fix: the admin requests list names who asked, not a cut-off user id (#6265)

/admin/requests showed "by user f7e1ec86" — the first eight characters of
the requester's id, a placeholder from the first build. The admin list now
sends each requester's username, looked up for the whole page in one query,
and the row reads "by <username>". The id stays as the fallback for a list
that comes back without names.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/api/admin_requests.go

@@ -1,6 +1,7 @@
 package api
 
 import (
+	"context"
 	"encoding/json"
 	"errors"
 	"net/http"
@@ -59,15 +60,36 @@ func (h *handlers) handleListAdminRequests(w http.ResponseWriter, r *http.Reques
 	}
 
 	q := dbq.New(h.pool)
+	names := requesterNames(r.Context(), q, rows)
 	out := make([]requestView, 0, len(rows))
 	for _, row := range rows {
 		v := requestViewFrom(row)
+		v.Username = names[row.UserID]
 		fillProgress(r.Context(), q, row, &v)
 		out = append(out, v)
 	}
 	writeJSON(w, http.StatusOK, out)
 }
 
+// requesterNames maps each request's user id to that user's username, in one
+// query for the whole page. Like fillProgress, a failed lookup is swallowed:
+// the names are a reporting nicety, and the page falls back to the id.
+func requesterNames(ctx context.Context, q *dbq.Queries, rows []dbq.Request) map[pgtype.UUID]string {
+	ids := make([]pgtype.UUID, 0, len(rows))
+	for _, row := range rows {
+		ids = append(ids, row.UserID)
+	}
+	names := make(map[pgtype.UUID]string, len(rows))
+	users, err := q.ListUsernamesByIDs(ctx, ids)
+	if err != nil {
+		return names
+	}
+	for _, u := range users {
+		names[u.ID] = u.Username
+	}
+	return names
+}
+
 // approveRequestBody is the optional JSON body for POST /api/admin/requests/:id/approve.
 // profile_id picks the release-type profile an artist request is followed
 // on; omitted, the default profile.

internal/api/admin_requests_test.go

@@ -90,6 +90,9 @@ func TestHandleListAdminRequests_DefaultStatus_Pending(t *testing.T) {
 		if rv.Status != "pending" {
 			t.Errorf("result status = %q, want pending", rv.Status)
 		}
+		if rv.Username != "alice" {
+			t.Errorf("result username = %q, want alice (the requester)", rv.Username)
+		}
 	}
 }
 

internal/api/requests.go

@@ -16,8 +16,11 @@ import (
 // requestView is the JSON shape returned by all /api/requests handlers.
 // Field names follow the lowercase snake_case convention for /api/* responses.
 type requestView struct {
-	ID              pgtype.UUID        `json:"id"`
-	UserID          pgtype.UUID        `json:"user_id"`
+	ID     pgtype.UUID `json:"id"`
+	UserID pgtype.UUID `json:"user_id"`
+	// Username names the requester. Only the admin list fills it; a user's
+	// own /requests page has no need to name them back to themselves.
+	Username        string             `json:"username,omitempty"`
 	Status          string             `json:"status"`
 	Kind            string             `json:"kind"`
 	ArtistMBID      string             `json:"artist_mbid"`