Fix ML-143 review: security, worker, and test improvements

Closes ML-143 review findings:
- cast_id/1 uses Integer.parse instead of String.to_integer
- add_to_cart validates against server-side release_groups
- JS.push payload trimmed to {id, format} only
- Oban.insert_all result checked for partial failures
- handle_async success resets @importing? to false
- ImportFromMusicbrainzReleaseGroup gets unique constraint
- Record.parse_datetime/1 made public with safe match
- Workers delegate to Record.parse_datetime/1
- Test coverage: change_format, clear_cart, wishlist single import

lib/music_library/records/record.ex

@@ -349,10 +349,13 @@ defmodule MusicLibrary.Records.Record do
     defp parse_format(unquote(Atom.to_string(format))), do: unquote(format)
   end
 
-  defp parse_datetime(nil), do: nil
+  @doc false
+  def parse_datetime(nil), do: nil
 
-  defp parse_datetime(dt_string) do
-    {:ok, dt, _offset} = DateTime.from_iso8601(dt_string)
-    dt
+  def parse_datetime(str) when is_binary(str) do
+    case DateTime.from_iso8601(str) do
+      {:ok, dt, _offset} -> dt
+      {:error, _} -> nil
+    end
   end
 end

lib/music_library/worker/import_from_musicbrainz_release.ex

@@ -7,11 +7,13 @@ defmodule MusicLibrary.Worker.ImportFromMusicbrainzRelease do
 
   use Oban.Worker, queue: :music_brainz, max_attempts: 3
 
+  alias MusicLibrary.Records.Record
+
   @impl Oban.Worker
   def perform(%Oban.Job{args: %{"release_id" => release_id} = args}) do
     opts = [
       format: args["format"],
-      purchased_at: parse_datetime(args["purchased_at"]),
+      purchased_at: Record.parse_datetime(args["purchased_at"]),
       selected_release_id: args["selected_release_id"]
     ]
 
@@ -20,11 +22,4 @@ defmodule MusicLibrary.Worker.ImportFromMusicbrainzRelease do
       {:error, reason} -> {:error, reason}
     end
   end
-
-  defp parse_datetime(nil), do: nil
-
-  defp parse_datetime(str) do
-    {:ok, datetime, _offset} = DateTime.from_iso8601(str)
-    datetime
-  end
 end

lib/music_library/worker/import_from_musicbrainz_release_group.ex

@@ -6,15 +6,19 @@ defmodule MusicLibrary.Worker.ImportFromMusicbrainzReleaseGroup do
   records to import at once.
   """
 
-  use Oban.Worker, queue: :music_brainz, max_attempts: 3
+  use Oban.Worker,
+    queue: :music_brainz,
+    max_attempts: 3,
+    unique: [period: 300, keys: [:release_group_id, :format]]
 
   alias MusicLibrary.Records
+  alias MusicLibrary.Records.Record
 
   @impl Oban.Worker
   def perform(%Oban.Job{args: %{"release_group_id" => release_group_id} = args}) do
     opts = [
       format: args["format"],
-      purchased_at: parse_datetime(args["purchased_at"])
+      purchased_at: Record.parse_datetime(args["purchased_at"])
     ]
 
     case Records.import_from_musicbrainz_release_group(release_group_id, opts) do
@@ -22,11 +26,4 @@ defmodule MusicLibrary.Worker.ImportFromMusicbrainzReleaseGroup do
       {:error, reason} -> {:error, reason}
     end
   end
-
-  defp parse_datetime(nil), do: nil
-
-  defp parse_datetime(str) do
-    {:ok, datetime, _offset} = DateTime.from_iso8601(str)
-    datetime
-  end
 end