From 0e62d4aa1832ccb33052af2472c54b4dafde1274 Mon Sep 17 00:00:00 2001
From: XingfenD <xingfen.fendy@outlook.com>
Date: Mon, 14 Sep 2026 19:42:25 +0800
Subject: [PATCH] =?UTF-8?q?fix(handlers):=20Upload=20io.Copy=20error=20?=
 =?UTF-8?q?=E2=86=92=20500=20not=20413=20(B6),=20Me=20distinguishes=20no-r?=
 =?UTF-8?q?ows=20from=20DB=20errors=20(B7)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 backend/cmd/webui/handlers/auth.go      | 7 ++++++-
 backend/cmd/webui/handlers/libraries.go | 9 ++++++++-
 2 files changed, 14 insertions(+), 2 deletions(-)

diff --git a/backend/cmd/webui/handlers/auth.go b/backend/cmd/webui/handlers/auth.go
index 641c26c..fe9eb1e 100644
--- a/backend/cmd/webui/handlers/auth.go
+++ b/backend/cmd/webui/handlers/auth.go
@@ -48,9 +48,14 @@ func (h *H) Login(c *gin.Context) {
 }
 
 func (h *H) Me(c *gin.Context) {
+	// B7: only no-rows → 401; other errors (PG down) go through dbErr → 503.
 	u, qerr := h.st.GetUserByID(c, uid(c))
 	if qerr != nil {
-		err(c, http.StatusUnauthorized, "unauthorized", "no such user")
+		if errors.Is(qerr, pgx.ErrNoRows) {
+			err(c, http.StatusUnauthorized, "unauthorized", "no such user")
+			return
+		}
+		dbErr(c, qerr)
 		return
 	}
 	c.JSON(http.StatusOK, gin.H{"id": u.ID, "username": u.Username, "role": u.Role})
diff --git a/backend/cmd/webui/handlers/libraries.go b/backend/cmd/webui/handlers/libraries.go
index 7edb9a1..586be1a 100644
--- a/backend/cmd/webui/handlers/libraries.go
+++ b/backend/cmd/webui/handlers/libraries.go
@@ -146,10 +146,17 @@ func (h *H) Upload(c *gin.Context) {
 		err(c, http.StatusInternalServerError, "internal", "create tmp")
 		return
 	}
+	// B6: only MaxBytesError returns 413; other io.Copy failures (disk full,
+	// connection drop) return 500.
 	if _, e := io.Copy(out, src); e != nil {
 		out.Close()
 		os.Remove(tmp)
-		err(c, http.StatusRequestEntityTooLarge, "too_large", "upload failed")
+		var mbe *http.MaxBytesError
+		if errors.As(e, &mbe) {
+			err(c, http.StatusRequestEntityTooLarge, "too_large", "file exceeds upload limit")
+			return
+		}
+		err(c, http.StatusInternalServerError, "internal", "upload failed")
 		return
 	}
 	out.Close()