fix(review): fix issues based on review comments

src/converters/main.ts

@@ -85,6 +85,11 @@ const properties: Record<
     properties: propertiesxelatex,
     converter: convertxelatex,
   },
+  // djvu before calibre so the dedicated ddjvu converter wins for DjVu files
+  djvu: {
+    properties: propertiesDjvu,
+    converter: convertDjvu,
+  },
   calibre: {
     properties: propertiesCalibre,
     converter: convertCalibre,
@@ -93,10 +98,6 @@ const properties: Record<
     properties: propertiesDasel,
     converter: convertDasel,
   },
-  djvu: {
-    properties: propertiesDjvu,
-    converter: convertDjvu,
-  },
   libreoffice: {
     properties: propertiesLibreOffice,
     converter: convertLibreOffice,

src/pages/convert.tsx

@@ -67,6 +67,10 @@ export const convert = new Elysia().use(userService).post(
       return redirect(`${WEBROOT}/`, 302);
     }
 
+    if (!fileNames.every((name) => typeof name === "string")) {
+      return redirect(`${WEBROOT}/`, 302);
+    }
+
     for (let i = 0; i < fileNames.length; i++) {
       fileNames[i] = sanitize(fileNames[i] || "");
     }

src/pages/deleteFile.tsx

@@ -9,7 +9,7 @@ import path from "node:path";
 
 export const deleteFile = new Elysia().use(userService).post(
   "/delete",
-  async ({ body, redirect, cookie: { jobId }, user }) => {
+  async ({ body, redirect, set, cookie: { jobId }, user }) => {
     if (!jobId?.value) {
       return redirect(`${WEBROOT}/`, 302);
     }
@@ -31,6 +31,7 @@ export const deleteFile = new Elysia().use(userService).post(
       await unlink(targetPath);
     } catch (e) {
       if ((e as NodeJS.ErrnoException).code === "ENOENT") {
+        set.status = 404;
         return { message: "File not found." };
       }
       throw e;

src/pages/root.tsx

@@ -38,7 +38,15 @@ export const root = new Elysia().use(userService).get(
         try {
           const verifiedUser = await jwt.verify(auth.value);
           if (verifiedUser && verifiedUser.id) {
-            user = verifiedUser;
+            const numericId = Number.parseInt(verifiedUser.id);
+            // IDs below the anonymous range (excluding shared 0) are registered users
+            const isRegistered = numericId > 0 && numericId < 2 ** 24;
+            if (
+              !isRegistered ||
+              db.query("SELECT * FROM users WHERE id = ?").as(User).get(verifiedUser.id)
+            ) {
+              user = verifiedUser;
+            }
           }
         } catch {
           // Invalid cookie, fall through to anonymous creation