(d => orderMap.GetValueOrDefault(d.Id))]; } /// -- 2.54.0 From 89edf290ff4adbcebdd1620fc3592b4ea6d846de Mon Sep 17 00:00:00 2001 From: REDCODE Date: Sun, 12 Jul 2026 17:41:24 +0200 Subject: [PATCH 34/50] refactor: project AlbumPreviewDto directly in repository with visibility-aware asset count Align AlbumRepository.SearchQuery with the PersonRepository pattern: return AlbumPreviewDto directly with access-level filtering at the query level, avoiding loading full entity graphs and filtering in-memory in the controller. - Add userId/accessLevel params to SearchQuery - Push visibility filter into the query for regular users - Compute AssetCount with same visibility logic in the projection - Sort by 'assets' uses visible count for regular users - Remove unused AlbumMapper.ToAlbumPreviewDto extension - Simplify AlbumController.Search to just return repo results --- Lactose/Controllers/AlbumController.cs | 23 ++------ Lactose/Mapper/AlbumMapper.cs | 17 ------ Lactose/Repositories/AlbumRepository.cs | 75 ++++++++++++++++++++---- Lactose/Repositories/IAlbumRepository.cs | 10 +++- 4 files changed, 75 insertions(+), 50 deletions(-) diff --git a/Lactose/Controllers/AlbumController.cs b/Lactose/Controllers/AlbumController.cs index 3e5323e..bd8d6ee 100644 --- a/Lactose/Controllers/AlbumController.cs +++ b/Lactose/Controllers/AlbumController.cs @@ -79,32 +79,21 @@ public class AlbumController( public ActionResult> Search([FromQuery] AlbumSearchParametersDto pagingOptions) { var uid = authService.GetUserData(User)?.Id; var accessLevel = authService.GetUserData(User)?.AccessLevel ?? EAccessLevel.User; - + if(pagingOptions.Page < 0 || pagingOptions.PageSize < 0) return BadRequest(); - + var albums = albumRepository.SearchQuery( pagingOptions.Search ?? string.Empty, pagingOptions.Page, pagingOptions.PageSize, pagingOptions.SortBy, pagingOptions.SortAsc, - pagingOptions.Unassigned + pagingOptions.Unassigned, + uid ?? default, + accessLevel ).ToList(); - switch (accessLevel) { - default: - case EAccessLevel.User: - List filteredAlbums; - // Only publicly shared albums or owned by user - filteredAlbums = albums.Where(album => album.Assets != null && (album.UserOwnerId == uid || album.Assets.Any(asset => asset.IsPubliclyShared && asset.DeletedAt == null))).ToList(); - // Add shared albums - filteredAlbums.AddRange(albums.Where(album => album.Assets != null && album.Assets.Any(x => x.DeletedAt == null && x.SharedWith!.Any(user => user.Id == uid)))); - return Ok(filteredAlbums.Select(x => x.ToAlbumPreviewDto()).ToList()); - case EAccessLevel.Curator: - case EAccessLevel.Admin: - // All albums - return Ok(albums.Select(x => x.ToAlbumPreviewDto()).ToList()); - } + return Ok(albums); } /// diff --git a/Lactose/Mapper/AlbumMapper.cs b/Lactose/Mapper/AlbumMapper.cs index 78e8368..91ce710 100644 --- a/Lactose/Mapper/AlbumMapper.cs +++ b/Lactose/Mapper/AlbumMapper.cs @@ -31,21 +31,4 @@ public static class AlbumMapper { }).ToList() }; - /// - /// Maps an Album object to an AlbumPreviewDto object. - /// - /// The album to map. - /// An AlbumPreviewDto object. - public static AlbumPreviewDto ToAlbumPreviewDto(this Album album) => new AlbumPreviewDto { - Id = album.Id, - Name = album.Title, - Owner = album.UserOwnerId, - Person = album.PersonOwnerId, - PersonName = album.PersonOwner?.Name, - CoverAssetId = album.CoverAssetId, - AssetCount = album.Assets?.Count ?? 0 - }; - - - } diff --git a/Lactose/Repositories/AlbumRepository.cs b/Lactose/Repositories/AlbumRepository.cs index ee9214b..e13b605 100644 --- a/Lactose/Repositories/AlbumRepository.cs +++ b/Lactose/Repositories/AlbumRepository.cs @@ -1,3 +1,5 @@ +using Butter.Dtos.Album; +using Butter.Types; using Lactose.Context; using Lactose.Models; using Microsoft.EntityFrameworkCore; @@ -24,11 +26,8 @@ public class AlbumRepository(LactoseDbContext context) : IAlbumRepository { } /// - public IEnumerable SearchQuery(string query, int page = 0, int pageSize = 150, string? sortBy = null, bool sortAsc = false, bool unassigned = false) { - IQueryable albumsQuery = context.Albums - .Include(a => a.CoverAsset) - .Include(a => a.PersonOwner) - .Include(a => a.Assets)!.ThenInclude(a => a.SharedWith); + public IEnumerable SearchQuery(string query, int page = 0, int pageSize = 150, string? sortBy = null, bool sortAsc = false, bool unassigned = false, Guid userId = default, EAccessLevel accessLevel = EAccessLevel.User) { + IQueryable albumsQuery = context.Albums; if (!string.IsNullOrEmpty(query)) albumsQuery = albumsQuery.Where(x => EF.Functions.ILike(x.Title, $"%{query}%")); @@ -36,18 +35,68 @@ public class AlbumRepository(LactoseDbContext context) : IAlbumRepository { if (unassigned) albumsQuery = albumsQuery.Where(a => a.PersonOwnerId == null); + if (accessLevel == EAccessLevel.User) + albumsQuery = albumsQuery.Where(a => + a.Assets != null && a.Assets.Any(asset => + asset.DeletedAt == null && ( + asset.IsPubliclyShared || + asset.OwnerId == userId || + (asset.SharedWith != null && asset.SharedWith.Any(u => u.Id == userId)) + ))); + IOrderedQueryable ordered = sortBy?.ToLower() switch { - "name" => sortAsc ? albumsQuery.OrderBy(a => a.Title) : albumsQuery.OrderByDescending(a => a.Title), - "updated" => sortAsc ? albumsQuery.OrderBy(a => a.UpdatedAt) : albumsQuery.OrderByDescending(a => a.UpdatedAt), - "assets" => sortAsc ? albumsQuery.OrderBy(a => a.Assets.Count) : albumsQuery.OrderByDescending(a => a.Assets.Count), - "person" => sortAsc ? albumsQuery.OrderBy(a => a.PersonOwner!.Name): albumsQuery.OrderByDescending(a => a.PersonOwner!.Name), - _ => sortAsc ? albumsQuery.OrderBy(a => a.CreatedAt) : albumsQuery.OrderByDescending(a => a.CreatedAt), + "name" => sortAsc ? albumsQuery.OrderBy(a => a.Title) : albumsQuery.OrderByDescending(a => a.Title), + "updated" => sortAsc ? albumsQuery.OrderBy(a => a.UpdatedAt) : albumsQuery.OrderByDescending(a => a.UpdatedAt), + "assets" when accessLevel == EAccessLevel.User => sortAsc + ? albumsQuery.OrderBy(a => a.Assets!.Count(asset => + asset.DeletedAt == null && ( + asset.IsPubliclyShared || + asset.OwnerId == userId || + (asset.SharedWith != null && asset.SharedWith.Any(u => u.Id == userId))))) + : albumsQuery.OrderByDescending(a => a.Assets!.Count(asset => + asset.DeletedAt == null && ( + asset.IsPubliclyShared || + asset.OwnerId == userId || + (asset.SharedWith != null && asset.SharedWith.Any(u => u.Id == userId))))), + "assets" => sortAsc + ? albumsQuery.OrderBy(a => a.Assets!.Count) + : albumsQuery.OrderByDescending(a => a.Assets!.Count), + "person" => sortAsc ? albumsQuery.OrderBy(a => a.PersonOwner!.Name) : albumsQuery.OrderByDescending(a => a.PersonOwner!.Name), + _ => sortAsc ? albumsQuery.OrderBy(a => a.CreatedAt) : albumsQuery.OrderByDescending(a => a.CreatedAt), }; - return ordered - .Skip(page * pageSize) - .Take(pageSize); + var pageOffset = page * pageSize; + var albumIds = ordered + .Skip(pageOffset) + .Take(pageSize) + .Select(a => a.Id) + .ToList(); + + if (albumIds.Count == 0) + return []; + + var dtos = context.Albums + .Where(a => albumIds.Contains(a.Id)) + .Select(a => new AlbumPreviewDto { + Id = a.Id, + Name = a.Title, + Owner = a.UserOwnerId, + Person = a.PersonOwnerId, + PersonName = a.PersonOwner!.Name, + CoverAssetId = a.CoverAssetId, + AssetCount = accessLevel == EAccessLevel.User + ? a.Assets!.Count(asset => + asset.DeletedAt == null && ( + asset.IsPubliclyShared || + asset.OwnerId == userId || + (asset.SharedWith != null && asset.SharedWith.Any(u => u.Id == userId)))) + : a.Assets!.Count + }) + .ToList(); + + var orderMap = albumIds.Select((id, i) => (id, i)).ToDictionary(x => x.id, x => x.i); + return [.. dtos.OrderBy(d => orderMap.GetValueOrDefault(d.Id))]; } /// diff --git a/Lactose/Repositories/IAlbumRepository.cs b/Lactose/Repositories/IAlbumRepository.cs index 4c43fac..042956f 100644 --- a/Lactose/Repositories/IAlbumRepository.cs +++ b/Lactose/Repositories/IAlbumRepository.cs @@ -1,3 +1,5 @@ +using Butter.Dtos.Album; +using Butter.Types; using Lactose.Models; namespace Lactose.Repositories; @@ -72,7 +74,7 @@ public interface IAlbumRepository : IDisposable { public void Remove(Album album); /// - /// Searches for albums based on a query string with optional sorting and filtering. + /// Searches for albums based on a query string with optional sorting, filtering, and access-level scoping. /// /// The search query string to filter by title. /// The page number for pagination (default is 0). @@ -80,7 +82,9 @@ public interface IAlbumRepository : IDisposable { /// The field to sort by (e.g. "name", "created", "updated", "assets", "person"). When null, defaults to created descending. /// Whether to sort ascending. Default is false (descending). /// When true, only return albums with no person assigned. - /// A list of albums that match the search query. - public IEnumerable SearchQuery(string query, int page = 0, int pageSize = 150, string? sortBy = null, bool sortAsc = false, bool unassigned = false); + /// The current user's ID for access-level filtering. + /// The current user's access level. Regular users only see albums with visible assets. + /// A list of album previews matching the search query. + public IEnumerable SearchQuery(string query, int page = 0, int pageSize = 150, string? sortBy = null, bool sortAsc = false, bool unassigned = false, Guid userId = default, EAccessLevel accessLevel = EAccessLevel.User); } \ No newline at end of file -- 2.54.0 From 48b6d4f149f569c3403da4b44df5fbaff218a90a Mon Sep 17 00:00:00 2001 From: REDCODE Date: Sun, 12 Jul 2026 18:04:53 +0200 Subject: [PATCH 35/50] perf: add partial index on Assets for visibility-aware search queries Create IX_Assets_VisibleForSearch on (IsPubliclyShared, OwnerId) WHERE "DeletedAt" IS NULL to accelerate the correlated subqueries used in both AlbumRepository and PersonRepository for filtering, sorting by asset/album count, and projecting AssetCount/TotalAlbums. - Fluent API in LactoseDbContext.OnModelCreating - Generated migration via dotnet ef migrations add --- AGENTS.md | 8 + Lactose/Context/LactoseDbContext.cs | 3 + ...AddAssetsSearchVisibilityIndex.Designer.cs | 581 ++++++++++++++++++ ...12160403_AddAssetsSearchVisibilityIndex.cs | 28 + .../LactoseDbContextModelSnapshot.cs | 4 + 5 files changed, 624 insertions(+) create mode 100644 Lactose/Migrations/20260712160403_AddAssetsSearchVisibilityIndex.Designer.cs create mode 100644 Lactose/Migrations/20260712160403_AddAssetsSearchVisibilityIndex.cs diff --git a/AGENTS.md b/AGENTS.md index c23bde6..f7d18cc 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -90,6 +90,14 @@ dotnet ef migrations add --project Lactose dotnet ef database update --project Lactose ``` +**Database indexes for performance** should be defined using the **fluent API** in `LactoseDbContext.OnModelCreating` via `HasIndex().HasFilter()`. Do not use the `[Index]` data annotation — the `Filter` parameter is not available in the current package configuration (EF Core Tools v8.0.15 vs Design v10.0.9 mismatch). Example: + +```csharp +modelBuilder.Entity().HasIndex(e => new { e.IsPubliclyShared, e.OwnerId }) + .HasDatabaseName("IX_Assets_VisibleForSearch") + .HasFilter("\"DeletedAt\" IS NULL"); +``` + ## Tests No test project found in solution. diff --git a/Lactose/Context/LactoseDbContext.cs b/Lactose/Context/LactoseDbContext.cs index 3132d39..c33e1ac 100644 --- a/Lactose/Context/LactoseDbContext.cs +++ b/Lactose/Context/LactoseDbContext.cs @@ -72,6 +72,9 @@ public class LactoseDbContext : DbContext { modelBuilder.Entity().HasMany(e => e.Tags).WithMany(e => e.Assets); modelBuilder.Entity().HasMany(e => e.Faces).WithOne(e => e.Asset); modelBuilder.Entity().HasOne(e => e.Folder).WithMany(e => e.Assets); + modelBuilder.Entity().HasIndex(e => new { e.IsPubliclyShared, e.OwnerId }) + .HasDatabaseName("IX_Assets_VisibleForSearch") + .HasFilter("\"DeletedAt\" IS NULL"); //Face Relationships modelBuilder.Entity().HasOne(e => e.Asset).WithMany(e => e.Faces); modelBuilder.Entity().HasOne(e => e.Person).WithMany(e => e.Faces); diff --git a/Lactose/Migrations/20260712160403_AddAssetsSearchVisibilityIndex.Designer.cs b/Lactose/Migrations/20260712160403_AddAssetsSearchVisibilityIndex.Designer.cs new file mode 100644 index 0000000..3cb0b58 --- /dev/null +++ b/Lactose/Migrations/20260712160403_AddAssetsSearchVisibilityIndex.Designer.cs @@ -0,0 +1,581 @@ +// +using System; +using System.Collections; +using Lactose.Context; +using Microsoft.EntityFrameworkCore; +using Microsoft.EntityFrameworkCore.Infrastructure; +using Microsoft.EntityFrameworkCore.Migrations; +using Microsoft.EntityFrameworkCore.Storage.ValueConversion; +using Npgsql.EntityFrameworkCore.PostgreSQL.Metadata; + +#nullable disable + +namespace Lactose.Migrations +{ + [DbContext(typeof(LactoseDbContext))] + [Migration("20260712160403_AddAssetsSearchVisibilityIndex")] + partial class AddAssetsSearchVisibilityIndex + { + /// + protected override void BuildTargetModel(ModelBuilder modelBuilder) + { +#pragma warning disable 612, 618 + modelBuilder + .HasAnnotation("ProductVersion", "10.0.9") + .HasAnnotation("Relational:MaxIdentifierLength", 63); + + NpgsqlModelBuilderExtensions.HasPostgresExtension(modelBuilder, "vector"); + NpgsqlModelBuilderExtensions.UseIdentityByDefaultColumns(modelBuilder); + + modelBuilder.Entity("AlbumAsset", b => + { + b.Property("AlbumsId") + .HasColumnType("uuid"); + + b.Property("AssetsId") + .HasColumnType("uuid"); + + b.HasKey("AlbumsId", "AssetsId"); + + b.HasIndex("AssetsId"); + + b.ToTable("AlbumAsset"); + }); + + modelBuilder.Entity("AssetTag", b => + { + b.Property("AssetsId") + .HasColumnType("uuid"); + + b.Property("TagsId") + .HasColumnType("uuid"); + + b.HasKey("AssetsId", "TagsId"); + + b.HasIndex("TagsId"); + + b.ToTable("AssetTag"); + }); + + modelBuilder.Entity("AssetUser", b => + { + b.Property("SharedAssetsId") + .HasColumnType("uuid"); + + b.Property("SharedWithId") + .HasColumnType("uuid"); + + b.HasKey("SharedAssetsId", "SharedWithId"); + + b.HasIndex("SharedWithId"); + + b.ToTable("AssetUser"); + }); + + modelBuilder.Entity("Lactose.Models.Album", b => + { + b.Property("Id") + .ValueGeneratedOnAdd() + .HasColumnType("uuid"); + + b.Property("CoverAssetId") + .HasColumnType("uuid"); + + b.Property("CreatedAt") + .HasColumnType("timestamp with time zone"); + + b.Property("PersonOwnerId") + .HasColumnType("uuid"); + + b.Property("Title") + .IsRequired() + .HasColumnType("VARCHAR(255)"); + + b.Property("UpdatedAt") + .HasColumnType("timestamp with time zone"); + + b.Property("UserOwnerId") + .HasColumnType("uuid"); + + b.HasKey("Id"); + + b.HasIndex("CoverAssetId"); + + b.HasIndex("PersonOwnerId"); + + b.HasIndex("UserOwnerId"); + + b.ToTable("Albums"); + }); + + modelBuilder.Entity("Lactose.Models.Asset", b => + { + b.Property("Id") + .ValueGeneratedOnAdd() + .HasColumnType("uuid"); + + b.Property("CreatedAt") + .HasColumnType("timestamp with time zone"); + + b.Property("DeletedAt") + .HasColumnType("timestamp with time zone"); + + b.Property("Duration") + .HasColumnType("real"); + + b.Property("FileSize") + .HasColumnType("bigint"); + + b.Property("FolderId") + .HasColumnType("uuid"); + + b.Property("FrameRate") + .HasColumnType("real"); + + b.Property("Hash") + .IsRequired() + .HasColumnType("bit(64)"); + + b.Property("IsPubliclyShared") + .HasColumnType("boolean"); + + b.Property("MimeType") + .IsRequired() + .HasColumnType("VARCHAR(255)"); + + b.Property("OriginalFilename") + .IsRequired() + .HasColumnType("VARCHAR(255)"); + + b.Property("OriginalPath") + .IsRequired() + .HasColumnType("VARCHAR(2048)"); + + b.Property("OwnerId") + .HasColumnType("uuid"); + + b.Property("PreviewFormat") + .IsRequired() + .HasColumnType("VARCHAR(16)"); + + b.Property("PreviewPath") + .IsRequired() + .HasColumnType("VARCHAR(2048)"); + + b.Property("PreviewSize") + .HasColumnType("integer"); + + b.Property("ResolutionHeight") + .HasColumnType("integer"); + + b.Property("ResolutionWidth") + .HasColumnType("integer"); + + b.Property("ThumbnailFormat") + .IsRequired() + .HasColumnType("VARCHAR(16)"); + + b.Property("ThumbnailPath") + .IsRequired() + .HasColumnType("VARCHAR(2048)"); + + b.Property("ThumbnailSize") + .HasColumnType("integer"); + + b.Property("Type") + .HasColumnType("integer"); + + b.Property("UpdatedAt") + .HasColumnType("timestamp with time zone"); + + b.HasKey("Id"); + + b.HasIndex("FolderId"); + + b.HasIndex("OriginalPath") + .IsUnique(); + + b.HasIndex("OwnerId"); + + b.HasIndex("IsPubliclyShared", "OwnerId") + .HasDatabaseName("IX_Assets_VisibleForSearch") + .HasFilter("\"DeletedAt\" IS NULL"); + + b.ToTable("Assets"); + }); + + modelBuilder.Entity("Lactose.Models.Face", b => + { + b.Property("Id") + .ValueGeneratedOnAdd() + .HasColumnType("uuid"); + + b.Property("AssetId") + .HasColumnType("uuid"); + + b.Property("BoundingBoxX1") + .HasColumnType("integer"); + + b.Property("BoundingBoxX2") + .HasColumnType("integer"); + + b.Property("BoundingBoxY1") + .HasColumnType("integer"); + + b.Property("BoundingBoxY2") + .HasColumnType("integer"); + + b.Property("ImageHeight") + .HasColumnType("integer"); + + b.Property("ImageWidth") + .HasColumnType("integer"); + + b.Property("PersonId") + .HasColumnType("uuid"); + + b.HasKey("Id"); + + b.HasIndex("AssetId"); + + b.HasIndex("PersonId"); + + b.ToTable("Faces"); + }); + + modelBuilder.Entity("Lactose.Models.Folder", b => + { + b.Property("Id") + .ValueGeneratedOnAdd() + .HasColumnType("uuid"); + + b.Property("Active") + .HasColumnType("boolean"); + + b.Property("BasePath") + .IsRequired() + .HasColumnType("VARCHAR(2048)"); + + b.Property("RegexPattern") + .HasMaxLength(2048) + .HasColumnType("character varying(2048)"); + + b.HasKey("Id"); + + b.ToTable("Folders"); + }); + + modelBuilder.Entity("Lactose.Models.JobRecord", b => + { + b.Property("Id") + .ValueGeneratedOnAdd() + .HasColumnType("uuid"); + + b.Property("Created") + .HasColumnType("timestamp with time zone"); + + b.Property("Finished") + .HasColumnType("timestamp with time zone"); + + b.Property("JobType") + .HasColumnType("integer"); + + b.Property("Message") + .HasColumnType("VARCHAR(2048)"); + + b.Property("ModifiedAt") + .HasColumnType("timestamp with time zone"); + + b.Property("Name") + .IsRequired() + .HasColumnType("VARCHAR(2048)"); + + b.Property("ParentJobId") + .HasColumnType("uuid"); + + b.Property("Progress") + .HasColumnType("real"); + + b.Property("Started") + .HasColumnType("timestamp with time zone"); + + b.Property("Status") + .HasColumnType("integer"); + + b.HasKey("Id"); + + b.ToTable("JobRecords"); + }); + + modelBuilder.Entity("Lactose.Models.Person", b => + { + b.Property("Id") + .ValueGeneratedOnAdd() + .HasColumnType("uuid"); + + b.Property("CreatedAt") + .HasColumnType("timestamp with time zone"); + + b.Property("Name") + .IsRequired() + .HasColumnType("VARCHAR(255)"); + + b.Property("ProfileAssetId") + .HasColumnType("uuid"); + + b.Property("ProfileCropX") + .HasColumnType("real"); + + b.Property("ProfileCropY") + .HasColumnType("real"); + + b.Property("ProfileCropZoom") + .HasColumnType("real"); + + b.Property("UpdatedAt") + .HasColumnType("timestamp with time zone"); + + b.HasKey("Id"); + + b.HasIndex("ProfileAssetId"); + + b.ToTable("People"); + }); + + modelBuilder.Entity("Lactose.Models.Setting", b => + { + b.Property("Name") + .HasMaxLength(50) + .HasColumnType("character varying(50)"); + + b.Property("Description") + .HasMaxLength(2048) + .HasColumnType("character varying(2048)"); + + b.Property("DisplayType") + .HasColumnType("integer"); + + b.PrimitiveCollection("Options") + .HasColumnType("text[]"); + + b.Property("Type") + .HasColumnType("integer"); + + b.Property("Value") + .HasMaxLength(1024) + .HasColumnType("character varying(1024)"); + + b.HasKey("Name"); + + b.ToTable("Settings"); + }); + + modelBuilder.Entity("Lactose.Models.Tag", b => + { + b.Property("Id") + .ValueGeneratedOnAdd() + .HasColumnType("uuid"); + + b.Property("Name") + .IsRequired() + .HasColumnType("VARCHAR(255)"); + + b.Property("ParentId") + .HasColumnType("uuid"); + + b.HasKey("Id"); + + b.HasIndex("ParentId"); + + b.ToTable("Tags"); + }); + + modelBuilder.Entity("Lactose.Models.User", b => + { + b.Property("Id") + .ValueGeneratedOnAdd() + .HasColumnType("uuid"); + + b.Property("AccessLevel") + .HasColumnType("integer"); + + b.Property("BannedAt") + .HasColumnType("timestamp with time zone"); + + b.Property("CreatedAt") + .HasColumnType("timestamp with time zone"); + + b.Property("DeletedAt") + .HasColumnType("timestamp with time zone"); + + b.Property("Email") + .IsRequired() + .HasColumnType("VARCHAR(128)"); + + b.Property("LastLogin") + .HasColumnType("timestamp with time zone"); + + b.Property("Password") + .IsRequired() + .HasColumnType("VARCHAR(255)"); + + b.Property("RefreshToken") + .IsRequired() + .HasColumnType("VARCHAR(255)"); + + b.Property("RefreshTokenExpires") + .HasColumnType("timestamp with time zone"); + + b.Property("UpdatedAt") + .HasColumnType("timestamp with time zone"); + + b.Property("Username") + .IsRequired() + .HasColumnType("VARCHAR(64)"); + + b.HasKey("Id"); + + b.ToTable("Users"); + }); + + modelBuilder.Entity("AlbumAsset", b => + { + b.HasOne("Lactose.Models.Album", null) + .WithMany() + .HasForeignKey("AlbumsId") + .OnDelete(DeleteBehavior.Cascade) + .IsRequired(); + + b.HasOne("Lactose.Models.Asset", null) + .WithMany() + .HasForeignKey("AssetsId") + .OnDelete(DeleteBehavior.Cascade) + .IsRequired(); + }); + + modelBuilder.Entity("AssetTag", b => + { + b.HasOne("Lactose.Models.Asset", null) + .WithMany() + .HasForeignKey("AssetsId") + .OnDelete(DeleteBehavior.Cascade) + .IsRequired(); + + b.HasOne("Lactose.Models.Tag", null) + .WithMany() + .HasForeignKey("TagsId") + .OnDelete(DeleteBehavior.Cascade) + .IsRequired(); + }); + + modelBuilder.Entity("AssetUser", b => + { + b.HasOne("Lactose.Models.Asset", null) + .WithMany() + .HasForeignKey("SharedAssetsId") + .OnDelete(DeleteBehavior.Cascade) + .IsRequired(); + + b.HasOne("Lactose.Models.User", null) + .WithMany() + .HasForeignKey("SharedWithId") + .OnDelete(DeleteBehavior.Cascade) + .IsRequired(); + }); + + modelBuilder.Entity("Lactose.Models.Album", b => + { + b.HasOne("Lactose.Models.Asset", "CoverAsset") + .WithMany() + .HasForeignKey("CoverAssetId"); + + b.HasOne("Lactose.Models.Person", "PersonOwner") + .WithMany("Albums") + .HasForeignKey("PersonOwnerId"); + + b.HasOne("Lactose.Models.User", "UserOwner") + .WithMany("OwnedAlbums") + .HasForeignKey("UserOwnerId"); + + b.Navigation("CoverAsset"); + + b.Navigation("PersonOwner"); + + b.Navigation("UserOwner"); + }); + + modelBuilder.Entity("Lactose.Models.Asset", b => + { + b.HasOne("Lactose.Models.Folder", "Folder") + .WithMany("Assets") + .HasForeignKey("FolderId"); + + b.HasOne("Lactose.Models.User", "Owner") + .WithMany("OwnedAssets") + .HasForeignKey("OwnerId"); + + b.Navigation("Folder"); + + b.Navigation("Owner"); + }); + + modelBuilder.Entity("Lactose.Models.Face", b => + { + b.HasOne("Lactose.Models.Asset", "Asset") + .WithMany("Faces") + .HasForeignKey("AssetId"); + + b.HasOne("Lactose.Models.Person", "Person") + .WithMany("Faces") + .HasForeignKey("PersonId"); + + b.Navigation("Asset"); + + b.Navigation("Person"); + }); + + modelBuilder.Entity("Lactose.Models.Person", b => + { + b.HasOne("Lactose.Models.Asset", "ProfileAsset") + .WithMany() + .HasForeignKey("ProfileAssetId"); + + b.Navigation("ProfileAsset"); + }); + + modelBuilder.Entity("Lactose.Models.Tag", b => + { + b.HasOne("Lactose.Models.Tag", "Parent") + .WithMany() + .HasForeignKey("ParentId"); + + b.Navigation("Parent"); + }); + + modelBuilder.Entity("Lactose.Models.Asset", b => + { + b.Navigation("Faces"); + }); + + modelBuilder.Entity("Lactose.Models.Folder", b => + { + b.Navigation("Assets"); + }); + + modelBuilder.Entity("Lactose.Models.Person", b => + { + b.Navigation("Albums"); + + b.Navigation("Faces"); + }); + + modelBuilder.Entity("Lactose.Models.User", b => + { + b.Navigation("OwnedAlbums"); + + b.Navigation("OwnedAssets"); + }); +#pragma warning restore 612, 618 + } + } +} diff --git a/Lactose/Migrations/20260712160403_AddAssetsSearchVisibilityIndex.cs b/Lactose/Migrations/20260712160403_AddAssetsSearchVisibilityIndex.cs new file mode 100644 index 0000000..0820be2 --- /dev/null +++ b/Lactose/Migrations/20260712160403_AddAssetsSearchVisibilityIndex.cs @@ -0,0 +1,28 @@ +using Microsoft.EntityFrameworkCore.Migrations; + +#nullable disable + +namespace Lactose.Migrations +{ + /// + public partial class AddAssetsSearchVisibilityIndex : Migration + { + /// + protected override void Up(MigrationBuilder migrationBuilder) + { + migrationBuilder.CreateIndex( + name: "IX_Assets_VisibleForSearch", + table: "Assets", + columns: new[] { "IsPubliclyShared", "OwnerId" }, + filter: "\"DeletedAt\" IS NULL"); + } + + /// + protected override void Down(MigrationBuilder migrationBuilder) + { + migrationBuilder.DropIndex( + name: "IX_Assets_VisibleForSearch", + table: "Assets"); + } + } +} diff --git a/Lactose/Migrations/LactoseDbContextModelSnapshot.cs b/Lactose/Migrations/LactoseDbContextModelSnapshot.cs index 392f1db..46d541e 100644 --- a/Lactose/Migrations/LactoseDbContextModelSnapshot.cs +++ b/Lactose/Migrations/LactoseDbContextModelSnapshot.cs @@ -194,6 +194,10 @@ namespace Lactose.Migrations b.HasIndex("OwnerId"); + b.HasIndex("IsPubliclyShared", "OwnerId") + .HasDatabaseName("IX_Assets_VisibleForSearch") + .HasFilter("\"DeletedAt\" IS NULL"); + b.ToTable("Assets"); }); -- 2.54.0 From e05ab3beafc5140e3cbd2c7a1351691eed1a5f87 Mon Sep 17 00:00:00 2001 From: REDCODE Date: Sun, 12 Jul 2026 18:05:55 +0200 Subject: [PATCH 36/50] docs: document REST Client tests in AGENTS.md --- AGENTS.md | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/AGENTS.md b/AGENTS.md index f7d18cc..c88627b 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -100,6 +100,10 @@ modelBuilder.Entity().HasIndex(e => new { e.IsPubliclyShared, e.OwnerId } ## Tests -No test project found in solution. +No unit/integration test project exists. API endpoint testing is done via **REST Client `.http` files**: + +- **`Lactose/WepApiTest.http`** — 66+ numbered tests covering all API endpoints across 10 sections (Auth → User CRUD → Person → Album → Tag → Asset → Stats → Settings → Cleanup). Tests verify authorization at every level (anonymous, user, curator, admin). Self-contained — all test data is created at runtime and cleaned up. +- Open in VS Code/Rider with the REST Client extension and run individual tests or the full suite. +- Server must be running locally (default `http://localhost:5162`). -- 2.54.0 From ad2f08698dd5b943eec37c9c21d351eadaae7eee Mon Sep 17 00:00:00 2001 From: REDCODE Date: Sun, 12 Jul 2026 18:24:55 +0200 Subject: [PATCH 37/50] perf: simplify ORDER BY to total count and add trigram GIN indexes Simplify the 'assets'/'albums' sort to use total count instead of visibility-filtered count, eliminating the expensive correlated COUNT subquery from ORDER BY (which evaluated 25k times for every album). Add pg_trgm extension and GIN trigram indexes on People.Name and Albums.Title for efficient ILike %%query%% searches. The SELECT projection still computes visibility-filtered counts for accuracy, but only for the paginated subset (30 rows). Migration: 20260712162406_AddTrigramIndexes --- Lactose/Context/LactoseDbContext.cs | 11 + ...260712162406_AddTrigramIndexes.Designer.cs | 594 ++++++++++++++++++ .../20260712162406_AddTrigramIndexes.cs | 50 ++ .../LactoseDbContextModelSnapshot.cs | 13 + Lactose/Repositories/AlbumRepository.cs | 11 - Lactose/Repositories/PersonRepository.cs | 13 - 6 files changed, 668 insertions(+), 24 deletions(-) create mode 100644 Lactose/Migrations/20260712162406_AddTrigramIndexes.Designer.cs create mode 100644 Lactose/Migrations/20260712162406_AddTrigramIndexes.cs diff --git a/Lactose/Context/LactoseDbContext.cs b/Lactose/Context/LactoseDbContext.cs index c33e1ac..47f81b4 100644 --- a/Lactose/Context/LactoseDbContext.cs +++ b/Lactose/Context/LactoseDbContext.cs @@ -60,6 +60,7 @@ public class LactoseDbContext : DbContext { /// protected override void OnModelCreating(ModelBuilder modelBuilder) { modelBuilder.HasPostgresExtension("vector"); + modelBuilder.HasPostgresExtension("pg_trgm"); //Album Relationships modelBuilder.Entity().HasOne(e => e.UserOwner).WithMany(e => e.OwnedAlbums); modelBuilder.Entity().HasOne(e => e.PersonOwner).WithMany(e => e.Albums); @@ -75,6 +76,16 @@ public class LactoseDbContext : DbContext { modelBuilder.Entity().HasIndex(e => new { e.IsPubliclyShared, e.OwnerId }) .HasDatabaseName("IX_Assets_VisibleForSearch") .HasFilter("\"DeletedAt\" IS NULL"); + // People + modelBuilder.Entity().HasIndex(p => p.Name) + .HasDatabaseName("IX_People_Name_Trgm") + .HasMethod("gin") + .HasOperators("gin_trgm_ops"); + // Albums + modelBuilder.Entity().HasIndex(a => a.Title) + .HasDatabaseName("IX_Albums_Title_Trgm") + .HasMethod("gin") + .HasOperators("gin_trgm_ops"); //Face Relationships modelBuilder.Entity().HasOne(e => e.Asset).WithMany(e => e.Faces); modelBuilder.Entity().HasOne(e => e.Person).WithMany(e => e.Faces); diff --git a/Lactose/Migrations/20260712162406_AddTrigramIndexes.Designer.cs b/Lactose/Migrations/20260712162406_AddTrigramIndexes.Designer.cs new file mode 100644 index 0000000..909d910 --- /dev/null +++ b/Lactose/Migrations/20260712162406_AddTrigramIndexes.Designer.cs @@ -0,0 +1,594 @@ +// +using System; +using System.Collections; +using Lactose.Context; +using Microsoft.EntityFrameworkCore; +using Microsoft.EntityFrameworkCore.Infrastructure; +using Microsoft.EntityFrameworkCore.Migrations; +using Microsoft.EntityFrameworkCore.Storage.ValueConversion; +using Npgsql.EntityFrameworkCore.PostgreSQL.Metadata; + +#nullable disable + +namespace Lactose.Migrations +{ + [DbContext(typeof(LactoseDbContext))] + [Migration("20260712162406_AddTrigramIndexes")] + partial class AddTrigramIndexes + { + /// + protected override void BuildTargetModel(ModelBuilder modelBuilder) + { +#pragma warning disable 612, 618 + modelBuilder + .HasAnnotation("ProductVersion", "10.0.9") + .HasAnnotation("Relational:MaxIdentifierLength", 63); + + NpgsqlModelBuilderExtensions.HasPostgresExtension(modelBuilder, "pg_trgm"); + NpgsqlModelBuilderExtensions.HasPostgresExtension(modelBuilder, "vector"); + NpgsqlModelBuilderExtensions.UseIdentityByDefaultColumns(modelBuilder); + + modelBuilder.Entity("AlbumAsset", b => + { + b.Property("AlbumsId") + .HasColumnType("uuid"); + + b.Property("AssetsId") + .HasColumnType("uuid"); + + b.HasKey("AlbumsId", "AssetsId"); + + b.HasIndex("AssetsId"); + + b.ToTable("AlbumAsset"); + }); + + modelBuilder.Entity("AssetTag", b => + { + b.Property("AssetsId") + .HasColumnType("uuid"); + + b.Property("TagsId") + .HasColumnType("uuid"); + + b.HasKey("AssetsId", "TagsId"); + + b.HasIndex("TagsId"); + + b.ToTable("AssetTag"); + }); + + modelBuilder.Entity("AssetUser", b => + { + b.Property("SharedAssetsId") + .HasColumnType("uuid"); + + b.Property("SharedWithId") + .HasColumnType("uuid"); + + b.HasKey("SharedAssetsId", "SharedWithId"); + + b.HasIndex("SharedWithId"); + + b.ToTable("AssetUser"); + }); + + modelBuilder.Entity("Lactose.Models.Album", b => + { + b.Property("Id") + .ValueGeneratedOnAdd() + .HasColumnType("uuid"); + + b.Property("CoverAssetId") + .HasColumnType("uuid"); + + b.Property("CreatedAt") + .HasColumnType("timestamp with time zone"); + + b.Property("PersonOwnerId") + .HasColumnType("uuid"); + + b.Property("Title") + .IsRequired() + .HasColumnType("VARCHAR(255)"); + + b.Property("UpdatedAt") + .HasColumnType("timestamp with time zone"); + + b.Property("UserOwnerId") + .HasColumnType("uuid"); + + b.HasKey("Id"); + + b.HasIndex("CoverAssetId"); + + b.HasIndex("PersonOwnerId"); + + b.HasIndex("Title") + .HasDatabaseName("IX_Albums_Title_Trgm"); + + NpgsqlIndexBuilderExtensions.HasMethod(b.HasIndex("Title"), "gin"); + NpgsqlIndexBuilderExtensions.HasOperators(b.HasIndex("Title"), new[] { "gin_trgm_ops" }); + + b.HasIndex("UserOwnerId"); + + b.ToTable("Albums"); + }); + + modelBuilder.Entity("Lactose.Models.Asset", b => + { + b.Property("Id") + .ValueGeneratedOnAdd() + .HasColumnType("uuid"); + + b.Property("CreatedAt") + .HasColumnType("timestamp with time zone"); + + b.Property("DeletedAt") + .HasColumnType("timestamp with time zone"); + + b.Property("Duration") + .HasColumnType("real"); + + b.Property("FileSize") + .HasColumnType("bigint"); + + b.Property("FolderId") + .HasColumnType("uuid"); + + b.Property("FrameRate") + .HasColumnType("real"); + + b.Property("Hash") + .IsRequired() + .HasColumnType("bit(64)"); + + b.Property("IsPubliclyShared") + .HasColumnType("boolean"); + + b.Property("MimeType") + .IsRequired() + .HasColumnType("VARCHAR(255)"); + + b.Property("OriginalFilename") + .IsRequired() + .HasColumnType("VARCHAR(255)"); + + b.Property("OriginalPath") + .IsRequired() + .HasColumnType("VARCHAR(2048)"); + + b.Property("OwnerId") + .HasColumnType("uuid"); + + b.Property("PreviewFormat") + .IsRequired() + .HasColumnType("VARCHAR(16)"); + + b.Property("PreviewPath") + .IsRequired() + .HasColumnType("VARCHAR(2048)"); + + b.Property("PreviewSize") + .HasColumnType("integer"); + + b.Property("ResolutionHeight") + .HasColumnType("integer"); + + b.Property("ResolutionWidth") + .HasColumnType("integer"); + + b.Property("ThumbnailFormat") + .IsRequired() + .HasColumnType("VARCHAR(16)"); + + b.Property("ThumbnailPath") + .IsRequired() + .HasColumnType("VARCHAR(2048)"); + + b.Property("ThumbnailSize") + .HasColumnType("integer"); + + b.Property("Type") + .HasColumnType("integer"); + + b.Property("UpdatedAt") + .HasColumnType("timestamp with time zone"); + + b.HasKey("Id"); + + b.HasIndex("FolderId"); + + b.HasIndex("OriginalPath") + .IsUnique(); + + b.HasIndex("OwnerId"); + + b.HasIndex("IsPubliclyShared", "OwnerId") + .HasDatabaseName("IX_Assets_VisibleForSearch") + .HasFilter("\"DeletedAt\" IS NULL"); + + b.ToTable("Assets"); + }); + + modelBuilder.Entity("Lactose.Models.Face", b => + { + b.Property("Id") + .ValueGeneratedOnAdd() + .HasColumnType("uuid"); + + b.Property("AssetId") + .HasColumnType("uuid"); + + b.Property("BoundingBoxX1") + .HasColumnType("integer"); + + b.Property("BoundingBoxX2") + .HasColumnType("integer"); + + b.Property("BoundingBoxY1") + .HasColumnType("integer"); + + b.Property("BoundingBoxY2") + .HasColumnType("integer"); + + b.Property("ImageHeight") + .HasColumnType("integer"); + + b.Property("ImageWidth") + .HasColumnType("integer"); + + b.Property("PersonId") + .HasColumnType("uuid"); + + b.HasKey("Id"); + + b.HasIndex("AssetId"); + + b.HasIndex("PersonId"); + + b.ToTable("Faces"); + }); + + modelBuilder.Entity("Lactose.Models.Folder", b => + { + b.Property("Id") + .ValueGeneratedOnAdd() + .HasColumnType("uuid"); + + b.Property("Active") + .HasColumnType("boolean"); + + b.Property("BasePath") + .IsRequired() + .HasColumnType("VARCHAR(2048)"); + + b.Property("RegexPattern") + .HasMaxLength(2048) + .HasColumnType("character varying(2048)"); + + b.HasKey("Id"); + + b.ToTable("Folders"); + }); + + modelBuilder.Entity("Lactose.Models.JobRecord", b => + { + b.Property("Id") + .ValueGeneratedOnAdd() + .HasColumnType("uuid"); + + b.Property("Created") + .HasColumnType("timestamp with time zone"); + + b.Property("Finished") + .HasColumnType("timestamp with time zone"); + + b.Property("JobType") + .HasColumnType("integer"); + + b.Property("Message") + .HasColumnType("VARCHAR(2048)"); + + b.Property("ModifiedAt") + .HasColumnType("timestamp with time zone"); + + b.Property("Name") + .IsRequired() + .HasColumnType("VARCHAR(2048)"); + + b.Property("ParentJobId") + .HasColumnType("uuid"); + + b.Property("Progress") + .HasColumnType("real"); + + b.Property("Started") + .HasColumnType("timestamp with time zone"); + + b.Property("Status") + .HasColumnType("integer"); + + b.HasKey("Id"); + + b.ToTable("JobRecords"); + }); + + modelBuilder.Entity("Lactose.Models.Person", b => + { + b.Property("Id") + .ValueGeneratedOnAdd() + .HasColumnType("uuid"); + + b.Property("CreatedAt") + .HasColumnType("timestamp with time zone"); + + b.Property("Name") + .IsRequired() + .HasColumnType("VARCHAR(255)"); + + b.Property("ProfileAssetId") + .HasColumnType("uuid"); + + b.Property("ProfileCropX") + .HasColumnType("real"); + + b.Property("ProfileCropY") + .HasColumnType("real"); + + b.Property("ProfileCropZoom") + .HasColumnType("real"); + + b.Property("UpdatedAt") + .HasColumnType("timestamp with time zone"); + + b.HasKey("Id"); + + b.HasIndex("Name") + .HasDatabaseName("IX_People_Name_Trgm"); + + NpgsqlIndexBuilderExtensions.HasMethod(b.HasIndex("Name"), "gin"); + NpgsqlIndexBuilderExtensions.HasOperators(b.HasIndex("Name"), new[] { "gin_trgm_ops" }); + + b.HasIndex("ProfileAssetId"); + + b.ToTable("People"); + }); + + modelBuilder.Entity("Lactose.Models.Setting", b => + { + b.Property("Name") + .HasMaxLength(50) + .HasColumnType("character varying(50)"); + + b.Property("Description") + .HasMaxLength(2048) + .HasColumnType("character varying(2048)"); + + b.Property("DisplayType") + .HasColumnType("integer"); + + b.PrimitiveCollection("Options") + .HasColumnType("text[]"); + + b.Property("Type") + .HasColumnType("integer"); + + b.Property("Value") + .HasMaxLength(1024) + .HasColumnType("character varying(1024)"); + + b.HasKey("Name"); + + b.ToTable("Settings"); + }); + + modelBuilder.Entity("Lactose.Models.Tag", b => + { + b.Property("Id") + .ValueGeneratedOnAdd() + .HasColumnType("uuid"); + + b.Property("Name") + .IsRequired() + .HasColumnType("VARCHAR(255)"); + + b.Property("ParentId") + .HasColumnType("uuid"); + + b.HasKey("Id"); + + b.HasIndex("ParentId"); + + b.ToTable("Tags"); + }); + + modelBuilder.Entity("Lactose.Models.User", b => + { + b.Property("Id") + .ValueGeneratedOnAdd() + .HasColumnType("uuid"); + + b.Property("AccessLevel") + .HasColumnType("integer"); + + b.Property("BannedAt") + .HasColumnType("timestamp with time zone"); + + b.Property("CreatedAt") + .HasColumnType("timestamp with time zone"); + + b.Property("DeletedAt") + .HasColumnType("timestamp with time zone"); + + b.Property("Email") + .IsRequired() + .HasColumnType("VARCHAR(128)"); + + b.Property("LastLogin") + .HasColumnType("timestamp with time zone"); + + b.Property("Password") + .IsRequired() + .HasColumnType("VARCHAR(255)"); + + b.Property("RefreshToken") + .IsRequired() + .HasColumnType("VARCHAR(255)"); + + b.Property("RefreshTokenExpires") + .HasColumnType("timestamp with time zone"); + + b.Property("UpdatedAt") + .HasColumnType("timestamp with time zone"); + + b.Property("Username") + .IsRequired() + .HasColumnType("VARCHAR(64)"); + + b.HasKey("Id"); + + b.ToTable("Users"); + }); + + modelBuilder.Entity("AlbumAsset", b => + { + b.HasOne("Lactose.Models.Album", null) + .WithMany() + .HasForeignKey("AlbumsId") + .OnDelete(DeleteBehavior.Cascade) + .IsRequired(); + + b.HasOne("Lactose.Models.Asset", null) + .WithMany() + .HasForeignKey("AssetsId") + .OnDelete(DeleteBehavior.Cascade) + .IsRequired(); + }); + + modelBuilder.Entity("AssetTag", b => + { + b.HasOne("Lactose.Models.Asset", null) + .WithMany() + .HasForeignKey("AssetsId") + .OnDelete(DeleteBehavior.Cascade) + .IsRequired(); + + b.HasOne("Lactose.Models.Tag", null) + .WithMany() + .HasForeignKey("TagsId") + .OnDelete(DeleteBehavior.Cascade) + .IsRequired(); + }); + + modelBuilder.Entity("AssetUser", b => + { + b.HasOne("Lactose.Models.Asset", null) + .WithMany() + .HasForeignKey("SharedAssetsId") + .OnDelete(DeleteBehavior.Cascade) + .IsRequired(); + + b.HasOne("Lactose.Models.User", null) + .WithMany() + .HasForeignKey("SharedWithId") + .OnDelete(DeleteBehavior.Cascade) + .IsRequired(); + }); + + modelBuilder.Entity("Lactose.Models.Album", b => + { + b.HasOne("Lactose.Models.Asset", "CoverAsset") + .WithMany() + .HasForeignKey("CoverAssetId"); + + b.HasOne("Lactose.Models.Person", "PersonOwner") + .WithMany("Albums") + .HasForeignKey("PersonOwnerId"); + + b.HasOne("Lactose.Models.User", "UserOwner") + .WithMany("OwnedAlbums") + .HasForeignKey("UserOwnerId"); + + b.Navigation("CoverAsset"); + + b.Navigation("PersonOwner"); + + b.Navigation("UserOwner"); + }); + + modelBuilder.Entity("Lactose.Models.Asset", b => + { + b.HasOne("Lactose.Models.Folder", "Folder") + .WithMany("Assets") + .HasForeignKey("FolderId"); + + b.HasOne("Lactose.Models.User", "Owner") + .WithMany("OwnedAssets") + .HasForeignKey("OwnerId"); + + b.Navigation("Folder"); + + b.Navigation("Owner"); + }); + + modelBuilder.Entity("Lactose.Models.Face", b => + { + b.HasOne("Lactose.Models.Asset", "Asset") + .WithMany("Faces") + .HasForeignKey("AssetId"); + + b.HasOne("Lactose.Models.Person", "Person") + .WithMany("Faces") + .HasForeignKey("PersonId"); + + b.Navigation("Asset"); + + b.Navigation("Person"); + }); + + modelBuilder.Entity("Lactose.Models.Person", b => + { + b.HasOne("Lactose.Models.Asset", "ProfileAsset") + .WithMany() + .HasForeignKey("ProfileAssetId"); + + b.Navigation("ProfileAsset"); + }); + + modelBuilder.Entity("Lactose.Models.Tag", b => + { + b.HasOne("Lactose.Models.Tag", "Parent") + .WithMany() + .HasForeignKey("ParentId"); + + b.Navigation("Parent"); + }); + + modelBuilder.Entity("Lactose.Models.Asset", b => + { + b.Navigation("Faces"); + }); + + modelBuilder.Entity("Lactose.Models.Folder", b => + { + b.Navigation("Assets"); + }); + + modelBuilder.Entity("Lactose.Models.Person", b => + { + b.Navigation("Albums"); + + b.Navigation("Faces"); + }); + + modelBuilder.Entity("Lactose.Models.User", b => + { + b.Navigation("OwnedAlbums"); + + b.Navigation("OwnedAssets"); + }); +#pragma warning restore 612, 618 + } + } +} diff --git a/Lactose/Migrations/20260712162406_AddTrigramIndexes.cs b/Lactose/Migrations/20260712162406_AddTrigramIndexes.cs new file mode 100644 index 0000000..be2f7dd --- /dev/null +++ b/Lactose/Migrations/20260712162406_AddTrigramIndexes.cs @@ -0,0 +1,50 @@ +using Microsoft.EntityFrameworkCore.Migrations; + +#nullable disable + +namespace Lactose.Migrations +{ + /// + public partial class AddTrigramIndexes : Migration + { + /// + protected override void Up(MigrationBuilder migrationBuilder) + { + migrationBuilder.AlterDatabase() + .Annotation("Npgsql:PostgresExtension:pg_trgm", ",,") + .Annotation("Npgsql:PostgresExtension:vector", ",,") + .OldAnnotation("Npgsql:PostgresExtension:vector", ",,"); + + migrationBuilder.CreateIndex( + name: "IX_People_Name_Trgm", + table: "People", + column: "Name") + .Annotation("Npgsql:IndexMethod", "gin") + .Annotation("Npgsql:IndexOperators", new[] { "gin_trgm_ops" }); + + migrationBuilder.CreateIndex( + name: "IX_Albums_Title_Trgm", + table: "Albums", + column: "Title") + .Annotation("Npgsql:IndexMethod", "gin") + .Annotation("Npgsql:IndexOperators", new[] { "gin_trgm_ops" }); + } + + /// + protected override void Down(MigrationBuilder migrationBuilder) + { + migrationBuilder.DropIndex( + name: "IX_People_Name_Trgm", + table: "People"); + + migrationBuilder.DropIndex( + name: "IX_Albums_Title_Trgm", + table: "Albums"); + + migrationBuilder.AlterDatabase() + .Annotation("Npgsql:PostgresExtension:vector", ",,") + .OldAnnotation("Npgsql:PostgresExtension:pg_trgm", ",,") + .OldAnnotation("Npgsql:PostgresExtension:vector", ",,"); + } + } +} diff --git a/Lactose/Migrations/LactoseDbContextModelSnapshot.cs b/Lactose/Migrations/LactoseDbContextModelSnapshot.cs index 46d541e..e979af5 100644 --- a/Lactose/Migrations/LactoseDbContextModelSnapshot.cs +++ b/Lactose/Migrations/LactoseDbContextModelSnapshot.cs @@ -21,6 +21,7 @@ namespace Lactose.Migrations .HasAnnotation("ProductVersion", "10.0.9") .HasAnnotation("Relational:MaxIdentifierLength", 63); + NpgsqlModelBuilderExtensions.HasPostgresExtension(modelBuilder, "pg_trgm"); NpgsqlModelBuilderExtensions.HasPostgresExtension(modelBuilder, "vector"); NpgsqlModelBuilderExtensions.UseIdentityByDefaultColumns(modelBuilder); @@ -100,6 +101,12 @@ namespace Lactose.Migrations b.HasIndex("PersonOwnerId"); + b.HasIndex("Title") + .HasDatabaseName("IX_Albums_Title_Trgm"); + + NpgsqlIndexBuilderExtensions.HasMethod(b.HasIndex("Title"), "gin"); + NpgsqlIndexBuilderExtensions.HasOperators(b.HasIndex("Title"), new[] { "gin_trgm_ops" }); + b.HasIndex("UserOwnerId"); b.ToTable("Albums"); @@ -334,6 +341,12 @@ namespace Lactose.Migrations b.HasKey("Id"); + b.HasIndex("Name") + .HasDatabaseName("IX_People_Name_Trgm"); + + NpgsqlIndexBuilderExtensions.HasMethod(b.HasIndex("Name"), "gin"); + NpgsqlIndexBuilderExtensions.HasOperators(b.HasIndex("Name"), new[] { "gin_trgm_ops" }); + b.HasIndex("ProfileAssetId"); b.ToTable("People"); diff --git a/Lactose/Repositories/AlbumRepository.cs b/Lactose/Repositories/AlbumRepository.cs index e13b605..0f1f199 100644 --- a/Lactose/Repositories/AlbumRepository.cs +++ b/Lactose/Repositories/AlbumRepository.cs @@ -48,17 +48,6 @@ public class AlbumRepository(LactoseDbContext context) : IAlbumRepository { { "name" => sortAsc ? albumsQuery.OrderBy(a => a.Title) : albumsQuery.OrderByDescending(a => a.Title), "updated" => sortAsc ? albumsQuery.OrderBy(a => a.UpdatedAt) : albumsQuery.OrderByDescending(a => a.UpdatedAt), - "assets" when accessLevel == EAccessLevel.User => sortAsc - ? albumsQuery.OrderBy(a => a.Assets!.Count(asset => - asset.DeletedAt == null && ( - asset.IsPubliclyShared || - asset.OwnerId == userId || - (asset.SharedWith != null && asset.SharedWith.Any(u => u.Id == userId))))) - : albumsQuery.OrderByDescending(a => a.Assets!.Count(asset => - asset.DeletedAt == null && ( - asset.IsPubliclyShared || - asset.OwnerId == userId || - (asset.SharedWith != null && asset.SharedWith.Any(u => u.Id == userId))))), "assets" => sortAsc ? albumsQuery.OrderBy(a => a.Assets!.Count) : albumsQuery.OrderByDescending(a => a.Assets!.Count), diff --git a/Lactose/Repositories/PersonRepository.cs b/Lactose/Repositories/PersonRepository.cs index c34933a..1bf6bcd 100644 --- a/Lactose/Repositories/PersonRepository.cs +++ b/Lactose/Repositories/PersonRepository.cs @@ -79,19 +79,6 @@ public class PersonRepository(LactoseDbContext context) : IPersonRepository { IOrderedQueryable ordered = sortBy?.ToLower() switch { "created" => sortAsc ? peopleQuery.OrderBy(p => p.CreatedAt) : peopleQuery.OrderByDescending(p => p.CreatedAt), - "albums" when accessLevel == EAccessLevel.User => sortAsc - ? peopleQuery.OrderBy(p => p.Albums!.Count(a => - a.Assets != null && a.Assets.Any(asset => asset.DeletedAt == null && ( - asset.IsPubliclyShared || - asset.OwnerId == userId || - (asset.SharedWith != null && asset.SharedWith.Any(u => u.Id == userId)) - )))) - : peopleQuery.OrderByDescending(p => p.Albums!.Count(a => - a.Assets != null && a.Assets.Any(asset => asset.DeletedAt == null && ( - asset.IsPubliclyShared || - asset.OwnerId == userId || - (asset.SharedWith != null && asset.SharedWith.Any(u => u.Id == userId)) - )))), "albums" => sortAsc ? peopleQuery.OrderBy(p => p.Albums!.Count) : peopleQuery.OrderByDescending(p => p.Albums!.Count), -- 2.54.0 From 50c58e22ffbc9a76cc9259b5d0d6d7a8e2f63f14 Mon Sep 17 00:00:00 2001 From: REDCODE Date: Sun, 12 Jul 2026 18:50:03 +0200 Subject: [PATCH 38/50] fix: restore ToAlbumPreviewDto mapper method per review feedback #91 --- Lactose/Mapper/AlbumMapper.cs | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/Lactose/Mapper/AlbumMapper.cs b/Lactose/Mapper/AlbumMapper.cs index 91ce710..0dfaf16 100644 --- a/Lactose/Mapper/AlbumMapper.cs +++ b/Lactose/Mapper/AlbumMapper.cs @@ -7,6 +7,21 @@ namespace Lactose.Mapper; /// provides mapping methods for converting Album objects to DTOs. /// public static class AlbumMapper { + /// + /// Maps an Album object to an AlbumPreviewDto object. + /// + /// The album to map. + /// An AlbumPreviewDto object. + public static AlbumPreviewDto ToAlbumPreviewDto(this Album album) => new AlbumPreviewDto { + Id = album.Id, + Name = album.Title, + Owner = album.UserOwnerId, + Person = album.PersonOwnerId, + PersonName = album.PersonOwner?.Name, + CoverAssetId = album.CoverAssetId, + AssetCount = album.Assets?.Count ?? 0 + }; + /// /// Maps an Album object to an AlbumFullDto object. /// -- 2.54.0 From 1b301ff2c0a18d1cdb66ad816b016b93868895d2 Mon Sep 17 00:00:00 2001 From: REDCODE Date: Sun, 12 Jul 2026 19:03:09 +0200 Subject: [PATCH 39/50] fix: standardize pagination to zero-based across all layers MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - AssetRepository: all Skip() formulas changed from (page-1)*size to page*size - JobRecordRepository: same formula change for GetPastRootJobs - AssetController: removed Page+1 bridge conversion, passes Page directly - JobsController: GetPast default changed from 1 to 0, added validation - AlbumController, TagController, PersonController: consistent Page<0/PageSize<1 validation - IAssetRepository XML doc: 1-based → zero-based - Home.razor: shifted all internal page state from 1-based to 0-based Closes #95 --- Lactose/Controllers/AlbumController.cs | 2 +- Lactose/Controllers/AssetController.cs | 2 +- Lactose/Controllers/JobsController.cs | 3 ++- Lactose/Controllers/PersonController.cs | 2 ++ Lactose/Controllers/TagController.cs | 2 +- Lactose/Repositories/AssetRepository.cs | 6 +++--- Lactose/Repositories/IAssetRepository.cs | 2 +- Lactose/Repositories/JobRecordRepository.cs | 2 +- MilkStream.Client/Components/Pages/Home.razor | 14 +++++++------- 9 files changed, 19 insertions(+), 16 deletions(-) diff --git a/Lactose/Controllers/AlbumController.cs b/Lactose/Controllers/AlbumController.cs index bd8d6ee..baf9328 100644 --- a/Lactose/Controllers/AlbumController.cs +++ b/Lactose/Controllers/AlbumController.cs @@ -80,7 +80,7 @@ public class AlbumController( var uid = authService.GetUserData(User)?.Id; var accessLevel = authService.GetUserData(User)?.AccessLevel ?? EAccessLevel.User; - if(pagingOptions.Page < 0 || pagingOptions.PageSize < 0) return BadRequest(); + if(pagingOptions.Page < 0 || pagingOptions.PageSize < 1) return BadRequest(); var albums = albumRepository.SearchQuery( pagingOptions.Search ?? string.Empty, diff --git a/Lactose/Controllers/AssetController.cs b/Lactose/Controllers/AssetController.cs index 646f082..69f8fc3 100644 --- a/Lactose/Controllers/AssetController.cs +++ b/Lactose/Controllers/AssetController.cs @@ -131,7 +131,7 @@ public class AssetController( var assets = assetRepository.GetAssets( searchOptionsDto.Type, from, to, searchOptionsDto.Random, searchOptionsDto.Seed, - searchOptionsDto.Page + 1, searchOptionsDto.PageSize, out int total + searchOptionsDto.Page, searchOptionsDto.PageSize, out int total ); logger.LogTrace( diff --git a/Lactose/Controllers/JobsController.cs b/Lactose/Controllers/JobsController.cs index af4667b..116dc0f 100644 --- a/Lactose/Controllers/JobsController.cs +++ b/Lactose/Controllers/JobsController.cs @@ -35,7 +35,8 @@ public class JobsController(JobManager jobManager, JobScheduler jobScheduler, La /// [HttpGet("past")] [Authorize(Roles = "Admin")] - public ActionResult GetPast([FromQuery] int page = 1, [FromQuery] int pageSize = 5) { + public ActionResult GetPast([FromQuery] int page = 0, [FromQuery] int pageSize = 5) { + if (page < 0 || pageSize < 1) { return BadRequest(); } var accessLevel = authService.GetUserData(User)?.AccessLevel ?? EAccessLevel.User; if (accessLevel != EAccessLevel.Admin) { return Unauthorized(); } var (jobs, total) = jobManager.GetPastRootJobs(page, pageSize); diff --git a/Lactose/Controllers/PersonController.cs b/Lactose/Controllers/PersonController.cs index 2851624..25cf61c 100644 --- a/Lactose/Controllers/PersonController.cs +++ b/Lactose/Controllers/PersonController.cs @@ -76,6 +76,8 @@ public class PersonController( var uid = authService.GetUserData(User)?.Id; var accessLevel = authService.GetUserData(User)?.AccessLevel ?? EAccessLevel.User; + if (pagedSearch.Page < 0 || pagedSearch.PageSize < 1) { return BadRequest(); } + var people = personRepository.SearchQuery( pagedSearch.Search ?? string.Empty, pagedSearch.Page, diff --git a/Lactose/Controllers/TagController.cs b/Lactose/Controllers/TagController.cs index 5b60d7c..31ac4b5 100644 --- a/Lactose/Controllers/TagController.cs +++ b/Lactose/Controllers/TagController.cs @@ -70,7 +70,7 @@ public class TagController( public ActionResult> GetAll([FromQuery] PagedSearchParametersDto pagedSearch) { pagedSearch.Search ??= string.Empty; if(pagedSearch.Page < 0) { return BadRequest("Page must be greater than 0"); } - if(pagedSearch.PageSize < 0) { return BadRequest("PageSize must be greater than 0"); } + if(pagedSearch.PageSize < 1) { return BadRequest("PageSize must be greater than 0"); } List tags = tagRepository.Search(pagedSearch.Search, pagedSearch.Page, pagedSearch.PageSize); List tagsDto = []; diff --git a/Lactose/Repositories/AssetRepository.cs b/Lactose/Repositories/AssetRepository.cs index 617975a..c951ad9 100644 --- a/Lactose/Repositories/AssetRepository.cs +++ b/Lactose/Repositories/AssetRepository.cs @@ -21,7 +21,7 @@ public class AssetRepository(LactoseDbContext context) : IAssetRepository { /// public IEnumerable FindByDateRange(DateTime from, DateTime to, int pageNumber, int pageSize) => context.Assets.Where(x => x.CreatedAt >= from && x.UpdatedAt <= to) - .Skip((pageNumber - 1) * pageSize) + .Skip(pageNumber * pageSize) .Take(pageSize); /// @@ -151,7 +151,7 @@ public class AssetRepository(LactoseDbContext context) : IAssetRepository { var seedHash = seed.Value.GetHashCode(); var shuffledIds = allIds .OrderBy(id => DeterministicHash(id, seedHash)) - .Skip((pageNumber - 1) * pageSize) + .Skip(pageNumber * pageSize) .Take(pageSize) .ToList(); @@ -167,7 +167,7 @@ public class AssetRepository(LactoseDbContext context) : IAssetRepository { dataQuery = orderRandomly ? dataQuery.OrderBy(a => a.Id) : dataQuery.OrderByDescending(a => a.CreatedAt); return dataQuery - .Skip((pageNumber - 1) * pageSize) + .Skip(pageNumber * pageSize) .Take(pageSize) .ToList(); } diff --git a/Lactose/Repositories/IAssetRepository.cs b/Lactose/Repositories/IAssetRepository.cs index d5c7b88..6120cc3 100644 --- a/Lactose/Repositories/IAssetRepository.cs +++ b/Lactose/Repositories/IAssetRepository.cs @@ -168,7 +168,7 @@ public interface IAssetRepository : IDisposable { /// Optional end date for the date range filter. /// If true, orders randomly instead of by date. /// An optional seed for deterministic random ordering across paginated requests. - /// The 1-based page number. + /// The zero-based page number. /// The number of items per page. /// The total count of matching assets. /// A paginated collection of assets matching the filters. diff --git a/Lactose/Repositories/JobRecordRepository.cs b/Lactose/Repositories/JobRecordRepository.cs index d76da4a..ddaba92 100644 --- a/Lactose/Repositories/JobRecordRepository.cs +++ b/Lactose/Repositories/JobRecordRepository.cs @@ -35,7 +35,7 @@ public class JobRecordRepository(LactoseDbContext context) : IJobRecordRepositor return query .OrderByDescending(j => j.Finished ?? j.Created) - .Skip((page - 1) * pageSize) + .Skip(page * pageSize) .Take(pageSize) .ToList(); } diff --git a/MilkStream.Client/Components/Pages/Home.razor b/MilkStream.Client/Components/Pages/Home.razor index e9de699..86d1f4b 100644 --- a/MilkStream.Client/Components/Pages/Home.razor +++ b/MilkStream.Client/Components/Pages/Home.razor @@ -172,13 +172,13 @@ async Task LoadFirstPage() { _randomSeed = Guid.NewGuid(); isLoading = true; - var items = await assetService.GetAssetsAsync(EAssetType.Image, true, _randomSeed, 1, 30); + var items = await assetService.GetAssetsAsync(EAssetType.Image, true, _randomSeed, 0, 30); if (items?.Count > 0) { allAssetPages.Add(items); RebuildFlatList(); - loadedMinPage = 1; - loadedMaxPage = 1; - currentPage = 2; + loadedMinPage = 0; + loadedMaxPage = 0; + currentPage = 1; hasMoreUp = false; } hasMore = items?.Count == 30; @@ -211,12 +211,12 @@ [JSInvokable] public async Task LoadPreviousPage() { - if (isLoadingUp || !hasMoreUp || loadedMinPage <= 1) return; + if (isLoadingUp || !hasMoreUp || loadedMinPage <= 0) return; isLoadingUp = true; StateHasChanged(); var pageToLoad = loadedMinPage - 1; - if (pageToLoad < 1) { + if (pageToLoad < 0) { hasMoreUp = false; isLoadingUp = false; return; @@ -234,7 +234,7 @@ } } - hasMoreUp = loadedMinPage > 1; + hasMoreUp = loadedMinPage > 0; isLoadingUp = false; StateHasChanged(); } -- 2.54.0 From 20a456591dd734d8921adb7c75a8de9fb354e95c Mon Sep 17 00:00:00 2001 From: REDCODE Date: Sun, 12 Jul 2026 19:07:38 +0200 Subject: [PATCH 40/50] fix: move SharedWith visibility check to client side for translatable queries EF Core cannot translate SharedWith.Any() through the many-to-many AlbumAsset join table inside a SQL WHERE clause. Moved the visibility filter to client-side after loading the page's records with Include. PersonRepository.SearchQuery and AlbumRepository.SearchQuery now: 1. Get paginated IDs without visibility filter (translatable SQL) 2. Load those records with Include chains 3. Filter visibility in C# (SharedWith.Any(), etc.) 4. Project to DTOs --- Lactose/Repositories/AlbumRepository.cs | 57 ++++++++++++---------- Lactose/Repositories/PersonRepository.cs | 60 +++++++++++++----------- 2 files changed, 64 insertions(+), 53 deletions(-) diff --git a/Lactose/Repositories/AlbumRepository.cs b/Lactose/Repositories/AlbumRepository.cs index 0f1f199..36278b9 100644 --- a/Lactose/Repositories/AlbumRepository.cs +++ b/Lactose/Repositories/AlbumRepository.cs @@ -35,15 +35,6 @@ public class AlbumRepository(LactoseDbContext context) : IAlbumRepository { if (unassigned) albumsQuery = albumsQuery.Where(a => a.PersonOwnerId == null); - if (accessLevel == EAccessLevel.User) - albumsQuery = albumsQuery.Where(a => - a.Assets != null && a.Assets.Any(asset => - asset.DeletedAt == null && ( - asset.IsPubliclyShared || - asset.OwnerId == userId || - (asset.SharedWith != null && asset.SharedWith.Any(u => u.Id == userId)) - ))); - IOrderedQueryable ordered = sortBy?.ToLower() switch { "name" => sortAsc ? albumsQuery.OrderBy(a => a.Title) : albumsQuery.OrderByDescending(a => a.Title), @@ -65,25 +56,41 @@ public class AlbumRepository(LactoseDbContext context) : IAlbumRepository { if (albumIds.Count == 0) return []; - var dtos = context.Albums + // Load with includes for client-side visibility filtering + var pagedAlbums = context.Albums + .Include(a => a.Assets)!.ThenInclude(a => a.SharedWith) + .Include(a => a.PersonOwner) .Where(a => albumIds.Contains(a.Id)) - .Select(a => new AlbumPreviewDto { - Id = a.Id, - Name = a.Title, - Owner = a.UserOwnerId, - Person = a.PersonOwnerId, - PersonName = a.PersonOwner!.Name, - CoverAssetId = a.CoverAssetId, - AssetCount = accessLevel == EAccessLevel.User - ? a.Assets!.Count(asset => - asset.DeletedAt == null && ( - asset.IsPubliclyShared || - asset.OwnerId == userId || - (asset.SharedWith != null && asset.SharedWith.Any(u => u.Id == userId)))) - : a.Assets!.Count - }) .ToList(); + // Filter out albums with no visible content for regular users + if (accessLevel == EAccessLevel.User) + pagedAlbums = pagedAlbums.Where(a => + a.Assets != null && a.Assets.Any(asset => + asset.DeletedAt == null && ( + asset.IsPubliclyShared || + asset.OwnerId == userId || + (asset.SharedWith != null && asset.SharedWith.Any(u => u.Id == userId)) + )) + ).ToList(); + + // Project to DTOs + var dtos = pagedAlbums.Select(a => new AlbumPreviewDto { + Id = a.Id, + Name = a.Title, + Owner = a.UserOwnerId, + Person = a.PersonOwnerId, + PersonName = a.PersonOwner?.Name ?? string.Empty, + CoverAssetId = a.CoverAssetId, + AssetCount = accessLevel == EAccessLevel.User + ? a.Assets?.Count(asset => + asset.DeletedAt == null && ( + asset.IsPubliclyShared || + asset.OwnerId == userId || + (asset.SharedWith != null && asset.SharedWith.Any(u => u.Id == userId)))) ?? 0 + : a.Assets?.Count ?? 0 + }).ToList(); + var orderMap = albumIds.Select((id, i) => (id, i)).ToDictionary(x => x.id, x => x.i); return [.. dtos.OrderBy(d => orderMap.GetValueOrDefault(d.Id))]; } diff --git a/Lactose/Repositories/PersonRepository.cs b/Lactose/Repositories/PersonRepository.cs index 1bf6bcd..0e3cdac 100644 --- a/Lactose/Repositories/PersonRepository.cs +++ b/Lactose/Repositories/PersonRepository.cs @@ -65,16 +65,6 @@ public class PersonRepository(LactoseDbContext context) : IPersonRepository { if (!string.IsNullOrEmpty(query)) peopleQuery = peopleQuery.Where(p => EF.Functions.ILike(p.Name, $"%{query}%")); - // Filter out people with no visible content for regular users - if (accessLevel == EAccessLevel.User) - peopleQuery = peopleQuery.Where(p => - p.Albums != null && p.Albums.Any(a => - a.Assets != null && a.Assets.Any(asset => asset.DeletedAt == null && ( - asset.IsPubliclyShared || - asset.OwnerId == userId || - (asset.SharedWith != null && asset.SharedWith.Any(u => u.Id == userId)) - )))); - // Apply sorting — use subquery counts for "albums" IOrderedQueryable ordered = sortBy?.ToLower() switch { @@ -96,27 +86,41 @@ public class PersonRepository(LactoseDbContext context) : IPersonRepository { if (personIds.Count == 0) return []; - // Then load the scalar data + visible album count via subquery - var dtos = context.People + // Load with includes for client-side visibility filtering + var pagedPeople = context.People + .Include(p => p.Albums)!.ThenInclude(a => a.Assets)!.ThenInclude(a => a.SharedWith) .Where(p => personIds.Contains(p.Id)) - .Select(p => new PersonPreviewDto { - Id = p.Id, - Name = p.Name, - ProfileAssetId = p.ProfileAssetId, - ProfileCropX = p.ProfileCropX, - ProfileCropY = p.ProfileCropY, - ProfileCropZoom = p.ProfileCropZoom, - TotalAlbums = accessLevel == EAccessLevel.User - ? p.Albums!.Count(a => - a.Assets != null && a.Assets.Any(asset => asset.DeletedAt == null && ( - asset.IsPubliclyShared || - asset.OwnerId == userId || - (asset.SharedWith != null && asset.SharedWith.Any(u => u.Id == userId)) - ))) - : p.Albums!.Count - }) .ToList(); + // Filter out people with no visible content for regular users + if (accessLevel == EAccessLevel.User) + pagedPeople = pagedPeople.Where(p => + p.Albums != null && p.Albums.Any(a => + a.Assets != null && a.Assets.Any(asset => asset.DeletedAt == null && ( + asset.IsPubliclyShared || + asset.OwnerId == userId || + (asset.SharedWith != null && asset.SharedWith.Any(u => u.Id == userId)) + ))) + ).ToList(); + + // Project to DTOs + var dtos = pagedPeople.Select(p => new PersonPreviewDto { + Id = p.Id, + Name = p.Name, + ProfileAssetId = p.ProfileAssetId, + ProfileCropX = p.ProfileCropX, + ProfileCropY = p.ProfileCropY, + ProfileCropZoom = p.ProfileCropZoom, + TotalAlbums = accessLevel == EAccessLevel.User + ? p.Albums?.Count(a => + a.Assets != null && a.Assets.Any(asset => asset.DeletedAt == null && ( + asset.IsPubliclyShared || + asset.OwnerId == userId || + (asset.SharedWith != null && asset.SharedWith.Any(u => u.Id == userId)) + ))) ?? 0 + : p.Albums?.Count ?? 0 + }).ToList(); + // Reorder to match the paginated order var orderMap = personIds.Select((id, i) => (id, i)).ToDictionary(x => x.id, x => x.i); return [.. dtos.OrderBy(d => orderMap.GetValueOrDefault(d.Id))]; -- 2.54.0 From efc6379bb3ea475b160df92e0534479447caaa35 Mon Sep 17 00:00:00 2001 From: REDCODE Date: Sun, 12 Jul 2026 19:11:11 +0200 Subject: [PATCH 41/50] test: add cleanup of regular test user in REST Client suite --- Lactose/WepApiTest.http | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/Lactose/WepApiTest.http b/Lactose/WepApiTest.http index ea5b125..ab82ab2 100644 --- a/Lactose/WepApiTest.http +++ b/Lactose/WepApiTest.http @@ -913,3 +913,13 @@ Authorization: Bearer {{admin_token}} client.assert(response.status === 200) }); %} + +### 67. Delete regular user as admin +DELETE {{WepApiTest_HostAddress}}/api/user/{{user_id}} +Authorization: Bearer {{admin_token}} + +> {% + client.test("Delete regular user as admin", function () { + client.assert(response.status === 200) + }); +%} -- 2.54.0 From efeed2b6681484261e17e23200c0cf0081279305 Mon Sep 17 00:00:00 2001 From: REDCODE Date: Sun, 12 Jul 2026 19:17:15 +0200 Subject: [PATCH 42/50] test: add page=0&pageSize=5 to paginated list endpoints Person (tests 23-26), Album (tests 45-48), and User (test 12) list endpoints now explicitly request the first page instead of the full set. --- Lactose/WepApiTest.http | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) diff --git a/Lactose/WepApiTest.http b/Lactose/WepApiTest.http index ab82ab2..c69e5ff 100644 --- a/Lactose/WepApiTest.http +++ b/Lactose/WepApiTest.http @@ -195,7 +195,7 @@ Content-Type: application/json # ============================================================================= ### 12. Get all users as admin (should succeed) -GET {{WepApiTest_HostAddress}}/api/user +GET {{WepApiTest_HostAddress}}/api/user?page=0&pageSize=5 Authorization: Bearer {{admin_token}} > {% @@ -361,7 +361,7 @@ Content-Type: application/json %} ### 23. Get all people as anonymous -GET {{WepApiTest_HostAddress}}/api/person +GET {{WepApiTest_HostAddress}}/api/person?page=0&pageSize=5 > {% client.test("Get all people as anonymous", function () { @@ -370,7 +370,7 @@ GET {{WepApiTest_HostAddress}}/api/person %} ### 24. Get all people as regular user -GET {{WepApiTest_HostAddress}}/api/person +GET {{WepApiTest_HostAddress}}/api/person?page=0&pageSize=5 Authorization: Bearer {{user_token}} > {% @@ -380,7 +380,7 @@ Authorization: Bearer {{user_token}} %} ### 25. Get all people as curator -GET {{WepApiTest_HostAddress}}/api/person +GET {{WepApiTest_HostAddress}}/api/person?page=0&pageSize=5 Authorization: Bearer {{curator_token}} > {% @@ -390,7 +390,7 @@ Authorization: Bearer {{curator_token}} %} ### 26. Get all people as admin -GET {{WepApiTest_HostAddress}}/api/person +GET {{WepApiTest_HostAddress}}/api/person?page=0&pageSize=5 Authorization: Bearer {{admin_token}} > {% @@ -662,7 +662,7 @@ Content-Type: application/json %} ### 45. Get all albums as anonymous -GET {{WepApiTest_HostAddress}}/api/album +GET {{WepApiTest_HostAddress}}/api/album?page=0&pageSize=5 > {% client.test("Get all albums as anonymous", function () { @@ -671,7 +671,7 @@ GET {{WepApiTest_HostAddress}}/api/album %} ### 46. Get all albums as regular user -GET {{WepApiTest_HostAddress}}/api/album +GET {{WepApiTest_HostAddress}}/api/album?page=0&pageSize=5 Authorization: Bearer {{user_token}} > {% @@ -681,7 +681,7 @@ Authorization: Bearer {{user_token}} %} ### 47. Get all albums as curator -GET {{WepApiTest_HostAddress}}/api/album +GET {{WepApiTest_HostAddress}}/api/album?page=0&pageSize=5 Authorization: Bearer {{curator_token}} > {% @@ -691,7 +691,7 @@ Authorization: Bearer {{curator_token}} %} ### 48. Get all albums as admin -GET {{WepApiTest_HostAddress}}/api/album +GET {{WepApiTest_HostAddress}}/api/album?page=0&pageSize=5 Authorization: Bearer {{admin_token}} > {% -- 2.54.0 From 00acfef28c627853646a681014c783aeec0650d7 Mon Sep 17 00:00:00 2001 From: REDCODE Date: Sun, 12 Jul 2026 19:27:10 +0200 Subject: [PATCH 43/50] fix: only reject Page < 0, keep original PageSize validation Per review feedback: only Page being negative is truly invalid. PageSize validation reverted to original < 0 (allowing 0). PersonController keeps minimal Page < 0 check since it had none before. JobsController aligned for consistency. --- Lactose/Controllers/AlbumController.cs | 2 +- Lactose/Controllers/JobsController.cs | 2 +- Lactose/Controllers/PersonController.cs | 2 +- Lactose/Controllers/TagController.cs | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-) diff --git a/Lactose/Controllers/AlbumController.cs b/Lactose/Controllers/AlbumController.cs index baf9328..bd8d6ee 100644 --- a/Lactose/Controllers/AlbumController.cs +++ b/Lactose/Controllers/AlbumController.cs @@ -80,7 +80,7 @@ public class AlbumController( var uid = authService.GetUserData(User)?.Id; var accessLevel = authService.GetUserData(User)?.AccessLevel ?? EAccessLevel.User; - if(pagingOptions.Page < 0 || pagingOptions.PageSize < 1) return BadRequest(); + if(pagingOptions.Page < 0 || pagingOptions.PageSize < 0) return BadRequest(); var albums = albumRepository.SearchQuery( pagingOptions.Search ?? string.Empty, diff --git a/Lactose/Controllers/JobsController.cs b/Lactose/Controllers/JobsController.cs index 116dc0f..6458684 100644 --- a/Lactose/Controllers/JobsController.cs +++ b/Lactose/Controllers/JobsController.cs @@ -36,7 +36,7 @@ public class JobsController(JobManager jobManager, JobScheduler jobScheduler, La [HttpGet("past")] [Authorize(Roles = "Admin")] public ActionResult GetPast([FromQuery] int page = 0, [FromQuery] int pageSize = 5) { - if (page < 0 || pageSize < 1) { return BadRequest(); } + if (page < 0 || pageSize < 0) { return BadRequest(); } var accessLevel = authService.GetUserData(User)?.AccessLevel ?? EAccessLevel.User; if (accessLevel != EAccessLevel.Admin) { return Unauthorized(); } var (jobs, total) = jobManager.GetPastRootJobs(page, pageSize); diff --git a/Lactose/Controllers/PersonController.cs b/Lactose/Controllers/PersonController.cs index 25cf61c..66b7ea7 100644 --- a/Lactose/Controllers/PersonController.cs +++ b/Lactose/Controllers/PersonController.cs @@ -76,7 +76,7 @@ public class PersonController( var uid = authService.GetUserData(User)?.Id; var accessLevel = authService.GetUserData(User)?.AccessLevel ?? EAccessLevel.User; - if (pagedSearch.Page < 0 || pagedSearch.PageSize < 1) { return BadRequest(); } + if (pagedSearch.Page < 0) { return BadRequest(); } var people = personRepository.SearchQuery( pagedSearch.Search ?? string.Empty, diff --git a/Lactose/Controllers/TagController.cs b/Lactose/Controllers/TagController.cs index 31ac4b5..5b60d7c 100644 --- a/Lactose/Controllers/TagController.cs +++ b/Lactose/Controllers/TagController.cs @@ -70,7 +70,7 @@ public class TagController( public ActionResult> GetAll([FromQuery] PagedSearchParametersDto pagedSearch) { pagedSearch.Search ??= string.Empty; if(pagedSearch.Page < 0) { return BadRequest("Page must be greater than 0"); } - if(pagedSearch.PageSize < 1) { return BadRequest("PageSize must be greater than 0"); } + if(pagedSearch.PageSize < 0) { return BadRequest("PageSize must be greater than 0"); } List tags = tagRepository.Search(pagedSearch.Search, pagedSearch.Page, pagedSearch.PageSize); List tagsDto = []; -- 2.54.0 From 393ad136f630f814e0209883c574017f3a61e37e Mon Sep 17 00:00:00 2001 From: REDCODE Date: Sun, 12 Jul 2026 19:31:23 +0200 Subject: [PATCH 44/50] fix: restore PageSize < 1 validation with upper limit of 250 --- Lactose/Controllers/AlbumController.cs | 2 +- Lactose/Controllers/AssetController.cs | 2 +- Lactose/Controllers/JobsController.cs | 2 +- Lactose/Controllers/PersonController.cs | 2 +- Lactose/Controllers/TagController.cs | 2 +- 5 files changed, 5 insertions(+), 5 deletions(-) diff --git a/Lactose/Controllers/AlbumController.cs b/Lactose/Controllers/AlbumController.cs index bd8d6ee..5b226b5 100644 --- a/Lactose/Controllers/AlbumController.cs +++ b/Lactose/Controllers/AlbumController.cs @@ -80,7 +80,7 @@ public class AlbumController( var uid = authService.GetUserData(User)?.Id; var accessLevel = authService.GetUserData(User)?.AccessLevel ?? EAccessLevel.User; - if(pagingOptions.Page < 0 || pagingOptions.PageSize < 0) return BadRequest(); + if(pagingOptions.Page < 0 || pagingOptions.PageSize < 1 || pagingOptions.PageSize > 250) return BadRequest(); var albums = albumRepository.SearchQuery( pagingOptions.Search ?? string.Empty, diff --git a/Lactose/Controllers/AssetController.cs b/Lactose/Controllers/AssetController.cs index 69f8fc3..10efd22 100644 --- a/Lactose/Controllers/AssetController.cs +++ b/Lactose/Controllers/AssetController.cs @@ -124,7 +124,7 @@ public class AssetController( return BadRequest(); } - if (searchOptionsDto.Page < 0 || searchOptionsDto.PageSize < 1) { + if (searchOptionsDto.Page < 0 || searchOptionsDto.PageSize < 1 || searchOptionsDto.PageSize > 250) { logger.LogWarning("Invalid pagination parameters provided"); return BadRequest(); } diff --git a/Lactose/Controllers/JobsController.cs b/Lactose/Controllers/JobsController.cs index 6458684..7fe7b53 100644 --- a/Lactose/Controllers/JobsController.cs +++ b/Lactose/Controllers/JobsController.cs @@ -36,7 +36,7 @@ public class JobsController(JobManager jobManager, JobScheduler jobScheduler, La [HttpGet("past")] [Authorize(Roles = "Admin")] public ActionResult GetPast([FromQuery] int page = 0, [FromQuery] int pageSize = 5) { - if (page < 0 || pageSize < 0) { return BadRequest(); } + if (page < 0 || pageSize < 1 || pageSize > 250) { return BadRequest(); } var accessLevel = authService.GetUserData(User)?.AccessLevel ?? EAccessLevel.User; if (accessLevel != EAccessLevel.Admin) { return Unauthorized(); } var (jobs, total) = jobManager.GetPastRootJobs(page, pageSize); diff --git a/Lactose/Controllers/PersonController.cs b/Lactose/Controllers/PersonController.cs index 66b7ea7..8496229 100644 --- a/Lactose/Controllers/PersonController.cs +++ b/Lactose/Controllers/PersonController.cs @@ -76,7 +76,7 @@ public class PersonController( var uid = authService.GetUserData(User)?.Id; var accessLevel = authService.GetUserData(User)?.AccessLevel ?? EAccessLevel.User; - if (pagedSearch.Page < 0) { return BadRequest(); } + if (pagedSearch.Page < 0 || pagedSearch.PageSize < 1 || pagedSearch.PageSize > 250) { return BadRequest(); } var people = personRepository.SearchQuery( pagedSearch.Search ?? string.Empty, diff --git a/Lactose/Controllers/TagController.cs b/Lactose/Controllers/TagController.cs index 5b60d7c..a0bb538 100644 --- a/Lactose/Controllers/TagController.cs +++ b/Lactose/Controllers/TagController.cs @@ -70,7 +70,7 @@ public class TagController( public ActionResult> GetAll([FromQuery] PagedSearchParametersDto pagedSearch) { pagedSearch.Search ??= string.Empty; if(pagedSearch.Page < 0) { return BadRequest("Page must be greater than 0"); } - if(pagedSearch.PageSize < 0) { return BadRequest("PageSize must be greater than 0"); } + if(pagedSearch.PageSize < 1 || pagedSearch.PageSize > 250) { return BadRequest("PageSize must be between 1 and 250"); } List tags = tagRepository.Search(pagedSearch.Search, pagedSearch.Page, pagedSearch.PageSize); List tagsDto = []; -- 2.54.0 From 819580850048501939463affe94c8fb9050cef51 Mon Sep 17 00:00:00 2001 From: REDCODE Date: Sun, 12 Jul 2026 19:41:10 +0200 Subject: [PATCH 45/50] docs: update AGENTS.md with missing conventions and project info MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - Add Lactose.Analyzers as 5th project (DateTime.UtcNow error MS001) - Document zero-based pagination standard with validation rules - Add SharedWith.Any() EF Core translation gotcha - Document pg_trgm GIN indexes and pgvector extensions - Fix test count (66+ → 67), add env file reference --- AGENTS.md | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) diff --git a/AGENTS.md b/AGENTS.md index c88627b..57d9584 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -24,11 +24,12 @@ dotnet build # compiles SCSS automatically - Aggressive gradient mixins in `Styles/_gradients.scss` - Works in Docker — MSBuild task runs during `dotnet build`/`dotnet publish`, no hosted service -## Projects (4 in solution) +## Projects (5 in solution) | Project | Role | Entrypoint | |---|---|---| | **Butter** | Shared class library (DTOs, enums, MIME types) | — | +| **Lactose.Analyzers** | Roslyn analyzer — enforces `DateTime.UtcNow` (not `DateTime.Now`) as error MS001 | — | | **Lactose** | ASP.NET Core Web API — controllers, EF Core, repos, background jobs | `Lactose/Program.cs` | | **MilkStream** | Blazor WASM host — serves WASM files + dynamic `/appsettings.json` | `MilkStream/Program.cs` | | **MilkStream.Client** | Blazor WASM client — Razor components, SCSS, frontend services, shared UI components (ModalFrame, EmptyState) | `MilkStream.Client/Program.cs` | @@ -53,6 +54,8 @@ dotnet run --project MilkStream # WASM host on :5269 (host) / :8080 (conta - **EF Core Tools v8.0.15 vs EF Core Design v10.0.9:** Version mismatch may cause `dotnet ef` CLI quirks. - **WASM client DI:** `LoginService` is **Singleton**; all other services are `Scoped`. Two `HttpClient` registrations: one unauthenticated (default) for login, and one named `"MilkstreamClient"` which has `JwtTokenRefresher` as a `DelegatingHandler`. The handler transparently refreshes expired tokens pre-flight and retries once on 401 — authenticated services must **never** handle token refreshes manually. Do not add `SendWithRefreshAsync` or similar wrappers; rely solely on the named client. - **HTTPS redirection is commented out** in Lactose — API does not enforce HTTPS. +- **`SharedWith.Any()` EF Core translation:** Cannot be translated to SQL through many-to-many join tables (`AlbumAsset`, `AssetUser`). When visibility filtering includes `SharedWith.Any(u => u.Id == userId)`, you must materialize records first with `.Include().ThenInclude()` chains, then filter client-side in C#. The two-pass pagination approach preserves page-limited loading — see `PersonRepository.SearchQuery` and `AlbumRepository.SearchQuery` for the pattern. +- **DateTime analyzer:** `Lactose.Analyzers` treats `DateTime.Now` as error MS001. Always use `DateTime.UtcNow`. All timestamp columns use `timestamp with time zone`. ## XML docs enforced @@ -65,6 +68,7 @@ dotnet run --project MilkStream # WASM host on :5269 (host) / :8080 (conta - **Repository `Save()` must be called explicitly** after insert/update/delete - **Enum prefix `E`** (e.g. `EAccessLevel`, `EAssetType`, `EJobStatus`) - **JWT access token**: 10 min, refresh token: 60 min (constants in `LactoseAuthService.cs`) +- **Pagination is zero-based** everywhere — `Page = 0` is the first page. All repositories use `Skip(page * pageSize)`. All controllers validate `Page < 0` (reject negative) and `PageSize < 1 || PageSize > 250` (clamp 1–250). - **Conventional Commits** enforced via `cliff.toml`; changelog generated with `git-cliff` - **Granular commits** — commit each logical change separately (e.g., DTO change, controller logic, UI component) with a descriptive commit message - **Reuse API endpoints** — prefer adding optional query parameters to existing endpoints over creating new routes. New endpoints are a last resort when the existing ones fundamentally cannot serve the need. @@ -98,12 +102,17 @@ modelBuilder.Entity().HasIndex(e => new { e.IsPubliclyShared, e.OwnerId } .HasFilter("\"DeletedAt\" IS NULL"); ``` +- **Trigram GIN indexes** on `People.Name` and `Albums.Title` use `HasMethod("gin")` with `HasOperators("gin_trgm_ops")` for case-insensitive `ILike` search. +- **pgvector and pg_trgm** extensions are enabled in `OnModelCreating` via `HasPostgresExtension`. + ## Tests No unit/integration test project exists. API endpoint testing is done via **REST Client `.http` files**: -- **`Lactose/WepApiTest.http`** — 66+ numbered tests covering all API endpoints across 10 sections (Auth → User CRUD → Person → Album → Tag → Asset → Stats → Settings → Cleanup). Tests verify authorization at every level (anonymous, user, curator, admin). Self-contained — all test data is created at runtime and cleaned up. +- **`Lactose/WepApiTest.http`** — 67 numbered tests covering all API endpoints across 10 sections (Auth → User CRUD → Person → Album → Tag → Asset → Stats → Settings → Cleanup). Tests verify authorization at every level (anonymous, user, curator, admin). Self-contained — all test data is created at runtime and cleaned up. +- **`Lactose/http-client.env.json`** — provides pre-filled variable values (`userName`, `curatorName`, etc.) for the REST Client extension. - Open in VS Code/Rider with the REST Client extension and run individual tests or the full suite. - Server must be running locally (default `http://localhost:5162`). +- Paginated list tests (people, albums, users) use `?page=0&pageSize=5` — change these carefully. -- 2.54.0 From 820d3b1c8b6397becb4866cd063f3ff152897293 Mon Sep 17 00:00:00 2001 From: REDCODE Date: Sun, 12 Jul 2026 21:02:33 +0200 Subject: [PATCH 46/50] fix: replace untranslatable Album navigation in stats queries with direct join table queries --- Lactose/Repositories/StatsRepository.cs | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/Lactose/Repositories/StatsRepository.cs b/Lactose/Repositories/StatsRepository.cs index e24db51..8eb9dc5 100644 --- a/Lactose/Repositories/StatsRepository.cs +++ b/Lactose/Repositories/StatsRepository.cs @@ -2,6 +2,7 @@ using Butter.Dtos.Stats; using Butter.Settings; using Butter.Types; using Lactose.Context; +using Lactose.Models; using System.Collections; namespace Lactose.Repositories; @@ -82,11 +83,15 @@ public class StatsRepository(LactoseDbContext context, ISettingsRepository setti dto.AssetsMissingPhash = context.Assets.Count(a => a.Hash == emptyHash && a.DeletedAt == null); + var albumAssetSet = context.Set>("AlbumAsset"); + dto.AssetsWithNoAlbum = context.Assets.Count(a => - a.DeletedAt == null && !a.Albums.Any()); + a.DeletedAt == null && !albumAssetSet.Any(aa => EF.Property(aa, "AssetsId") == a.Id)); dto.AssetsWithNoPerson = context.Assets.Count(a => - a.DeletedAt == null && !a.Albums.Any(al => al.PersonOwnerId != null)); + a.DeletedAt == null && !albumAssetSet.Any(aa => + EF.Property(aa, "AssetsId") == a.Id + && context.Albums.Any(al => al.Id == EF.Property(aa, "AlbumsId") && al.PersonOwnerId != null))); dto.AlbumsMissingCover = context.Albums.Count(a => a.CoverAssetId == null); -- 2.54.0 From 28f9e7faae8c817b0a144c267c5c194b4548dc68 Mon Sep 17 00:00:00 2001 From: REDCODE Date: Sun, 12 Jul 2026 21:02:50 +0200 Subject: [PATCH 47/50] fix: replace untranslatable Tags navigation in TopTags stats query with direct join table query --- Lactose/Repositories/StatsRepository.cs | 19 ++++++++++--------- 1 file changed, 10 insertions(+), 9 deletions(-) diff --git a/Lactose/Repositories/StatsRepository.cs b/Lactose/Repositories/StatsRepository.cs index 8eb9dc5..a7d5b33 100644 --- a/Lactose/Repositories/StatsRepository.cs +++ b/Lactose/Repositories/StatsRepository.cs @@ -97,18 +97,19 @@ public class StatsRepository(LactoseDbContext context, ISettingsRepository setti dto.CosplayersMissingCover = 0; - dto.TopTags = context.Assets - .Where(a => a.DeletedAt == null) - .SelectMany(a => a.Tags) - .GroupBy(t => new { t.Id, t.Name }) - .Select(g => new TagStatDto { + dto.TopTags = ( + from at in context.Set>("AssetTag") + join a in context.Assets.Where(a => a.DeletedAt == null) + on EF.Property(at, "AssetsId") equals (Guid?)a.Id + join t in context.Tags + on EF.Property(at, "TagsId") equals (Guid?)t.Id + group t by new { t.Id, t.Name } into g + select new TagStatDto { Id = g.Key.Id, Name = g.Key.Name, AssetCount = g.Count() - }) - .OrderByDescending(t => t.AssetCount) - .Take(10) - .ToList(); + } + ).OrderByDescending(t => t.AssetCount).Take(10).ToList(); var resolutions = context.Assets .Where(a => a.DeletedAt == null && a.ResolutionWidth > 0 && a.ResolutionHeight > 0) -- 2.54.0 From dbe55be63f88404ddf83cfd873303cf58c30bafa Mon Sep 17 00:00:00 2001 From: REDCODE Date: Sun, 12 Jul 2026 21:15:00 +0200 Subject: [PATCH 48/50] refactor(albums): extract visibility-aware AssetCount into AlbumMapper overload Replace inline AlbumPreviewDto construction in AlbumRepository.SearchQuery with a call to the new ToAlbumPreviewDto(album, userId, accessLevel) mapper overload, making the visibility logic reusable and the repository more compact. --- Lactose/Mapper/AlbumMapper.cs | 24 ++++++++++++++++++++++++ Lactose/Repositories/AlbumRepository.cs | 17 ++--------------- 2 files changed, 26 insertions(+), 15 deletions(-) diff --git a/Lactose/Mapper/AlbumMapper.cs b/Lactose/Mapper/AlbumMapper.cs index 0dfaf16..5144ed3 100644 --- a/Lactose/Mapper/AlbumMapper.cs +++ b/Lactose/Mapper/AlbumMapper.cs @@ -1,4 +1,5 @@ using Butter.Dtos.Album; +using Butter.Types; using Lactose.Models; namespace Lactose.Mapper; @@ -22,6 +23,29 @@ public static class AlbumMapper { AssetCount = album.Assets?.Count ?? 0 }; + /// + /// Maps an Album object to an AlbumPreviewDto with visibility-aware asset counting. + /// + /// The album to map. + /// The requesting user's ID (used for visibility filtering). + /// The requesting user's access level. + /// An AlbumPreviewDto object. + public static AlbumPreviewDto ToAlbumPreviewDto(this Album album, Guid userId, EAccessLevel accessLevel) => new AlbumPreviewDto { + Id = album.Id, + Name = album.Title, + Owner = album.UserOwnerId, + Person = album.PersonOwnerId, + PersonName = album.PersonOwner?.Name, + CoverAssetId = album.CoverAssetId, + AssetCount = accessLevel == EAccessLevel.User + ? album.Assets?.Count(asset => + asset.DeletedAt == null && ( + asset.IsPubliclyShared || + asset.OwnerId == userId || + (asset.SharedWith != null && asset.SharedWith.Any(u => u.Id == userId)))) ?? 0 + : album.Assets?.Count ?? 0 + }; + /// /// Maps an Album object to an AlbumFullDto object. /// diff --git a/Lactose/Repositories/AlbumRepository.cs b/Lactose/Repositories/AlbumRepository.cs index de9c805..3c3bd2e 100644 --- a/Lactose/Repositories/AlbumRepository.cs +++ b/Lactose/Repositories/AlbumRepository.cs @@ -1,6 +1,7 @@ using Butter.Dtos.Album; using Butter.Types; using Lactose.Context; +using Lactose.Mapper; using Lactose.Models; namespace Lactose.Repositories; @@ -74,21 +75,7 @@ public class AlbumRepository(LactoseDbContext context) : IAlbumRepository { ).ToList(); // Project to DTOs - var dtos = pagedAlbums.Select(a => new AlbumPreviewDto { - Id = a.Id, - Name = a.Title, - Owner = a.UserOwnerId, - Person = a.PersonOwnerId, - PersonName = a.PersonOwner?.Name ?? string.Empty, - CoverAssetId = a.CoverAssetId, - AssetCount = accessLevel == EAccessLevel.User - ? a.Assets?.Count(asset => - asset.DeletedAt == null && ( - asset.IsPubliclyShared || - asset.OwnerId == userId || - (asset.SharedWith != null && asset.SharedWith.Any(u => u.Id == userId)))) ?? 0 - : a.Assets?.Count ?? 0 - }).ToList(); + var dtos = pagedAlbums.Select(a => a.ToAlbumPreviewDto(userId, accessLevel)).ToList(); var orderMap = albumIds.Select((id, i) => (id, i)).ToDictionary(x => x.id, x => x.i); return [.. dtos.OrderBy(d => orderMap.GetValueOrDefault(d.Id))]; -- 2.54.0 From e0d46aa87b3bfffc4288d4a2dfb7865fd916e855 Mon Sep 17 00:00:00 2001 From: REDCODE Date: Mon, 13 Jul 2026 17:02:13 +0200 Subject: [PATCH 49/50] refactor: replace hardcoded 250 page size limit with PagedParametersDto.MaxPageSize --- Butter/Dtos/PagedParametersDTO.cs | 6 ++++++ Lactose/Controllers/AlbumController.cs | 2 +- Lactose/Controllers/AssetController.cs | 2 +- Lactose/Controllers/JobsController.cs | 3 ++- Lactose/Controllers/PersonController.cs | 2 +- Lactose/Controllers/TagController.cs | 2 +- 6 files changed, 12 insertions(+), 5 deletions(-) diff --git a/Butter/Dtos/PagedParametersDTO.cs b/Butter/Dtos/PagedParametersDTO.cs index 8f962b2..992168a 100644 --- a/Butter/Dtos/PagedParametersDTO.cs +++ b/Butter/Dtos/PagedParametersDTO.cs @@ -4,6 +4,12 @@ namespace Butter.Dtos; /// Represents pagination parameters for a query. /// public class PagedParametersDto { + + /// + /// Contains the global constant for max pages. + /// + public const int MaxPageSize = 250; + /// /// Gets or sets the page number (zero-based). /// diff --git a/Lactose/Controllers/AlbumController.cs b/Lactose/Controllers/AlbumController.cs index 5b226b5..5ff8496 100644 --- a/Lactose/Controllers/AlbumController.cs +++ b/Lactose/Controllers/AlbumController.cs @@ -80,7 +80,7 @@ public class AlbumController( var uid = authService.GetUserData(User)?.Id; var accessLevel = authService.GetUserData(User)?.AccessLevel ?? EAccessLevel.User; - if(pagingOptions.Page < 0 || pagingOptions.PageSize < 1 || pagingOptions.PageSize > 250) return BadRequest(); + if(pagingOptions.Page < 0 || pagingOptions.PageSize < 1 || pagingOptions.PageSize > PagedParametersDto.MaxPageSize) return BadRequest(); var albums = albumRepository.SearchQuery( pagingOptions.Search ?? string.Empty, diff --git a/Lactose/Controllers/AssetController.cs b/Lactose/Controllers/AssetController.cs index 10efd22..b940039 100644 --- a/Lactose/Controllers/AssetController.cs +++ b/Lactose/Controllers/AssetController.cs @@ -124,7 +124,7 @@ public class AssetController( return BadRequest(); } - if (searchOptionsDto.Page < 0 || searchOptionsDto.PageSize < 1 || searchOptionsDto.PageSize > 250) { + if (searchOptionsDto.Page < 0 || searchOptionsDto.PageSize < 1 || searchOptionsDto.PageSize > PagedParametersDto.MaxPageSize) { logger.LogWarning("Invalid pagination parameters provided"); return BadRequest(); } diff --git a/Lactose/Controllers/JobsController.cs b/Lactose/Controllers/JobsController.cs index e0901b4..b5125ef 100644 --- a/Lactose/Controllers/JobsController.cs +++ b/Lactose/Controllers/JobsController.cs @@ -1,3 +1,4 @@ +using Butter.Dtos; using Butter.Dtos.Jobs; using Butter.Types; using Lactose.Jobs; @@ -35,7 +36,7 @@ public class JobsController(JobManager jobManager, JobScheduler jobScheduler, La [HttpGet("past")] [Authorize(Roles = "Admin")] public ActionResult GetPast([FromQuery] int page = 0, [FromQuery] int pageSize = 5) { - if (page < 0 || pageSize < 1 || pageSize > 250) { return BadRequest(); } + if (page < 0 || pageSize < 1 || pageSize > PagedParametersDto.MaxPageSize) { return BadRequest(); } var accessLevel = authService.GetUserData(User)?.AccessLevel ?? EAccessLevel.User; if (accessLevel != EAccessLevel.Admin) { return Unauthorized(); } var (jobs, total) = jobManager.GetPastRootJobs(page, pageSize); diff --git a/Lactose/Controllers/PersonController.cs b/Lactose/Controllers/PersonController.cs index de6cd82..e83129f 100644 --- a/Lactose/Controllers/PersonController.cs +++ b/Lactose/Controllers/PersonController.cs @@ -103,7 +103,7 @@ public class PersonController( var uid = authService.GetUserData(User)?.Id; var accessLevel = authService.GetUserData(User)?.AccessLevel ?? EAccessLevel.User; - if (pagedSearch.Page < 0 || pagedSearch.PageSize < 1 || pagedSearch.PageSize > 250) { return BadRequest(); } + if (pagedSearch.Page < 0 || pagedSearch.PageSize < 1 || pagedSearch.PageSize > PagedParametersDto.MaxPageSize) { return BadRequest(); } var people = personRepository.SearchQuery( pagedSearch.Search ?? string.Empty, diff --git a/Lactose/Controllers/TagController.cs b/Lactose/Controllers/TagController.cs index a0bb538..246656e 100644 --- a/Lactose/Controllers/TagController.cs +++ b/Lactose/Controllers/TagController.cs @@ -70,7 +70,7 @@ public class TagController( public ActionResult> GetAll([FromQuery] PagedSearchParametersDto pagedSearch) { pagedSearch.Search ??= string.Empty; if(pagedSearch.Page < 0) { return BadRequest("Page must be greater than 0"); } - if(pagedSearch.PageSize < 1 || pagedSearch.PageSize > 250) { return BadRequest("PageSize must be between 1 and 250"); } + if(pagedSearch.PageSize < 1 || pagedSearch.PageSize > PagedParametersDto.MaxPageSize) { return BadRequest($"PageSize must be between 1 and {PagedParametersDto.MaxPageSize}"); } List tags = tagRepository.Search(pagedSearch.Search, pagedSearch.Page, pagedSearch.PageSize); List tagsDto = []; -- 2.54.0 From 87b69d5ee8771a2f8e06e38a513725080d9de867 Mon Sep 17 00:00:00 2001 From: REDCODE Date: Mon, 13 Jul 2026 17:03:53 +0200 Subject: [PATCH 50/50] revert: remove AllowAnonymous from AlbumController.Search and PersonController.GetAll --- Lactose/Controllers/AlbumController.cs | 1 - Lactose/Controllers/PersonController.cs | 1 - 2 files changed, 2 deletions(-) diff --git a/Lactose/Controllers/AlbumController.cs b/Lactose/Controllers/AlbumController.cs index 5ff8496..7f797a3 100644 --- a/Lactose/Controllers/AlbumController.cs +++ b/Lactose/Controllers/AlbumController.cs @@ -75,7 +75,6 @@ public class AlbumController( /// Pagination, search, sort, and filter parameters. /// A list of album previews accessible to the user. [HttpGet] - [AllowAnonymous] public ActionResult> Search([FromQuery] AlbumSearchParametersDto pagingOptions) { var uid = authService.GetUserData(User)?.Id; var accessLevel = authService.GetUserData(User)?.AccessLevel ?? EAccessLevel.User; diff --git a/Lactose/Controllers/PersonController.cs b/Lactose/Controllers/PersonController.cs index e83129f..3a5e656 100644 --- a/Lactose/Controllers/PersonController.cs +++ b/Lactose/Controllers/PersonController.cs @@ -98,7 +98,6 @@ public class PersonController( /// Pagination, search, and sort parameters. /// A paginated list of person previews. [HttpGet] - [AllowAnonymous] public ActionResult> GetAll([FromQuery] PersonSearchParametersDto pagedSearch) { var uid = authService.GetUserData(User)?.Id; var accessLevel = authService.GetUserData(User)?.AccessLevel ?? EAccessLevel.User; -- 2.54.0