From ac5641bcd3b9ff7c9aa7ee8ba37b6e88a86287d5 Mon Sep 17 00:00:00 2001
From: MechaCat02 <MechaCat02@example.com>
Date: Mon, 13 Jul 2026 21:31:26 +0200
Subject: [PATCH] fix: guard AddToCollectionModal against out-of-order load
 results

Retargeting the modal mid-load could resolve responses out of order, overwriting
the newer target's membership with the older one's (audit FE-2). Route load()
through the tested CancellableLoader so a superseded result is dropped.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 backend/Cargo.lock                            |  2 +-
 backend/Cargo.toml                            |  2 +-
 frontend/package.json                         |  2 +-
 .../components/AddToCollectionModal.svelte    | 26 ++++++++++++++-----
 4 files changed, 22 insertions(+), 10 deletions(-)

diff --git a/backend/Cargo.lock b/backend/Cargo.lock
index bdc3ea6..a285ab0 100644
--- a/backend/Cargo.lock
+++ b/backend/Cargo.lock
@@ -1558,7 +1558,7 @@ checksum = "c41e0c4fef86961ac6d6f8a82609f55f31b05e4fce149ac5710e439df7619ba4"
 
 [[package]]
 name = "mangalord"
-version = "0.128.14"
+version = "0.128.15"
 dependencies = [
  "anyhow",
  "argon2",
diff --git a/backend/Cargo.toml b/backend/Cargo.toml
index d12d172..231e9e9 100644
--- a/backend/Cargo.toml
+++ b/backend/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "mangalord"
-version = "0.128.14"
+version = "0.128.15"
 edition = "2021"
 default-run = "mangalord"
 
diff --git a/frontend/package.json b/frontend/package.json
index 5d5deff..3d2b40e 100644
--- a/frontend/package.json
+++ b/frontend/package.json
@@ -1,6 +1,6 @@
 {
   "name": "mangalord-frontend",
-  "version": "0.128.14",
+  "version": "0.128.15",
   "private": true,
   "type": "module",
   "scripts": {
diff --git a/frontend/src/lib/components/AddToCollectionModal.svelte b/frontend/src/lib/components/AddToCollectionModal.svelte
index d1d8d04..c66d5d8 100644
--- a/frontend/src/lib/components/AddToCollectionModal.svelte
+++ b/frontend/src/lib/components/AddToCollectionModal.svelte
@@ -1,5 +1,6 @@
 <script lang="ts">
     import AdaptiveDialog from './AdaptiveDialog.svelte';
+    import { CancellableLoader } from '$lib/util/cancellable';
     import {
         addMangaToCollection,
         createCollection,
@@ -74,19 +75,30 @@
             : removePageFromCollection(collectionId, t.id);
     }
 
+    // Reopening for a different target (or an in-flight retarget) fires load()
+    // again; without this guard the two responses can resolve out of order and
+    // the first target's membership overwrites the second's (audit FE-2). The
+    // CancellableLoader drops a superseded call's result — the newer load then
+    // owns both the state and the spinner.
+    const loader = new CancellableLoader();
+
     async function load() {
         loading = true;
         error = null;
         try {
-            const [page, ids] = await Promise.all([
-                listMyCollections({ limit: 200 }),
-                loadContaining(target)
-            ]);
-            collections = page.items;
-            containingIds = new Set(ids);
+            const result = await loader.run(async () => {
+                const [page, ids] = await Promise.all([
+                    listMyCollections({ limit: 200 }),
+                    loadContaining(target)
+                ]);
+                return { items: page.items, ids };
+            });
+            if (result === null) return; // superseded — a newer load owns the state
+            collections = result.items;
+            containingIds = new Set(result.ids);
+            loading = false;
         } catch (e) {
             error = (e as Error).message;
-        } finally {
             loading = false;
         }
     }