feat: add visual admin panel with page builder and settings editor
- Add /admin route with password-protected visual page builder
- Page Builder: manage hero images, standalone albums, subpages, and sections
- Album Picker: browse all shared Immich albums with search and filtering
- Settings Editor: theme, grid, footer, legal, SEO configuration
- YAML service with atomic writes and automatic backups (content/.backups/)
- HMAC-signed admin sessions (24h expiry, HttpOnly cookies)
- API endpoints: /api/admin/{auth,gallery,settings,albums,reload}
- Enable with ADMIN_PASSWORD env var; disabled by default
- invalidateConfigCache() export for hot-reload after saves
2026-05-29 17:04:37 +02:00
|
|
|
|
'use client';
|
|
|
|
|
|
|
release: v0.11.0 — journal fixes, admin URLs, design system cleanup (#432)
* fix(screenshots): sharp-Typen fuer 0.34 und 0.35 gleichzeitig (#410)
sharp 0.35 ist von `export =` auf ESM umgestellt: der Modul-Namespace
ist nicht mehr aufrufbar, die Factory sitzt unter .default. Der
Type-Check brach damit in scripts/screenshots.ts weg, sobald der
Next-Bump (#402) sharp von 0.34.5 auf 0.35.3 mitzieht -- sharp ist hier
keine deklarierte Dependency, sondern kommt ueber Next mit.
Die Form wird jetzt aus dem installierten Paket abgeleitet statt
festgeschrieben, zur Laufzeit wie im Typ. Geprueft mit beiden
Versionen: tsc laeuft mit 0.34.5 und mit 0.35.3 fehlerfrei durch.
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
* chore(deps): bump the nextjs group across 1 directory with 2 updates (#402)
Bumps the nextjs group with 2 updates in the / directory: [next](https://github.com/vercel/next.js) and [eslint-config-next](https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next).
Updates `next` from 16.2.12 to 16.3.0
- [Release notes](https://github.com/vercel/next.js/releases)
- [Commits](https://github.com/vercel/next.js/compare/v16.2.12...v16.3.0)
Updates `eslint-config-next` from 16.2.12 to 16.3.0
- [Release notes](https://github.com/vercel/next.js/releases)
- [Commits](https://github.com/vercel/next.js/commits/v16.3.0/packages/eslint-config-next)
---
updated-dependencies:
- dependency-name: eslint-config-next
dependency-version: 16.3.0
dependency-type: direct:development
update-type: version-update:semver-minor
dependency-group: nextjs
- dependency-name: next
dependency-version: 16.3.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: nextjs
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* chore(deps-dev): bump prettier from 3.8.3 to 3.9.6 (#405)
Bumps [prettier](https://github.com/prettier/prettier) from 3.8.3 to 3.9.6.
- [Release notes](https://github.com/prettier/prettier/releases)
- [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md)
- [Commits](https://github.com/prettier/prettier/compare/3.8.3...3.9.6)
---
updated-dependencies:
- dependency-name: prettier
dependency-version: 3.9.6
dependency-type: direct:development
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* docs(changelog): Unreleased-Sektion fuer die Bumps nach v0.10.0 (#413)
Die Dependency-PRs sind nach dem Release auf dev gelandet, teils auch
auf main. Ohne Eintrag waeren sie beim naechsten Release unsichtbar --
inklusive Next 16.3.0, das CVE-2025-13465 mitbringt.
Ausserdem im 0.10.0-Abschnitt nachgetragen, dass der Trivy-Scan bis
#409 nie gelaufen ist. Der Fix steckt im Tag v0.10.0, fehlte aber in der
Aufzaehlung -- und "Images werden bei jedem Publish gescannt" stand im
Changelog, waehrend der Job im Action-Setup abbrach.
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
* feat(gallery): per-album sort order, independent of Immich (#408) (#414)
Album order was dictated entirely by Immich: getAlbum() sorted by the
album's own asc/desc flag, so a Folio album always mirrored the archive.
A curated series has a narrative order that has nothing to do with
capture time, and changing the Immich album's sort to fit the website
changes it for the archive too.
Adds an optional per-album `sort` in gallery.yaml, editable in /admin,
defaulting to today's behaviour so every existing config is unchanged:
immich (default) | newest | oldest | filename | manual
`manual` is a pinned *prefix*: `assetOrder` lists only the photos placed
by hand, everything else follows in the album's Immich order. A full
permutation of a 2,000-photo album would be ~80 KB of UUIDs in a file
that is rewritten and copied to content/.backups/ on every admin save.
It also makes drift fall out for free — photos removed in Immich never
match, new ones land in the tail rather than being hidden.
Sorting is applied after the cache read, not before the cache write, so
the LRU keeps one canonical Immich-ordered copy per album. That avoids
putting the mode in the cache key, lets a config change take effect
without depending on invalidation, and keeps the stale-serving path
correct. cache.get() returns the stored object by reference, so
withSort() returns a shallow clone with a new array — sorting in place
would reorder the shared entry, and under request coalescing every
concurrent caller would be sorting the same array.
Also fixes a prerequisite bug: /api/admin/albums/[albumId]/assets read
album.assets from GET /albums/:id, which Immich 3.x no longer populates
(lib/immich.ts:507). The hero picker's "This Album" tab returned nothing
and threw outright when the key was absent. It now goes through the
client's paginated metadata search, with ?types=all to opt videos in for
the reorder editor.
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
* refactor(admin): drop decorative emoji from the sort select labels (#415)
An <option> cannot contain markup, so the SVG set in Icons is not
reachable there — but a decorative emoji is not a substitute for it.
Plain text instead; the album card badge already uses a real icon.
The remaining emoji in the admin panel (asset picker tabs, section
headings, layout picker options) predate this branch and are left for a
separate cleanup.
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
* refactor(admin): replace emoji icons with the shared SVG icon set (#416)
The admin panel mixed two icon conventions: inline SVGs from
`Icons.tsx` in most components, and decorative emoji in the asset
picker and a few PageBuilder labels. Emoji render inconsistently
across platforms, ignore the accent colour, and cannot inherit the
`.svg-icon` sizing rules.
- Icons.tsx: add `IconStar` (filled — it marks a state, not an
action) and `IconImage`.
- AssetPicker: the three tab labels and the favourite tile badge now
use IconFolder / IconStar / IconImage.
- PageBuilder: the "Standalone Albums" and "Subpages" headings use
the icon set instead of an emoji.
- PageBuilder: the layout picker drops its emoji for plain text. An
<option> cannot contain markup, so an SVG is impossible there and a
decorative glyph is not a substitute.
- admin.css: align icon and label in the picker tabs, and swap the
favourite badge's text-shadow for drop-shadow, which is what
applies to an inline SVG.
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
* refactor(admin): fold PageBuilder's local icons into the shared Icons module (#418)
* refactor(admin): fold PageBuilder's local icons into the shared module
PageBuilder.tsx carried its own `Icons` object duplicating most of the
glyphs already exported by Icons.tsx, with hardcoded sizes and slightly
divergent paths. Migrate all 32 call sites to the shared module and
delete the local object.
Five glyphs had no counterpart and are added to Icons.tsx as 1:1 ports
of the local paths: IconX, IconPlus, IconHome, IconCopy, IconImage.
The local ExternalLink and Check are dropped rather than ported — both
had zero call sites.
Two glyphs change shape slightly, which is the point of consolidating:
the shared IconCamera includes the viewfinder bump the local copy
omitted, and drag handles now use IconGripVertical.
IconGripVertical uses the module's square 24x24 viewBox, so `.svg-drag`
goes from 12x18 to 18x18 — the old non-square box would letterbox the
glyph down to 12x12 and shrink the handle.
* fix(admin): resolve icon-module integration after #416
Merging dev brought in #416, which added a second IconImage to Icons.tsx
and two <Icons.Camera>/<Icons.Folder> section headers that reference the
local Icons object this PR removes. Git merged both cleanly but the result
did not type-check.
- drop the duplicate IconImage (both copies were byte-identical)
- point the two section headers at the imported IconCamera/IconFolder
- refresh the SORT_LABELS comment: the icon set is imported now, not
declared below
---------
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
* fix(config): allow an empty gallery, guard against a double /api suffix (#421)
An empty gallery is now a valid, rendered state instead of a throw: deriveGallery() no longer requires at least one album or subpage, so a deployment with no albums yet renders a bare homepage the owner can fill in via /admin.
getConfig() also stops appending /api to an Immich URL that already ends in it, which previously produced .../api/api and broke every upstream request.
Includes a restore of the per-album sort test cases, which the branch had lost by being cut before #408/#414.
* feat(admin): favicon upload, served from the content volume (#422)
Adds a bundled default favicon, an upload widget in admin Settings > General, and a route that serves the icon from the writable content/ volume with a fallback to the bundled default. Raster uploads (PNG/ICO/JPEG) are wrapped in an SVG container; the response carries its own CSP so an uploaded SVG cannot execute script on the origin.
The GET route revalidates with an ETag instead of caching immutably, so a newly uploaded icon shows up immediately. Uploads are written via temp file + rename, and a Reset button restores the bundled default.
* ci: flag unformatted files in a PR, without blocking it (#424)
Prettier is configured as an error rule in eslint.config.mjs but has never run in CI, so part of the tree predates it. A final CI step now diffs against the PR base, runs prettier --list-different over the changed files, and emits a warning annotation per offender plus a job summary.
Advisory by design: it never fails the job. Blocking would turn a PR red for merely touching a file that was already unformatted, and normalising the tree in one commit would wreck git blame and conflict with the PRs in flight.
Requires fetch-depth: 0, since diffing against the base needs its history.
* feat(install): first-run wizard gated by a one-time setup token (#419)
Adds /install, a four-step first-run wizard: connect to Immich, optionally pick albums, name the site, finish. It verifies the credentials against the Immich server before writing anything, then writes gallery.yaml, settings.yaml and a content/install.json carrying the Immich credentials and a generated site secret.
install.json exists because a running process cannot pick up new env vars — the wizard has to write configuration that takes effect without a restart. getInstallCredentials() merges it under the real environment, so env vars always win and rotation stays a matter of setting one.
Both the page and the API routes are gated by a one-time setup token printed to the server log, so a deployment that is reachable before gallery.yaml exists cannot be configured by whoever finds it first. The token is stored in content/.setup-token (0600) rather than a module variable: Next.js bundles the page and each route handler separately, so a module-level token left the page and the API disagreeing inside one process and the wizard stuck on step 1. It is removed once the install completes.
The admin password is stored as an scrypt hash using the scheme lib/auth.ts already applies to album passwords; a plaintext ADMIN_PASSWORD env var keeps working.
* docs: document the setup wizard, fix the read-only content mount (#425)
Quick Start now leads with the /install wizard, with the hand-written YAML route kept alongside it, and a First-Run Setup section covers the setup token, the files the wizard writes, and env-var precedence.
Two corrections: both Docker examples mounted content/ as :ro, which silently breaks the wizard, the admin panel and the backup rotation alike — docs/admin-panel.md already said so and the README contradicted it. And nothing documented that content/install.json holds the Immich API key, so a backup of content/ is a backup of credentials.
Also adds a Contributors section crediting the people whose work is in the project.
* feat(admin): floating save bar pinned to the bottom of the viewport (#426)
The save bar was the first, static element inside .admin-main. Since the
document itself scrolls, it left the viewport as soon as you scrolled down
— editing a subpage section or a settings block far below gave no visible
dirty hint and no reachable save button.
Replace it with a bottom-pinned floating bar shared by both editors. It
only mounts while there is something to act on (unsaved changes, an
in-flight save, or a result message), so it never covers content while
idle. The success message clears after 5s, which hides the bar again.
- new SaveBar component, replacing the duplicated markup in PageBuilder
and SettingsEditor
- adopt the previously unused .floating-save-bar CSS: slide-in keyframes
(carrying translateX(-50%)), dirty border, wrap/gap, mobile variant and
a prefers-reduced-motion opt-out; z-index 900 keeps it below modals
- .admin-main gains bottom padding so the bar never covers page content
- drop the now-unreachable idle hints: the ⌘S hint becomes a button title,
the Live Sync note becomes a static line above the settings layout
- header "Site" link now bypasses the cache (/?fresh=1), so the preview
stays reachable when the bar is hidden
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
* feat(admin): themed listbox for the album sort control (#427)
The per-album "Photo order" control was a native <select>. Because an
<option> cannot contain markup, its choices could not use the admin
panel's currentColor SVG set — the reason #415 had to fall back to plain
text after dropping the emoji labels.
Adds a Listbox component implementing the ARIA combobox/listbox pattern,
so options can render a glyph beside their label:
- DOM focus stays on the trigger button; the active option is announced
through aria-activedescendant, keeping focus management to one element
- Keyboard: arrows (clamped at the ends, like a native select),
Home/End, Enter/Space to commit, Escape to cancel, Tab commits and
moves on, and prefix type-ahead with a repeat-key cycle
- Outside dismissal on pointerdown, so a press starting outside closes
the popup before the click retargets
The sort options now carry an icon each: calendar, arrow-down, arrow-up,
an A→Z marker, and the drag glyph for manual — matching the badge the
album card already shows. SORT_LABELS stays plain text because the badge
feeds it to a title attribute.
Closes #417
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
* chore(git): ignore generated design handoff folders
* fix(admin): stop the album sort dropdown clipping, and simplify the panel (#428)
* fix(admin): render listbox popup in a portal so it escapes modal clipping
The sort control's popup was position:absolute inside three clipping ancestors
(.album-drawer overflow:hidden > .album-drawer-body overflow-y:auto >
.modal-right-column overflow-y:auto), so it was cut off at the bottom of the
Edit Album Details modal. z-index could not help: clipping happens before
stacking. It also always hung below the trigger, with no flip.
Portal the popup to document.body and position it from the trigger's viewport
rect, flipping above when there is more room there and capping max-height to the
space available so it scrolls internally rather than overflowing. It is
dismissed on scroll and resize, since the anchor is only measured on open.
The outside-pointerdown handler now also treats the popup as inside; without
that the portalled list counts as outside, and a click on an option would close
it before the selection commits.
* refactor(admin): single-column album details panel
The left column spent 1.2fr on a cover thumbnail and three stat rows, two of
which (Status, Custom Hero) only restated the form fields opposite them, while
the form itself was squeezed into 1.8fr behind a second nested scroller.
Stack the drawer in one column instead: cover as a banner, then the form at full
width, with the UUID moved into the footer. The body is now the only scroll
container, which also removes one of the ancestors that was clipping the sort
popup.
---------
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
* fix(admin): give the portalled listbox its theme back, lock the page behind modals (#429)
Two defects in the album editor.
The sort listbox popup painted transparent. Every --admin-* variable is
scoped to .admin-layout, and since the popup moved into document.body it
sits outside that subtree, so background/border/text all resolved to
nothing. It now carries its own copy of the palette in both colour
schemes, plus the font it no longer inherits.
Scrolling inside a modal also moved the page behind it. No admin modal
ever locked body scroll: the overlay covers the page but does not absorb
wheel events, so a scroll starting on the backdrop — or continuing past
the end of the modal's own scroller — reaches the document.
overscroll-behavior cannot cover that case on its own, because it only
applies to scroll containers and the backdrop is not one.
useScrollLock freezes body while a modal is open and compensates for the
width the scrollbar gives up, so nothing shifts underneath. Each lock
restores the inline value it found, which makes nesting work without a
counter — a picker opened from the drawer restores the drawer's hidden
state instead of clearing it. Applied to both drawers and all four
picker modals, which share the defect. overscroll-behavior: contain on
the scrollers stops the chaining they can handle themselves.
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
* fix(security): allow unsafe-eval in CSP script-src during dev mode
* feat(journal): add Journal Studio with split-screen editor, live preview and dedicated routes
* fix(build): separate client parser from server journal-service and fix build type errors
* fix(journal): Fotos rendern, Layout und Lightbox-Steuerung korrigieren
Fünf unabhängige Fehler in der öffentlichen Journal- und Essay-Ansicht:
* Foto-Blöcke wurden nie angezeigt. EssayView löst ein Foto über
PhotoItem.id auf, und das sind verschlüsselte Tokens — die Blöcke aus
dem Markdown tragen aber rohe Asset-UUIDs. Jede Zuordnung lief ins
Leere, und nicht auflösbare Blöcke werden still verworfen. Die IDs
werden jetzt serverseitig übersetzt; damit verschwinden nebenbei die
rohen UUIDs aus dem Client-Payload, die dort laut Projektregel nie
auftauchen dürfen. Nicht auflösbare Referenzen werden geloggt.
* Überschriften standen weiter links als der Fließtext. Jeder Block
hatte einzeln `max-width: 68ch`, und `ch` ist relativ zur Schrift des
Elements — die Serif-Überschrift ergab eine breitere Spalte. Ersetzt
durch eine gemeinsame, font-unabhängige `--essay-measure`.
* Fullbleed-Fotos bluteten nur nach links aus: `.essay-figure` ist
`width: 100%`, wodurch die Box überbestimmt ist und der negative
rechte Margin verworfen wird.
* Foto-Paare stellten beide Bilder gleich breit dar, wodurch ein
Hochformat neben einem Querformat doppelt so hoch wurde. Jetzt eine
Justified-Reihe: Breite proportional zum Seitenverhältnis, dadurch
exakt gleiche Höhen ohne Beschnitt.
* Die Lightbox hatte im Journal keine Tastatursteuerung und keine
Scroll-Sperre — beides lag in PhotoGrid, also nur im Album-Raster.
Verlagert in die Lightbox selbst, der doppelte Handler in PhotoGrid
entfernt (sonst wäre pro Pfeildruck zwei Bilder weitergesprungen).
Zusätzlich sind Proofing-Herzen und das EXIF-Panel im redaktionellen
Modus abschaltbar und im Journal aus: Client-Proofing ist ein
Übergabe-Workflow für Alben, keine Funktion einer Reportage. Auf der
Übersicht wurde der Untertitel doppelt gerendert, weil extractExcerpt()
auf ihn zurückfällt.
* feat(admin): eigene URLs für alle Bereiche und überarbeiteter Journal Studio
Das Panel war eine einzige Client-Komponente, die ihre Tabs über
useState umschaltet: keine Route pro Bereich, kein Deep-Link, kein
Zurück-Button, und nach jedem Reload landete man wieder auf "Pages".
Auch der Journal-Editor hatte keine eigene URL.
Jetzt sieben echte Routen (/admin, /admin/pages, /admin/journal,
/admin/journal/<slug>, /admin/settings, /admin/settings/<section>,
/admin/analytics). Die Shell mit Auth-Prüfung und Kopfzeile sitzt im
Layout und umschließt children — so bleibt die Session-Prüfung über
Routenwechsel montiert, statt bei jedem Tab-Wechsel neu zu laufen und
den Spinner aufblitzen zu lassen. Unbekannte Settings-Sections fallen
auf General zurück.
Im selben Zug der Journal Studio, der die Routing-Änderung ohnehin
berührt:
* Alle Eingabefelder nutzten die Klasse `admin-input`, die in keinem
CSS definiert war — sie fielen auf Browser-Defaults zurück. Jetzt
gestylt, gescoped, damit der generische Name nicht ins übrige Panel
leckt.
* Der Split View ist per Divider verschiebbar (Maus, Tastatur,
Doppelklick zum Zurücksetzen), Breite in localStorage.
* Das Studio bricht aus der 1120px-Spalte aus, die Preview hat Platz.
* Die Preview zeigte für jedes Foto fest 3:2 und log damit über das
Layout der veröffentlichten Seite; die echten Verhältnisse werden
jetzt an den Thumbnails gemessen.
* Blöcke mit alten positionsbasierten Foto-Referenzen werden markiert —
die lassen sich auf einer eigenständigen Journal-Seite nicht auflösen
und verschwanden bisher stillschweigend.
* Blocktyp-Chips als gemeinsame Komponente, monochrom und per Icon
unterschieden statt in einer eigenen Blau/Lila/Orange-Palette, die
sonst nirgends im Panel vorkommt.
* Emojis raus, SVG-Icons rein.
* fix(admin): Designsystem-Lücken im Panel schließen
Eine systematische Suche nach Klassen, die im TSX benutzt, aber in
keinem CSS definiert sind, hat vier Stellen mit demselben Muster
gefunden:
* `admin-btn-secondary` und `admin-btn-danger` existierten nicht.
Sämtliche Löschen-Buttons sahen aus wie normale Buttons — keine
Warnwirkung. Als `.admin-btn.admin-btn-danger` geschrieben, weil die
Varianten mit den Größenklassen kombiniert werden, die weiter unten
ihren eigenen Hintergrund setzen.
* `page-progress-fill` fehlte: die Balken im Analytics-Panel waren
leere Rinnen, der Wert unsichtbar. Ebenso `analytics-empty` und
`admin-loading-container`.
* `subpage-drawer-section`, `subpage-drawer-title-group` und
`input-with-icon` im PageBuilder waren wirkungslos und teils mit
Inline-Styles notdürftig kompensiert.
* `grid-card-preview` fehlte, wodurch alle Layout-Vorschauen auf Höhe
null kollabierten. Nur "Showcase" war sichtbar — und das aus Versehen,
weil sein Tile `hero-tile` hieß und damit die `aspect-ratio` einer
fremden PageBuilder-Klasse erbte. Umbenannt.
Dazu die Theme-Vorschauen, die praktisch identisch aussahen: alle
sieben zeigten dieselben drei quadratischen Kacheln, einziger
Unterschied war die Hintergrundfarbe. Sie spiegeln jetzt die echten
Preset-Daten aus lib/config/theme.ts — Schriftcharakter, Eckradius,
Rasterdichte, Passepartout bzw. Schatten.
Die Kopfzeile richtet sich an einer gemeinsamen Steuerhöhe aus. Der
"Site"-Link war höher als die Buttons daneben: `.admin-btn` hatte keine
explizite line-height, und <button> bekommt box-sizing: border-box vom
Browser, <a> nicht. Die Statusanzeige setzte weder Schriftfamilie noch
-größe und fiel auf den Browser-Default zurück — sie war nie Teil des
Designsystems. Jetzt gleiche Höhe und Typografie, Pillenform als
Zustandsanzeige, Trenner zur Aktionsgruppe. Das dauerhafte Pulsieren
des grünen Punkts entfällt; Animation bleibt den Zuständen vorbehalten,
die Aufmerksamkeit brauchen.
Restliche Emojis durch SVG-Icons ersetzt.
* feat(admin): add scroll-to-top toggle and SVG arrow
The back-to-top button was always on and drew its arrow with the ↑ text
character. Add a `scrollToTop` setting (General section in the admin
panel, defaults to on so existing sites are unaffected) and replace the
glyph with a stroked SVG that inherits currentColor across all presets.
Scroll handling is now rAF-throttled, and prefers-reduced-motion turns
off both the hover lift and the smooth scroll.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
* security(journal): escape author HTML instead of filtering it
CodeQL flags 26 high-severity alerts on the release PR; the bulk of them
point at sanitizeHtml(), a denylist of three regexes whose output goes
into dangerouslySetInnerHTML. I reproduced the bypasses before changing
anything — all four pass the old filter:
<img src=x onerror=alert(1)> unquoted handler, regex wants quotes
<img src=x onerror='alert(1)'> single quotes, same reason
<svg onload=alert(1)> not a <script> tag
javasjavascript:cript:alert(1) one-pass replace, the rest recombines
Plus an attribute breakout in the link renderer, which interpolated the
URL into href="${url}" unescaped:
[x](" onmouseover=alert(1) x=") -> <a href="" onmouseover=alert(1" ...>
Replaced with escaping. Every `&<>"'` in author text becomes an entity
before any markdown rule runs, so the only tags in the output are the
ones renderInlineMarkdown builds itself and a URL cannot leave its
attribute. Link schemes are now an allowlist (http, https, mailto, tel,
relative, anchor); anything else renders as plain text.
The serializer needed decodeHtmlEntities to match: without it a save
would write `<` into the Markdown file and the next parse would
escape the `&` again, corrupting the text further on every round trip.
A test covers parse -> serialize -> parse stability.
Two existing tests asserted the old behaviour and were rewritten rather
than deleted: one expected the script tag to be *removed* from the
output, the other expected the substring "onerror" to be absent. Both
now assert the property that matters — that no tag can form — because
`onerror` surviving as inert text is fine.
Exploitation required admin access either way: journal and essay text
comes from the studio or from content/*.md. This removes the weakness,
it does not close an open door.
* fix(journal): contain file paths, fix frontmatter escaping, defuse two regexes
Follow-up to the CodeQL findings on release PR #432. I went through all 23
alerts individually; this addresses the ones that are worth addressing and
documents the ones that are not.
Path containment (12 alerts, all false positives). Every path built from a
slug goes through isValidSlug(), a strict `/^[a-zA-Z0-9_-]+$/` allowlist —
verified against `../../etc/passwd`, `foo/../../bar`, `a/b`, `..` and
friends, all rejected. CodeQL cannot see it because the check lives in
another module. Added a containedPath() helper that resolves the path and
refuses anything landing outside the content directory: a second lock on a
door that was already locked, and a barrier the analysis can follow. Also
removed the dead `slug.endsWith('.md')` branches — isValidSlug rejects
dots, so they could never be taken.
Frontmatter escaping (1 alert, a real bug). The serializer escaped `"` but
not `\`, and the parser never unescaped anything. A title containing either
character gained a backslash on every save/load cycle:
Path C:\Users "quoted" -> Path C:\\Users \"quoted\" -> ...
Escaping now covers the backslash first and the parser undoes both. A round
trip test covers quotes, backslashes, colons and apostrophes.
Two of three ReDoS regexes (2 alerts). The heading pattern had `\s+` next to
`(.+)`, which overlap, so the engine tried every split of the whitespace run
before failing; it is `[ \t]+` and `(\S.*)` now. The quote author pattern
wrapped a lazy group around an optional group — the quadratic case — and is
an index split on the first separator now.
The third regex, the bold/italic pass, is deliberately left alone. Rewriting
it with a negated class removes the backtracking but breaks nesting:
`**bold *and italic* here**` renders as `*<em>bold </em>and italic<em> here</em>*`.
The input is Markdown from an authenticated admin, never a visitor, so the
worst case is an author slowing down their own page. The comment in the code
says so.
Not addressed: 5 js/insufficient-password-hash alerts. They ask for a slow
KDF where the code uses SHA-256/HMAC — correct in general, but the admin
password comes from an environment variable and is never stored, so a
stronger KDF protects nothing that is not already in plaintext in the
environment.
399 unit tests pass (18 new), build and tsc clean.
* fix(journal): split the quote author by scanning, not by pattern
Cleaning up after myself. #439 replaced the quote author regex
`/^(.*?)(?:\s+--\s+(.+))?$/` — a lazy group around an optional one, the
quadratic case — with `/\s+--\s+/`, and CodeQL promptly flagged the
replacement for the same reason. One reported pattern traded for another.
splitQuoteAuthor() scans for the first `--` that has whitespace on both
sides. Linear, and it needs no reasoning about the regex engine at all.
Behaviour is identical to the original regex, checked case by case
against it: separator, no separator, several separators, tabs, wide gaps,
`a--b` without spaces, leading and trailing separators, empty string. All
nine are covered by tests, plus one asserting it stays fast on a 50k
whitespace run.
* security(admin): derive the session signing key with scrypt
getSigningKey() ran the admin password through a single SHA-256 digest.
It is key derivation rather than password storage, so it was never a
stored-hash problem — but if the derived key ever leaked, one fast hash
makes recovering the password by brute force cheap. CodeQL flags it as
js/insufficient-password-hash and, for this particular alert, has a
point.
scrypt now. Two details that matter:
The salt has to be stable. A random salt would produce a different key on
every call and invalidate every session; it is derived from AUTH_SECRET,
which is deployment-specific. Verified across separate processes: same
inputs produce a verifying token, so a restart or redeploy does not log
everyone out.
The result is cached for the process lifetime. scrypt is deliberately
slow and getSigningKey() runs on every admin request — deriving per call
would add ~24ms to each one. The cache key is a digest of secret plus
password, so a rotation misses the cache and derives again, and no extra
plaintext copy of the password is kept around.
Measured: first derivation 24ms, subsequent calls 0.12ms. Password
change and secret change both invalidate an existing token, checked in
separate processes.
Note the one-time effect: existing admin sessions are invalidated by the
change in derivation, so everyone logs in once more.
* security(admin): key the signing-key cache on its inputs, not a digest
#441 removed the SHA-256 digest of the admin password from the key
derivation and introduced a new one three lines above it, as the cache
key. Same rule, same file: CodeQL reported it immediately.
The comment justifying it was wrong too. It claimed no second plaintext
copy of the password was retained, while building the digest input
allocates exactly that in order to hash it.
The cache now holds the two input strings and compares them directly.
They are the same objects the env and install caches already hold, so
nothing extra is retained, and no fast hash of the password exists in
memory for the life of the process.
Re-verified after the change, in separate processes: a token from one
process verifies in another with the same inputs, a changed password or
secret rejects it, first derivation 24ms, cached calls 0.001ms.
That leaves scrypt as the only place the password is hashed here. The
two HMACs further down operate on the derived key and on token data, not
on the password; the constant-time comparison in verifyAdminPassword is
the previously dismissed one.
---------
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
2026-08-14 16:55:07 +02:00
|
|
|
|
import { useState, useEffect, useCallback, type ReactNode } from 'react';
|
2026-05-29 17:59:25 +02:00
|
|
|
|
import {
|
|
|
|
|
|
DndContext,
|
|
|
|
|
|
closestCenter,
|
|
|
|
|
|
KeyboardSensor,
|
|
|
|
|
|
PointerSensor,
|
|
|
|
|
|
useSensor,
|
|
|
|
|
|
useSensors,
|
|
|
|
|
|
DragEndEvent,
|
|
|
|
|
|
} from '@dnd-kit/core';
|
|
|
|
|
|
import {
|
|
|
|
|
|
arrayMove,
|
|
|
|
|
|
SortableContext,
|
|
|
|
|
|
sortableKeyboardCoordinates,
|
|
|
|
|
|
useSortable,
|
|
|
|
|
|
verticalListSortingStrategy,
|
|
|
|
|
|
horizontalListSortingStrategy,
|
|
|
|
|
|
} from '@dnd-kit/sortable';
|
|
|
|
|
|
import { CSS } from '@dnd-kit/utilities';
|
feat: add visual admin panel with page builder and settings editor
- Add /admin route with password-protected visual page builder
- Page Builder: manage hero images, standalone albums, subpages, and sections
- Album Picker: browse all shared Immich albums with search and filtering
- Settings Editor: theme, grid, footer, legal, SEO configuration
- YAML service with atomic writes and automatic backups (content/.backups/)
- HMAC-signed admin sessions (24h expiry, HttpOnly cookies)
- API endpoints: /api/admin/{auth,gallery,settings,albums,reload}
- Enable with ADMIN_PASSWORD env var; disabled by default
- invalidateConfigCache() export for hot-reload after saves
2026-05-29 17:04:37 +02:00
|
|
|
|
import AlbumPicker from './AlbumPicker';
|
2026-05-29 17:59:25 +02:00
|
|
|
|
import AssetPicker from './AssetPicker';
|
2026-08-14 11:10:42 +02:00
|
|
|
|
import AssetOrderEditor from './AssetOrderEditor';
|
security: add Trivy container scan to Docker publish workflow (#399)
* feat(admin): add backup manager UI with 1-click restore
* feat(admin): collapse older backup entries by default
* fix(theme): isolate admin layout, instant DOM theme updates, and add Light/Dark mode toggle
* feat(admin): replace text controls for Photo Frame and Hero Style with visual preview cards
* fix(admin): define missing CSS rules for button system (.btn, .preset-btn)
* feat(admin): redesign theme settings with segmented mode toggle, accent color swatches, and custom iOS-style toggle cards
* feat(admin): upgrade all settings tabs with visual grid previews, Google SEO snippet preview, and toggle cards
* feat(admin): overhaul Pages Builder UX with slide-over drawer, card hover badges, real-time search, and floating save bar
* fix(admin): remove leftover dangling syntax snippet in PageBuilder.tsx
* fix(admin): add position: relative to subpage-tile so hover overlay is contained inside the tile
* style(admin): replace all emojis with clean Leica-style vector SVG icons
* fix(types): extend IconProps with SVGProps to allow style prop on Leica SVG icons
* feat(admin): add subpage live-preview, privacy analytics, and asset protection settings
* fix(typecheck): fix AlbumEntry property access in subpage drawer preview mode
* fix(types): fix ImmichAlbumInfo property names thumbnailAssetId and albumName in PageBuilder.tsx
* fix(types): add protection and watermark optional properties to AppConfig interface
* feat(settings): add toggle for disabling analytics tracking (defaults to enabled)
* feat(ux): show status banner when analytics tracking is disabled + add live sync indicator
* feat(watermark): render customizable watermark overlay on Lightbox images + rename section to Portfolio Features & Modules
* fix(types): import type LightboxWatermark in PhotoGrid.tsx
* fix(types): destructure watermark prop in PhotoGrid function signature
* feat(seo): add configurable subpage title template and metadata descriptions
* feat(seo): add generateMetadata to about page for title template support
* feat(proofing): add client proofing, favorites selection, compact URL bitmasking, and export modal
* feat(essay): add Photo Essay storytelling mode with RSC markdown parser and fullbleed/pair layouts
* feat(subpages): add page enabled toggle to deactivate subpages without deleting them
* feat(admin): add visual essay block builder for photo essay storytelling pages
* security: add Trivy container scan to Docker publish workflow
Scans the built image for CRITICAL/HIGH CVEs on every release and
uploads results to the GitHub Security tab. Non-blocking for now
(exit-code 0) so releases aren't gated on findings. Also documents
the scan and existing Dependabot coverage in the README.
---------
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-08-07 11:08:04 +02:00
|
|
|
|
import { EssayBlockEditor } from './EssayBlockEditor';
|
release: v0.11.0 — journal fixes, admin URLs, design system cleanup (#432)
* fix(screenshots): sharp-Typen fuer 0.34 und 0.35 gleichzeitig (#410)
sharp 0.35 ist von `export =` auf ESM umgestellt: der Modul-Namespace
ist nicht mehr aufrufbar, die Factory sitzt unter .default. Der
Type-Check brach damit in scripts/screenshots.ts weg, sobald der
Next-Bump (#402) sharp von 0.34.5 auf 0.35.3 mitzieht -- sharp ist hier
keine deklarierte Dependency, sondern kommt ueber Next mit.
Die Form wird jetzt aus dem installierten Paket abgeleitet statt
festgeschrieben, zur Laufzeit wie im Typ. Geprueft mit beiden
Versionen: tsc laeuft mit 0.34.5 und mit 0.35.3 fehlerfrei durch.
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
* chore(deps): bump the nextjs group across 1 directory with 2 updates (#402)
Bumps the nextjs group with 2 updates in the / directory: [next](https://github.com/vercel/next.js) and [eslint-config-next](https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next).
Updates `next` from 16.2.12 to 16.3.0
- [Release notes](https://github.com/vercel/next.js/releases)
- [Commits](https://github.com/vercel/next.js/compare/v16.2.12...v16.3.0)
Updates `eslint-config-next` from 16.2.12 to 16.3.0
- [Release notes](https://github.com/vercel/next.js/releases)
- [Commits](https://github.com/vercel/next.js/commits/v16.3.0/packages/eslint-config-next)
---
updated-dependencies:
- dependency-name: eslint-config-next
dependency-version: 16.3.0
dependency-type: direct:development
update-type: version-update:semver-minor
dependency-group: nextjs
- dependency-name: next
dependency-version: 16.3.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: nextjs
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* chore(deps-dev): bump prettier from 3.8.3 to 3.9.6 (#405)
Bumps [prettier](https://github.com/prettier/prettier) from 3.8.3 to 3.9.6.
- [Release notes](https://github.com/prettier/prettier/releases)
- [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md)
- [Commits](https://github.com/prettier/prettier/compare/3.8.3...3.9.6)
---
updated-dependencies:
- dependency-name: prettier
dependency-version: 3.9.6
dependency-type: direct:development
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* docs(changelog): Unreleased-Sektion fuer die Bumps nach v0.10.0 (#413)
Die Dependency-PRs sind nach dem Release auf dev gelandet, teils auch
auf main. Ohne Eintrag waeren sie beim naechsten Release unsichtbar --
inklusive Next 16.3.0, das CVE-2025-13465 mitbringt.
Ausserdem im 0.10.0-Abschnitt nachgetragen, dass der Trivy-Scan bis
#409 nie gelaufen ist. Der Fix steckt im Tag v0.10.0, fehlte aber in der
Aufzaehlung -- und "Images werden bei jedem Publish gescannt" stand im
Changelog, waehrend der Job im Action-Setup abbrach.
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
* feat(gallery): per-album sort order, independent of Immich (#408) (#414)
Album order was dictated entirely by Immich: getAlbum() sorted by the
album's own asc/desc flag, so a Folio album always mirrored the archive.
A curated series has a narrative order that has nothing to do with
capture time, and changing the Immich album's sort to fit the website
changes it for the archive too.
Adds an optional per-album `sort` in gallery.yaml, editable in /admin,
defaulting to today's behaviour so every existing config is unchanged:
immich (default) | newest | oldest | filename | manual
`manual` is a pinned *prefix*: `assetOrder` lists only the photos placed
by hand, everything else follows in the album's Immich order. A full
permutation of a 2,000-photo album would be ~80 KB of UUIDs in a file
that is rewritten and copied to content/.backups/ on every admin save.
It also makes drift fall out for free — photos removed in Immich never
match, new ones land in the tail rather than being hidden.
Sorting is applied after the cache read, not before the cache write, so
the LRU keeps one canonical Immich-ordered copy per album. That avoids
putting the mode in the cache key, lets a config change take effect
without depending on invalidation, and keeps the stale-serving path
correct. cache.get() returns the stored object by reference, so
withSort() returns a shallow clone with a new array — sorting in place
would reorder the shared entry, and under request coalescing every
concurrent caller would be sorting the same array.
Also fixes a prerequisite bug: /api/admin/albums/[albumId]/assets read
album.assets from GET /albums/:id, which Immich 3.x no longer populates
(lib/immich.ts:507). The hero picker's "This Album" tab returned nothing
and threw outright when the key was absent. It now goes through the
client's paginated metadata search, with ?types=all to opt videos in for
the reorder editor.
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
* refactor(admin): drop decorative emoji from the sort select labels (#415)
An <option> cannot contain markup, so the SVG set in Icons is not
reachable there — but a decorative emoji is not a substitute for it.
Plain text instead; the album card badge already uses a real icon.
The remaining emoji in the admin panel (asset picker tabs, section
headings, layout picker options) predate this branch and are left for a
separate cleanup.
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
* refactor(admin): replace emoji icons with the shared SVG icon set (#416)
The admin panel mixed two icon conventions: inline SVGs from
`Icons.tsx` in most components, and decorative emoji in the asset
picker and a few PageBuilder labels. Emoji render inconsistently
across platforms, ignore the accent colour, and cannot inherit the
`.svg-icon` sizing rules.
- Icons.tsx: add `IconStar` (filled — it marks a state, not an
action) and `IconImage`.
- AssetPicker: the three tab labels and the favourite tile badge now
use IconFolder / IconStar / IconImage.
- PageBuilder: the "Standalone Albums" and "Subpages" headings use
the icon set instead of an emoji.
- PageBuilder: the layout picker drops its emoji for plain text. An
<option> cannot contain markup, so an SVG is impossible there and a
decorative glyph is not a substitute.
- admin.css: align icon and label in the picker tabs, and swap the
favourite badge's text-shadow for drop-shadow, which is what
applies to an inline SVG.
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
* refactor(admin): fold PageBuilder's local icons into the shared Icons module (#418)
* refactor(admin): fold PageBuilder's local icons into the shared module
PageBuilder.tsx carried its own `Icons` object duplicating most of the
glyphs already exported by Icons.tsx, with hardcoded sizes and slightly
divergent paths. Migrate all 32 call sites to the shared module and
delete the local object.
Five glyphs had no counterpart and are added to Icons.tsx as 1:1 ports
of the local paths: IconX, IconPlus, IconHome, IconCopy, IconImage.
The local ExternalLink and Check are dropped rather than ported — both
had zero call sites.
Two glyphs change shape slightly, which is the point of consolidating:
the shared IconCamera includes the viewfinder bump the local copy
omitted, and drag handles now use IconGripVertical.
IconGripVertical uses the module's square 24x24 viewBox, so `.svg-drag`
goes from 12x18 to 18x18 — the old non-square box would letterbox the
glyph down to 12x12 and shrink the handle.
* fix(admin): resolve icon-module integration after #416
Merging dev brought in #416, which added a second IconImage to Icons.tsx
and two <Icons.Camera>/<Icons.Folder> section headers that reference the
local Icons object this PR removes. Git merged both cleanly but the result
did not type-check.
- drop the duplicate IconImage (both copies were byte-identical)
- point the two section headers at the imported IconCamera/IconFolder
- refresh the SORT_LABELS comment: the icon set is imported now, not
declared below
---------
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
* fix(config): allow an empty gallery, guard against a double /api suffix (#421)
An empty gallery is now a valid, rendered state instead of a throw: deriveGallery() no longer requires at least one album or subpage, so a deployment with no albums yet renders a bare homepage the owner can fill in via /admin.
getConfig() also stops appending /api to an Immich URL that already ends in it, which previously produced .../api/api and broke every upstream request.
Includes a restore of the per-album sort test cases, which the branch had lost by being cut before #408/#414.
* feat(admin): favicon upload, served from the content volume (#422)
Adds a bundled default favicon, an upload widget in admin Settings > General, and a route that serves the icon from the writable content/ volume with a fallback to the bundled default. Raster uploads (PNG/ICO/JPEG) are wrapped in an SVG container; the response carries its own CSP so an uploaded SVG cannot execute script on the origin.
The GET route revalidates with an ETag instead of caching immutably, so a newly uploaded icon shows up immediately. Uploads are written via temp file + rename, and a Reset button restores the bundled default.
* ci: flag unformatted files in a PR, without blocking it (#424)
Prettier is configured as an error rule in eslint.config.mjs but has never run in CI, so part of the tree predates it. A final CI step now diffs against the PR base, runs prettier --list-different over the changed files, and emits a warning annotation per offender plus a job summary.
Advisory by design: it never fails the job. Blocking would turn a PR red for merely touching a file that was already unformatted, and normalising the tree in one commit would wreck git blame and conflict with the PRs in flight.
Requires fetch-depth: 0, since diffing against the base needs its history.
* feat(install): first-run wizard gated by a one-time setup token (#419)
Adds /install, a four-step first-run wizard: connect to Immich, optionally pick albums, name the site, finish. It verifies the credentials against the Immich server before writing anything, then writes gallery.yaml, settings.yaml and a content/install.json carrying the Immich credentials and a generated site secret.
install.json exists because a running process cannot pick up new env vars — the wizard has to write configuration that takes effect without a restart. getInstallCredentials() merges it under the real environment, so env vars always win and rotation stays a matter of setting one.
Both the page and the API routes are gated by a one-time setup token printed to the server log, so a deployment that is reachable before gallery.yaml exists cannot be configured by whoever finds it first. The token is stored in content/.setup-token (0600) rather than a module variable: Next.js bundles the page and each route handler separately, so a module-level token left the page and the API disagreeing inside one process and the wizard stuck on step 1. It is removed once the install completes.
The admin password is stored as an scrypt hash using the scheme lib/auth.ts already applies to album passwords; a plaintext ADMIN_PASSWORD env var keeps working.
* docs: document the setup wizard, fix the read-only content mount (#425)
Quick Start now leads with the /install wizard, with the hand-written YAML route kept alongside it, and a First-Run Setup section covers the setup token, the files the wizard writes, and env-var precedence.
Two corrections: both Docker examples mounted content/ as :ro, which silently breaks the wizard, the admin panel and the backup rotation alike — docs/admin-panel.md already said so and the README contradicted it. And nothing documented that content/install.json holds the Immich API key, so a backup of content/ is a backup of credentials.
Also adds a Contributors section crediting the people whose work is in the project.
* feat(admin): floating save bar pinned to the bottom of the viewport (#426)
The save bar was the first, static element inside .admin-main. Since the
document itself scrolls, it left the viewport as soon as you scrolled down
— editing a subpage section or a settings block far below gave no visible
dirty hint and no reachable save button.
Replace it with a bottom-pinned floating bar shared by both editors. It
only mounts while there is something to act on (unsaved changes, an
in-flight save, or a result message), so it never covers content while
idle. The success message clears after 5s, which hides the bar again.
- new SaveBar component, replacing the duplicated markup in PageBuilder
and SettingsEditor
- adopt the previously unused .floating-save-bar CSS: slide-in keyframes
(carrying translateX(-50%)), dirty border, wrap/gap, mobile variant and
a prefers-reduced-motion opt-out; z-index 900 keeps it below modals
- .admin-main gains bottom padding so the bar never covers page content
- drop the now-unreachable idle hints: the ⌘S hint becomes a button title,
the Live Sync note becomes a static line above the settings layout
- header "Site" link now bypasses the cache (/?fresh=1), so the preview
stays reachable when the bar is hidden
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
* feat(admin): themed listbox for the album sort control (#427)
The per-album "Photo order" control was a native <select>. Because an
<option> cannot contain markup, its choices could not use the admin
panel's currentColor SVG set — the reason #415 had to fall back to plain
text after dropping the emoji labels.
Adds a Listbox component implementing the ARIA combobox/listbox pattern,
so options can render a glyph beside their label:
- DOM focus stays on the trigger button; the active option is announced
through aria-activedescendant, keeping focus management to one element
- Keyboard: arrows (clamped at the ends, like a native select),
Home/End, Enter/Space to commit, Escape to cancel, Tab commits and
moves on, and prefix type-ahead with a repeat-key cycle
- Outside dismissal on pointerdown, so a press starting outside closes
the popup before the click retargets
The sort options now carry an icon each: calendar, arrow-down, arrow-up,
an A→Z marker, and the drag glyph for manual — matching the badge the
album card already shows. SORT_LABELS stays plain text because the badge
feeds it to a title attribute.
Closes #417
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
* chore(git): ignore generated design handoff folders
* fix(admin): stop the album sort dropdown clipping, and simplify the panel (#428)
* fix(admin): render listbox popup in a portal so it escapes modal clipping
The sort control's popup was position:absolute inside three clipping ancestors
(.album-drawer overflow:hidden > .album-drawer-body overflow-y:auto >
.modal-right-column overflow-y:auto), so it was cut off at the bottom of the
Edit Album Details modal. z-index could not help: clipping happens before
stacking. It also always hung below the trigger, with no flip.
Portal the popup to document.body and position it from the trigger's viewport
rect, flipping above when there is more room there and capping max-height to the
space available so it scrolls internally rather than overflowing. It is
dismissed on scroll and resize, since the anchor is only measured on open.
The outside-pointerdown handler now also treats the popup as inside; without
that the portalled list counts as outside, and a click on an option would close
it before the selection commits.
* refactor(admin): single-column album details panel
The left column spent 1.2fr on a cover thumbnail and three stat rows, two of
which (Status, Custom Hero) only restated the form fields opposite them, while
the form itself was squeezed into 1.8fr behind a second nested scroller.
Stack the drawer in one column instead: cover as a banner, then the form at full
width, with the UUID moved into the footer. The body is now the only scroll
container, which also removes one of the ancestors that was clipping the sort
popup.
---------
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
* fix(admin): give the portalled listbox its theme back, lock the page behind modals (#429)
Two defects in the album editor.
The sort listbox popup painted transparent. Every --admin-* variable is
scoped to .admin-layout, and since the popup moved into document.body it
sits outside that subtree, so background/border/text all resolved to
nothing. It now carries its own copy of the palette in both colour
schemes, plus the font it no longer inherits.
Scrolling inside a modal also moved the page behind it. No admin modal
ever locked body scroll: the overlay covers the page but does not absorb
wheel events, so a scroll starting on the backdrop — or continuing past
the end of the modal's own scroller — reaches the document.
overscroll-behavior cannot cover that case on its own, because it only
applies to scroll containers and the backdrop is not one.
useScrollLock freezes body while a modal is open and compensates for the
width the scrollbar gives up, so nothing shifts underneath. Each lock
restores the inline value it found, which makes nesting work without a
counter — a picker opened from the drawer restores the drawer's hidden
state instead of clearing it. Applied to both drawers and all four
picker modals, which share the defect. overscroll-behavior: contain on
the scrollers stops the chaining they can handle themselves.
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
* fix(security): allow unsafe-eval in CSP script-src during dev mode
* feat(journal): add Journal Studio with split-screen editor, live preview and dedicated routes
* fix(build): separate client parser from server journal-service and fix build type errors
* fix(journal): Fotos rendern, Layout und Lightbox-Steuerung korrigieren
Fünf unabhängige Fehler in der öffentlichen Journal- und Essay-Ansicht:
* Foto-Blöcke wurden nie angezeigt. EssayView löst ein Foto über
PhotoItem.id auf, und das sind verschlüsselte Tokens — die Blöcke aus
dem Markdown tragen aber rohe Asset-UUIDs. Jede Zuordnung lief ins
Leere, und nicht auflösbare Blöcke werden still verworfen. Die IDs
werden jetzt serverseitig übersetzt; damit verschwinden nebenbei die
rohen UUIDs aus dem Client-Payload, die dort laut Projektregel nie
auftauchen dürfen. Nicht auflösbare Referenzen werden geloggt.
* Überschriften standen weiter links als der Fließtext. Jeder Block
hatte einzeln `max-width: 68ch`, und `ch` ist relativ zur Schrift des
Elements — die Serif-Überschrift ergab eine breitere Spalte. Ersetzt
durch eine gemeinsame, font-unabhängige `--essay-measure`.
* Fullbleed-Fotos bluteten nur nach links aus: `.essay-figure` ist
`width: 100%`, wodurch die Box überbestimmt ist und der negative
rechte Margin verworfen wird.
* Foto-Paare stellten beide Bilder gleich breit dar, wodurch ein
Hochformat neben einem Querformat doppelt so hoch wurde. Jetzt eine
Justified-Reihe: Breite proportional zum Seitenverhältnis, dadurch
exakt gleiche Höhen ohne Beschnitt.
* Die Lightbox hatte im Journal keine Tastatursteuerung und keine
Scroll-Sperre — beides lag in PhotoGrid, also nur im Album-Raster.
Verlagert in die Lightbox selbst, der doppelte Handler in PhotoGrid
entfernt (sonst wäre pro Pfeildruck zwei Bilder weitergesprungen).
Zusätzlich sind Proofing-Herzen und das EXIF-Panel im redaktionellen
Modus abschaltbar und im Journal aus: Client-Proofing ist ein
Übergabe-Workflow für Alben, keine Funktion einer Reportage. Auf der
Übersicht wurde der Untertitel doppelt gerendert, weil extractExcerpt()
auf ihn zurückfällt.
* feat(admin): eigene URLs für alle Bereiche und überarbeiteter Journal Studio
Das Panel war eine einzige Client-Komponente, die ihre Tabs über
useState umschaltet: keine Route pro Bereich, kein Deep-Link, kein
Zurück-Button, und nach jedem Reload landete man wieder auf "Pages".
Auch der Journal-Editor hatte keine eigene URL.
Jetzt sieben echte Routen (/admin, /admin/pages, /admin/journal,
/admin/journal/<slug>, /admin/settings, /admin/settings/<section>,
/admin/analytics). Die Shell mit Auth-Prüfung und Kopfzeile sitzt im
Layout und umschließt children — so bleibt die Session-Prüfung über
Routenwechsel montiert, statt bei jedem Tab-Wechsel neu zu laufen und
den Spinner aufblitzen zu lassen. Unbekannte Settings-Sections fallen
auf General zurück.
Im selben Zug der Journal Studio, der die Routing-Änderung ohnehin
berührt:
* Alle Eingabefelder nutzten die Klasse `admin-input`, die in keinem
CSS definiert war — sie fielen auf Browser-Defaults zurück. Jetzt
gestylt, gescoped, damit der generische Name nicht ins übrige Panel
leckt.
* Der Split View ist per Divider verschiebbar (Maus, Tastatur,
Doppelklick zum Zurücksetzen), Breite in localStorage.
* Das Studio bricht aus der 1120px-Spalte aus, die Preview hat Platz.
* Die Preview zeigte für jedes Foto fest 3:2 und log damit über das
Layout der veröffentlichten Seite; die echten Verhältnisse werden
jetzt an den Thumbnails gemessen.
* Blöcke mit alten positionsbasierten Foto-Referenzen werden markiert —
die lassen sich auf einer eigenständigen Journal-Seite nicht auflösen
und verschwanden bisher stillschweigend.
* Blocktyp-Chips als gemeinsame Komponente, monochrom und per Icon
unterschieden statt in einer eigenen Blau/Lila/Orange-Palette, die
sonst nirgends im Panel vorkommt.
* Emojis raus, SVG-Icons rein.
* fix(admin): Designsystem-Lücken im Panel schließen
Eine systematische Suche nach Klassen, die im TSX benutzt, aber in
keinem CSS definiert sind, hat vier Stellen mit demselben Muster
gefunden:
* `admin-btn-secondary` und `admin-btn-danger` existierten nicht.
Sämtliche Löschen-Buttons sahen aus wie normale Buttons — keine
Warnwirkung. Als `.admin-btn.admin-btn-danger` geschrieben, weil die
Varianten mit den Größenklassen kombiniert werden, die weiter unten
ihren eigenen Hintergrund setzen.
* `page-progress-fill` fehlte: die Balken im Analytics-Panel waren
leere Rinnen, der Wert unsichtbar. Ebenso `analytics-empty` und
`admin-loading-container`.
* `subpage-drawer-section`, `subpage-drawer-title-group` und
`input-with-icon` im PageBuilder waren wirkungslos und teils mit
Inline-Styles notdürftig kompensiert.
* `grid-card-preview` fehlte, wodurch alle Layout-Vorschauen auf Höhe
null kollabierten. Nur "Showcase" war sichtbar — und das aus Versehen,
weil sein Tile `hero-tile` hieß und damit die `aspect-ratio` einer
fremden PageBuilder-Klasse erbte. Umbenannt.
Dazu die Theme-Vorschauen, die praktisch identisch aussahen: alle
sieben zeigten dieselben drei quadratischen Kacheln, einziger
Unterschied war die Hintergrundfarbe. Sie spiegeln jetzt die echten
Preset-Daten aus lib/config/theme.ts — Schriftcharakter, Eckradius,
Rasterdichte, Passepartout bzw. Schatten.
Die Kopfzeile richtet sich an einer gemeinsamen Steuerhöhe aus. Der
"Site"-Link war höher als die Buttons daneben: `.admin-btn` hatte keine
explizite line-height, und <button> bekommt box-sizing: border-box vom
Browser, <a> nicht. Die Statusanzeige setzte weder Schriftfamilie noch
-größe und fiel auf den Browser-Default zurück — sie war nie Teil des
Designsystems. Jetzt gleiche Höhe und Typografie, Pillenform als
Zustandsanzeige, Trenner zur Aktionsgruppe. Das dauerhafte Pulsieren
des grünen Punkts entfällt; Animation bleibt den Zuständen vorbehalten,
die Aufmerksamkeit brauchen.
Restliche Emojis durch SVG-Icons ersetzt.
* feat(admin): add scroll-to-top toggle and SVG arrow
The back-to-top button was always on and drew its arrow with the ↑ text
character. Add a `scrollToTop` setting (General section in the admin
panel, defaults to on so existing sites are unaffected) and replace the
glyph with a stroked SVG that inherits currentColor across all presets.
Scroll handling is now rAF-throttled, and prefers-reduced-motion turns
off both the hover lift and the smooth scroll.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
* security(journal): escape author HTML instead of filtering it
CodeQL flags 26 high-severity alerts on the release PR; the bulk of them
point at sanitizeHtml(), a denylist of three regexes whose output goes
into dangerouslySetInnerHTML. I reproduced the bypasses before changing
anything — all four pass the old filter:
<img src=x onerror=alert(1)> unquoted handler, regex wants quotes
<img src=x onerror='alert(1)'> single quotes, same reason
<svg onload=alert(1)> not a <script> tag
javasjavascript:cript:alert(1) one-pass replace, the rest recombines
Plus an attribute breakout in the link renderer, which interpolated the
URL into href="${url}" unescaped:
[x](" onmouseover=alert(1) x=") -> <a href="" onmouseover=alert(1" ...>
Replaced with escaping. Every `&<>"'` in author text becomes an entity
before any markdown rule runs, so the only tags in the output are the
ones renderInlineMarkdown builds itself and a URL cannot leave its
attribute. Link schemes are now an allowlist (http, https, mailto, tel,
relative, anchor); anything else renders as plain text.
The serializer needed decodeHtmlEntities to match: without it a save
would write `<` into the Markdown file and the next parse would
escape the `&` again, corrupting the text further on every round trip.
A test covers parse -> serialize -> parse stability.
Two existing tests asserted the old behaviour and were rewritten rather
than deleted: one expected the script tag to be *removed* from the
output, the other expected the substring "onerror" to be absent. Both
now assert the property that matters — that no tag can form — because
`onerror` surviving as inert text is fine.
Exploitation required admin access either way: journal and essay text
comes from the studio or from content/*.md. This removes the weakness,
it does not close an open door.
* fix(journal): contain file paths, fix frontmatter escaping, defuse two regexes
Follow-up to the CodeQL findings on release PR #432. I went through all 23
alerts individually; this addresses the ones that are worth addressing and
documents the ones that are not.
Path containment (12 alerts, all false positives). Every path built from a
slug goes through isValidSlug(), a strict `/^[a-zA-Z0-9_-]+$/` allowlist —
verified against `../../etc/passwd`, `foo/../../bar`, `a/b`, `..` and
friends, all rejected. CodeQL cannot see it because the check lives in
another module. Added a containedPath() helper that resolves the path and
refuses anything landing outside the content directory: a second lock on a
door that was already locked, and a barrier the analysis can follow. Also
removed the dead `slug.endsWith('.md')` branches — isValidSlug rejects
dots, so they could never be taken.
Frontmatter escaping (1 alert, a real bug). The serializer escaped `"` but
not `\`, and the parser never unescaped anything. A title containing either
character gained a backslash on every save/load cycle:
Path C:\Users "quoted" -> Path C:\\Users \"quoted\" -> ...
Escaping now covers the backslash first and the parser undoes both. A round
trip test covers quotes, backslashes, colons and apostrophes.
Two of three ReDoS regexes (2 alerts). The heading pattern had `\s+` next to
`(.+)`, which overlap, so the engine tried every split of the whitespace run
before failing; it is `[ \t]+` and `(\S.*)` now. The quote author pattern
wrapped a lazy group around an optional group — the quadratic case — and is
an index split on the first separator now.
The third regex, the bold/italic pass, is deliberately left alone. Rewriting
it with a negated class removes the backtracking but breaks nesting:
`**bold *and italic* here**` renders as `*<em>bold </em>and italic<em> here</em>*`.
The input is Markdown from an authenticated admin, never a visitor, so the
worst case is an author slowing down their own page. The comment in the code
says so.
Not addressed: 5 js/insufficient-password-hash alerts. They ask for a slow
KDF where the code uses SHA-256/HMAC — correct in general, but the admin
password comes from an environment variable and is never stored, so a
stronger KDF protects nothing that is not already in plaintext in the
environment.
399 unit tests pass (18 new), build and tsc clean.
* fix(journal): split the quote author by scanning, not by pattern
Cleaning up after myself. #439 replaced the quote author regex
`/^(.*?)(?:\s+--\s+(.+))?$/` — a lazy group around an optional one, the
quadratic case — with `/\s+--\s+/`, and CodeQL promptly flagged the
replacement for the same reason. One reported pattern traded for another.
splitQuoteAuthor() scans for the first `--` that has whitespace on both
sides. Linear, and it needs no reasoning about the regex engine at all.
Behaviour is identical to the original regex, checked case by case
against it: separator, no separator, several separators, tabs, wide gaps,
`a--b` without spaces, leading and trailing separators, empty string. All
nine are covered by tests, plus one asserting it stays fast on a 50k
whitespace run.
* security(admin): derive the session signing key with scrypt
getSigningKey() ran the admin password through a single SHA-256 digest.
It is key derivation rather than password storage, so it was never a
stored-hash problem — but if the derived key ever leaked, one fast hash
makes recovering the password by brute force cheap. CodeQL flags it as
js/insufficient-password-hash and, for this particular alert, has a
point.
scrypt now. Two details that matter:
The salt has to be stable. A random salt would produce a different key on
every call and invalidate every session; it is derived from AUTH_SECRET,
which is deployment-specific. Verified across separate processes: same
inputs produce a verifying token, so a restart or redeploy does not log
everyone out.
The result is cached for the process lifetime. scrypt is deliberately
slow and getSigningKey() runs on every admin request — deriving per call
would add ~24ms to each one. The cache key is a digest of secret plus
password, so a rotation misses the cache and derives again, and no extra
plaintext copy of the password is kept around.
Measured: first derivation 24ms, subsequent calls 0.12ms. Password
change and secret change both invalidate an existing token, checked in
separate processes.
Note the one-time effect: existing admin sessions are invalidated by the
change in derivation, so everyone logs in once more.
* security(admin): key the signing-key cache on its inputs, not a digest
#441 removed the SHA-256 digest of the admin password from the key
derivation and introduced a new one three lines above it, as the cache
key. Same rule, same file: CodeQL reported it immediately.
The comment justifying it was wrong too. It claimed no second plaintext
copy of the password was retained, while building the digest input
allocates exactly that in order to hash it.
The cache now holds the two input strings and compares them directly.
They are the same objects the env and install caches already hold, so
nothing extra is retained, and no fast hash of the password exists in
memory for the life of the process.
Re-verified after the change, in separate processes: a token from one
process verifies in another with the same inputs, a changed password or
secret rejects it, first derivation 24ms, cached calls 0.001ms.
That leaves scrypt as the only place the password is hashed here. The
two HMACs further down operate on the derived key and on token data, not
on the password; the constant-time comparison in verifyAdminPassword is
the previously dismissed one.
---------
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
2026-08-14 16:55:07 +02:00
|
|
|
|
import SaveBar from './SaveBar';
|
|
|
|
|
|
import { useScrollLock } from './useScrollLock';
|
2026-08-14 11:10:42 +02:00
|
|
|
|
import {
|
|
|
|
|
|
ALBUM_SORT_MODES,
|
|
|
|
|
|
DEFAULT_ALBUM_SORT,
|
|
|
|
|
|
isAlbumSortMode,
|
|
|
|
|
|
type AlbumSortMode,
|
|
|
|
|
|
} from '@/lib/albumSort';
|
2026-08-23 23:18:14 +02:00
|
|
|
|
import {
|
|
|
|
|
|
COVER_GRID_COLUMNS_MAX,
|
|
|
|
|
|
COVER_GRID_COLUMNS_MIN,
|
|
|
|
|
|
COVER_GRID_GAP_MAX,
|
|
|
|
|
|
type AlbumEntryObject,
|
|
|
|
|
|
} from '@/lib/config/schema';
|
2026-08-14 11:10:42 +02:00
|
|
|
|
import {
|
release: v0.11.0 — journal fixes, admin URLs, design system cleanup (#432)
* fix(screenshots): sharp-Typen fuer 0.34 und 0.35 gleichzeitig (#410)
sharp 0.35 ist von `export =` auf ESM umgestellt: der Modul-Namespace
ist nicht mehr aufrufbar, die Factory sitzt unter .default. Der
Type-Check brach damit in scripts/screenshots.ts weg, sobald der
Next-Bump (#402) sharp von 0.34.5 auf 0.35.3 mitzieht -- sharp ist hier
keine deklarierte Dependency, sondern kommt ueber Next mit.
Die Form wird jetzt aus dem installierten Paket abgeleitet statt
festgeschrieben, zur Laufzeit wie im Typ. Geprueft mit beiden
Versionen: tsc laeuft mit 0.34.5 und mit 0.35.3 fehlerfrei durch.
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
* chore(deps): bump the nextjs group across 1 directory with 2 updates (#402)
Bumps the nextjs group with 2 updates in the / directory: [next](https://github.com/vercel/next.js) and [eslint-config-next](https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next).
Updates `next` from 16.2.12 to 16.3.0
- [Release notes](https://github.com/vercel/next.js/releases)
- [Commits](https://github.com/vercel/next.js/compare/v16.2.12...v16.3.0)
Updates `eslint-config-next` from 16.2.12 to 16.3.0
- [Release notes](https://github.com/vercel/next.js/releases)
- [Commits](https://github.com/vercel/next.js/commits/v16.3.0/packages/eslint-config-next)
---
updated-dependencies:
- dependency-name: eslint-config-next
dependency-version: 16.3.0
dependency-type: direct:development
update-type: version-update:semver-minor
dependency-group: nextjs
- dependency-name: next
dependency-version: 16.3.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: nextjs
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* chore(deps-dev): bump prettier from 3.8.3 to 3.9.6 (#405)
Bumps [prettier](https://github.com/prettier/prettier) from 3.8.3 to 3.9.6.
- [Release notes](https://github.com/prettier/prettier/releases)
- [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md)
- [Commits](https://github.com/prettier/prettier/compare/3.8.3...3.9.6)
---
updated-dependencies:
- dependency-name: prettier
dependency-version: 3.9.6
dependency-type: direct:development
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* docs(changelog): Unreleased-Sektion fuer die Bumps nach v0.10.0 (#413)
Die Dependency-PRs sind nach dem Release auf dev gelandet, teils auch
auf main. Ohne Eintrag waeren sie beim naechsten Release unsichtbar --
inklusive Next 16.3.0, das CVE-2025-13465 mitbringt.
Ausserdem im 0.10.0-Abschnitt nachgetragen, dass der Trivy-Scan bis
#409 nie gelaufen ist. Der Fix steckt im Tag v0.10.0, fehlte aber in der
Aufzaehlung -- und "Images werden bei jedem Publish gescannt" stand im
Changelog, waehrend der Job im Action-Setup abbrach.
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
* feat(gallery): per-album sort order, independent of Immich (#408) (#414)
Album order was dictated entirely by Immich: getAlbum() sorted by the
album's own asc/desc flag, so a Folio album always mirrored the archive.
A curated series has a narrative order that has nothing to do with
capture time, and changing the Immich album's sort to fit the website
changes it for the archive too.
Adds an optional per-album `sort` in gallery.yaml, editable in /admin,
defaulting to today's behaviour so every existing config is unchanged:
immich (default) | newest | oldest | filename | manual
`manual` is a pinned *prefix*: `assetOrder` lists only the photos placed
by hand, everything else follows in the album's Immich order. A full
permutation of a 2,000-photo album would be ~80 KB of UUIDs in a file
that is rewritten and copied to content/.backups/ on every admin save.
It also makes drift fall out for free — photos removed in Immich never
match, new ones land in the tail rather than being hidden.
Sorting is applied after the cache read, not before the cache write, so
the LRU keeps one canonical Immich-ordered copy per album. That avoids
putting the mode in the cache key, lets a config change take effect
without depending on invalidation, and keeps the stale-serving path
correct. cache.get() returns the stored object by reference, so
withSort() returns a shallow clone with a new array — sorting in place
would reorder the shared entry, and under request coalescing every
concurrent caller would be sorting the same array.
Also fixes a prerequisite bug: /api/admin/albums/[albumId]/assets read
album.assets from GET /albums/:id, which Immich 3.x no longer populates
(lib/immich.ts:507). The hero picker's "This Album" tab returned nothing
and threw outright when the key was absent. It now goes through the
client's paginated metadata search, with ?types=all to opt videos in for
the reorder editor.
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
* refactor(admin): drop decorative emoji from the sort select labels (#415)
An <option> cannot contain markup, so the SVG set in Icons is not
reachable there — but a decorative emoji is not a substitute for it.
Plain text instead; the album card badge already uses a real icon.
The remaining emoji in the admin panel (asset picker tabs, section
headings, layout picker options) predate this branch and are left for a
separate cleanup.
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
* refactor(admin): replace emoji icons with the shared SVG icon set (#416)
The admin panel mixed two icon conventions: inline SVGs from
`Icons.tsx` in most components, and decorative emoji in the asset
picker and a few PageBuilder labels. Emoji render inconsistently
across platforms, ignore the accent colour, and cannot inherit the
`.svg-icon` sizing rules.
- Icons.tsx: add `IconStar` (filled — it marks a state, not an
action) and `IconImage`.
- AssetPicker: the three tab labels and the favourite tile badge now
use IconFolder / IconStar / IconImage.
- PageBuilder: the "Standalone Albums" and "Subpages" headings use
the icon set instead of an emoji.
- PageBuilder: the layout picker drops its emoji for plain text. An
<option> cannot contain markup, so an SVG is impossible there and a
decorative glyph is not a substitute.
- admin.css: align icon and label in the picker tabs, and swap the
favourite badge's text-shadow for drop-shadow, which is what
applies to an inline SVG.
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
* refactor(admin): fold PageBuilder's local icons into the shared Icons module (#418)
* refactor(admin): fold PageBuilder's local icons into the shared module
PageBuilder.tsx carried its own `Icons` object duplicating most of the
glyphs already exported by Icons.tsx, with hardcoded sizes and slightly
divergent paths. Migrate all 32 call sites to the shared module and
delete the local object.
Five glyphs had no counterpart and are added to Icons.tsx as 1:1 ports
of the local paths: IconX, IconPlus, IconHome, IconCopy, IconImage.
The local ExternalLink and Check are dropped rather than ported — both
had zero call sites.
Two glyphs change shape slightly, which is the point of consolidating:
the shared IconCamera includes the viewfinder bump the local copy
omitted, and drag handles now use IconGripVertical.
IconGripVertical uses the module's square 24x24 viewBox, so `.svg-drag`
goes from 12x18 to 18x18 — the old non-square box would letterbox the
glyph down to 12x12 and shrink the handle.
* fix(admin): resolve icon-module integration after #416
Merging dev brought in #416, which added a second IconImage to Icons.tsx
and two <Icons.Camera>/<Icons.Folder> section headers that reference the
local Icons object this PR removes. Git merged both cleanly but the result
did not type-check.
- drop the duplicate IconImage (both copies were byte-identical)
- point the two section headers at the imported IconCamera/IconFolder
- refresh the SORT_LABELS comment: the icon set is imported now, not
declared below
---------
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
* fix(config): allow an empty gallery, guard against a double /api suffix (#421)
An empty gallery is now a valid, rendered state instead of a throw: deriveGallery() no longer requires at least one album or subpage, so a deployment with no albums yet renders a bare homepage the owner can fill in via /admin.
getConfig() also stops appending /api to an Immich URL that already ends in it, which previously produced .../api/api and broke every upstream request.
Includes a restore of the per-album sort test cases, which the branch had lost by being cut before #408/#414.
* feat(admin): favicon upload, served from the content volume (#422)
Adds a bundled default favicon, an upload widget in admin Settings > General, and a route that serves the icon from the writable content/ volume with a fallback to the bundled default. Raster uploads (PNG/ICO/JPEG) are wrapped in an SVG container; the response carries its own CSP so an uploaded SVG cannot execute script on the origin.
The GET route revalidates with an ETag instead of caching immutably, so a newly uploaded icon shows up immediately. Uploads are written via temp file + rename, and a Reset button restores the bundled default.
* ci: flag unformatted files in a PR, without blocking it (#424)
Prettier is configured as an error rule in eslint.config.mjs but has never run in CI, so part of the tree predates it. A final CI step now diffs against the PR base, runs prettier --list-different over the changed files, and emits a warning annotation per offender plus a job summary.
Advisory by design: it never fails the job. Blocking would turn a PR red for merely touching a file that was already unformatted, and normalising the tree in one commit would wreck git blame and conflict with the PRs in flight.
Requires fetch-depth: 0, since diffing against the base needs its history.
* feat(install): first-run wizard gated by a one-time setup token (#419)
Adds /install, a four-step first-run wizard: connect to Immich, optionally pick albums, name the site, finish. It verifies the credentials against the Immich server before writing anything, then writes gallery.yaml, settings.yaml and a content/install.json carrying the Immich credentials and a generated site secret.
install.json exists because a running process cannot pick up new env vars — the wizard has to write configuration that takes effect without a restart. getInstallCredentials() merges it under the real environment, so env vars always win and rotation stays a matter of setting one.
Both the page and the API routes are gated by a one-time setup token printed to the server log, so a deployment that is reachable before gallery.yaml exists cannot be configured by whoever finds it first. The token is stored in content/.setup-token (0600) rather than a module variable: Next.js bundles the page and each route handler separately, so a module-level token left the page and the API disagreeing inside one process and the wizard stuck on step 1. It is removed once the install completes.
The admin password is stored as an scrypt hash using the scheme lib/auth.ts already applies to album passwords; a plaintext ADMIN_PASSWORD env var keeps working.
* docs: document the setup wizard, fix the read-only content mount (#425)
Quick Start now leads with the /install wizard, with the hand-written YAML route kept alongside it, and a First-Run Setup section covers the setup token, the files the wizard writes, and env-var precedence.
Two corrections: both Docker examples mounted content/ as :ro, which silently breaks the wizard, the admin panel and the backup rotation alike — docs/admin-panel.md already said so and the README contradicted it. And nothing documented that content/install.json holds the Immich API key, so a backup of content/ is a backup of credentials.
Also adds a Contributors section crediting the people whose work is in the project.
* feat(admin): floating save bar pinned to the bottom of the viewport (#426)
The save bar was the first, static element inside .admin-main. Since the
document itself scrolls, it left the viewport as soon as you scrolled down
— editing a subpage section or a settings block far below gave no visible
dirty hint and no reachable save button.
Replace it with a bottom-pinned floating bar shared by both editors. It
only mounts while there is something to act on (unsaved changes, an
in-flight save, or a result message), so it never covers content while
idle. The success message clears after 5s, which hides the bar again.
- new SaveBar component, replacing the duplicated markup in PageBuilder
and SettingsEditor
- adopt the previously unused .floating-save-bar CSS: slide-in keyframes
(carrying translateX(-50%)), dirty border, wrap/gap, mobile variant and
a prefers-reduced-motion opt-out; z-index 900 keeps it below modals
- .admin-main gains bottom padding so the bar never covers page content
- drop the now-unreachable idle hints: the ⌘S hint becomes a button title,
the Live Sync note becomes a static line above the settings layout
- header "Site" link now bypasses the cache (/?fresh=1), so the preview
stays reachable when the bar is hidden
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
* feat(admin): themed listbox for the album sort control (#427)
The per-album "Photo order" control was a native <select>. Because an
<option> cannot contain markup, its choices could not use the admin
panel's currentColor SVG set — the reason #415 had to fall back to plain
text after dropping the emoji labels.
Adds a Listbox component implementing the ARIA combobox/listbox pattern,
so options can render a glyph beside their label:
- DOM focus stays on the trigger button; the active option is announced
through aria-activedescendant, keeping focus management to one element
- Keyboard: arrows (clamped at the ends, like a native select),
Home/End, Enter/Space to commit, Escape to cancel, Tab commits and
moves on, and prefix type-ahead with a repeat-key cycle
- Outside dismissal on pointerdown, so a press starting outside closes
the popup before the click retargets
The sort options now carry an icon each: calendar, arrow-down, arrow-up,
an A→Z marker, and the drag glyph for manual — matching the badge the
album card already shows. SORT_LABELS stays plain text because the badge
feeds it to a title attribute.
Closes #417
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
* chore(git): ignore generated design handoff folders
* fix(admin): stop the album sort dropdown clipping, and simplify the panel (#428)
* fix(admin): render listbox popup in a portal so it escapes modal clipping
The sort control's popup was position:absolute inside three clipping ancestors
(.album-drawer overflow:hidden > .album-drawer-body overflow-y:auto >
.modal-right-column overflow-y:auto), so it was cut off at the bottom of the
Edit Album Details modal. z-index could not help: clipping happens before
stacking. It also always hung below the trigger, with no flip.
Portal the popup to document.body and position it from the trigger's viewport
rect, flipping above when there is more room there and capping max-height to the
space available so it scrolls internally rather than overflowing. It is
dismissed on scroll and resize, since the anchor is only measured on open.
The outside-pointerdown handler now also treats the popup as inside; without
that the portalled list counts as outside, and a click on an option would close
it before the selection commits.
* refactor(admin): single-column album details panel
The left column spent 1.2fr on a cover thumbnail and three stat rows, two of
which (Status, Custom Hero) only restated the form fields opposite them, while
the form itself was squeezed into 1.8fr behind a second nested scroller.
Stack the drawer in one column instead: cover as a banner, then the form at full
width, with the UUID moved into the footer. The body is now the only scroll
container, which also removes one of the ancestors that was clipping the sort
popup.
---------
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
* fix(admin): give the portalled listbox its theme back, lock the page behind modals (#429)
Two defects in the album editor.
The sort listbox popup painted transparent. Every --admin-* variable is
scoped to .admin-layout, and since the popup moved into document.body it
sits outside that subtree, so background/border/text all resolved to
nothing. It now carries its own copy of the palette in both colour
schemes, plus the font it no longer inherits.
Scrolling inside a modal also moved the page behind it. No admin modal
ever locked body scroll: the overlay covers the page but does not absorb
wheel events, so a scroll starting on the backdrop — or continuing past
the end of the modal's own scroller — reaches the document.
overscroll-behavior cannot cover that case on its own, because it only
applies to scroll containers and the backdrop is not one.
useScrollLock freezes body while a modal is open and compensates for the
width the scrollbar gives up, so nothing shifts underneath. Each lock
restores the inline value it found, which makes nesting work without a
counter — a picker opened from the drawer restores the drawer's hidden
state instead of clearing it. Applied to both drawers and all four
picker modals, which share the defect. overscroll-behavior: contain on
the scrollers stops the chaining they can handle themselves.
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
* fix(security): allow unsafe-eval in CSP script-src during dev mode
* feat(journal): add Journal Studio with split-screen editor, live preview and dedicated routes
* fix(build): separate client parser from server journal-service and fix build type errors
* fix(journal): Fotos rendern, Layout und Lightbox-Steuerung korrigieren
Fünf unabhängige Fehler in der öffentlichen Journal- und Essay-Ansicht:
* Foto-Blöcke wurden nie angezeigt. EssayView löst ein Foto über
PhotoItem.id auf, und das sind verschlüsselte Tokens — die Blöcke aus
dem Markdown tragen aber rohe Asset-UUIDs. Jede Zuordnung lief ins
Leere, und nicht auflösbare Blöcke werden still verworfen. Die IDs
werden jetzt serverseitig übersetzt; damit verschwinden nebenbei die
rohen UUIDs aus dem Client-Payload, die dort laut Projektregel nie
auftauchen dürfen. Nicht auflösbare Referenzen werden geloggt.
* Überschriften standen weiter links als der Fließtext. Jeder Block
hatte einzeln `max-width: 68ch`, und `ch` ist relativ zur Schrift des
Elements — die Serif-Überschrift ergab eine breitere Spalte. Ersetzt
durch eine gemeinsame, font-unabhängige `--essay-measure`.
* Fullbleed-Fotos bluteten nur nach links aus: `.essay-figure` ist
`width: 100%`, wodurch die Box überbestimmt ist und der negative
rechte Margin verworfen wird.
* Foto-Paare stellten beide Bilder gleich breit dar, wodurch ein
Hochformat neben einem Querformat doppelt so hoch wurde. Jetzt eine
Justified-Reihe: Breite proportional zum Seitenverhältnis, dadurch
exakt gleiche Höhen ohne Beschnitt.
* Die Lightbox hatte im Journal keine Tastatursteuerung und keine
Scroll-Sperre — beides lag in PhotoGrid, also nur im Album-Raster.
Verlagert in die Lightbox selbst, der doppelte Handler in PhotoGrid
entfernt (sonst wäre pro Pfeildruck zwei Bilder weitergesprungen).
Zusätzlich sind Proofing-Herzen und das EXIF-Panel im redaktionellen
Modus abschaltbar und im Journal aus: Client-Proofing ist ein
Übergabe-Workflow für Alben, keine Funktion einer Reportage. Auf der
Übersicht wurde der Untertitel doppelt gerendert, weil extractExcerpt()
auf ihn zurückfällt.
* feat(admin): eigene URLs für alle Bereiche und überarbeiteter Journal Studio
Das Panel war eine einzige Client-Komponente, die ihre Tabs über
useState umschaltet: keine Route pro Bereich, kein Deep-Link, kein
Zurück-Button, und nach jedem Reload landete man wieder auf "Pages".
Auch der Journal-Editor hatte keine eigene URL.
Jetzt sieben echte Routen (/admin, /admin/pages, /admin/journal,
/admin/journal/<slug>, /admin/settings, /admin/settings/<section>,
/admin/analytics). Die Shell mit Auth-Prüfung und Kopfzeile sitzt im
Layout und umschließt children — so bleibt die Session-Prüfung über
Routenwechsel montiert, statt bei jedem Tab-Wechsel neu zu laufen und
den Spinner aufblitzen zu lassen. Unbekannte Settings-Sections fallen
auf General zurück.
Im selben Zug der Journal Studio, der die Routing-Änderung ohnehin
berührt:
* Alle Eingabefelder nutzten die Klasse `admin-input`, die in keinem
CSS definiert war — sie fielen auf Browser-Defaults zurück. Jetzt
gestylt, gescoped, damit der generische Name nicht ins übrige Panel
leckt.
* Der Split View ist per Divider verschiebbar (Maus, Tastatur,
Doppelklick zum Zurücksetzen), Breite in localStorage.
* Das Studio bricht aus der 1120px-Spalte aus, die Preview hat Platz.
* Die Preview zeigte für jedes Foto fest 3:2 und log damit über das
Layout der veröffentlichten Seite; die echten Verhältnisse werden
jetzt an den Thumbnails gemessen.
* Blöcke mit alten positionsbasierten Foto-Referenzen werden markiert —
die lassen sich auf einer eigenständigen Journal-Seite nicht auflösen
und verschwanden bisher stillschweigend.
* Blocktyp-Chips als gemeinsame Komponente, monochrom und per Icon
unterschieden statt in einer eigenen Blau/Lila/Orange-Palette, die
sonst nirgends im Panel vorkommt.
* Emojis raus, SVG-Icons rein.
* fix(admin): Designsystem-Lücken im Panel schließen
Eine systematische Suche nach Klassen, die im TSX benutzt, aber in
keinem CSS definiert sind, hat vier Stellen mit demselben Muster
gefunden:
* `admin-btn-secondary` und `admin-btn-danger` existierten nicht.
Sämtliche Löschen-Buttons sahen aus wie normale Buttons — keine
Warnwirkung. Als `.admin-btn.admin-btn-danger` geschrieben, weil die
Varianten mit den Größenklassen kombiniert werden, die weiter unten
ihren eigenen Hintergrund setzen.
* `page-progress-fill` fehlte: die Balken im Analytics-Panel waren
leere Rinnen, der Wert unsichtbar. Ebenso `analytics-empty` und
`admin-loading-container`.
* `subpage-drawer-section`, `subpage-drawer-title-group` und
`input-with-icon` im PageBuilder waren wirkungslos und teils mit
Inline-Styles notdürftig kompensiert.
* `grid-card-preview` fehlte, wodurch alle Layout-Vorschauen auf Höhe
null kollabierten. Nur "Showcase" war sichtbar — und das aus Versehen,
weil sein Tile `hero-tile` hieß und damit die `aspect-ratio` einer
fremden PageBuilder-Klasse erbte. Umbenannt.
Dazu die Theme-Vorschauen, die praktisch identisch aussahen: alle
sieben zeigten dieselben drei quadratischen Kacheln, einziger
Unterschied war die Hintergrundfarbe. Sie spiegeln jetzt die echten
Preset-Daten aus lib/config/theme.ts — Schriftcharakter, Eckradius,
Rasterdichte, Passepartout bzw. Schatten.
Die Kopfzeile richtet sich an einer gemeinsamen Steuerhöhe aus. Der
"Site"-Link war höher als die Buttons daneben: `.admin-btn` hatte keine
explizite line-height, und <button> bekommt box-sizing: border-box vom
Browser, <a> nicht. Die Statusanzeige setzte weder Schriftfamilie noch
-größe und fiel auf den Browser-Default zurück — sie war nie Teil des
Designsystems. Jetzt gleiche Höhe und Typografie, Pillenform als
Zustandsanzeige, Trenner zur Aktionsgruppe. Das dauerhafte Pulsieren
des grünen Punkts entfällt; Animation bleibt den Zuständen vorbehalten,
die Aufmerksamkeit brauchen.
Restliche Emojis durch SVG-Icons ersetzt.
* feat(admin): add scroll-to-top toggle and SVG arrow
The back-to-top button was always on and drew its arrow with the ↑ text
character. Add a `scrollToTop` setting (General section in the admin
panel, defaults to on so existing sites are unaffected) and replace the
glyph with a stroked SVG that inherits currentColor across all presets.
Scroll handling is now rAF-throttled, and prefers-reduced-motion turns
off both the hover lift and the smooth scroll.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
* security(journal): escape author HTML instead of filtering it
CodeQL flags 26 high-severity alerts on the release PR; the bulk of them
point at sanitizeHtml(), a denylist of three regexes whose output goes
into dangerouslySetInnerHTML. I reproduced the bypasses before changing
anything — all four pass the old filter:
<img src=x onerror=alert(1)> unquoted handler, regex wants quotes
<img src=x onerror='alert(1)'> single quotes, same reason
<svg onload=alert(1)> not a <script> tag
javasjavascript:cript:alert(1) one-pass replace, the rest recombines
Plus an attribute breakout in the link renderer, which interpolated the
URL into href="${url}" unescaped:
[x](" onmouseover=alert(1) x=") -> <a href="" onmouseover=alert(1" ...>
Replaced with escaping. Every `&<>"'` in author text becomes an entity
before any markdown rule runs, so the only tags in the output are the
ones renderInlineMarkdown builds itself and a URL cannot leave its
attribute. Link schemes are now an allowlist (http, https, mailto, tel,
relative, anchor); anything else renders as plain text.
The serializer needed decodeHtmlEntities to match: without it a save
would write `<` into the Markdown file and the next parse would
escape the `&` again, corrupting the text further on every round trip.
A test covers parse -> serialize -> parse stability.
Two existing tests asserted the old behaviour and were rewritten rather
than deleted: one expected the script tag to be *removed* from the
output, the other expected the substring "onerror" to be absent. Both
now assert the property that matters — that no tag can form — because
`onerror` surviving as inert text is fine.
Exploitation required admin access either way: journal and essay text
comes from the studio or from content/*.md. This removes the weakness,
it does not close an open door.
* fix(journal): contain file paths, fix frontmatter escaping, defuse two regexes
Follow-up to the CodeQL findings on release PR #432. I went through all 23
alerts individually; this addresses the ones that are worth addressing and
documents the ones that are not.
Path containment (12 alerts, all false positives). Every path built from a
slug goes through isValidSlug(), a strict `/^[a-zA-Z0-9_-]+$/` allowlist —
verified against `../../etc/passwd`, `foo/../../bar`, `a/b`, `..` and
friends, all rejected. CodeQL cannot see it because the check lives in
another module. Added a containedPath() helper that resolves the path and
refuses anything landing outside the content directory: a second lock on a
door that was already locked, and a barrier the analysis can follow. Also
removed the dead `slug.endsWith('.md')` branches — isValidSlug rejects
dots, so they could never be taken.
Frontmatter escaping (1 alert, a real bug). The serializer escaped `"` but
not `\`, and the parser never unescaped anything. A title containing either
character gained a backslash on every save/load cycle:
Path C:\Users "quoted" -> Path C:\\Users \"quoted\" -> ...
Escaping now covers the backslash first and the parser undoes both. A round
trip test covers quotes, backslashes, colons and apostrophes.
Two of three ReDoS regexes (2 alerts). The heading pattern had `\s+` next to
`(.+)`, which overlap, so the engine tried every split of the whitespace run
before failing; it is `[ \t]+` and `(\S.*)` now. The quote author pattern
wrapped a lazy group around an optional group — the quadratic case — and is
an index split on the first separator now.
The third regex, the bold/italic pass, is deliberately left alone. Rewriting
it with a negated class removes the backtracking but breaks nesting:
`**bold *and italic* here**` renders as `*<em>bold </em>and italic<em> here</em>*`.
The input is Markdown from an authenticated admin, never a visitor, so the
worst case is an author slowing down their own page. The comment in the code
says so.
Not addressed: 5 js/insufficient-password-hash alerts. They ask for a slow
KDF where the code uses SHA-256/HMAC — correct in general, but the admin
password comes from an environment variable and is never stored, so a
stronger KDF protects nothing that is not already in plaintext in the
environment.
399 unit tests pass (18 new), build and tsc clean.
* fix(journal): split the quote author by scanning, not by pattern
Cleaning up after myself. #439 replaced the quote author regex
`/^(.*?)(?:\s+--\s+(.+))?$/` — a lazy group around an optional one, the
quadratic case — with `/\s+--\s+/`, and CodeQL promptly flagged the
replacement for the same reason. One reported pattern traded for another.
splitQuoteAuthor() scans for the first `--` that has whitespace on both
sides. Linear, and it needs no reasoning about the regex engine at all.
Behaviour is identical to the original regex, checked case by case
against it: separator, no separator, several separators, tabs, wide gaps,
`a--b` without spaces, leading and trailing separators, empty string. All
nine are covered by tests, plus one asserting it stays fast on a 50k
whitespace run.
* security(admin): derive the session signing key with scrypt
getSigningKey() ran the admin password through a single SHA-256 digest.
It is key derivation rather than password storage, so it was never a
stored-hash problem — but if the derived key ever leaked, one fast hash
makes recovering the password by brute force cheap. CodeQL flags it as
js/insufficient-password-hash and, for this particular alert, has a
point.
scrypt now. Two details that matter:
The salt has to be stable. A random salt would produce a different key on
every call and invalidate every session; it is derived from AUTH_SECRET,
which is deployment-specific. Verified across separate processes: same
inputs produce a verifying token, so a restart or redeploy does not log
everyone out.
The result is cached for the process lifetime. scrypt is deliberately
slow and getSigningKey() runs on every admin request — deriving per call
would add ~24ms to each one. The cache key is a digest of secret plus
password, so a rotation misses the cache and derives again, and no extra
plaintext copy of the password is kept around.
Measured: first derivation 24ms, subsequent calls 0.12ms. Password
change and secret change both invalidate an existing token, checked in
separate processes.
Note the one-time effect: existing admin sessions are invalidated by the
change in derivation, so everyone logs in once more.
* security(admin): key the signing-key cache on its inputs, not a digest
#441 removed the SHA-256 digest of the admin password from the key
derivation and introduced a new one three lines above it, as the cache
key. Same rule, same file: CodeQL reported it immediately.
The comment justifying it was wrong too. It claimed no second plaintext
copy of the password was retained, while building the digest input
allocates exactly that in order to hash it.
The cache now holds the two input strings and compares them directly.
They are the same objects the env and install caches already hold, so
nothing extra is retained, and no fast hash of the password exists in
memory for the life of the process.
Re-verified after the change, in separate processes: a token from one
process verifies in another with the same inputs, a changed password or
secret rejects it, first derivation 24ms, cached calls 0.001ms.
That leaves scrypt as the only place the password is hashed here. The
two HMACs further down operate on the derived key and on token data, not
on the password; the constant-time comparison in verifyAdminPassword is
the previously dismissed one.
---------
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
2026-08-14 16:55:07 +02:00
|
|
|
|
IconArrowDown,
|
|
|
|
|
|
IconArrowUp,
|
|
|
|
|
|
IconBook,
|
|
|
|
|
|
IconCalendar,
|
2026-08-14 11:10:42 +02:00
|
|
|
|
IconCamera,
|
|
|
|
|
|
IconCopy,
|
|
|
|
|
|
IconFolder,
|
|
|
|
|
|
IconGripVertical,
|
|
|
|
|
|
IconHome,
|
|
|
|
|
|
IconImage,
|
experimental: portfolio features (justified layout, unlisted pages, captions, per-album grid, focal point, nav links, cover hero) (#431)
## Was ist das?
Sieben neue Portfolio-Features, alle als **experimental** gekennzeichnet
— in YAML-Kommentaren, Admin-Panel-Labels und Commit-Scopes, damit sie
einzeln nachvollziehbar und revertierbar bleiben.
## Features (je ein Commit)
| Commit | Feature |
| --- | --- |
| `justified rows gallery layout` | Neues Grid-Layout `justified`:
zeilenbasiert, gleiche Höhen, volle Breite — Flexbox ohne JS-Messung,
letzte Zeile bleibt natürlich klein |
| `hide subpages from navigation` | `hidden: true`: Seite aus
Nav/Homepage raus, per Direktlink erreichbar — im Gegensatz zu `enabled:
false` (404) |
| `lightbox captions` | Immich-Asset-Description als Bildunterschrift im
Info-Panel; EXIF-Route liefert bei `exifOnHover: false` jetzt nur noch
die Caption statt 403 |
| `per-album grid overrides` | `grid:` pro Album-Eintrag, Präzedenz
global < Subpage < Album |
| `per-album cover focal point` | `coverPosition:` → `object-position`
auf Cover-Karten, strikt validiert |
| `external links in header navigation` | `navLinks:` in settings.yaml,
nur http(s), sanitisiert |
| `cover splash hero style` | `heroStyle: cover`: Fullscreen-Splash mit
Enter-Link ins Portfolio |
Alle Optionen sind im Admin-Panel editierbar (PageBuilder /
SettingsEditor).
## Tests
- 356 Unit-Tests grün (13 neue: deriveGallery hidden/grid/coverPosition,
sanitizeNavLinks, EXIF-Route-Captions, justified-Layout-Validierung)
- `npx tsc --noEmit`: 0 Fehler
- `npm run build`: sauber
- Justified-Zeilenmathematik und Cover-Splash per Browser-Harness
visuell/numerisch verifiziert (volle Zeilen enden exakt an der
Containerkante, letzte Zeile bleibt natürlich)
---------
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
2026-08-14 17:56:22 +02:00
|
|
|
|
IconBan,
|
|
|
|
|
|
IconEyeOff,
|
|
|
|
|
|
IconGlobe,
|
2026-08-14 11:10:42 +02:00
|
|
|
|
IconLock,
|
|
|
|
|
|
IconPencil,
|
|
|
|
|
|
IconPlus,
|
|
|
|
|
|
IconSearch,
|
release: v0.11.0 — journal fixes, admin URLs, design system cleanup (#432)
* fix(screenshots): sharp-Typen fuer 0.34 und 0.35 gleichzeitig (#410)
sharp 0.35 ist von `export =` auf ESM umgestellt: der Modul-Namespace
ist nicht mehr aufrufbar, die Factory sitzt unter .default. Der
Type-Check brach damit in scripts/screenshots.ts weg, sobald der
Next-Bump (#402) sharp von 0.34.5 auf 0.35.3 mitzieht -- sharp ist hier
keine deklarierte Dependency, sondern kommt ueber Next mit.
Die Form wird jetzt aus dem installierten Paket abgeleitet statt
festgeschrieben, zur Laufzeit wie im Typ. Geprueft mit beiden
Versionen: tsc laeuft mit 0.34.5 und mit 0.35.3 fehlerfrei durch.
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
* chore(deps): bump the nextjs group across 1 directory with 2 updates (#402)
Bumps the nextjs group with 2 updates in the / directory: [next](https://github.com/vercel/next.js) and [eslint-config-next](https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next).
Updates `next` from 16.2.12 to 16.3.0
- [Release notes](https://github.com/vercel/next.js/releases)
- [Commits](https://github.com/vercel/next.js/compare/v16.2.12...v16.3.0)
Updates `eslint-config-next` from 16.2.12 to 16.3.0
- [Release notes](https://github.com/vercel/next.js/releases)
- [Commits](https://github.com/vercel/next.js/commits/v16.3.0/packages/eslint-config-next)
---
updated-dependencies:
- dependency-name: eslint-config-next
dependency-version: 16.3.0
dependency-type: direct:development
update-type: version-update:semver-minor
dependency-group: nextjs
- dependency-name: next
dependency-version: 16.3.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: nextjs
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* chore(deps-dev): bump prettier from 3.8.3 to 3.9.6 (#405)
Bumps [prettier](https://github.com/prettier/prettier) from 3.8.3 to 3.9.6.
- [Release notes](https://github.com/prettier/prettier/releases)
- [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md)
- [Commits](https://github.com/prettier/prettier/compare/3.8.3...3.9.6)
---
updated-dependencies:
- dependency-name: prettier
dependency-version: 3.9.6
dependency-type: direct:development
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* docs(changelog): Unreleased-Sektion fuer die Bumps nach v0.10.0 (#413)
Die Dependency-PRs sind nach dem Release auf dev gelandet, teils auch
auf main. Ohne Eintrag waeren sie beim naechsten Release unsichtbar --
inklusive Next 16.3.0, das CVE-2025-13465 mitbringt.
Ausserdem im 0.10.0-Abschnitt nachgetragen, dass der Trivy-Scan bis
#409 nie gelaufen ist. Der Fix steckt im Tag v0.10.0, fehlte aber in der
Aufzaehlung -- und "Images werden bei jedem Publish gescannt" stand im
Changelog, waehrend der Job im Action-Setup abbrach.
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
* feat(gallery): per-album sort order, independent of Immich (#408) (#414)
Album order was dictated entirely by Immich: getAlbum() sorted by the
album's own asc/desc flag, so a Folio album always mirrored the archive.
A curated series has a narrative order that has nothing to do with
capture time, and changing the Immich album's sort to fit the website
changes it for the archive too.
Adds an optional per-album `sort` in gallery.yaml, editable in /admin,
defaulting to today's behaviour so every existing config is unchanged:
immich (default) | newest | oldest | filename | manual
`manual` is a pinned *prefix*: `assetOrder` lists only the photos placed
by hand, everything else follows in the album's Immich order. A full
permutation of a 2,000-photo album would be ~80 KB of UUIDs in a file
that is rewritten and copied to content/.backups/ on every admin save.
It also makes drift fall out for free — photos removed in Immich never
match, new ones land in the tail rather than being hidden.
Sorting is applied after the cache read, not before the cache write, so
the LRU keeps one canonical Immich-ordered copy per album. That avoids
putting the mode in the cache key, lets a config change take effect
without depending on invalidation, and keeps the stale-serving path
correct. cache.get() returns the stored object by reference, so
withSort() returns a shallow clone with a new array — sorting in place
would reorder the shared entry, and under request coalescing every
concurrent caller would be sorting the same array.
Also fixes a prerequisite bug: /api/admin/albums/[albumId]/assets read
album.assets from GET /albums/:id, which Immich 3.x no longer populates
(lib/immich.ts:507). The hero picker's "This Album" tab returned nothing
and threw outright when the key was absent. It now goes through the
client's paginated metadata search, with ?types=all to opt videos in for
the reorder editor.
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
* refactor(admin): drop decorative emoji from the sort select labels (#415)
An <option> cannot contain markup, so the SVG set in Icons is not
reachable there — but a decorative emoji is not a substitute for it.
Plain text instead; the album card badge already uses a real icon.
The remaining emoji in the admin panel (asset picker tabs, section
headings, layout picker options) predate this branch and are left for a
separate cleanup.
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
* refactor(admin): replace emoji icons with the shared SVG icon set (#416)
The admin panel mixed two icon conventions: inline SVGs from
`Icons.tsx` in most components, and decorative emoji in the asset
picker and a few PageBuilder labels. Emoji render inconsistently
across platforms, ignore the accent colour, and cannot inherit the
`.svg-icon` sizing rules.
- Icons.tsx: add `IconStar` (filled — it marks a state, not an
action) and `IconImage`.
- AssetPicker: the three tab labels and the favourite tile badge now
use IconFolder / IconStar / IconImage.
- PageBuilder: the "Standalone Albums" and "Subpages" headings use
the icon set instead of an emoji.
- PageBuilder: the layout picker drops its emoji for plain text. An
<option> cannot contain markup, so an SVG is impossible there and a
decorative glyph is not a substitute.
- admin.css: align icon and label in the picker tabs, and swap the
favourite badge's text-shadow for drop-shadow, which is what
applies to an inline SVG.
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
* refactor(admin): fold PageBuilder's local icons into the shared Icons module (#418)
* refactor(admin): fold PageBuilder's local icons into the shared module
PageBuilder.tsx carried its own `Icons` object duplicating most of the
glyphs already exported by Icons.tsx, with hardcoded sizes and slightly
divergent paths. Migrate all 32 call sites to the shared module and
delete the local object.
Five glyphs had no counterpart and are added to Icons.tsx as 1:1 ports
of the local paths: IconX, IconPlus, IconHome, IconCopy, IconImage.
The local ExternalLink and Check are dropped rather than ported — both
had zero call sites.
Two glyphs change shape slightly, which is the point of consolidating:
the shared IconCamera includes the viewfinder bump the local copy
omitted, and drag handles now use IconGripVertical.
IconGripVertical uses the module's square 24x24 viewBox, so `.svg-drag`
goes from 12x18 to 18x18 — the old non-square box would letterbox the
glyph down to 12x12 and shrink the handle.
* fix(admin): resolve icon-module integration after #416
Merging dev brought in #416, which added a second IconImage to Icons.tsx
and two <Icons.Camera>/<Icons.Folder> section headers that reference the
local Icons object this PR removes. Git merged both cleanly but the result
did not type-check.
- drop the duplicate IconImage (both copies were byte-identical)
- point the two section headers at the imported IconCamera/IconFolder
- refresh the SORT_LABELS comment: the icon set is imported now, not
declared below
---------
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
* fix(config): allow an empty gallery, guard against a double /api suffix (#421)
An empty gallery is now a valid, rendered state instead of a throw: deriveGallery() no longer requires at least one album or subpage, so a deployment with no albums yet renders a bare homepage the owner can fill in via /admin.
getConfig() also stops appending /api to an Immich URL that already ends in it, which previously produced .../api/api and broke every upstream request.
Includes a restore of the per-album sort test cases, which the branch had lost by being cut before #408/#414.
* feat(admin): favicon upload, served from the content volume (#422)
Adds a bundled default favicon, an upload widget in admin Settings > General, and a route that serves the icon from the writable content/ volume with a fallback to the bundled default. Raster uploads (PNG/ICO/JPEG) are wrapped in an SVG container; the response carries its own CSP so an uploaded SVG cannot execute script on the origin.
The GET route revalidates with an ETag instead of caching immutably, so a newly uploaded icon shows up immediately. Uploads are written via temp file + rename, and a Reset button restores the bundled default.
* ci: flag unformatted files in a PR, without blocking it (#424)
Prettier is configured as an error rule in eslint.config.mjs but has never run in CI, so part of the tree predates it. A final CI step now diffs against the PR base, runs prettier --list-different over the changed files, and emits a warning annotation per offender plus a job summary.
Advisory by design: it never fails the job. Blocking would turn a PR red for merely touching a file that was already unformatted, and normalising the tree in one commit would wreck git blame and conflict with the PRs in flight.
Requires fetch-depth: 0, since diffing against the base needs its history.
* feat(install): first-run wizard gated by a one-time setup token (#419)
Adds /install, a four-step first-run wizard: connect to Immich, optionally pick albums, name the site, finish. It verifies the credentials against the Immich server before writing anything, then writes gallery.yaml, settings.yaml and a content/install.json carrying the Immich credentials and a generated site secret.
install.json exists because a running process cannot pick up new env vars — the wizard has to write configuration that takes effect without a restart. getInstallCredentials() merges it under the real environment, so env vars always win and rotation stays a matter of setting one.
Both the page and the API routes are gated by a one-time setup token printed to the server log, so a deployment that is reachable before gallery.yaml exists cannot be configured by whoever finds it first. The token is stored in content/.setup-token (0600) rather than a module variable: Next.js bundles the page and each route handler separately, so a module-level token left the page and the API disagreeing inside one process and the wizard stuck on step 1. It is removed once the install completes.
The admin password is stored as an scrypt hash using the scheme lib/auth.ts already applies to album passwords; a plaintext ADMIN_PASSWORD env var keeps working.
* docs: document the setup wizard, fix the read-only content mount (#425)
Quick Start now leads with the /install wizard, with the hand-written YAML route kept alongside it, and a First-Run Setup section covers the setup token, the files the wizard writes, and env-var precedence.
Two corrections: both Docker examples mounted content/ as :ro, which silently breaks the wizard, the admin panel and the backup rotation alike — docs/admin-panel.md already said so and the README contradicted it. And nothing documented that content/install.json holds the Immich API key, so a backup of content/ is a backup of credentials.
Also adds a Contributors section crediting the people whose work is in the project.
* feat(admin): floating save bar pinned to the bottom of the viewport (#426)
The save bar was the first, static element inside .admin-main. Since the
document itself scrolls, it left the viewport as soon as you scrolled down
— editing a subpage section or a settings block far below gave no visible
dirty hint and no reachable save button.
Replace it with a bottom-pinned floating bar shared by both editors. It
only mounts while there is something to act on (unsaved changes, an
in-flight save, or a result message), so it never covers content while
idle. The success message clears after 5s, which hides the bar again.
- new SaveBar component, replacing the duplicated markup in PageBuilder
and SettingsEditor
- adopt the previously unused .floating-save-bar CSS: slide-in keyframes
(carrying translateX(-50%)), dirty border, wrap/gap, mobile variant and
a prefers-reduced-motion opt-out; z-index 900 keeps it below modals
- .admin-main gains bottom padding so the bar never covers page content
- drop the now-unreachable idle hints: the ⌘S hint becomes a button title,
the Live Sync note becomes a static line above the settings layout
- header "Site" link now bypasses the cache (/?fresh=1), so the preview
stays reachable when the bar is hidden
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
* feat(admin): themed listbox for the album sort control (#427)
The per-album "Photo order" control was a native <select>. Because an
<option> cannot contain markup, its choices could not use the admin
panel's currentColor SVG set — the reason #415 had to fall back to plain
text after dropping the emoji labels.
Adds a Listbox component implementing the ARIA combobox/listbox pattern,
so options can render a glyph beside their label:
- DOM focus stays on the trigger button; the active option is announced
through aria-activedescendant, keeping focus management to one element
- Keyboard: arrows (clamped at the ends, like a native select),
Home/End, Enter/Space to commit, Escape to cancel, Tab commits and
moves on, and prefix type-ahead with a repeat-key cycle
- Outside dismissal on pointerdown, so a press starting outside closes
the popup before the click retargets
The sort options now carry an icon each: calendar, arrow-down, arrow-up,
an A→Z marker, and the drag glyph for manual — matching the badge the
album card already shows. SORT_LABELS stays plain text because the badge
feeds it to a title attribute.
Closes #417
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
* chore(git): ignore generated design handoff folders
* fix(admin): stop the album sort dropdown clipping, and simplify the panel (#428)
* fix(admin): render listbox popup in a portal so it escapes modal clipping
The sort control's popup was position:absolute inside three clipping ancestors
(.album-drawer overflow:hidden > .album-drawer-body overflow-y:auto >
.modal-right-column overflow-y:auto), so it was cut off at the bottom of the
Edit Album Details modal. z-index could not help: clipping happens before
stacking. It also always hung below the trigger, with no flip.
Portal the popup to document.body and position it from the trigger's viewport
rect, flipping above when there is more room there and capping max-height to the
space available so it scrolls internally rather than overflowing. It is
dismissed on scroll and resize, since the anchor is only measured on open.
The outside-pointerdown handler now also treats the popup as inside; without
that the portalled list counts as outside, and a click on an option would close
it before the selection commits.
* refactor(admin): single-column album details panel
The left column spent 1.2fr on a cover thumbnail and three stat rows, two of
which (Status, Custom Hero) only restated the form fields opposite them, while
the form itself was squeezed into 1.8fr behind a second nested scroller.
Stack the drawer in one column instead: cover as a banner, then the form at full
width, with the UUID moved into the footer. The body is now the only scroll
container, which also removes one of the ancestors that was clipping the sort
popup.
---------
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
* fix(admin): give the portalled listbox its theme back, lock the page behind modals (#429)
Two defects in the album editor.
The sort listbox popup painted transparent. Every --admin-* variable is
scoped to .admin-layout, and since the popup moved into document.body it
sits outside that subtree, so background/border/text all resolved to
nothing. It now carries its own copy of the palette in both colour
schemes, plus the font it no longer inherits.
Scrolling inside a modal also moved the page behind it. No admin modal
ever locked body scroll: the overlay covers the page but does not absorb
wheel events, so a scroll starting on the backdrop — or continuing past
the end of the modal's own scroller — reaches the document.
overscroll-behavior cannot cover that case on its own, because it only
applies to scroll containers and the backdrop is not one.
useScrollLock freezes body while a modal is open and compensates for the
width the scrollbar gives up, so nothing shifts underneath. Each lock
restores the inline value it found, which makes nesting work without a
counter — a picker opened from the drawer restores the drawer's hidden
state instead of clearing it. Applied to both drawers and all four
picker modals, which share the defect. overscroll-behavior: contain on
the scrollers stops the chaining they can handle themselves.
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
* fix(security): allow unsafe-eval in CSP script-src during dev mode
* feat(journal): add Journal Studio with split-screen editor, live preview and dedicated routes
* fix(build): separate client parser from server journal-service and fix build type errors
* fix(journal): Fotos rendern, Layout und Lightbox-Steuerung korrigieren
Fünf unabhängige Fehler in der öffentlichen Journal- und Essay-Ansicht:
* Foto-Blöcke wurden nie angezeigt. EssayView löst ein Foto über
PhotoItem.id auf, und das sind verschlüsselte Tokens — die Blöcke aus
dem Markdown tragen aber rohe Asset-UUIDs. Jede Zuordnung lief ins
Leere, und nicht auflösbare Blöcke werden still verworfen. Die IDs
werden jetzt serverseitig übersetzt; damit verschwinden nebenbei die
rohen UUIDs aus dem Client-Payload, die dort laut Projektregel nie
auftauchen dürfen. Nicht auflösbare Referenzen werden geloggt.
* Überschriften standen weiter links als der Fließtext. Jeder Block
hatte einzeln `max-width: 68ch`, und `ch` ist relativ zur Schrift des
Elements — die Serif-Überschrift ergab eine breitere Spalte. Ersetzt
durch eine gemeinsame, font-unabhängige `--essay-measure`.
* Fullbleed-Fotos bluteten nur nach links aus: `.essay-figure` ist
`width: 100%`, wodurch die Box überbestimmt ist und der negative
rechte Margin verworfen wird.
* Foto-Paare stellten beide Bilder gleich breit dar, wodurch ein
Hochformat neben einem Querformat doppelt so hoch wurde. Jetzt eine
Justified-Reihe: Breite proportional zum Seitenverhältnis, dadurch
exakt gleiche Höhen ohne Beschnitt.
* Die Lightbox hatte im Journal keine Tastatursteuerung und keine
Scroll-Sperre — beides lag in PhotoGrid, also nur im Album-Raster.
Verlagert in die Lightbox selbst, der doppelte Handler in PhotoGrid
entfernt (sonst wäre pro Pfeildruck zwei Bilder weitergesprungen).
Zusätzlich sind Proofing-Herzen und das EXIF-Panel im redaktionellen
Modus abschaltbar und im Journal aus: Client-Proofing ist ein
Übergabe-Workflow für Alben, keine Funktion einer Reportage. Auf der
Übersicht wurde der Untertitel doppelt gerendert, weil extractExcerpt()
auf ihn zurückfällt.
* feat(admin): eigene URLs für alle Bereiche und überarbeiteter Journal Studio
Das Panel war eine einzige Client-Komponente, die ihre Tabs über
useState umschaltet: keine Route pro Bereich, kein Deep-Link, kein
Zurück-Button, und nach jedem Reload landete man wieder auf "Pages".
Auch der Journal-Editor hatte keine eigene URL.
Jetzt sieben echte Routen (/admin, /admin/pages, /admin/journal,
/admin/journal/<slug>, /admin/settings, /admin/settings/<section>,
/admin/analytics). Die Shell mit Auth-Prüfung und Kopfzeile sitzt im
Layout und umschließt children — so bleibt die Session-Prüfung über
Routenwechsel montiert, statt bei jedem Tab-Wechsel neu zu laufen und
den Spinner aufblitzen zu lassen. Unbekannte Settings-Sections fallen
auf General zurück.
Im selben Zug der Journal Studio, der die Routing-Änderung ohnehin
berührt:
* Alle Eingabefelder nutzten die Klasse `admin-input`, die in keinem
CSS definiert war — sie fielen auf Browser-Defaults zurück. Jetzt
gestylt, gescoped, damit der generische Name nicht ins übrige Panel
leckt.
* Der Split View ist per Divider verschiebbar (Maus, Tastatur,
Doppelklick zum Zurücksetzen), Breite in localStorage.
* Das Studio bricht aus der 1120px-Spalte aus, die Preview hat Platz.
* Die Preview zeigte für jedes Foto fest 3:2 und log damit über das
Layout der veröffentlichten Seite; die echten Verhältnisse werden
jetzt an den Thumbnails gemessen.
* Blöcke mit alten positionsbasierten Foto-Referenzen werden markiert —
die lassen sich auf einer eigenständigen Journal-Seite nicht auflösen
und verschwanden bisher stillschweigend.
* Blocktyp-Chips als gemeinsame Komponente, monochrom und per Icon
unterschieden statt in einer eigenen Blau/Lila/Orange-Palette, die
sonst nirgends im Panel vorkommt.
* Emojis raus, SVG-Icons rein.
* fix(admin): Designsystem-Lücken im Panel schließen
Eine systematische Suche nach Klassen, die im TSX benutzt, aber in
keinem CSS definiert sind, hat vier Stellen mit demselben Muster
gefunden:
* `admin-btn-secondary` und `admin-btn-danger` existierten nicht.
Sämtliche Löschen-Buttons sahen aus wie normale Buttons — keine
Warnwirkung. Als `.admin-btn.admin-btn-danger` geschrieben, weil die
Varianten mit den Größenklassen kombiniert werden, die weiter unten
ihren eigenen Hintergrund setzen.
* `page-progress-fill` fehlte: die Balken im Analytics-Panel waren
leere Rinnen, der Wert unsichtbar. Ebenso `analytics-empty` und
`admin-loading-container`.
* `subpage-drawer-section`, `subpage-drawer-title-group` und
`input-with-icon` im PageBuilder waren wirkungslos und teils mit
Inline-Styles notdürftig kompensiert.
* `grid-card-preview` fehlte, wodurch alle Layout-Vorschauen auf Höhe
null kollabierten. Nur "Showcase" war sichtbar — und das aus Versehen,
weil sein Tile `hero-tile` hieß und damit die `aspect-ratio` einer
fremden PageBuilder-Klasse erbte. Umbenannt.
Dazu die Theme-Vorschauen, die praktisch identisch aussahen: alle
sieben zeigten dieselben drei quadratischen Kacheln, einziger
Unterschied war die Hintergrundfarbe. Sie spiegeln jetzt die echten
Preset-Daten aus lib/config/theme.ts — Schriftcharakter, Eckradius,
Rasterdichte, Passepartout bzw. Schatten.
Die Kopfzeile richtet sich an einer gemeinsamen Steuerhöhe aus. Der
"Site"-Link war höher als die Buttons daneben: `.admin-btn` hatte keine
explizite line-height, und <button> bekommt box-sizing: border-box vom
Browser, <a> nicht. Die Statusanzeige setzte weder Schriftfamilie noch
-größe und fiel auf den Browser-Default zurück — sie war nie Teil des
Designsystems. Jetzt gleiche Höhe und Typografie, Pillenform als
Zustandsanzeige, Trenner zur Aktionsgruppe. Das dauerhafte Pulsieren
des grünen Punkts entfällt; Animation bleibt den Zuständen vorbehalten,
die Aufmerksamkeit brauchen.
Restliche Emojis durch SVG-Icons ersetzt.
* feat(admin): add scroll-to-top toggle and SVG arrow
The back-to-top button was always on and drew its arrow with the ↑ text
character. Add a `scrollToTop` setting (General section in the admin
panel, defaults to on so existing sites are unaffected) and replace the
glyph with a stroked SVG that inherits currentColor across all presets.
Scroll handling is now rAF-throttled, and prefers-reduced-motion turns
off both the hover lift and the smooth scroll.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
* security(journal): escape author HTML instead of filtering it
CodeQL flags 26 high-severity alerts on the release PR; the bulk of them
point at sanitizeHtml(), a denylist of three regexes whose output goes
into dangerouslySetInnerHTML. I reproduced the bypasses before changing
anything — all four pass the old filter:
<img src=x onerror=alert(1)> unquoted handler, regex wants quotes
<img src=x onerror='alert(1)'> single quotes, same reason
<svg onload=alert(1)> not a <script> tag
javasjavascript:cript:alert(1) one-pass replace, the rest recombines
Plus an attribute breakout in the link renderer, which interpolated the
URL into href="${url}" unescaped:
[x](" onmouseover=alert(1) x=") -> <a href="" onmouseover=alert(1" ...>
Replaced with escaping. Every `&<>"'` in author text becomes an entity
before any markdown rule runs, so the only tags in the output are the
ones renderInlineMarkdown builds itself and a URL cannot leave its
attribute. Link schemes are now an allowlist (http, https, mailto, tel,
relative, anchor); anything else renders as plain text.
The serializer needed decodeHtmlEntities to match: without it a save
would write `<` into the Markdown file and the next parse would
escape the `&` again, corrupting the text further on every round trip.
A test covers parse -> serialize -> parse stability.
Two existing tests asserted the old behaviour and were rewritten rather
than deleted: one expected the script tag to be *removed* from the
output, the other expected the substring "onerror" to be absent. Both
now assert the property that matters — that no tag can form — because
`onerror` surviving as inert text is fine.
Exploitation required admin access either way: journal and essay text
comes from the studio or from content/*.md. This removes the weakness,
it does not close an open door.
* fix(journal): contain file paths, fix frontmatter escaping, defuse two regexes
Follow-up to the CodeQL findings on release PR #432. I went through all 23
alerts individually; this addresses the ones that are worth addressing and
documents the ones that are not.
Path containment (12 alerts, all false positives). Every path built from a
slug goes through isValidSlug(), a strict `/^[a-zA-Z0-9_-]+$/` allowlist —
verified against `../../etc/passwd`, `foo/../../bar`, `a/b`, `..` and
friends, all rejected. CodeQL cannot see it because the check lives in
another module. Added a containedPath() helper that resolves the path and
refuses anything landing outside the content directory: a second lock on a
door that was already locked, and a barrier the analysis can follow. Also
removed the dead `slug.endsWith('.md')` branches — isValidSlug rejects
dots, so they could never be taken.
Frontmatter escaping (1 alert, a real bug). The serializer escaped `"` but
not `\`, and the parser never unescaped anything. A title containing either
character gained a backslash on every save/load cycle:
Path C:\Users "quoted" -> Path C:\\Users \"quoted\" -> ...
Escaping now covers the backslash first and the parser undoes both. A round
trip test covers quotes, backslashes, colons and apostrophes.
Two of three ReDoS regexes (2 alerts). The heading pattern had `\s+` next to
`(.+)`, which overlap, so the engine tried every split of the whitespace run
before failing; it is `[ \t]+` and `(\S.*)` now. The quote author pattern
wrapped a lazy group around an optional group — the quadratic case — and is
an index split on the first separator now.
The third regex, the bold/italic pass, is deliberately left alone. Rewriting
it with a negated class removes the backtracking but breaks nesting:
`**bold *and italic* here**` renders as `*<em>bold </em>and italic<em> here</em>*`.
The input is Markdown from an authenticated admin, never a visitor, so the
worst case is an author slowing down their own page. The comment in the code
says so.
Not addressed: 5 js/insufficient-password-hash alerts. They ask for a slow
KDF where the code uses SHA-256/HMAC — correct in general, but the admin
password comes from an environment variable and is never stored, so a
stronger KDF protects nothing that is not already in plaintext in the
environment.
399 unit tests pass (18 new), build and tsc clean.
* fix(journal): split the quote author by scanning, not by pattern
Cleaning up after myself. #439 replaced the quote author regex
`/^(.*?)(?:\s+--\s+(.+))?$/` — a lazy group around an optional one, the
quadratic case — with `/\s+--\s+/`, and CodeQL promptly flagged the
replacement for the same reason. One reported pattern traded for another.
splitQuoteAuthor() scans for the first `--` that has whitespace on both
sides. Linear, and it needs no reasoning about the regex engine at all.
Behaviour is identical to the original regex, checked case by case
against it: separator, no separator, several separators, tabs, wide gaps,
`a--b` without spaces, leading and trailing separators, empty string. All
nine are covered by tests, plus one asserting it stays fast on a 50k
whitespace run.
* security(admin): derive the session signing key with scrypt
getSigningKey() ran the admin password through a single SHA-256 digest.
It is key derivation rather than password storage, so it was never a
stored-hash problem — but if the derived key ever leaked, one fast hash
makes recovering the password by brute force cheap. CodeQL flags it as
js/insufficient-password-hash and, for this particular alert, has a
point.
scrypt now. Two details that matter:
The salt has to be stable. A random salt would produce a different key on
every call and invalidate every session; it is derived from AUTH_SECRET,
which is deployment-specific. Verified across separate processes: same
inputs produce a verifying token, so a restart or redeploy does not log
everyone out.
The result is cached for the process lifetime. scrypt is deliberately
slow and getSigningKey() runs on every admin request — deriving per call
would add ~24ms to each one. The cache key is a digest of secret plus
password, so a rotation misses the cache and derives again, and no extra
plaintext copy of the password is kept around.
Measured: first derivation 24ms, subsequent calls 0.12ms. Password
change and secret change both invalidate an existing token, checked in
separate processes.
Note the one-time effect: existing admin sessions are invalidated by the
change in derivation, so everyone logs in once more.
* security(admin): key the signing-key cache on its inputs, not a digest
#441 removed the SHA-256 digest of the admin password from the key
derivation and introduced a new one three lines above it, as the cache
key. Same rule, same file: CodeQL reported it immediately.
The comment justifying it was wrong too. It claimed no second plaintext
copy of the password was retained, while building the digest input
allocates exactly that in order to hash it.
The cache now holds the two input strings and compares them directly.
They are the same objects the env and install caches already hold, so
nothing extra is retained, and no fast hash of the password exists in
memory for the life of the process.
Re-verified after the change, in separate processes: a token from one
process verifies in another with the same inputs, a changed password or
secret rejects it, first derivation 24ms, cached calls 0.001ms.
That leaves scrypt as the only place the password is hashed here. The
two HMACs further down operate on the derived key and on token data, not
on the password; the constant-time comparison in verifyAdminPassword is
the previously dismissed one.
---------
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
2026-08-14 16:55:07 +02:00
|
|
|
|
IconSortAlpha,
|
2026-08-14 11:10:42 +02:00
|
|
|
|
IconTrash,
|
|
|
|
|
|
IconX,
|
|
|
|
|
|
} from './Icons';
|
release: v0.11.0 — journal fixes, admin URLs, design system cleanup (#432)
* fix(screenshots): sharp-Typen fuer 0.34 und 0.35 gleichzeitig (#410)
sharp 0.35 ist von `export =` auf ESM umgestellt: der Modul-Namespace
ist nicht mehr aufrufbar, die Factory sitzt unter .default. Der
Type-Check brach damit in scripts/screenshots.ts weg, sobald der
Next-Bump (#402) sharp von 0.34.5 auf 0.35.3 mitzieht -- sharp ist hier
keine deklarierte Dependency, sondern kommt ueber Next mit.
Die Form wird jetzt aus dem installierten Paket abgeleitet statt
festgeschrieben, zur Laufzeit wie im Typ. Geprueft mit beiden
Versionen: tsc laeuft mit 0.34.5 und mit 0.35.3 fehlerfrei durch.
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
* chore(deps): bump the nextjs group across 1 directory with 2 updates (#402)
Bumps the nextjs group with 2 updates in the / directory: [next](https://github.com/vercel/next.js) and [eslint-config-next](https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next).
Updates `next` from 16.2.12 to 16.3.0
- [Release notes](https://github.com/vercel/next.js/releases)
- [Commits](https://github.com/vercel/next.js/compare/v16.2.12...v16.3.0)
Updates `eslint-config-next` from 16.2.12 to 16.3.0
- [Release notes](https://github.com/vercel/next.js/releases)
- [Commits](https://github.com/vercel/next.js/commits/v16.3.0/packages/eslint-config-next)
---
updated-dependencies:
- dependency-name: eslint-config-next
dependency-version: 16.3.0
dependency-type: direct:development
update-type: version-update:semver-minor
dependency-group: nextjs
- dependency-name: next
dependency-version: 16.3.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: nextjs
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* chore(deps-dev): bump prettier from 3.8.3 to 3.9.6 (#405)
Bumps [prettier](https://github.com/prettier/prettier) from 3.8.3 to 3.9.6.
- [Release notes](https://github.com/prettier/prettier/releases)
- [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md)
- [Commits](https://github.com/prettier/prettier/compare/3.8.3...3.9.6)
---
updated-dependencies:
- dependency-name: prettier
dependency-version: 3.9.6
dependency-type: direct:development
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* docs(changelog): Unreleased-Sektion fuer die Bumps nach v0.10.0 (#413)
Die Dependency-PRs sind nach dem Release auf dev gelandet, teils auch
auf main. Ohne Eintrag waeren sie beim naechsten Release unsichtbar --
inklusive Next 16.3.0, das CVE-2025-13465 mitbringt.
Ausserdem im 0.10.0-Abschnitt nachgetragen, dass der Trivy-Scan bis
#409 nie gelaufen ist. Der Fix steckt im Tag v0.10.0, fehlte aber in der
Aufzaehlung -- und "Images werden bei jedem Publish gescannt" stand im
Changelog, waehrend der Job im Action-Setup abbrach.
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
* feat(gallery): per-album sort order, independent of Immich (#408) (#414)
Album order was dictated entirely by Immich: getAlbum() sorted by the
album's own asc/desc flag, so a Folio album always mirrored the archive.
A curated series has a narrative order that has nothing to do with
capture time, and changing the Immich album's sort to fit the website
changes it for the archive too.
Adds an optional per-album `sort` in gallery.yaml, editable in /admin,
defaulting to today's behaviour so every existing config is unchanged:
immich (default) | newest | oldest | filename | manual
`manual` is a pinned *prefix*: `assetOrder` lists only the photos placed
by hand, everything else follows in the album's Immich order. A full
permutation of a 2,000-photo album would be ~80 KB of UUIDs in a file
that is rewritten and copied to content/.backups/ on every admin save.
It also makes drift fall out for free — photos removed in Immich never
match, new ones land in the tail rather than being hidden.
Sorting is applied after the cache read, not before the cache write, so
the LRU keeps one canonical Immich-ordered copy per album. That avoids
putting the mode in the cache key, lets a config change take effect
without depending on invalidation, and keeps the stale-serving path
correct. cache.get() returns the stored object by reference, so
withSort() returns a shallow clone with a new array — sorting in place
would reorder the shared entry, and under request coalescing every
concurrent caller would be sorting the same array.
Also fixes a prerequisite bug: /api/admin/albums/[albumId]/assets read
album.assets from GET /albums/:id, which Immich 3.x no longer populates
(lib/immich.ts:507). The hero picker's "This Album" tab returned nothing
and threw outright when the key was absent. It now goes through the
client's paginated metadata search, with ?types=all to opt videos in for
the reorder editor.
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
* refactor(admin): drop decorative emoji from the sort select labels (#415)
An <option> cannot contain markup, so the SVG set in Icons is not
reachable there — but a decorative emoji is not a substitute for it.
Plain text instead; the album card badge already uses a real icon.
The remaining emoji in the admin panel (asset picker tabs, section
headings, layout picker options) predate this branch and are left for a
separate cleanup.
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
* refactor(admin): replace emoji icons with the shared SVG icon set (#416)
The admin panel mixed two icon conventions: inline SVGs from
`Icons.tsx` in most components, and decorative emoji in the asset
picker and a few PageBuilder labels. Emoji render inconsistently
across platforms, ignore the accent colour, and cannot inherit the
`.svg-icon` sizing rules.
- Icons.tsx: add `IconStar` (filled — it marks a state, not an
action) and `IconImage`.
- AssetPicker: the three tab labels and the favourite tile badge now
use IconFolder / IconStar / IconImage.
- PageBuilder: the "Standalone Albums" and "Subpages" headings use
the icon set instead of an emoji.
- PageBuilder: the layout picker drops its emoji for plain text. An
<option> cannot contain markup, so an SVG is impossible there and a
decorative glyph is not a substitute.
- admin.css: align icon and label in the picker tabs, and swap the
favourite badge's text-shadow for drop-shadow, which is what
applies to an inline SVG.
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
* refactor(admin): fold PageBuilder's local icons into the shared Icons module (#418)
* refactor(admin): fold PageBuilder's local icons into the shared module
PageBuilder.tsx carried its own `Icons` object duplicating most of the
glyphs already exported by Icons.tsx, with hardcoded sizes and slightly
divergent paths. Migrate all 32 call sites to the shared module and
delete the local object.
Five glyphs had no counterpart and are added to Icons.tsx as 1:1 ports
of the local paths: IconX, IconPlus, IconHome, IconCopy, IconImage.
The local ExternalLink and Check are dropped rather than ported — both
had zero call sites.
Two glyphs change shape slightly, which is the point of consolidating:
the shared IconCamera includes the viewfinder bump the local copy
omitted, and drag handles now use IconGripVertical.
IconGripVertical uses the module's square 24x24 viewBox, so `.svg-drag`
goes from 12x18 to 18x18 — the old non-square box would letterbox the
glyph down to 12x12 and shrink the handle.
* fix(admin): resolve icon-module integration after #416
Merging dev brought in #416, which added a second IconImage to Icons.tsx
and two <Icons.Camera>/<Icons.Folder> section headers that reference the
local Icons object this PR removes. Git merged both cleanly but the result
did not type-check.
- drop the duplicate IconImage (both copies were byte-identical)
- point the two section headers at the imported IconCamera/IconFolder
- refresh the SORT_LABELS comment: the icon set is imported now, not
declared below
---------
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
* fix(config): allow an empty gallery, guard against a double /api suffix (#421)
An empty gallery is now a valid, rendered state instead of a throw: deriveGallery() no longer requires at least one album or subpage, so a deployment with no albums yet renders a bare homepage the owner can fill in via /admin.
getConfig() also stops appending /api to an Immich URL that already ends in it, which previously produced .../api/api and broke every upstream request.
Includes a restore of the per-album sort test cases, which the branch had lost by being cut before #408/#414.
* feat(admin): favicon upload, served from the content volume (#422)
Adds a bundled default favicon, an upload widget in admin Settings > General, and a route that serves the icon from the writable content/ volume with a fallback to the bundled default. Raster uploads (PNG/ICO/JPEG) are wrapped in an SVG container; the response carries its own CSP so an uploaded SVG cannot execute script on the origin.
The GET route revalidates with an ETag instead of caching immutably, so a newly uploaded icon shows up immediately. Uploads are written via temp file + rename, and a Reset button restores the bundled default.
* ci: flag unformatted files in a PR, without blocking it (#424)
Prettier is configured as an error rule in eslint.config.mjs but has never run in CI, so part of the tree predates it. A final CI step now diffs against the PR base, runs prettier --list-different over the changed files, and emits a warning annotation per offender plus a job summary.
Advisory by design: it never fails the job. Blocking would turn a PR red for merely touching a file that was already unformatted, and normalising the tree in one commit would wreck git blame and conflict with the PRs in flight.
Requires fetch-depth: 0, since diffing against the base needs its history.
* feat(install): first-run wizard gated by a one-time setup token (#419)
Adds /install, a four-step first-run wizard: connect to Immich, optionally pick albums, name the site, finish. It verifies the credentials against the Immich server before writing anything, then writes gallery.yaml, settings.yaml and a content/install.json carrying the Immich credentials and a generated site secret.
install.json exists because a running process cannot pick up new env vars — the wizard has to write configuration that takes effect without a restart. getInstallCredentials() merges it under the real environment, so env vars always win and rotation stays a matter of setting one.
Both the page and the API routes are gated by a one-time setup token printed to the server log, so a deployment that is reachable before gallery.yaml exists cannot be configured by whoever finds it first. The token is stored in content/.setup-token (0600) rather than a module variable: Next.js bundles the page and each route handler separately, so a module-level token left the page and the API disagreeing inside one process and the wizard stuck on step 1. It is removed once the install completes.
The admin password is stored as an scrypt hash using the scheme lib/auth.ts already applies to album passwords; a plaintext ADMIN_PASSWORD env var keeps working.
* docs: document the setup wizard, fix the read-only content mount (#425)
Quick Start now leads with the /install wizard, with the hand-written YAML route kept alongside it, and a First-Run Setup section covers the setup token, the files the wizard writes, and env-var precedence.
Two corrections: both Docker examples mounted content/ as :ro, which silently breaks the wizard, the admin panel and the backup rotation alike — docs/admin-panel.md already said so and the README contradicted it. And nothing documented that content/install.json holds the Immich API key, so a backup of content/ is a backup of credentials.
Also adds a Contributors section crediting the people whose work is in the project.
* feat(admin): floating save bar pinned to the bottom of the viewport (#426)
The save bar was the first, static element inside .admin-main. Since the
document itself scrolls, it left the viewport as soon as you scrolled down
— editing a subpage section or a settings block far below gave no visible
dirty hint and no reachable save button.
Replace it with a bottom-pinned floating bar shared by both editors. It
only mounts while there is something to act on (unsaved changes, an
in-flight save, or a result message), so it never covers content while
idle. The success message clears after 5s, which hides the bar again.
- new SaveBar component, replacing the duplicated markup in PageBuilder
and SettingsEditor
- adopt the previously unused .floating-save-bar CSS: slide-in keyframes
(carrying translateX(-50%)), dirty border, wrap/gap, mobile variant and
a prefers-reduced-motion opt-out; z-index 900 keeps it below modals
- .admin-main gains bottom padding so the bar never covers page content
- drop the now-unreachable idle hints: the ⌘S hint becomes a button title,
the Live Sync note becomes a static line above the settings layout
- header "Site" link now bypasses the cache (/?fresh=1), so the preview
stays reachable when the bar is hidden
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
* feat(admin): themed listbox for the album sort control (#427)
The per-album "Photo order" control was a native <select>. Because an
<option> cannot contain markup, its choices could not use the admin
panel's currentColor SVG set — the reason #415 had to fall back to plain
text after dropping the emoji labels.
Adds a Listbox component implementing the ARIA combobox/listbox pattern,
so options can render a glyph beside their label:
- DOM focus stays on the trigger button; the active option is announced
through aria-activedescendant, keeping focus management to one element
- Keyboard: arrows (clamped at the ends, like a native select),
Home/End, Enter/Space to commit, Escape to cancel, Tab commits and
moves on, and prefix type-ahead with a repeat-key cycle
- Outside dismissal on pointerdown, so a press starting outside closes
the popup before the click retargets
The sort options now carry an icon each: calendar, arrow-down, arrow-up,
an A→Z marker, and the drag glyph for manual — matching the badge the
album card already shows. SORT_LABELS stays plain text because the badge
feeds it to a title attribute.
Closes #417
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
* chore(git): ignore generated design handoff folders
* fix(admin): stop the album sort dropdown clipping, and simplify the panel (#428)
* fix(admin): render listbox popup in a portal so it escapes modal clipping
The sort control's popup was position:absolute inside three clipping ancestors
(.album-drawer overflow:hidden > .album-drawer-body overflow-y:auto >
.modal-right-column overflow-y:auto), so it was cut off at the bottom of the
Edit Album Details modal. z-index could not help: clipping happens before
stacking. It also always hung below the trigger, with no flip.
Portal the popup to document.body and position it from the trigger's viewport
rect, flipping above when there is more room there and capping max-height to the
space available so it scrolls internally rather than overflowing. It is
dismissed on scroll and resize, since the anchor is only measured on open.
The outside-pointerdown handler now also treats the popup as inside; without
that the portalled list counts as outside, and a click on an option would close
it before the selection commits.
* refactor(admin): single-column album details panel
The left column spent 1.2fr on a cover thumbnail and three stat rows, two of
which (Status, Custom Hero) only restated the form fields opposite them, while
the form itself was squeezed into 1.8fr behind a second nested scroller.
Stack the drawer in one column instead: cover as a banner, then the form at full
width, with the UUID moved into the footer. The body is now the only scroll
container, which also removes one of the ancestors that was clipping the sort
popup.
---------
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
* fix(admin): give the portalled listbox its theme back, lock the page behind modals (#429)
Two defects in the album editor.
The sort listbox popup painted transparent. Every --admin-* variable is
scoped to .admin-layout, and since the popup moved into document.body it
sits outside that subtree, so background/border/text all resolved to
nothing. It now carries its own copy of the palette in both colour
schemes, plus the font it no longer inherits.
Scrolling inside a modal also moved the page behind it. No admin modal
ever locked body scroll: the overlay covers the page but does not absorb
wheel events, so a scroll starting on the backdrop — or continuing past
the end of the modal's own scroller — reaches the document.
overscroll-behavior cannot cover that case on its own, because it only
applies to scroll containers and the backdrop is not one.
useScrollLock freezes body while a modal is open and compensates for the
width the scrollbar gives up, so nothing shifts underneath. Each lock
restores the inline value it found, which makes nesting work without a
counter — a picker opened from the drawer restores the drawer's hidden
state instead of clearing it. Applied to both drawers and all four
picker modals, which share the defect. overscroll-behavior: contain on
the scrollers stops the chaining they can handle themselves.
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
* fix(security): allow unsafe-eval in CSP script-src during dev mode
* feat(journal): add Journal Studio with split-screen editor, live preview and dedicated routes
* fix(build): separate client parser from server journal-service and fix build type errors
* fix(journal): Fotos rendern, Layout und Lightbox-Steuerung korrigieren
Fünf unabhängige Fehler in der öffentlichen Journal- und Essay-Ansicht:
* Foto-Blöcke wurden nie angezeigt. EssayView löst ein Foto über
PhotoItem.id auf, und das sind verschlüsselte Tokens — die Blöcke aus
dem Markdown tragen aber rohe Asset-UUIDs. Jede Zuordnung lief ins
Leere, und nicht auflösbare Blöcke werden still verworfen. Die IDs
werden jetzt serverseitig übersetzt; damit verschwinden nebenbei die
rohen UUIDs aus dem Client-Payload, die dort laut Projektregel nie
auftauchen dürfen. Nicht auflösbare Referenzen werden geloggt.
* Überschriften standen weiter links als der Fließtext. Jeder Block
hatte einzeln `max-width: 68ch`, und `ch` ist relativ zur Schrift des
Elements — die Serif-Überschrift ergab eine breitere Spalte. Ersetzt
durch eine gemeinsame, font-unabhängige `--essay-measure`.
* Fullbleed-Fotos bluteten nur nach links aus: `.essay-figure` ist
`width: 100%`, wodurch die Box überbestimmt ist und der negative
rechte Margin verworfen wird.
* Foto-Paare stellten beide Bilder gleich breit dar, wodurch ein
Hochformat neben einem Querformat doppelt so hoch wurde. Jetzt eine
Justified-Reihe: Breite proportional zum Seitenverhältnis, dadurch
exakt gleiche Höhen ohne Beschnitt.
* Die Lightbox hatte im Journal keine Tastatursteuerung und keine
Scroll-Sperre — beides lag in PhotoGrid, also nur im Album-Raster.
Verlagert in die Lightbox selbst, der doppelte Handler in PhotoGrid
entfernt (sonst wäre pro Pfeildruck zwei Bilder weitergesprungen).
Zusätzlich sind Proofing-Herzen und das EXIF-Panel im redaktionellen
Modus abschaltbar und im Journal aus: Client-Proofing ist ein
Übergabe-Workflow für Alben, keine Funktion einer Reportage. Auf der
Übersicht wurde der Untertitel doppelt gerendert, weil extractExcerpt()
auf ihn zurückfällt.
* feat(admin): eigene URLs für alle Bereiche und überarbeiteter Journal Studio
Das Panel war eine einzige Client-Komponente, die ihre Tabs über
useState umschaltet: keine Route pro Bereich, kein Deep-Link, kein
Zurück-Button, und nach jedem Reload landete man wieder auf "Pages".
Auch der Journal-Editor hatte keine eigene URL.
Jetzt sieben echte Routen (/admin, /admin/pages, /admin/journal,
/admin/journal/<slug>, /admin/settings, /admin/settings/<section>,
/admin/analytics). Die Shell mit Auth-Prüfung und Kopfzeile sitzt im
Layout und umschließt children — so bleibt die Session-Prüfung über
Routenwechsel montiert, statt bei jedem Tab-Wechsel neu zu laufen und
den Spinner aufblitzen zu lassen. Unbekannte Settings-Sections fallen
auf General zurück.
Im selben Zug der Journal Studio, der die Routing-Änderung ohnehin
berührt:
* Alle Eingabefelder nutzten die Klasse `admin-input`, die in keinem
CSS definiert war — sie fielen auf Browser-Defaults zurück. Jetzt
gestylt, gescoped, damit der generische Name nicht ins übrige Panel
leckt.
* Der Split View ist per Divider verschiebbar (Maus, Tastatur,
Doppelklick zum Zurücksetzen), Breite in localStorage.
* Das Studio bricht aus der 1120px-Spalte aus, die Preview hat Platz.
* Die Preview zeigte für jedes Foto fest 3:2 und log damit über das
Layout der veröffentlichten Seite; die echten Verhältnisse werden
jetzt an den Thumbnails gemessen.
* Blöcke mit alten positionsbasierten Foto-Referenzen werden markiert —
die lassen sich auf einer eigenständigen Journal-Seite nicht auflösen
und verschwanden bisher stillschweigend.
* Blocktyp-Chips als gemeinsame Komponente, monochrom und per Icon
unterschieden statt in einer eigenen Blau/Lila/Orange-Palette, die
sonst nirgends im Panel vorkommt.
* Emojis raus, SVG-Icons rein.
* fix(admin): Designsystem-Lücken im Panel schließen
Eine systematische Suche nach Klassen, die im TSX benutzt, aber in
keinem CSS definiert sind, hat vier Stellen mit demselben Muster
gefunden:
* `admin-btn-secondary` und `admin-btn-danger` existierten nicht.
Sämtliche Löschen-Buttons sahen aus wie normale Buttons — keine
Warnwirkung. Als `.admin-btn.admin-btn-danger` geschrieben, weil die
Varianten mit den Größenklassen kombiniert werden, die weiter unten
ihren eigenen Hintergrund setzen.
* `page-progress-fill` fehlte: die Balken im Analytics-Panel waren
leere Rinnen, der Wert unsichtbar. Ebenso `analytics-empty` und
`admin-loading-container`.
* `subpage-drawer-section`, `subpage-drawer-title-group` und
`input-with-icon` im PageBuilder waren wirkungslos und teils mit
Inline-Styles notdürftig kompensiert.
* `grid-card-preview` fehlte, wodurch alle Layout-Vorschauen auf Höhe
null kollabierten. Nur "Showcase" war sichtbar — und das aus Versehen,
weil sein Tile `hero-tile` hieß und damit die `aspect-ratio` einer
fremden PageBuilder-Klasse erbte. Umbenannt.
Dazu die Theme-Vorschauen, die praktisch identisch aussahen: alle
sieben zeigten dieselben drei quadratischen Kacheln, einziger
Unterschied war die Hintergrundfarbe. Sie spiegeln jetzt die echten
Preset-Daten aus lib/config/theme.ts — Schriftcharakter, Eckradius,
Rasterdichte, Passepartout bzw. Schatten.
Die Kopfzeile richtet sich an einer gemeinsamen Steuerhöhe aus. Der
"Site"-Link war höher als die Buttons daneben: `.admin-btn` hatte keine
explizite line-height, und <button> bekommt box-sizing: border-box vom
Browser, <a> nicht. Die Statusanzeige setzte weder Schriftfamilie noch
-größe und fiel auf den Browser-Default zurück — sie war nie Teil des
Designsystems. Jetzt gleiche Höhe und Typografie, Pillenform als
Zustandsanzeige, Trenner zur Aktionsgruppe. Das dauerhafte Pulsieren
des grünen Punkts entfällt; Animation bleibt den Zuständen vorbehalten,
die Aufmerksamkeit brauchen.
Restliche Emojis durch SVG-Icons ersetzt.
* feat(admin): add scroll-to-top toggle and SVG arrow
The back-to-top button was always on and drew its arrow with the ↑ text
character. Add a `scrollToTop` setting (General section in the admin
panel, defaults to on so existing sites are unaffected) and replace the
glyph with a stroked SVG that inherits currentColor across all presets.
Scroll handling is now rAF-throttled, and prefers-reduced-motion turns
off both the hover lift and the smooth scroll.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
* security(journal): escape author HTML instead of filtering it
CodeQL flags 26 high-severity alerts on the release PR; the bulk of them
point at sanitizeHtml(), a denylist of three regexes whose output goes
into dangerouslySetInnerHTML. I reproduced the bypasses before changing
anything — all four pass the old filter:
<img src=x onerror=alert(1)> unquoted handler, regex wants quotes
<img src=x onerror='alert(1)'> single quotes, same reason
<svg onload=alert(1)> not a <script> tag
javasjavascript:cript:alert(1) one-pass replace, the rest recombines
Plus an attribute breakout in the link renderer, which interpolated the
URL into href="${url}" unescaped:
[x](" onmouseover=alert(1) x=") -> <a href="" onmouseover=alert(1" ...>
Replaced with escaping. Every `&<>"'` in author text becomes an entity
before any markdown rule runs, so the only tags in the output are the
ones renderInlineMarkdown builds itself and a URL cannot leave its
attribute. Link schemes are now an allowlist (http, https, mailto, tel,
relative, anchor); anything else renders as plain text.
The serializer needed decodeHtmlEntities to match: without it a save
would write `<` into the Markdown file and the next parse would
escape the `&` again, corrupting the text further on every round trip.
A test covers parse -> serialize -> parse stability.
Two existing tests asserted the old behaviour and were rewritten rather
than deleted: one expected the script tag to be *removed* from the
output, the other expected the substring "onerror" to be absent. Both
now assert the property that matters — that no tag can form — because
`onerror` surviving as inert text is fine.
Exploitation required admin access either way: journal and essay text
comes from the studio or from content/*.md. This removes the weakness,
it does not close an open door.
* fix(journal): contain file paths, fix frontmatter escaping, defuse two regexes
Follow-up to the CodeQL findings on release PR #432. I went through all 23
alerts individually; this addresses the ones that are worth addressing and
documents the ones that are not.
Path containment (12 alerts, all false positives). Every path built from a
slug goes through isValidSlug(), a strict `/^[a-zA-Z0-9_-]+$/` allowlist —
verified against `../../etc/passwd`, `foo/../../bar`, `a/b`, `..` and
friends, all rejected. CodeQL cannot see it because the check lives in
another module. Added a containedPath() helper that resolves the path and
refuses anything landing outside the content directory: a second lock on a
door that was already locked, and a barrier the analysis can follow. Also
removed the dead `slug.endsWith('.md')` branches — isValidSlug rejects
dots, so they could never be taken.
Frontmatter escaping (1 alert, a real bug). The serializer escaped `"` but
not `\`, and the parser never unescaped anything. A title containing either
character gained a backslash on every save/load cycle:
Path C:\Users "quoted" -> Path C:\\Users \"quoted\" -> ...
Escaping now covers the backslash first and the parser undoes both. A round
trip test covers quotes, backslashes, colons and apostrophes.
Two of three ReDoS regexes (2 alerts). The heading pattern had `\s+` next to
`(.+)`, which overlap, so the engine tried every split of the whitespace run
before failing; it is `[ \t]+` and `(\S.*)` now. The quote author pattern
wrapped a lazy group around an optional group — the quadratic case — and is
an index split on the first separator now.
The third regex, the bold/italic pass, is deliberately left alone. Rewriting
it with a negated class removes the backtracking but breaks nesting:
`**bold *and italic* here**` renders as `*<em>bold </em>and italic<em> here</em>*`.
The input is Markdown from an authenticated admin, never a visitor, so the
worst case is an author slowing down their own page. The comment in the code
says so.
Not addressed: 5 js/insufficient-password-hash alerts. They ask for a slow
KDF where the code uses SHA-256/HMAC — correct in general, but the admin
password comes from an environment variable and is never stored, so a
stronger KDF protects nothing that is not already in plaintext in the
environment.
399 unit tests pass (18 new), build and tsc clean.
* fix(journal): split the quote author by scanning, not by pattern
Cleaning up after myself. #439 replaced the quote author regex
`/^(.*?)(?:\s+--\s+(.+))?$/` — a lazy group around an optional one, the
quadratic case — with `/\s+--\s+/`, and CodeQL promptly flagged the
replacement for the same reason. One reported pattern traded for another.
splitQuoteAuthor() scans for the first `--` that has whitespace on both
sides. Linear, and it needs no reasoning about the regex engine at all.
Behaviour is identical to the original regex, checked case by case
against it: separator, no separator, several separators, tabs, wide gaps,
`a--b` without spaces, leading and trailing separators, empty string. All
nine are covered by tests, plus one asserting it stays fast on a 50k
whitespace run.
* security(admin): derive the session signing key with scrypt
getSigningKey() ran the admin password through a single SHA-256 digest.
It is key derivation rather than password storage, so it was never a
stored-hash problem — but if the derived key ever leaked, one fast hash
makes recovering the password by brute force cheap. CodeQL flags it as
js/insufficient-password-hash and, for this particular alert, has a
point.
scrypt now. Two details that matter:
The salt has to be stable. A random salt would produce a different key on
every call and invalidate every session; it is derived from AUTH_SECRET,
which is deployment-specific. Verified across separate processes: same
inputs produce a verifying token, so a restart or redeploy does not log
everyone out.
The result is cached for the process lifetime. scrypt is deliberately
slow and getSigningKey() runs on every admin request — deriving per call
would add ~24ms to each one. The cache key is a digest of secret plus
password, so a rotation misses the cache and derives again, and no extra
plaintext copy of the password is kept around.
Measured: first derivation 24ms, subsequent calls 0.12ms. Password
change and secret change both invalidate an existing token, checked in
separate processes.
Note the one-time effect: existing admin sessions are invalidated by the
change in derivation, so everyone logs in once more.
* security(admin): key the signing-key cache on its inputs, not a digest
#441 removed the SHA-256 digest of the admin password from the key
derivation and introduced a new one three lines above it, as the cache
key. Same rule, same file: CodeQL reported it immediately.
The comment justifying it was wrong too. It claimed no second plaintext
copy of the password was retained, while building the digest input
allocates exactly that in order to hash it.
The cache now holds the two input strings and compares them directly.
They are the same objects the env and install caches already hold, so
nothing extra is retained, and no fast hash of the password exists in
memory for the life of the process.
Re-verified after the change, in separate processes: a token from one
process verifies in another with the same inputs, a changed password or
secret rejects it, first derivation 24ms, cached calls 0.001ms.
That leaves scrypt as the only place the password is hashed here. The
two HMACs further down operate on the derived key and on token data, not
on the password; the constant-time comparison in verifyAdminPassword is
the previously dismissed one.
---------
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
2026-08-14 16:55:07 +02:00
|
|
|
|
import { Listbox, type ListboxOption } from './Listbox';
|
2026-08-14 11:10:42 +02:00
|
|
|
|
|
|
|
|
|
|
/**
|
release: v0.11.0 — journal fixes, admin URLs, design system cleanup (#432)
* fix(screenshots): sharp-Typen fuer 0.34 und 0.35 gleichzeitig (#410)
sharp 0.35 ist von `export =` auf ESM umgestellt: der Modul-Namespace
ist nicht mehr aufrufbar, die Factory sitzt unter .default. Der
Type-Check brach damit in scripts/screenshots.ts weg, sobald der
Next-Bump (#402) sharp von 0.34.5 auf 0.35.3 mitzieht -- sharp ist hier
keine deklarierte Dependency, sondern kommt ueber Next mit.
Die Form wird jetzt aus dem installierten Paket abgeleitet statt
festgeschrieben, zur Laufzeit wie im Typ. Geprueft mit beiden
Versionen: tsc laeuft mit 0.34.5 und mit 0.35.3 fehlerfrei durch.
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
* chore(deps): bump the nextjs group across 1 directory with 2 updates (#402)
Bumps the nextjs group with 2 updates in the / directory: [next](https://github.com/vercel/next.js) and [eslint-config-next](https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next).
Updates `next` from 16.2.12 to 16.3.0
- [Release notes](https://github.com/vercel/next.js/releases)
- [Commits](https://github.com/vercel/next.js/compare/v16.2.12...v16.3.0)
Updates `eslint-config-next` from 16.2.12 to 16.3.0
- [Release notes](https://github.com/vercel/next.js/releases)
- [Commits](https://github.com/vercel/next.js/commits/v16.3.0/packages/eslint-config-next)
---
updated-dependencies:
- dependency-name: eslint-config-next
dependency-version: 16.3.0
dependency-type: direct:development
update-type: version-update:semver-minor
dependency-group: nextjs
- dependency-name: next
dependency-version: 16.3.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: nextjs
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* chore(deps-dev): bump prettier from 3.8.3 to 3.9.6 (#405)
Bumps [prettier](https://github.com/prettier/prettier) from 3.8.3 to 3.9.6.
- [Release notes](https://github.com/prettier/prettier/releases)
- [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md)
- [Commits](https://github.com/prettier/prettier/compare/3.8.3...3.9.6)
---
updated-dependencies:
- dependency-name: prettier
dependency-version: 3.9.6
dependency-type: direct:development
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* docs(changelog): Unreleased-Sektion fuer die Bumps nach v0.10.0 (#413)
Die Dependency-PRs sind nach dem Release auf dev gelandet, teils auch
auf main. Ohne Eintrag waeren sie beim naechsten Release unsichtbar --
inklusive Next 16.3.0, das CVE-2025-13465 mitbringt.
Ausserdem im 0.10.0-Abschnitt nachgetragen, dass der Trivy-Scan bis
#409 nie gelaufen ist. Der Fix steckt im Tag v0.10.0, fehlte aber in der
Aufzaehlung -- und "Images werden bei jedem Publish gescannt" stand im
Changelog, waehrend der Job im Action-Setup abbrach.
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
* feat(gallery): per-album sort order, independent of Immich (#408) (#414)
Album order was dictated entirely by Immich: getAlbum() sorted by the
album's own asc/desc flag, so a Folio album always mirrored the archive.
A curated series has a narrative order that has nothing to do with
capture time, and changing the Immich album's sort to fit the website
changes it for the archive too.
Adds an optional per-album `sort` in gallery.yaml, editable in /admin,
defaulting to today's behaviour so every existing config is unchanged:
immich (default) | newest | oldest | filename | manual
`manual` is a pinned *prefix*: `assetOrder` lists only the photos placed
by hand, everything else follows in the album's Immich order. A full
permutation of a 2,000-photo album would be ~80 KB of UUIDs in a file
that is rewritten and copied to content/.backups/ on every admin save.
It also makes drift fall out for free — photos removed in Immich never
match, new ones land in the tail rather than being hidden.
Sorting is applied after the cache read, not before the cache write, so
the LRU keeps one canonical Immich-ordered copy per album. That avoids
putting the mode in the cache key, lets a config change take effect
without depending on invalidation, and keeps the stale-serving path
correct. cache.get() returns the stored object by reference, so
withSort() returns a shallow clone with a new array — sorting in place
would reorder the shared entry, and under request coalescing every
concurrent caller would be sorting the same array.
Also fixes a prerequisite bug: /api/admin/albums/[albumId]/assets read
album.assets from GET /albums/:id, which Immich 3.x no longer populates
(lib/immich.ts:507). The hero picker's "This Album" tab returned nothing
and threw outright when the key was absent. It now goes through the
client's paginated metadata search, with ?types=all to opt videos in for
the reorder editor.
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
* refactor(admin): drop decorative emoji from the sort select labels (#415)
An <option> cannot contain markup, so the SVG set in Icons is not
reachable there — but a decorative emoji is not a substitute for it.
Plain text instead; the album card badge already uses a real icon.
The remaining emoji in the admin panel (asset picker tabs, section
headings, layout picker options) predate this branch and are left for a
separate cleanup.
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
* refactor(admin): replace emoji icons with the shared SVG icon set (#416)
The admin panel mixed two icon conventions: inline SVGs from
`Icons.tsx` in most components, and decorative emoji in the asset
picker and a few PageBuilder labels. Emoji render inconsistently
across platforms, ignore the accent colour, and cannot inherit the
`.svg-icon` sizing rules.
- Icons.tsx: add `IconStar` (filled — it marks a state, not an
action) and `IconImage`.
- AssetPicker: the three tab labels and the favourite tile badge now
use IconFolder / IconStar / IconImage.
- PageBuilder: the "Standalone Albums" and "Subpages" headings use
the icon set instead of an emoji.
- PageBuilder: the layout picker drops its emoji for plain text. An
<option> cannot contain markup, so an SVG is impossible there and a
decorative glyph is not a substitute.
- admin.css: align icon and label in the picker tabs, and swap the
favourite badge's text-shadow for drop-shadow, which is what
applies to an inline SVG.
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
* refactor(admin): fold PageBuilder's local icons into the shared Icons module (#418)
* refactor(admin): fold PageBuilder's local icons into the shared module
PageBuilder.tsx carried its own `Icons` object duplicating most of the
glyphs already exported by Icons.tsx, with hardcoded sizes and slightly
divergent paths. Migrate all 32 call sites to the shared module and
delete the local object.
Five glyphs had no counterpart and are added to Icons.tsx as 1:1 ports
of the local paths: IconX, IconPlus, IconHome, IconCopy, IconImage.
The local ExternalLink and Check are dropped rather than ported — both
had zero call sites.
Two glyphs change shape slightly, which is the point of consolidating:
the shared IconCamera includes the viewfinder bump the local copy
omitted, and drag handles now use IconGripVertical.
IconGripVertical uses the module's square 24x24 viewBox, so `.svg-drag`
goes from 12x18 to 18x18 — the old non-square box would letterbox the
glyph down to 12x12 and shrink the handle.
* fix(admin): resolve icon-module integration after #416
Merging dev brought in #416, which added a second IconImage to Icons.tsx
and two <Icons.Camera>/<Icons.Folder> section headers that reference the
local Icons object this PR removes. Git merged both cleanly but the result
did not type-check.
- drop the duplicate IconImage (both copies were byte-identical)
- point the two section headers at the imported IconCamera/IconFolder
- refresh the SORT_LABELS comment: the icon set is imported now, not
declared below
---------
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
* fix(config): allow an empty gallery, guard against a double /api suffix (#421)
An empty gallery is now a valid, rendered state instead of a throw: deriveGallery() no longer requires at least one album or subpage, so a deployment with no albums yet renders a bare homepage the owner can fill in via /admin.
getConfig() also stops appending /api to an Immich URL that already ends in it, which previously produced .../api/api and broke every upstream request.
Includes a restore of the per-album sort test cases, which the branch had lost by being cut before #408/#414.
* feat(admin): favicon upload, served from the content volume (#422)
Adds a bundled default favicon, an upload widget in admin Settings > General, and a route that serves the icon from the writable content/ volume with a fallback to the bundled default. Raster uploads (PNG/ICO/JPEG) are wrapped in an SVG container; the response carries its own CSP so an uploaded SVG cannot execute script on the origin.
The GET route revalidates with an ETag instead of caching immutably, so a newly uploaded icon shows up immediately. Uploads are written via temp file + rename, and a Reset button restores the bundled default.
* ci: flag unformatted files in a PR, without blocking it (#424)
Prettier is configured as an error rule in eslint.config.mjs but has never run in CI, so part of the tree predates it. A final CI step now diffs against the PR base, runs prettier --list-different over the changed files, and emits a warning annotation per offender plus a job summary.
Advisory by design: it never fails the job. Blocking would turn a PR red for merely touching a file that was already unformatted, and normalising the tree in one commit would wreck git blame and conflict with the PRs in flight.
Requires fetch-depth: 0, since diffing against the base needs its history.
* feat(install): first-run wizard gated by a one-time setup token (#419)
Adds /install, a four-step first-run wizard: connect to Immich, optionally pick albums, name the site, finish. It verifies the credentials against the Immich server before writing anything, then writes gallery.yaml, settings.yaml and a content/install.json carrying the Immich credentials and a generated site secret.
install.json exists because a running process cannot pick up new env vars — the wizard has to write configuration that takes effect without a restart. getInstallCredentials() merges it under the real environment, so env vars always win and rotation stays a matter of setting one.
Both the page and the API routes are gated by a one-time setup token printed to the server log, so a deployment that is reachable before gallery.yaml exists cannot be configured by whoever finds it first. The token is stored in content/.setup-token (0600) rather than a module variable: Next.js bundles the page and each route handler separately, so a module-level token left the page and the API disagreeing inside one process and the wizard stuck on step 1. It is removed once the install completes.
The admin password is stored as an scrypt hash using the scheme lib/auth.ts already applies to album passwords; a plaintext ADMIN_PASSWORD env var keeps working.
* docs: document the setup wizard, fix the read-only content mount (#425)
Quick Start now leads with the /install wizard, with the hand-written YAML route kept alongside it, and a First-Run Setup section covers the setup token, the files the wizard writes, and env-var precedence.
Two corrections: both Docker examples mounted content/ as :ro, which silently breaks the wizard, the admin panel and the backup rotation alike — docs/admin-panel.md already said so and the README contradicted it. And nothing documented that content/install.json holds the Immich API key, so a backup of content/ is a backup of credentials.
Also adds a Contributors section crediting the people whose work is in the project.
* feat(admin): floating save bar pinned to the bottom of the viewport (#426)
The save bar was the first, static element inside .admin-main. Since the
document itself scrolls, it left the viewport as soon as you scrolled down
— editing a subpage section or a settings block far below gave no visible
dirty hint and no reachable save button.
Replace it with a bottom-pinned floating bar shared by both editors. It
only mounts while there is something to act on (unsaved changes, an
in-flight save, or a result message), so it never covers content while
idle. The success message clears after 5s, which hides the bar again.
- new SaveBar component, replacing the duplicated markup in PageBuilder
and SettingsEditor
- adopt the previously unused .floating-save-bar CSS: slide-in keyframes
(carrying translateX(-50%)), dirty border, wrap/gap, mobile variant and
a prefers-reduced-motion opt-out; z-index 900 keeps it below modals
- .admin-main gains bottom padding so the bar never covers page content
- drop the now-unreachable idle hints: the ⌘S hint becomes a button title,
the Live Sync note becomes a static line above the settings layout
- header "Site" link now bypasses the cache (/?fresh=1), so the preview
stays reachable when the bar is hidden
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
* feat(admin): themed listbox for the album sort control (#427)
The per-album "Photo order" control was a native <select>. Because an
<option> cannot contain markup, its choices could not use the admin
panel's currentColor SVG set — the reason #415 had to fall back to plain
text after dropping the emoji labels.
Adds a Listbox component implementing the ARIA combobox/listbox pattern,
so options can render a glyph beside their label:
- DOM focus stays on the trigger button; the active option is announced
through aria-activedescendant, keeping focus management to one element
- Keyboard: arrows (clamped at the ends, like a native select),
Home/End, Enter/Space to commit, Escape to cancel, Tab commits and
moves on, and prefix type-ahead with a repeat-key cycle
- Outside dismissal on pointerdown, so a press starting outside closes
the popup before the click retargets
The sort options now carry an icon each: calendar, arrow-down, arrow-up,
an A→Z marker, and the drag glyph for manual — matching the badge the
album card already shows. SORT_LABELS stays plain text because the badge
feeds it to a title attribute.
Closes #417
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
* chore(git): ignore generated design handoff folders
* fix(admin): stop the album sort dropdown clipping, and simplify the panel (#428)
* fix(admin): render listbox popup in a portal so it escapes modal clipping
The sort control's popup was position:absolute inside three clipping ancestors
(.album-drawer overflow:hidden > .album-drawer-body overflow-y:auto >
.modal-right-column overflow-y:auto), so it was cut off at the bottom of the
Edit Album Details modal. z-index could not help: clipping happens before
stacking. It also always hung below the trigger, with no flip.
Portal the popup to document.body and position it from the trigger's viewport
rect, flipping above when there is more room there and capping max-height to the
space available so it scrolls internally rather than overflowing. It is
dismissed on scroll and resize, since the anchor is only measured on open.
The outside-pointerdown handler now also treats the popup as inside; without
that the portalled list counts as outside, and a click on an option would close
it before the selection commits.
* refactor(admin): single-column album details panel
The left column spent 1.2fr on a cover thumbnail and three stat rows, two of
which (Status, Custom Hero) only restated the form fields opposite them, while
the form itself was squeezed into 1.8fr behind a second nested scroller.
Stack the drawer in one column instead: cover as a banner, then the form at full
width, with the UUID moved into the footer. The body is now the only scroll
container, which also removes one of the ancestors that was clipping the sort
popup.
---------
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
* fix(admin): give the portalled listbox its theme back, lock the page behind modals (#429)
Two defects in the album editor.
The sort listbox popup painted transparent. Every --admin-* variable is
scoped to .admin-layout, and since the popup moved into document.body it
sits outside that subtree, so background/border/text all resolved to
nothing. It now carries its own copy of the palette in both colour
schemes, plus the font it no longer inherits.
Scrolling inside a modal also moved the page behind it. No admin modal
ever locked body scroll: the overlay covers the page but does not absorb
wheel events, so a scroll starting on the backdrop — or continuing past
the end of the modal's own scroller — reaches the document.
overscroll-behavior cannot cover that case on its own, because it only
applies to scroll containers and the backdrop is not one.
useScrollLock freezes body while a modal is open and compensates for the
width the scrollbar gives up, so nothing shifts underneath. Each lock
restores the inline value it found, which makes nesting work without a
counter — a picker opened from the drawer restores the drawer's hidden
state instead of clearing it. Applied to both drawers and all four
picker modals, which share the defect. overscroll-behavior: contain on
the scrollers stops the chaining they can handle themselves.
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
* fix(security): allow unsafe-eval in CSP script-src during dev mode
* feat(journal): add Journal Studio with split-screen editor, live preview and dedicated routes
* fix(build): separate client parser from server journal-service and fix build type errors
* fix(journal): Fotos rendern, Layout und Lightbox-Steuerung korrigieren
Fünf unabhängige Fehler in der öffentlichen Journal- und Essay-Ansicht:
* Foto-Blöcke wurden nie angezeigt. EssayView löst ein Foto über
PhotoItem.id auf, und das sind verschlüsselte Tokens — die Blöcke aus
dem Markdown tragen aber rohe Asset-UUIDs. Jede Zuordnung lief ins
Leere, und nicht auflösbare Blöcke werden still verworfen. Die IDs
werden jetzt serverseitig übersetzt; damit verschwinden nebenbei die
rohen UUIDs aus dem Client-Payload, die dort laut Projektregel nie
auftauchen dürfen. Nicht auflösbare Referenzen werden geloggt.
* Überschriften standen weiter links als der Fließtext. Jeder Block
hatte einzeln `max-width: 68ch`, und `ch` ist relativ zur Schrift des
Elements — die Serif-Überschrift ergab eine breitere Spalte. Ersetzt
durch eine gemeinsame, font-unabhängige `--essay-measure`.
* Fullbleed-Fotos bluteten nur nach links aus: `.essay-figure` ist
`width: 100%`, wodurch die Box überbestimmt ist und der negative
rechte Margin verworfen wird.
* Foto-Paare stellten beide Bilder gleich breit dar, wodurch ein
Hochformat neben einem Querformat doppelt so hoch wurde. Jetzt eine
Justified-Reihe: Breite proportional zum Seitenverhältnis, dadurch
exakt gleiche Höhen ohne Beschnitt.
* Die Lightbox hatte im Journal keine Tastatursteuerung und keine
Scroll-Sperre — beides lag in PhotoGrid, also nur im Album-Raster.
Verlagert in die Lightbox selbst, der doppelte Handler in PhotoGrid
entfernt (sonst wäre pro Pfeildruck zwei Bilder weitergesprungen).
Zusätzlich sind Proofing-Herzen und das EXIF-Panel im redaktionellen
Modus abschaltbar und im Journal aus: Client-Proofing ist ein
Übergabe-Workflow für Alben, keine Funktion einer Reportage. Auf der
Übersicht wurde der Untertitel doppelt gerendert, weil extractExcerpt()
auf ihn zurückfällt.
* feat(admin): eigene URLs für alle Bereiche und überarbeiteter Journal Studio
Das Panel war eine einzige Client-Komponente, die ihre Tabs über
useState umschaltet: keine Route pro Bereich, kein Deep-Link, kein
Zurück-Button, und nach jedem Reload landete man wieder auf "Pages".
Auch der Journal-Editor hatte keine eigene URL.
Jetzt sieben echte Routen (/admin, /admin/pages, /admin/journal,
/admin/journal/<slug>, /admin/settings, /admin/settings/<section>,
/admin/analytics). Die Shell mit Auth-Prüfung und Kopfzeile sitzt im
Layout und umschließt children — so bleibt die Session-Prüfung über
Routenwechsel montiert, statt bei jedem Tab-Wechsel neu zu laufen und
den Spinner aufblitzen zu lassen. Unbekannte Settings-Sections fallen
auf General zurück.
Im selben Zug der Journal Studio, der die Routing-Änderung ohnehin
berührt:
* Alle Eingabefelder nutzten die Klasse `admin-input`, die in keinem
CSS definiert war — sie fielen auf Browser-Defaults zurück. Jetzt
gestylt, gescoped, damit der generische Name nicht ins übrige Panel
leckt.
* Der Split View ist per Divider verschiebbar (Maus, Tastatur,
Doppelklick zum Zurücksetzen), Breite in localStorage.
* Das Studio bricht aus der 1120px-Spalte aus, die Preview hat Platz.
* Die Preview zeigte für jedes Foto fest 3:2 und log damit über das
Layout der veröffentlichten Seite; die echten Verhältnisse werden
jetzt an den Thumbnails gemessen.
* Blöcke mit alten positionsbasierten Foto-Referenzen werden markiert —
die lassen sich auf einer eigenständigen Journal-Seite nicht auflösen
und verschwanden bisher stillschweigend.
* Blocktyp-Chips als gemeinsame Komponente, monochrom und per Icon
unterschieden statt in einer eigenen Blau/Lila/Orange-Palette, die
sonst nirgends im Panel vorkommt.
* Emojis raus, SVG-Icons rein.
* fix(admin): Designsystem-Lücken im Panel schließen
Eine systematische Suche nach Klassen, die im TSX benutzt, aber in
keinem CSS definiert sind, hat vier Stellen mit demselben Muster
gefunden:
* `admin-btn-secondary` und `admin-btn-danger` existierten nicht.
Sämtliche Löschen-Buttons sahen aus wie normale Buttons — keine
Warnwirkung. Als `.admin-btn.admin-btn-danger` geschrieben, weil die
Varianten mit den Größenklassen kombiniert werden, die weiter unten
ihren eigenen Hintergrund setzen.
* `page-progress-fill` fehlte: die Balken im Analytics-Panel waren
leere Rinnen, der Wert unsichtbar. Ebenso `analytics-empty` und
`admin-loading-container`.
* `subpage-drawer-section`, `subpage-drawer-title-group` und
`input-with-icon` im PageBuilder waren wirkungslos und teils mit
Inline-Styles notdürftig kompensiert.
* `grid-card-preview` fehlte, wodurch alle Layout-Vorschauen auf Höhe
null kollabierten. Nur "Showcase" war sichtbar — und das aus Versehen,
weil sein Tile `hero-tile` hieß und damit die `aspect-ratio` einer
fremden PageBuilder-Klasse erbte. Umbenannt.
Dazu die Theme-Vorschauen, die praktisch identisch aussahen: alle
sieben zeigten dieselben drei quadratischen Kacheln, einziger
Unterschied war die Hintergrundfarbe. Sie spiegeln jetzt die echten
Preset-Daten aus lib/config/theme.ts — Schriftcharakter, Eckradius,
Rasterdichte, Passepartout bzw. Schatten.
Die Kopfzeile richtet sich an einer gemeinsamen Steuerhöhe aus. Der
"Site"-Link war höher als die Buttons daneben: `.admin-btn` hatte keine
explizite line-height, und <button> bekommt box-sizing: border-box vom
Browser, <a> nicht. Die Statusanzeige setzte weder Schriftfamilie noch
-größe und fiel auf den Browser-Default zurück — sie war nie Teil des
Designsystems. Jetzt gleiche Höhe und Typografie, Pillenform als
Zustandsanzeige, Trenner zur Aktionsgruppe. Das dauerhafte Pulsieren
des grünen Punkts entfällt; Animation bleibt den Zuständen vorbehalten,
die Aufmerksamkeit brauchen.
Restliche Emojis durch SVG-Icons ersetzt.
* feat(admin): add scroll-to-top toggle and SVG arrow
The back-to-top button was always on and drew its arrow with the ↑ text
character. Add a `scrollToTop` setting (General section in the admin
panel, defaults to on so existing sites are unaffected) and replace the
glyph with a stroked SVG that inherits currentColor across all presets.
Scroll handling is now rAF-throttled, and prefers-reduced-motion turns
off both the hover lift and the smooth scroll.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
* security(journal): escape author HTML instead of filtering it
CodeQL flags 26 high-severity alerts on the release PR; the bulk of them
point at sanitizeHtml(), a denylist of three regexes whose output goes
into dangerouslySetInnerHTML. I reproduced the bypasses before changing
anything — all four pass the old filter:
<img src=x onerror=alert(1)> unquoted handler, regex wants quotes
<img src=x onerror='alert(1)'> single quotes, same reason
<svg onload=alert(1)> not a <script> tag
javasjavascript:cript:alert(1) one-pass replace, the rest recombines
Plus an attribute breakout in the link renderer, which interpolated the
URL into href="${url}" unescaped:
[x](" onmouseover=alert(1) x=") -> <a href="" onmouseover=alert(1" ...>
Replaced with escaping. Every `&<>"'` in author text becomes an entity
before any markdown rule runs, so the only tags in the output are the
ones renderInlineMarkdown builds itself and a URL cannot leave its
attribute. Link schemes are now an allowlist (http, https, mailto, tel,
relative, anchor); anything else renders as plain text.
The serializer needed decodeHtmlEntities to match: without it a save
would write `<` into the Markdown file and the next parse would
escape the `&` again, corrupting the text further on every round trip.
A test covers parse -> serialize -> parse stability.
Two existing tests asserted the old behaviour and were rewritten rather
than deleted: one expected the script tag to be *removed* from the
output, the other expected the substring "onerror" to be absent. Both
now assert the property that matters — that no tag can form — because
`onerror` surviving as inert text is fine.
Exploitation required admin access either way: journal and essay text
comes from the studio or from content/*.md. This removes the weakness,
it does not close an open door.
* fix(journal): contain file paths, fix frontmatter escaping, defuse two regexes
Follow-up to the CodeQL findings on release PR #432. I went through all 23
alerts individually; this addresses the ones that are worth addressing and
documents the ones that are not.
Path containment (12 alerts, all false positives). Every path built from a
slug goes through isValidSlug(), a strict `/^[a-zA-Z0-9_-]+$/` allowlist —
verified against `../../etc/passwd`, `foo/../../bar`, `a/b`, `..` and
friends, all rejected. CodeQL cannot see it because the check lives in
another module. Added a containedPath() helper that resolves the path and
refuses anything landing outside the content directory: a second lock on a
door that was already locked, and a barrier the analysis can follow. Also
removed the dead `slug.endsWith('.md')` branches — isValidSlug rejects
dots, so they could never be taken.
Frontmatter escaping (1 alert, a real bug). The serializer escaped `"` but
not `\`, and the parser never unescaped anything. A title containing either
character gained a backslash on every save/load cycle:
Path C:\Users "quoted" -> Path C:\\Users \"quoted\" -> ...
Escaping now covers the backslash first and the parser undoes both. A round
trip test covers quotes, backslashes, colons and apostrophes.
Two of three ReDoS regexes (2 alerts). The heading pattern had `\s+` next to
`(.+)`, which overlap, so the engine tried every split of the whitespace run
before failing; it is `[ \t]+` and `(\S.*)` now. The quote author pattern
wrapped a lazy group around an optional group — the quadratic case — and is
an index split on the first separator now.
The third regex, the bold/italic pass, is deliberately left alone. Rewriting
it with a negated class removes the backtracking but breaks nesting:
`**bold *and italic* here**` renders as `*<em>bold </em>and italic<em> here</em>*`.
The input is Markdown from an authenticated admin, never a visitor, so the
worst case is an author slowing down their own page. The comment in the code
says so.
Not addressed: 5 js/insufficient-password-hash alerts. They ask for a slow
KDF where the code uses SHA-256/HMAC — correct in general, but the admin
password comes from an environment variable and is never stored, so a
stronger KDF protects nothing that is not already in plaintext in the
environment.
399 unit tests pass (18 new), build and tsc clean.
* fix(journal): split the quote author by scanning, not by pattern
Cleaning up after myself. #439 replaced the quote author regex
`/^(.*?)(?:\s+--\s+(.+))?$/` — a lazy group around an optional one, the
quadratic case — with `/\s+--\s+/`, and CodeQL promptly flagged the
replacement for the same reason. One reported pattern traded for another.
splitQuoteAuthor() scans for the first `--` that has whitespace on both
sides. Linear, and it needs no reasoning about the regex engine at all.
Behaviour is identical to the original regex, checked case by case
against it: separator, no separator, several separators, tabs, wide gaps,
`a--b` without spaces, leading and trailing separators, empty string. All
nine are covered by tests, plus one asserting it stays fast on a 50k
whitespace run.
* security(admin): derive the session signing key with scrypt
getSigningKey() ran the admin password through a single SHA-256 digest.
It is key derivation rather than password storage, so it was never a
stored-hash problem — but if the derived key ever leaked, one fast hash
makes recovering the password by brute force cheap. CodeQL flags it as
js/insufficient-password-hash and, for this particular alert, has a
point.
scrypt now. Two details that matter:
The salt has to be stable. A random salt would produce a different key on
every call and invalidate every session; it is derived from AUTH_SECRET,
which is deployment-specific. Verified across separate processes: same
inputs produce a verifying token, so a restart or redeploy does not log
everyone out.
The result is cached for the process lifetime. scrypt is deliberately
slow and getSigningKey() runs on every admin request — deriving per call
would add ~24ms to each one. The cache key is a digest of secret plus
password, so a rotation misses the cache and derives again, and no extra
plaintext copy of the password is kept around.
Measured: first derivation 24ms, subsequent calls 0.12ms. Password
change and secret change both invalidate an existing token, checked in
separate processes.
Note the one-time effect: existing admin sessions are invalidated by the
change in derivation, so everyone logs in once more.
* security(admin): key the signing-key cache on its inputs, not a digest
#441 removed the SHA-256 digest of the admin password from the key
derivation and introduced a new one three lines above it, as the cache
key. Same rule, same file: CodeQL reported it immediately.
The comment justifying it was wrong too. It claimed no second plaintext
copy of the password was retained, while building the digest input
allocates exactly that in order to hash it.
The cache now holds the two input strings and compares them directly.
They are the same objects the env and install caches already hold, so
nothing extra is retained, and no fast hash of the password exists in
memory for the life of the process.
Re-verified after the change, in separate processes: a token from one
process verifies in another with the same inputs, a changed password or
secret rejects it, first derivation 24ms, cached calls 0.001ms.
That leaves scrypt as the only place the password is hashed here. The
two HMACs further down operate on the derived key and on token data, not
on the password; the constant-time comparison in verifyAdminPassword is
the previously dismissed one.
---------
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
2026-08-14 16:55:07 +02:00
|
|
|
|
* Labels for the per-album sort control.
|
2026-08-14 11:10:42 +02:00
|
|
|
|
*
|
release: v0.11.0 — journal fixes, admin URLs, design system cleanup (#432)
* fix(screenshots): sharp-Typen fuer 0.34 und 0.35 gleichzeitig (#410)
sharp 0.35 ist von `export =` auf ESM umgestellt: der Modul-Namespace
ist nicht mehr aufrufbar, die Factory sitzt unter .default. Der
Type-Check brach damit in scripts/screenshots.ts weg, sobald der
Next-Bump (#402) sharp von 0.34.5 auf 0.35.3 mitzieht -- sharp ist hier
keine deklarierte Dependency, sondern kommt ueber Next mit.
Die Form wird jetzt aus dem installierten Paket abgeleitet statt
festgeschrieben, zur Laufzeit wie im Typ. Geprueft mit beiden
Versionen: tsc laeuft mit 0.34.5 und mit 0.35.3 fehlerfrei durch.
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
* chore(deps): bump the nextjs group across 1 directory with 2 updates (#402)
Bumps the nextjs group with 2 updates in the / directory: [next](https://github.com/vercel/next.js) and [eslint-config-next](https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next).
Updates `next` from 16.2.12 to 16.3.0
- [Release notes](https://github.com/vercel/next.js/releases)
- [Commits](https://github.com/vercel/next.js/compare/v16.2.12...v16.3.0)
Updates `eslint-config-next` from 16.2.12 to 16.3.0
- [Release notes](https://github.com/vercel/next.js/releases)
- [Commits](https://github.com/vercel/next.js/commits/v16.3.0/packages/eslint-config-next)
---
updated-dependencies:
- dependency-name: eslint-config-next
dependency-version: 16.3.0
dependency-type: direct:development
update-type: version-update:semver-minor
dependency-group: nextjs
- dependency-name: next
dependency-version: 16.3.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: nextjs
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* chore(deps-dev): bump prettier from 3.8.3 to 3.9.6 (#405)
Bumps [prettier](https://github.com/prettier/prettier) from 3.8.3 to 3.9.6.
- [Release notes](https://github.com/prettier/prettier/releases)
- [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md)
- [Commits](https://github.com/prettier/prettier/compare/3.8.3...3.9.6)
---
updated-dependencies:
- dependency-name: prettier
dependency-version: 3.9.6
dependency-type: direct:development
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* docs(changelog): Unreleased-Sektion fuer die Bumps nach v0.10.0 (#413)
Die Dependency-PRs sind nach dem Release auf dev gelandet, teils auch
auf main. Ohne Eintrag waeren sie beim naechsten Release unsichtbar --
inklusive Next 16.3.0, das CVE-2025-13465 mitbringt.
Ausserdem im 0.10.0-Abschnitt nachgetragen, dass der Trivy-Scan bis
#409 nie gelaufen ist. Der Fix steckt im Tag v0.10.0, fehlte aber in der
Aufzaehlung -- und "Images werden bei jedem Publish gescannt" stand im
Changelog, waehrend der Job im Action-Setup abbrach.
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
* feat(gallery): per-album sort order, independent of Immich (#408) (#414)
Album order was dictated entirely by Immich: getAlbum() sorted by the
album's own asc/desc flag, so a Folio album always mirrored the archive.
A curated series has a narrative order that has nothing to do with
capture time, and changing the Immich album's sort to fit the website
changes it for the archive too.
Adds an optional per-album `sort` in gallery.yaml, editable in /admin,
defaulting to today's behaviour so every existing config is unchanged:
immich (default) | newest | oldest | filename | manual
`manual` is a pinned *prefix*: `assetOrder` lists only the photos placed
by hand, everything else follows in the album's Immich order. A full
permutation of a 2,000-photo album would be ~80 KB of UUIDs in a file
that is rewritten and copied to content/.backups/ on every admin save.
It also makes drift fall out for free — photos removed in Immich never
match, new ones land in the tail rather than being hidden.
Sorting is applied after the cache read, not before the cache write, so
the LRU keeps one canonical Immich-ordered copy per album. That avoids
putting the mode in the cache key, lets a config change take effect
without depending on invalidation, and keeps the stale-serving path
correct. cache.get() returns the stored object by reference, so
withSort() returns a shallow clone with a new array — sorting in place
would reorder the shared entry, and under request coalescing every
concurrent caller would be sorting the same array.
Also fixes a prerequisite bug: /api/admin/albums/[albumId]/assets read
album.assets from GET /albums/:id, which Immich 3.x no longer populates
(lib/immich.ts:507). The hero picker's "This Album" tab returned nothing
and threw outright when the key was absent. It now goes through the
client's paginated metadata search, with ?types=all to opt videos in for
the reorder editor.
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
* refactor(admin): drop decorative emoji from the sort select labels (#415)
An <option> cannot contain markup, so the SVG set in Icons is not
reachable there — but a decorative emoji is not a substitute for it.
Plain text instead; the album card badge already uses a real icon.
The remaining emoji in the admin panel (asset picker tabs, section
headings, layout picker options) predate this branch and are left for a
separate cleanup.
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
* refactor(admin): replace emoji icons with the shared SVG icon set (#416)
The admin panel mixed two icon conventions: inline SVGs from
`Icons.tsx` in most components, and decorative emoji in the asset
picker and a few PageBuilder labels. Emoji render inconsistently
across platforms, ignore the accent colour, and cannot inherit the
`.svg-icon` sizing rules.
- Icons.tsx: add `IconStar` (filled — it marks a state, not an
action) and `IconImage`.
- AssetPicker: the three tab labels and the favourite tile badge now
use IconFolder / IconStar / IconImage.
- PageBuilder: the "Standalone Albums" and "Subpages" headings use
the icon set instead of an emoji.
- PageBuilder: the layout picker drops its emoji for plain text. An
<option> cannot contain markup, so an SVG is impossible there and a
decorative glyph is not a substitute.
- admin.css: align icon and label in the picker tabs, and swap the
favourite badge's text-shadow for drop-shadow, which is what
applies to an inline SVG.
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
* refactor(admin): fold PageBuilder's local icons into the shared Icons module (#418)
* refactor(admin): fold PageBuilder's local icons into the shared module
PageBuilder.tsx carried its own `Icons` object duplicating most of the
glyphs already exported by Icons.tsx, with hardcoded sizes and slightly
divergent paths. Migrate all 32 call sites to the shared module and
delete the local object.
Five glyphs had no counterpart and are added to Icons.tsx as 1:1 ports
of the local paths: IconX, IconPlus, IconHome, IconCopy, IconImage.
The local ExternalLink and Check are dropped rather than ported — both
had zero call sites.
Two glyphs change shape slightly, which is the point of consolidating:
the shared IconCamera includes the viewfinder bump the local copy
omitted, and drag handles now use IconGripVertical.
IconGripVertical uses the module's square 24x24 viewBox, so `.svg-drag`
goes from 12x18 to 18x18 — the old non-square box would letterbox the
glyph down to 12x12 and shrink the handle.
* fix(admin): resolve icon-module integration after #416
Merging dev brought in #416, which added a second IconImage to Icons.tsx
and two <Icons.Camera>/<Icons.Folder> section headers that reference the
local Icons object this PR removes. Git merged both cleanly but the result
did not type-check.
- drop the duplicate IconImage (both copies were byte-identical)
- point the two section headers at the imported IconCamera/IconFolder
- refresh the SORT_LABELS comment: the icon set is imported now, not
declared below
---------
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
* fix(config): allow an empty gallery, guard against a double /api suffix (#421)
An empty gallery is now a valid, rendered state instead of a throw: deriveGallery() no longer requires at least one album or subpage, so a deployment with no albums yet renders a bare homepage the owner can fill in via /admin.
getConfig() also stops appending /api to an Immich URL that already ends in it, which previously produced .../api/api and broke every upstream request.
Includes a restore of the per-album sort test cases, which the branch had lost by being cut before #408/#414.
* feat(admin): favicon upload, served from the content volume (#422)
Adds a bundled default favicon, an upload widget in admin Settings > General, and a route that serves the icon from the writable content/ volume with a fallback to the bundled default. Raster uploads (PNG/ICO/JPEG) are wrapped in an SVG container; the response carries its own CSP so an uploaded SVG cannot execute script on the origin.
The GET route revalidates with an ETag instead of caching immutably, so a newly uploaded icon shows up immediately. Uploads are written via temp file + rename, and a Reset button restores the bundled default.
* ci: flag unformatted files in a PR, without blocking it (#424)
Prettier is configured as an error rule in eslint.config.mjs but has never run in CI, so part of the tree predates it. A final CI step now diffs against the PR base, runs prettier --list-different over the changed files, and emits a warning annotation per offender plus a job summary.
Advisory by design: it never fails the job. Blocking would turn a PR red for merely touching a file that was already unformatted, and normalising the tree in one commit would wreck git blame and conflict with the PRs in flight.
Requires fetch-depth: 0, since diffing against the base needs its history.
* feat(install): first-run wizard gated by a one-time setup token (#419)
Adds /install, a four-step first-run wizard: connect to Immich, optionally pick albums, name the site, finish. It verifies the credentials against the Immich server before writing anything, then writes gallery.yaml, settings.yaml and a content/install.json carrying the Immich credentials and a generated site secret.
install.json exists because a running process cannot pick up new env vars — the wizard has to write configuration that takes effect without a restart. getInstallCredentials() merges it under the real environment, so env vars always win and rotation stays a matter of setting one.
Both the page and the API routes are gated by a one-time setup token printed to the server log, so a deployment that is reachable before gallery.yaml exists cannot be configured by whoever finds it first. The token is stored in content/.setup-token (0600) rather than a module variable: Next.js bundles the page and each route handler separately, so a module-level token left the page and the API disagreeing inside one process and the wizard stuck on step 1. It is removed once the install completes.
The admin password is stored as an scrypt hash using the scheme lib/auth.ts already applies to album passwords; a plaintext ADMIN_PASSWORD env var keeps working.
* docs: document the setup wizard, fix the read-only content mount (#425)
Quick Start now leads with the /install wizard, with the hand-written YAML route kept alongside it, and a First-Run Setup section covers the setup token, the files the wizard writes, and env-var precedence.
Two corrections: both Docker examples mounted content/ as :ro, which silently breaks the wizard, the admin panel and the backup rotation alike — docs/admin-panel.md already said so and the README contradicted it. And nothing documented that content/install.json holds the Immich API key, so a backup of content/ is a backup of credentials.
Also adds a Contributors section crediting the people whose work is in the project.
* feat(admin): floating save bar pinned to the bottom of the viewport (#426)
The save bar was the first, static element inside .admin-main. Since the
document itself scrolls, it left the viewport as soon as you scrolled down
— editing a subpage section or a settings block far below gave no visible
dirty hint and no reachable save button.
Replace it with a bottom-pinned floating bar shared by both editors. It
only mounts while there is something to act on (unsaved changes, an
in-flight save, or a result message), so it never covers content while
idle. The success message clears after 5s, which hides the bar again.
- new SaveBar component, replacing the duplicated markup in PageBuilder
and SettingsEditor
- adopt the previously unused .floating-save-bar CSS: slide-in keyframes
(carrying translateX(-50%)), dirty border, wrap/gap, mobile variant and
a prefers-reduced-motion opt-out; z-index 900 keeps it below modals
- .admin-main gains bottom padding so the bar never covers page content
- drop the now-unreachable idle hints: the ⌘S hint becomes a button title,
the Live Sync note becomes a static line above the settings layout
- header "Site" link now bypasses the cache (/?fresh=1), so the preview
stays reachable when the bar is hidden
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
* feat(admin): themed listbox for the album sort control (#427)
The per-album "Photo order" control was a native <select>. Because an
<option> cannot contain markup, its choices could not use the admin
panel's currentColor SVG set — the reason #415 had to fall back to plain
text after dropping the emoji labels.
Adds a Listbox component implementing the ARIA combobox/listbox pattern,
so options can render a glyph beside their label:
- DOM focus stays on the trigger button; the active option is announced
through aria-activedescendant, keeping focus management to one element
- Keyboard: arrows (clamped at the ends, like a native select),
Home/End, Enter/Space to commit, Escape to cancel, Tab commits and
moves on, and prefix type-ahead with a repeat-key cycle
- Outside dismissal on pointerdown, so a press starting outside closes
the popup before the click retargets
The sort options now carry an icon each: calendar, arrow-down, arrow-up,
an A→Z marker, and the drag glyph for manual — matching the badge the
album card already shows. SORT_LABELS stays plain text because the badge
feeds it to a title attribute.
Closes #417
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
* chore(git): ignore generated design handoff folders
* fix(admin): stop the album sort dropdown clipping, and simplify the panel (#428)
* fix(admin): render listbox popup in a portal so it escapes modal clipping
The sort control's popup was position:absolute inside three clipping ancestors
(.album-drawer overflow:hidden > .album-drawer-body overflow-y:auto >
.modal-right-column overflow-y:auto), so it was cut off at the bottom of the
Edit Album Details modal. z-index could not help: clipping happens before
stacking. It also always hung below the trigger, with no flip.
Portal the popup to document.body and position it from the trigger's viewport
rect, flipping above when there is more room there and capping max-height to the
space available so it scrolls internally rather than overflowing. It is
dismissed on scroll and resize, since the anchor is only measured on open.
The outside-pointerdown handler now also treats the popup as inside; without
that the portalled list counts as outside, and a click on an option would close
it before the selection commits.
* refactor(admin): single-column album details panel
The left column spent 1.2fr on a cover thumbnail and three stat rows, two of
which (Status, Custom Hero) only restated the form fields opposite them, while
the form itself was squeezed into 1.8fr behind a second nested scroller.
Stack the drawer in one column instead: cover as a banner, then the form at full
width, with the UUID moved into the footer. The body is now the only scroll
container, which also removes one of the ancestors that was clipping the sort
popup.
---------
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
* fix(admin): give the portalled listbox its theme back, lock the page behind modals (#429)
Two defects in the album editor.
The sort listbox popup painted transparent. Every --admin-* variable is
scoped to .admin-layout, and since the popup moved into document.body it
sits outside that subtree, so background/border/text all resolved to
nothing. It now carries its own copy of the palette in both colour
schemes, plus the font it no longer inherits.
Scrolling inside a modal also moved the page behind it. No admin modal
ever locked body scroll: the overlay covers the page but does not absorb
wheel events, so a scroll starting on the backdrop — or continuing past
the end of the modal's own scroller — reaches the document.
overscroll-behavior cannot cover that case on its own, because it only
applies to scroll containers and the backdrop is not one.
useScrollLock freezes body while a modal is open and compensates for the
width the scrollbar gives up, so nothing shifts underneath. Each lock
restores the inline value it found, which makes nesting work without a
counter — a picker opened from the drawer restores the drawer's hidden
state instead of clearing it. Applied to both drawers and all four
picker modals, which share the defect. overscroll-behavior: contain on
the scrollers stops the chaining they can handle themselves.
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
* fix(security): allow unsafe-eval in CSP script-src during dev mode
* feat(journal): add Journal Studio with split-screen editor, live preview and dedicated routes
* fix(build): separate client parser from server journal-service and fix build type errors
* fix(journal): Fotos rendern, Layout und Lightbox-Steuerung korrigieren
Fünf unabhängige Fehler in der öffentlichen Journal- und Essay-Ansicht:
* Foto-Blöcke wurden nie angezeigt. EssayView löst ein Foto über
PhotoItem.id auf, und das sind verschlüsselte Tokens — die Blöcke aus
dem Markdown tragen aber rohe Asset-UUIDs. Jede Zuordnung lief ins
Leere, und nicht auflösbare Blöcke werden still verworfen. Die IDs
werden jetzt serverseitig übersetzt; damit verschwinden nebenbei die
rohen UUIDs aus dem Client-Payload, die dort laut Projektregel nie
auftauchen dürfen. Nicht auflösbare Referenzen werden geloggt.
* Überschriften standen weiter links als der Fließtext. Jeder Block
hatte einzeln `max-width: 68ch`, und `ch` ist relativ zur Schrift des
Elements — die Serif-Überschrift ergab eine breitere Spalte. Ersetzt
durch eine gemeinsame, font-unabhängige `--essay-measure`.
* Fullbleed-Fotos bluteten nur nach links aus: `.essay-figure` ist
`width: 100%`, wodurch die Box überbestimmt ist und der negative
rechte Margin verworfen wird.
* Foto-Paare stellten beide Bilder gleich breit dar, wodurch ein
Hochformat neben einem Querformat doppelt so hoch wurde. Jetzt eine
Justified-Reihe: Breite proportional zum Seitenverhältnis, dadurch
exakt gleiche Höhen ohne Beschnitt.
* Die Lightbox hatte im Journal keine Tastatursteuerung und keine
Scroll-Sperre — beides lag in PhotoGrid, also nur im Album-Raster.
Verlagert in die Lightbox selbst, der doppelte Handler in PhotoGrid
entfernt (sonst wäre pro Pfeildruck zwei Bilder weitergesprungen).
Zusätzlich sind Proofing-Herzen und das EXIF-Panel im redaktionellen
Modus abschaltbar und im Journal aus: Client-Proofing ist ein
Übergabe-Workflow für Alben, keine Funktion einer Reportage. Auf der
Übersicht wurde der Untertitel doppelt gerendert, weil extractExcerpt()
auf ihn zurückfällt.
* feat(admin): eigene URLs für alle Bereiche und überarbeiteter Journal Studio
Das Panel war eine einzige Client-Komponente, die ihre Tabs über
useState umschaltet: keine Route pro Bereich, kein Deep-Link, kein
Zurück-Button, und nach jedem Reload landete man wieder auf "Pages".
Auch der Journal-Editor hatte keine eigene URL.
Jetzt sieben echte Routen (/admin, /admin/pages, /admin/journal,
/admin/journal/<slug>, /admin/settings, /admin/settings/<section>,
/admin/analytics). Die Shell mit Auth-Prüfung und Kopfzeile sitzt im
Layout und umschließt children — so bleibt die Session-Prüfung über
Routenwechsel montiert, statt bei jedem Tab-Wechsel neu zu laufen und
den Spinner aufblitzen zu lassen. Unbekannte Settings-Sections fallen
auf General zurück.
Im selben Zug der Journal Studio, der die Routing-Änderung ohnehin
berührt:
* Alle Eingabefelder nutzten die Klasse `admin-input`, die in keinem
CSS definiert war — sie fielen auf Browser-Defaults zurück. Jetzt
gestylt, gescoped, damit der generische Name nicht ins übrige Panel
leckt.
* Der Split View ist per Divider verschiebbar (Maus, Tastatur,
Doppelklick zum Zurücksetzen), Breite in localStorage.
* Das Studio bricht aus der 1120px-Spalte aus, die Preview hat Platz.
* Die Preview zeigte für jedes Foto fest 3:2 und log damit über das
Layout der veröffentlichten Seite; die echten Verhältnisse werden
jetzt an den Thumbnails gemessen.
* Blöcke mit alten positionsbasierten Foto-Referenzen werden markiert —
die lassen sich auf einer eigenständigen Journal-Seite nicht auflösen
und verschwanden bisher stillschweigend.
* Blocktyp-Chips als gemeinsame Komponente, monochrom und per Icon
unterschieden statt in einer eigenen Blau/Lila/Orange-Palette, die
sonst nirgends im Panel vorkommt.
* Emojis raus, SVG-Icons rein.
* fix(admin): Designsystem-Lücken im Panel schließen
Eine systematische Suche nach Klassen, die im TSX benutzt, aber in
keinem CSS definiert sind, hat vier Stellen mit demselben Muster
gefunden:
* `admin-btn-secondary` und `admin-btn-danger` existierten nicht.
Sämtliche Löschen-Buttons sahen aus wie normale Buttons — keine
Warnwirkung. Als `.admin-btn.admin-btn-danger` geschrieben, weil die
Varianten mit den Größenklassen kombiniert werden, die weiter unten
ihren eigenen Hintergrund setzen.
* `page-progress-fill` fehlte: die Balken im Analytics-Panel waren
leere Rinnen, der Wert unsichtbar. Ebenso `analytics-empty` und
`admin-loading-container`.
* `subpage-drawer-section`, `subpage-drawer-title-group` und
`input-with-icon` im PageBuilder waren wirkungslos und teils mit
Inline-Styles notdürftig kompensiert.
* `grid-card-preview` fehlte, wodurch alle Layout-Vorschauen auf Höhe
null kollabierten. Nur "Showcase" war sichtbar — und das aus Versehen,
weil sein Tile `hero-tile` hieß und damit die `aspect-ratio` einer
fremden PageBuilder-Klasse erbte. Umbenannt.
Dazu die Theme-Vorschauen, die praktisch identisch aussahen: alle
sieben zeigten dieselben drei quadratischen Kacheln, einziger
Unterschied war die Hintergrundfarbe. Sie spiegeln jetzt die echten
Preset-Daten aus lib/config/theme.ts — Schriftcharakter, Eckradius,
Rasterdichte, Passepartout bzw. Schatten.
Die Kopfzeile richtet sich an einer gemeinsamen Steuerhöhe aus. Der
"Site"-Link war höher als die Buttons daneben: `.admin-btn` hatte keine
explizite line-height, und <button> bekommt box-sizing: border-box vom
Browser, <a> nicht. Die Statusanzeige setzte weder Schriftfamilie noch
-größe und fiel auf den Browser-Default zurück — sie war nie Teil des
Designsystems. Jetzt gleiche Höhe und Typografie, Pillenform als
Zustandsanzeige, Trenner zur Aktionsgruppe. Das dauerhafte Pulsieren
des grünen Punkts entfällt; Animation bleibt den Zuständen vorbehalten,
die Aufmerksamkeit brauchen.
Restliche Emojis durch SVG-Icons ersetzt.
* feat(admin): add scroll-to-top toggle and SVG arrow
The back-to-top button was always on and drew its arrow with the ↑ text
character. Add a `scrollToTop` setting (General section in the admin
panel, defaults to on so existing sites are unaffected) and replace the
glyph with a stroked SVG that inherits currentColor across all presets.
Scroll handling is now rAF-throttled, and prefers-reduced-motion turns
off both the hover lift and the smooth scroll.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
* security(journal): escape author HTML instead of filtering it
CodeQL flags 26 high-severity alerts on the release PR; the bulk of them
point at sanitizeHtml(), a denylist of three regexes whose output goes
into dangerouslySetInnerHTML. I reproduced the bypasses before changing
anything — all four pass the old filter:
<img src=x onerror=alert(1)> unquoted handler, regex wants quotes
<img src=x onerror='alert(1)'> single quotes, same reason
<svg onload=alert(1)> not a <script> tag
javasjavascript:cript:alert(1) one-pass replace, the rest recombines
Plus an attribute breakout in the link renderer, which interpolated the
URL into href="${url}" unescaped:
[x](" onmouseover=alert(1) x=") -> <a href="" onmouseover=alert(1" ...>
Replaced with escaping. Every `&<>"'` in author text becomes an entity
before any markdown rule runs, so the only tags in the output are the
ones renderInlineMarkdown builds itself and a URL cannot leave its
attribute. Link schemes are now an allowlist (http, https, mailto, tel,
relative, anchor); anything else renders as plain text.
The serializer needed decodeHtmlEntities to match: without it a save
would write `<` into the Markdown file and the next parse would
escape the `&` again, corrupting the text further on every round trip.
A test covers parse -> serialize -> parse stability.
Two existing tests asserted the old behaviour and were rewritten rather
than deleted: one expected the script tag to be *removed* from the
output, the other expected the substring "onerror" to be absent. Both
now assert the property that matters — that no tag can form — because
`onerror` surviving as inert text is fine.
Exploitation required admin access either way: journal and essay text
comes from the studio or from content/*.md. This removes the weakness,
it does not close an open door.
* fix(journal): contain file paths, fix frontmatter escaping, defuse two regexes
Follow-up to the CodeQL findings on release PR #432. I went through all 23
alerts individually; this addresses the ones that are worth addressing and
documents the ones that are not.
Path containment (12 alerts, all false positives). Every path built from a
slug goes through isValidSlug(), a strict `/^[a-zA-Z0-9_-]+$/` allowlist —
verified against `../../etc/passwd`, `foo/../../bar`, `a/b`, `..` and
friends, all rejected. CodeQL cannot see it because the check lives in
another module. Added a containedPath() helper that resolves the path and
refuses anything landing outside the content directory: a second lock on a
door that was already locked, and a barrier the analysis can follow. Also
removed the dead `slug.endsWith('.md')` branches — isValidSlug rejects
dots, so they could never be taken.
Frontmatter escaping (1 alert, a real bug). The serializer escaped `"` but
not `\`, and the parser never unescaped anything. A title containing either
character gained a backslash on every save/load cycle:
Path C:\Users "quoted" -> Path C:\\Users \"quoted\" -> ...
Escaping now covers the backslash first and the parser undoes both. A round
trip test covers quotes, backslashes, colons and apostrophes.
Two of three ReDoS regexes (2 alerts). The heading pattern had `\s+` next to
`(.+)`, which overlap, so the engine tried every split of the whitespace run
before failing; it is `[ \t]+` and `(\S.*)` now. The quote author pattern
wrapped a lazy group around an optional group — the quadratic case — and is
an index split on the first separator now.
The third regex, the bold/italic pass, is deliberately left alone. Rewriting
it with a negated class removes the backtracking but breaks nesting:
`**bold *and italic* here**` renders as `*<em>bold </em>and italic<em> here</em>*`.
The input is Markdown from an authenticated admin, never a visitor, so the
worst case is an author slowing down their own page. The comment in the code
says so.
Not addressed: 5 js/insufficient-password-hash alerts. They ask for a slow
KDF where the code uses SHA-256/HMAC — correct in general, but the admin
password comes from an environment variable and is never stored, so a
stronger KDF protects nothing that is not already in plaintext in the
environment.
399 unit tests pass (18 new), build and tsc clean.
* fix(journal): split the quote author by scanning, not by pattern
Cleaning up after myself. #439 replaced the quote author regex
`/^(.*?)(?:\s+--\s+(.+))?$/` — a lazy group around an optional one, the
quadratic case — with `/\s+--\s+/`, and CodeQL promptly flagged the
replacement for the same reason. One reported pattern traded for another.
splitQuoteAuthor() scans for the first `--` that has whitespace on both
sides. Linear, and it needs no reasoning about the regex engine at all.
Behaviour is identical to the original regex, checked case by case
against it: separator, no separator, several separators, tabs, wide gaps,
`a--b` without spaces, leading and trailing separators, empty string. All
nine are covered by tests, plus one asserting it stays fast on a 50k
whitespace run.
* security(admin): derive the session signing key with scrypt
getSigningKey() ran the admin password through a single SHA-256 digest.
It is key derivation rather than password storage, so it was never a
stored-hash problem — but if the derived key ever leaked, one fast hash
makes recovering the password by brute force cheap. CodeQL flags it as
js/insufficient-password-hash and, for this particular alert, has a
point.
scrypt now. Two details that matter:
The salt has to be stable. A random salt would produce a different key on
every call and invalidate every session; it is derived from AUTH_SECRET,
which is deployment-specific. Verified across separate processes: same
inputs produce a verifying token, so a restart or redeploy does not log
everyone out.
The result is cached for the process lifetime. scrypt is deliberately
slow and getSigningKey() runs on every admin request — deriving per call
would add ~24ms to each one. The cache key is a digest of secret plus
password, so a rotation misses the cache and derives again, and no extra
plaintext copy of the password is kept around.
Measured: first derivation 24ms, subsequent calls 0.12ms. Password
change and secret change both invalidate an existing token, checked in
separate processes.
Note the one-time effect: existing admin sessions are invalidated by the
change in derivation, so everyone logs in once more.
* security(admin): key the signing-key cache on its inputs, not a digest
#441 removed the SHA-256 digest of the admin password from the key
derivation and introduced a new one three lines above it, as the cache
key. Same rule, same file: CodeQL reported it immediately.
The comment justifying it was wrong too. It claimed no second plaintext
copy of the password was retained, while building the digest input
allocates exactly that in order to hash it.
The cache now holds the two input strings and compares them directly.
They are the same objects the env and install caches already hold, so
nothing extra is retained, and no fast hash of the password exists in
memory for the life of the process.
Re-verified after the change, in separate processes: a token from one
process verifies in another with the same inputs, a changed password or
secret rejects it, first derivation 24ms, cached calls 0.001ms.
That leaves scrypt as the only place the password is hashed here. The
two HMACs further down operate on the derived key and on token data, not
on the password; the constant-time comparison in verifyAdminPassword is
the previously dismissed one.
---------
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
2026-08-14 16:55:07 +02:00
|
|
|
|
* Kept as plain text on their own because they also feed the `title` attribute
|
|
|
|
|
|
* on the album card's sort badge, where markup is not an option.
|
2026-08-14 11:10:42 +02:00
|
|
|
|
*/
|
|
|
|
|
|
const SORT_LABELS: Record<AlbumSortMode, string> = {
|
|
|
|
|
|
immich: 'Immich order (default)',
|
|
|
|
|
|
newest: 'Newest first',
|
|
|
|
|
|
oldest: 'Oldest first',
|
|
|
|
|
|
filename: 'Filename',
|
|
|
|
|
|
manual: 'Manual',
|
2026-05-31 21:27:13 +02:00
|
|
|
|
};
|
|
|
|
|
|
|
release: v0.11.0 — journal fixes, admin URLs, design system cleanup (#432)
* fix(screenshots): sharp-Typen fuer 0.34 und 0.35 gleichzeitig (#410)
sharp 0.35 ist von `export =` auf ESM umgestellt: der Modul-Namespace
ist nicht mehr aufrufbar, die Factory sitzt unter .default. Der
Type-Check brach damit in scripts/screenshots.ts weg, sobald der
Next-Bump (#402) sharp von 0.34.5 auf 0.35.3 mitzieht -- sharp ist hier
keine deklarierte Dependency, sondern kommt ueber Next mit.
Die Form wird jetzt aus dem installierten Paket abgeleitet statt
festgeschrieben, zur Laufzeit wie im Typ. Geprueft mit beiden
Versionen: tsc laeuft mit 0.34.5 und mit 0.35.3 fehlerfrei durch.
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
* chore(deps): bump the nextjs group across 1 directory with 2 updates (#402)
Bumps the nextjs group with 2 updates in the / directory: [next](https://github.com/vercel/next.js) and [eslint-config-next](https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next).
Updates `next` from 16.2.12 to 16.3.0
- [Release notes](https://github.com/vercel/next.js/releases)
- [Commits](https://github.com/vercel/next.js/compare/v16.2.12...v16.3.0)
Updates `eslint-config-next` from 16.2.12 to 16.3.0
- [Release notes](https://github.com/vercel/next.js/releases)
- [Commits](https://github.com/vercel/next.js/commits/v16.3.0/packages/eslint-config-next)
---
updated-dependencies:
- dependency-name: eslint-config-next
dependency-version: 16.3.0
dependency-type: direct:development
update-type: version-update:semver-minor
dependency-group: nextjs
- dependency-name: next
dependency-version: 16.3.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: nextjs
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* chore(deps-dev): bump prettier from 3.8.3 to 3.9.6 (#405)
Bumps [prettier](https://github.com/prettier/prettier) from 3.8.3 to 3.9.6.
- [Release notes](https://github.com/prettier/prettier/releases)
- [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md)
- [Commits](https://github.com/prettier/prettier/compare/3.8.3...3.9.6)
---
updated-dependencies:
- dependency-name: prettier
dependency-version: 3.9.6
dependency-type: direct:development
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* docs(changelog): Unreleased-Sektion fuer die Bumps nach v0.10.0 (#413)
Die Dependency-PRs sind nach dem Release auf dev gelandet, teils auch
auf main. Ohne Eintrag waeren sie beim naechsten Release unsichtbar --
inklusive Next 16.3.0, das CVE-2025-13465 mitbringt.
Ausserdem im 0.10.0-Abschnitt nachgetragen, dass der Trivy-Scan bis
#409 nie gelaufen ist. Der Fix steckt im Tag v0.10.0, fehlte aber in der
Aufzaehlung -- und "Images werden bei jedem Publish gescannt" stand im
Changelog, waehrend der Job im Action-Setup abbrach.
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
* feat(gallery): per-album sort order, independent of Immich (#408) (#414)
Album order was dictated entirely by Immich: getAlbum() sorted by the
album's own asc/desc flag, so a Folio album always mirrored the archive.
A curated series has a narrative order that has nothing to do with
capture time, and changing the Immich album's sort to fit the website
changes it for the archive too.
Adds an optional per-album `sort` in gallery.yaml, editable in /admin,
defaulting to today's behaviour so every existing config is unchanged:
immich (default) | newest | oldest | filename | manual
`manual` is a pinned *prefix*: `assetOrder` lists only the photos placed
by hand, everything else follows in the album's Immich order. A full
permutation of a 2,000-photo album would be ~80 KB of UUIDs in a file
that is rewritten and copied to content/.backups/ on every admin save.
It also makes drift fall out for free — photos removed in Immich never
match, new ones land in the tail rather than being hidden.
Sorting is applied after the cache read, not before the cache write, so
the LRU keeps one canonical Immich-ordered copy per album. That avoids
putting the mode in the cache key, lets a config change take effect
without depending on invalidation, and keeps the stale-serving path
correct. cache.get() returns the stored object by reference, so
withSort() returns a shallow clone with a new array — sorting in place
would reorder the shared entry, and under request coalescing every
concurrent caller would be sorting the same array.
Also fixes a prerequisite bug: /api/admin/albums/[albumId]/assets read
album.assets from GET /albums/:id, which Immich 3.x no longer populates
(lib/immich.ts:507). The hero picker's "This Album" tab returned nothing
and threw outright when the key was absent. It now goes through the
client's paginated metadata search, with ?types=all to opt videos in for
the reorder editor.
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
* refactor(admin): drop decorative emoji from the sort select labels (#415)
An <option> cannot contain markup, so the SVG set in Icons is not
reachable there — but a decorative emoji is not a substitute for it.
Plain text instead; the album card badge already uses a real icon.
The remaining emoji in the admin panel (asset picker tabs, section
headings, layout picker options) predate this branch and are left for a
separate cleanup.
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
* refactor(admin): replace emoji icons with the shared SVG icon set (#416)
The admin panel mixed two icon conventions: inline SVGs from
`Icons.tsx` in most components, and decorative emoji in the asset
picker and a few PageBuilder labels. Emoji render inconsistently
across platforms, ignore the accent colour, and cannot inherit the
`.svg-icon` sizing rules.
- Icons.tsx: add `IconStar` (filled — it marks a state, not an
action) and `IconImage`.
- AssetPicker: the three tab labels and the favourite tile badge now
use IconFolder / IconStar / IconImage.
- PageBuilder: the "Standalone Albums" and "Subpages" headings use
the icon set instead of an emoji.
- PageBuilder: the layout picker drops its emoji for plain text. An
<option> cannot contain markup, so an SVG is impossible there and a
decorative glyph is not a substitute.
- admin.css: align icon and label in the picker tabs, and swap the
favourite badge's text-shadow for drop-shadow, which is what
applies to an inline SVG.
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
* refactor(admin): fold PageBuilder's local icons into the shared Icons module (#418)
* refactor(admin): fold PageBuilder's local icons into the shared module
PageBuilder.tsx carried its own `Icons` object duplicating most of the
glyphs already exported by Icons.tsx, with hardcoded sizes and slightly
divergent paths. Migrate all 32 call sites to the shared module and
delete the local object.
Five glyphs had no counterpart and are added to Icons.tsx as 1:1 ports
of the local paths: IconX, IconPlus, IconHome, IconCopy, IconImage.
The local ExternalLink and Check are dropped rather than ported — both
had zero call sites.
Two glyphs change shape slightly, which is the point of consolidating:
the shared IconCamera includes the viewfinder bump the local copy
omitted, and drag handles now use IconGripVertical.
IconGripVertical uses the module's square 24x24 viewBox, so `.svg-drag`
goes from 12x18 to 18x18 — the old non-square box would letterbox the
glyph down to 12x12 and shrink the handle.
* fix(admin): resolve icon-module integration after #416
Merging dev brought in #416, which added a second IconImage to Icons.tsx
and two <Icons.Camera>/<Icons.Folder> section headers that reference the
local Icons object this PR removes. Git merged both cleanly but the result
did not type-check.
- drop the duplicate IconImage (both copies were byte-identical)
- point the two section headers at the imported IconCamera/IconFolder
- refresh the SORT_LABELS comment: the icon set is imported now, not
declared below
---------
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
* fix(config): allow an empty gallery, guard against a double /api suffix (#421)
An empty gallery is now a valid, rendered state instead of a throw: deriveGallery() no longer requires at least one album or subpage, so a deployment with no albums yet renders a bare homepage the owner can fill in via /admin.
getConfig() also stops appending /api to an Immich URL that already ends in it, which previously produced .../api/api and broke every upstream request.
Includes a restore of the per-album sort test cases, which the branch had lost by being cut before #408/#414.
* feat(admin): favicon upload, served from the content volume (#422)
Adds a bundled default favicon, an upload widget in admin Settings > General, and a route that serves the icon from the writable content/ volume with a fallback to the bundled default. Raster uploads (PNG/ICO/JPEG) are wrapped in an SVG container; the response carries its own CSP so an uploaded SVG cannot execute script on the origin.
The GET route revalidates with an ETag instead of caching immutably, so a newly uploaded icon shows up immediately. Uploads are written via temp file + rename, and a Reset button restores the bundled default.
* ci: flag unformatted files in a PR, without blocking it (#424)
Prettier is configured as an error rule in eslint.config.mjs but has never run in CI, so part of the tree predates it. A final CI step now diffs against the PR base, runs prettier --list-different over the changed files, and emits a warning annotation per offender plus a job summary.
Advisory by design: it never fails the job. Blocking would turn a PR red for merely touching a file that was already unformatted, and normalising the tree in one commit would wreck git blame and conflict with the PRs in flight.
Requires fetch-depth: 0, since diffing against the base needs its history.
* feat(install): first-run wizard gated by a one-time setup token (#419)
Adds /install, a four-step first-run wizard: connect to Immich, optionally pick albums, name the site, finish. It verifies the credentials against the Immich server before writing anything, then writes gallery.yaml, settings.yaml and a content/install.json carrying the Immich credentials and a generated site secret.
install.json exists because a running process cannot pick up new env vars — the wizard has to write configuration that takes effect without a restart. getInstallCredentials() merges it under the real environment, so env vars always win and rotation stays a matter of setting one.
Both the page and the API routes are gated by a one-time setup token printed to the server log, so a deployment that is reachable before gallery.yaml exists cannot be configured by whoever finds it first. The token is stored in content/.setup-token (0600) rather than a module variable: Next.js bundles the page and each route handler separately, so a module-level token left the page and the API disagreeing inside one process and the wizard stuck on step 1. It is removed once the install completes.
The admin password is stored as an scrypt hash using the scheme lib/auth.ts already applies to album passwords; a plaintext ADMIN_PASSWORD env var keeps working.
* docs: document the setup wizard, fix the read-only content mount (#425)
Quick Start now leads with the /install wizard, with the hand-written YAML route kept alongside it, and a First-Run Setup section covers the setup token, the files the wizard writes, and env-var precedence.
Two corrections: both Docker examples mounted content/ as :ro, which silently breaks the wizard, the admin panel and the backup rotation alike — docs/admin-panel.md already said so and the README contradicted it. And nothing documented that content/install.json holds the Immich API key, so a backup of content/ is a backup of credentials.
Also adds a Contributors section crediting the people whose work is in the project.
* feat(admin): floating save bar pinned to the bottom of the viewport (#426)
The save bar was the first, static element inside .admin-main. Since the
document itself scrolls, it left the viewport as soon as you scrolled down
— editing a subpage section or a settings block far below gave no visible
dirty hint and no reachable save button.
Replace it with a bottom-pinned floating bar shared by both editors. It
only mounts while there is something to act on (unsaved changes, an
in-flight save, or a result message), so it never covers content while
idle. The success message clears after 5s, which hides the bar again.
- new SaveBar component, replacing the duplicated markup in PageBuilder
and SettingsEditor
- adopt the previously unused .floating-save-bar CSS: slide-in keyframes
(carrying translateX(-50%)), dirty border, wrap/gap, mobile variant and
a prefers-reduced-motion opt-out; z-index 900 keeps it below modals
- .admin-main gains bottom padding so the bar never covers page content
- drop the now-unreachable idle hints: the ⌘S hint becomes a button title,
the Live Sync note becomes a static line above the settings layout
- header "Site" link now bypasses the cache (/?fresh=1), so the preview
stays reachable when the bar is hidden
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
* feat(admin): themed listbox for the album sort control (#427)
The per-album "Photo order" control was a native <select>. Because an
<option> cannot contain markup, its choices could not use the admin
panel's currentColor SVG set — the reason #415 had to fall back to plain
text after dropping the emoji labels.
Adds a Listbox component implementing the ARIA combobox/listbox pattern,
so options can render a glyph beside their label:
- DOM focus stays on the trigger button; the active option is announced
through aria-activedescendant, keeping focus management to one element
- Keyboard: arrows (clamped at the ends, like a native select),
Home/End, Enter/Space to commit, Escape to cancel, Tab commits and
moves on, and prefix type-ahead with a repeat-key cycle
- Outside dismissal on pointerdown, so a press starting outside closes
the popup before the click retargets
The sort options now carry an icon each: calendar, arrow-down, arrow-up,
an A→Z marker, and the drag glyph for manual — matching the badge the
album card already shows. SORT_LABELS stays plain text because the badge
feeds it to a title attribute.
Closes #417
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
* chore(git): ignore generated design handoff folders
* fix(admin): stop the album sort dropdown clipping, and simplify the panel (#428)
* fix(admin): render listbox popup in a portal so it escapes modal clipping
The sort control's popup was position:absolute inside three clipping ancestors
(.album-drawer overflow:hidden > .album-drawer-body overflow-y:auto >
.modal-right-column overflow-y:auto), so it was cut off at the bottom of the
Edit Album Details modal. z-index could not help: clipping happens before
stacking. It also always hung below the trigger, with no flip.
Portal the popup to document.body and position it from the trigger's viewport
rect, flipping above when there is more room there and capping max-height to the
space available so it scrolls internally rather than overflowing. It is
dismissed on scroll and resize, since the anchor is only measured on open.
The outside-pointerdown handler now also treats the popup as inside; without
that the portalled list counts as outside, and a click on an option would close
it before the selection commits.
* refactor(admin): single-column album details panel
The left column spent 1.2fr on a cover thumbnail and three stat rows, two of
which (Status, Custom Hero) only restated the form fields opposite them, while
the form itself was squeezed into 1.8fr behind a second nested scroller.
Stack the drawer in one column instead: cover as a banner, then the form at full
width, with the UUID moved into the footer. The body is now the only scroll
container, which also removes one of the ancestors that was clipping the sort
popup.
---------
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
* fix(admin): give the portalled listbox its theme back, lock the page behind modals (#429)
Two defects in the album editor.
The sort listbox popup painted transparent. Every --admin-* variable is
scoped to .admin-layout, and since the popup moved into document.body it
sits outside that subtree, so background/border/text all resolved to
nothing. It now carries its own copy of the palette in both colour
schemes, plus the font it no longer inherits.
Scrolling inside a modal also moved the page behind it. No admin modal
ever locked body scroll: the overlay covers the page but does not absorb
wheel events, so a scroll starting on the backdrop — or continuing past
the end of the modal's own scroller — reaches the document.
overscroll-behavior cannot cover that case on its own, because it only
applies to scroll containers and the backdrop is not one.
useScrollLock freezes body while a modal is open and compensates for the
width the scrollbar gives up, so nothing shifts underneath. Each lock
restores the inline value it found, which makes nesting work without a
counter — a picker opened from the drawer restores the drawer's hidden
state instead of clearing it. Applied to both drawers and all four
picker modals, which share the defect. overscroll-behavior: contain on
the scrollers stops the chaining they can handle themselves.
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
* fix(security): allow unsafe-eval in CSP script-src during dev mode
* feat(journal): add Journal Studio with split-screen editor, live preview and dedicated routes
* fix(build): separate client parser from server journal-service and fix build type errors
* fix(journal): Fotos rendern, Layout und Lightbox-Steuerung korrigieren
Fünf unabhängige Fehler in der öffentlichen Journal- und Essay-Ansicht:
* Foto-Blöcke wurden nie angezeigt. EssayView löst ein Foto über
PhotoItem.id auf, und das sind verschlüsselte Tokens — die Blöcke aus
dem Markdown tragen aber rohe Asset-UUIDs. Jede Zuordnung lief ins
Leere, und nicht auflösbare Blöcke werden still verworfen. Die IDs
werden jetzt serverseitig übersetzt; damit verschwinden nebenbei die
rohen UUIDs aus dem Client-Payload, die dort laut Projektregel nie
auftauchen dürfen. Nicht auflösbare Referenzen werden geloggt.
* Überschriften standen weiter links als der Fließtext. Jeder Block
hatte einzeln `max-width: 68ch`, und `ch` ist relativ zur Schrift des
Elements — die Serif-Überschrift ergab eine breitere Spalte. Ersetzt
durch eine gemeinsame, font-unabhängige `--essay-measure`.
* Fullbleed-Fotos bluteten nur nach links aus: `.essay-figure` ist
`width: 100%`, wodurch die Box überbestimmt ist und der negative
rechte Margin verworfen wird.
* Foto-Paare stellten beide Bilder gleich breit dar, wodurch ein
Hochformat neben einem Querformat doppelt so hoch wurde. Jetzt eine
Justified-Reihe: Breite proportional zum Seitenverhältnis, dadurch
exakt gleiche Höhen ohne Beschnitt.
* Die Lightbox hatte im Journal keine Tastatursteuerung und keine
Scroll-Sperre — beides lag in PhotoGrid, also nur im Album-Raster.
Verlagert in die Lightbox selbst, der doppelte Handler in PhotoGrid
entfernt (sonst wäre pro Pfeildruck zwei Bilder weitergesprungen).
Zusätzlich sind Proofing-Herzen und das EXIF-Panel im redaktionellen
Modus abschaltbar und im Journal aus: Client-Proofing ist ein
Übergabe-Workflow für Alben, keine Funktion einer Reportage. Auf der
Übersicht wurde der Untertitel doppelt gerendert, weil extractExcerpt()
auf ihn zurückfällt.
* feat(admin): eigene URLs für alle Bereiche und überarbeiteter Journal Studio
Das Panel war eine einzige Client-Komponente, die ihre Tabs über
useState umschaltet: keine Route pro Bereich, kein Deep-Link, kein
Zurück-Button, und nach jedem Reload landete man wieder auf "Pages".
Auch der Journal-Editor hatte keine eigene URL.
Jetzt sieben echte Routen (/admin, /admin/pages, /admin/journal,
/admin/journal/<slug>, /admin/settings, /admin/settings/<section>,
/admin/analytics). Die Shell mit Auth-Prüfung und Kopfzeile sitzt im
Layout und umschließt children — so bleibt die Session-Prüfung über
Routenwechsel montiert, statt bei jedem Tab-Wechsel neu zu laufen und
den Spinner aufblitzen zu lassen. Unbekannte Settings-Sections fallen
auf General zurück.
Im selben Zug der Journal Studio, der die Routing-Änderung ohnehin
berührt:
* Alle Eingabefelder nutzten die Klasse `admin-input`, die in keinem
CSS definiert war — sie fielen auf Browser-Defaults zurück. Jetzt
gestylt, gescoped, damit der generische Name nicht ins übrige Panel
leckt.
* Der Split View ist per Divider verschiebbar (Maus, Tastatur,
Doppelklick zum Zurücksetzen), Breite in localStorage.
* Das Studio bricht aus der 1120px-Spalte aus, die Preview hat Platz.
* Die Preview zeigte für jedes Foto fest 3:2 und log damit über das
Layout der veröffentlichten Seite; die echten Verhältnisse werden
jetzt an den Thumbnails gemessen.
* Blöcke mit alten positionsbasierten Foto-Referenzen werden markiert —
die lassen sich auf einer eigenständigen Journal-Seite nicht auflösen
und verschwanden bisher stillschweigend.
* Blocktyp-Chips als gemeinsame Komponente, monochrom und per Icon
unterschieden statt in einer eigenen Blau/Lila/Orange-Palette, die
sonst nirgends im Panel vorkommt.
* Emojis raus, SVG-Icons rein.
* fix(admin): Designsystem-Lücken im Panel schließen
Eine systematische Suche nach Klassen, die im TSX benutzt, aber in
keinem CSS definiert sind, hat vier Stellen mit demselben Muster
gefunden:
* `admin-btn-secondary` und `admin-btn-danger` existierten nicht.
Sämtliche Löschen-Buttons sahen aus wie normale Buttons — keine
Warnwirkung. Als `.admin-btn.admin-btn-danger` geschrieben, weil die
Varianten mit den Größenklassen kombiniert werden, die weiter unten
ihren eigenen Hintergrund setzen.
* `page-progress-fill` fehlte: die Balken im Analytics-Panel waren
leere Rinnen, der Wert unsichtbar. Ebenso `analytics-empty` und
`admin-loading-container`.
* `subpage-drawer-section`, `subpage-drawer-title-group` und
`input-with-icon` im PageBuilder waren wirkungslos und teils mit
Inline-Styles notdürftig kompensiert.
* `grid-card-preview` fehlte, wodurch alle Layout-Vorschauen auf Höhe
null kollabierten. Nur "Showcase" war sichtbar — und das aus Versehen,
weil sein Tile `hero-tile` hieß und damit die `aspect-ratio` einer
fremden PageBuilder-Klasse erbte. Umbenannt.
Dazu die Theme-Vorschauen, die praktisch identisch aussahen: alle
sieben zeigten dieselben drei quadratischen Kacheln, einziger
Unterschied war die Hintergrundfarbe. Sie spiegeln jetzt die echten
Preset-Daten aus lib/config/theme.ts — Schriftcharakter, Eckradius,
Rasterdichte, Passepartout bzw. Schatten.
Die Kopfzeile richtet sich an einer gemeinsamen Steuerhöhe aus. Der
"Site"-Link war höher als die Buttons daneben: `.admin-btn` hatte keine
explizite line-height, und <button> bekommt box-sizing: border-box vom
Browser, <a> nicht. Die Statusanzeige setzte weder Schriftfamilie noch
-größe und fiel auf den Browser-Default zurück — sie war nie Teil des
Designsystems. Jetzt gleiche Höhe und Typografie, Pillenform als
Zustandsanzeige, Trenner zur Aktionsgruppe. Das dauerhafte Pulsieren
des grünen Punkts entfällt; Animation bleibt den Zuständen vorbehalten,
die Aufmerksamkeit brauchen.
Restliche Emojis durch SVG-Icons ersetzt.
* feat(admin): add scroll-to-top toggle and SVG arrow
The back-to-top button was always on and drew its arrow with the ↑ text
character. Add a `scrollToTop` setting (General section in the admin
panel, defaults to on so existing sites are unaffected) and replace the
glyph with a stroked SVG that inherits currentColor across all presets.
Scroll handling is now rAF-throttled, and prefers-reduced-motion turns
off both the hover lift and the smooth scroll.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
* security(journal): escape author HTML instead of filtering it
CodeQL flags 26 high-severity alerts on the release PR; the bulk of them
point at sanitizeHtml(), a denylist of three regexes whose output goes
into dangerouslySetInnerHTML. I reproduced the bypasses before changing
anything — all four pass the old filter:
<img src=x onerror=alert(1)> unquoted handler, regex wants quotes
<img src=x onerror='alert(1)'> single quotes, same reason
<svg onload=alert(1)> not a <script> tag
javasjavascript:cript:alert(1) one-pass replace, the rest recombines
Plus an attribute breakout in the link renderer, which interpolated the
URL into href="${url}" unescaped:
[x](" onmouseover=alert(1) x=") -> <a href="" onmouseover=alert(1" ...>
Replaced with escaping. Every `&<>"'` in author text becomes an entity
before any markdown rule runs, so the only tags in the output are the
ones renderInlineMarkdown builds itself and a URL cannot leave its
attribute. Link schemes are now an allowlist (http, https, mailto, tel,
relative, anchor); anything else renders as plain text.
The serializer needed decodeHtmlEntities to match: without it a save
would write `<` into the Markdown file and the next parse would
escape the `&` again, corrupting the text further on every round trip.
A test covers parse -> serialize -> parse stability.
Two existing tests asserted the old behaviour and were rewritten rather
than deleted: one expected the script tag to be *removed* from the
output, the other expected the substring "onerror" to be absent. Both
now assert the property that matters — that no tag can form — because
`onerror` surviving as inert text is fine.
Exploitation required admin access either way: journal and essay text
comes from the studio or from content/*.md. This removes the weakness,
it does not close an open door.
* fix(journal): contain file paths, fix frontmatter escaping, defuse two regexes
Follow-up to the CodeQL findings on release PR #432. I went through all 23
alerts individually; this addresses the ones that are worth addressing and
documents the ones that are not.
Path containment (12 alerts, all false positives). Every path built from a
slug goes through isValidSlug(), a strict `/^[a-zA-Z0-9_-]+$/` allowlist —
verified against `../../etc/passwd`, `foo/../../bar`, `a/b`, `..` and
friends, all rejected. CodeQL cannot see it because the check lives in
another module. Added a containedPath() helper that resolves the path and
refuses anything landing outside the content directory: a second lock on a
door that was already locked, and a barrier the analysis can follow. Also
removed the dead `slug.endsWith('.md')` branches — isValidSlug rejects
dots, so they could never be taken.
Frontmatter escaping (1 alert, a real bug). The serializer escaped `"` but
not `\`, and the parser never unescaped anything. A title containing either
character gained a backslash on every save/load cycle:
Path C:\Users "quoted" -> Path C:\\Users \"quoted\" -> ...
Escaping now covers the backslash first and the parser undoes both. A round
trip test covers quotes, backslashes, colons and apostrophes.
Two of three ReDoS regexes (2 alerts). The heading pattern had `\s+` next to
`(.+)`, which overlap, so the engine tried every split of the whitespace run
before failing; it is `[ \t]+` and `(\S.*)` now. The quote author pattern
wrapped a lazy group around an optional group — the quadratic case — and is
an index split on the first separator now.
The third regex, the bold/italic pass, is deliberately left alone. Rewriting
it with a negated class removes the backtracking but breaks nesting:
`**bold *and italic* here**` renders as `*<em>bold </em>and italic<em> here</em>*`.
The input is Markdown from an authenticated admin, never a visitor, so the
worst case is an author slowing down their own page. The comment in the code
says so.
Not addressed: 5 js/insufficient-password-hash alerts. They ask for a slow
KDF where the code uses SHA-256/HMAC — correct in general, but the admin
password comes from an environment variable and is never stored, so a
stronger KDF protects nothing that is not already in plaintext in the
environment.
399 unit tests pass (18 new), build and tsc clean.
* fix(journal): split the quote author by scanning, not by pattern
Cleaning up after myself. #439 replaced the quote author regex
`/^(.*?)(?:\s+--\s+(.+))?$/` — a lazy group around an optional one, the
quadratic case — with `/\s+--\s+/`, and CodeQL promptly flagged the
replacement for the same reason. One reported pattern traded for another.
splitQuoteAuthor() scans for the first `--` that has whitespace on both
sides. Linear, and it needs no reasoning about the regex engine at all.
Behaviour is identical to the original regex, checked case by case
against it: separator, no separator, several separators, tabs, wide gaps,
`a--b` without spaces, leading and trailing separators, empty string. All
nine are covered by tests, plus one asserting it stays fast on a 50k
whitespace run.
* security(admin): derive the session signing key with scrypt
getSigningKey() ran the admin password through a single SHA-256 digest.
It is key derivation rather than password storage, so it was never a
stored-hash problem — but if the derived key ever leaked, one fast hash
makes recovering the password by brute force cheap. CodeQL flags it as
js/insufficient-password-hash and, for this particular alert, has a
point.
scrypt now. Two details that matter:
The salt has to be stable. A random salt would produce a different key on
every call and invalidate every session; it is derived from AUTH_SECRET,
which is deployment-specific. Verified across separate processes: same
inputs produce a verifying token, so a restart or redeploy does not log
everyone out.
The result is cached for the process lifetime. scrypt is deliberately
slow and getSigningKey() runs on every admin request — deriving per call
would add ~24ms to each one. The cache key is a digest of secret plus
password, so a rotation misses the cache and derives again, and no extra
plaintext copy of the password is kept around.
Measured: first derivation 24ms, subsequent calls 0.12ms. Password
change and secret change both invalidate an existing token, checked in
separate processes.
Note the one-time effect: existing admin sessions are invalidated by the
change in derivation, so everyone logs in once more.
* security(admin): key the signing-key cache on its inputs, not a digest
#441 removed the SHA-256 digest of the admin password from the key
derivation and introduced a new one three lines above it, as the cache
key. Same rule, same file: CodeQL reported it immediately.
The comment justifying it was wrong too. It claimed no second plaintext
copy of the password was retained, while building the digest input
allocates exactly that in order to hash it.
The cache now holds the two input strings and compares them directly.
They are the same objects the env and install caches already hold, so
nothing extra is retained, and no fast hash of the password exists in
memory for the life of the process.
Re-verified after the change, in separate processes: a token from one
process verifies in another with the same inputs, a changed password or
secret rejects it, first derivation 24ms, cached calls 0.001ms.
That leaves scrypt as the only place the password is hashed here. The
two HMACs further down operate on the derived key and on token data, not
on the password; the constant-time comparison in verifyAdminPassword is
the previously dismissed one.
---------
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
2026-08-14 16:55:07 +02:00
|
|
|
|
/** Manual reuses the drag glyph so the control matches the card's badge. */
|
|
|
|
|
|
const SORT_ICONS: Record<AlbumSortMode, ReactNode> = {
|
|
|
|
|
|
immich: <IconCalendar />,
|
|
|
|
|
|
newest: <IconArrowDown />,
|
|
|
|
|
|
oldest: <IconArrowUp />,
|
|
|
|
|
|
filename: <IconSortAlpha />,
|
|
|
|
|
|
manual: <IconGripVertical />,
|
|
|
|
|
|
};
|
|
|
|
|
|
|
|
|
|
|
|
const SORT_OPTIONS: readonly ListboxOption<AlbumSortMode>[] = ALBUM_SORT_MODES.map((mode) => ({
|
|
|
|
|
|
value: mode,
|
|
|
|
|
|
label: SORT_LABELS[mode],
|
|
|
|
|
|
icon: SORT_ICONS[mode],
|
|
|
|
|
|
}));
|
|
|
|
|
|
|
feat: add visual admin panel with page builder and settings editor
- Add /admin route with password-protected visual page builder
- Page Builder: manage hero images, standalone albums, subpages, and sections
- Album Picker: browse all shared Immich albums with search and filtering
- Settings Editor: theme, grid, footer, legal, SEO configuration
- YAML service with atomic writes and automatic backups (content/.backups/)
- HMAC-signed admin sessions (24h expiry, HttpOnly cookies)
- API endpoints: /api/admin/{auth,gallery,settings,albums,reload}
- Enable with ADMIN_PASSWORD env var; disabled by default
- invalidateConfigCache() export for hot-reload after saves
2026-05-29 17:04:37 +02:00
|
|
|
|
// ── Types ──────────────────────────────────────────────────────
|
|
|
|
|
|
interface AlbumEntry {
|
|
|
|
|
|
id: string;
|
|
|
|
|
|
title?: string;
|
|
|
|
|
|
description?: string;
|
|
|
|
|
|
password?: string;
|
2026-05-30 15:33:43 +02:00
|
|
|
|
heroImage?: string;
|
2026-08-14 11:10:42 +02:00
|
|
|
|
sort?: AlbumSortMode;
|
|
|
|
|
|
/** Pinned asset UUIDs for `sort: manual`; everything else follows automatically. */
|
|
|
|
|
|
assetOrder?: string[];
|
experimental: portfolio features (justified layout, unlisted pages, captions, per-album grid, focal point, nav links, cover hero) (#431)
## Was ist das?
Sieben neue Portfolio-Features, alle als **experimental** gekennzeichnet
— in YAML-Kommentaren, Admin-Panel-Labels und Commit-Scopes, damit sie
einzeln nachvollziehbar und revertierbar bleiben.
## Features (je ein Commit)
| Commit | Feature |
| --- | --- |
| `justified rows gallery layout` | Neues Grid-Layout `justified`:
zeilenbasiert, gleiche Höhen, volle Breite — Flexbox ohne JS-Messung,
letzte Zeile bleibt natürlich klein |
| `hide subpages from navigation` | `hidden: true`: Seite aus
Nav/Homepage raus, per Direktlink erreichbar — im Gegensatz zu `enabled:
false` (404) |
| `lightbox captions` | Immich-Asset-Description als Bildunterschrift im
Info-Panel; EXIF-Route liefert bei `exifOnHover: false` jetzt nur noch
die Caption statt 403 |
| `per-album grid overrides` | `grid:` pro Album-Eintrag, Präzedenz
global < Subpage < Album |
| `per-album cover focal point` | `coverPosition:` → `object-position`
auf Cover-Karten, strikt validiert |
| `external links in header navigation` | `navLinks:` in settings.yaml,
nur http(s), sanitisiert |
| `cover splash hero style` | `heroStyle: cover`: Fullscreen-Splash mit
Enter-Link ins Portfolio |
Alle Optionen sind im Admin-Panel editierbar (PageBuilder /
SettingsEditor).
## Tests
- 356 Unit-Tests grün (13 neue: deriveGallery hidden/grid/coverPosition,
sanitizeNavLinks, EXIF-Route-Captions, justified-Layout-Validierung)
- `npx tsc --noEmit`: 0 Fehler
- `npm run build`: sauber
- Justified-Zeilenmathematik und Cover-Splash per Browser-Harness
visuell/numerisch verifiziert (volle Zeilen enden exakt an der
Containerkante, letzte Zeile bleibt natürlich)
---------
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
2026-08-14 17:56:22 +02:00
|
|
|
|
/** EXPERIMENTAL: per-album grid override (layout only in the UI for now) */
|
|
|
|
|
|
grid?: { columns?: number; gap?: number; aspectRatio?: string; layout?: string };
|
|
|
|
|
|
/** EXPERIMENTAL: focal point for the cover crop, e.g. "50% 25%" or "top" */
|
|
|
|
|
|
coverPosition?: string;
|
feat: add visual admin panel with page builder and settings editor
- Add /admin route with password-protected visual page builder
- Page Builder: manage hero images, standalone albums, subpages, and sections
- Album Picker: browse all shared Immich albums with search and filtering
- Settings Editor: theme, grid, footer, legal, SEO configuration
- YAML service with atomic writes and automatic backups (content/.backups/)
- HMAC-signed admin sessions (24h expiry, HttpOnly cookies)
- API endpoints: /api/admin/{auth,gallery,settings,albums,reload}
- Enable with ADMIN_PASSWORD env var; disabled by default
- invalidateConfigCache() export for hot-reload after saves
2026-05-29 17:04:37 +02:00
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
interface Section {
|
|
|
|
|
|
title: string;
|
|
|
|
|
|
description?: string;
|
|
|
|
|
|
albums: AlbumEntry[];
|
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
interface Subpage {
|
|
|
|
|
|
name: string;
|
|
|
|
|
|
title?: string;
|
|
|
|
|
|
subtitle?: string;
|
|
|
|
|
|
password?: string;
|
security: add Trivy container scan to Docker publish workflow (#399)
* feat(admin): add backup manager UI with 1-click restore
* feat(admin): collapse older backup entries by default
* fix(theme): isolate admin layout, instant DOM theme updates, and add Light/Dark mode toggle
* feat(admin): replace text controls for Photo Frame and Hero Style with visual preview cards
* fix(admin): define missing CSS rules for button system (.btn, .preset-btn)
* feat(admin): redesign theme settings with segmented mode toggle, accent color swatches, and custom iOS-style toggle cards
* feat(admin): upgrade all settings tabs with visual grid previews, Google SEO snippet preview, and toggle cards
* feat(admin): overhaul Pages Builder UX with slide-over drawer, card hover badges, real-time search, and floating save bar
* fix(admin): remove leftover dangling syntax snippet in PageBuilder.tsx
* fix(admin): add position: relative to subpage-tile so hover overlay is contained inside the tile
* style(admin): replace all emojis with clean Leica-style vector SVG icons
* fix(types): extend IconProps with SVGProps to allow style prop on Leica SVG icons
* feat(admin): add subpage live-preview, privacy analytics, and asset protection settings
* fix(typecheck): fix AlbumEntry property access in subpage drawer preview mode
* fix(types): fix ImmichAlbumInfo property names thumbnailAssetId and albumName in PageBuilder.tsx
* fix(types): add protection and watermark optional properties to AppConfig interface
* feat(settings): add toggle for disabling analytics tracking (defaults to enabled)
* feat(ux): show status banner when analytics tracking is disabled + add live sync indicator
* feat(watermark): render customizable watermark overlay on Lightbox images + rename section to Portfolio Features & Modules
* fix(types): import type LightboxWatermark in PhotoGrid.tsx
* fix(types): destructure watermark prop in PhotoGrid function signature
* feat(seo): add configurable subpage title template and metadata descriptions
* feat(seo): add generateMetadata to about page for title template support
* feat(proofing): add client proofing, favorites selection, compact URL bitmasking, and export modal
* feat(essay): add Photo Essay storytelling mode with RSC markdown parser and fullbleed/pair layouts
* feat(subpages): add page enabled toggle to deactivate subpages without deleting them
* feat(admin): add visual essay block builder for photo essay storytelling pages
* security: add Trivy container scan to Docker publish workflow
Scans the built image for CRITICAL/HIGH CVEs on every release and
uploads results to the GitHub Security tab. Non-blocking for now
(exit-code 0) so releases aren't gated on findings. Also documents
the scan and existing Dependabot coverage in the README.
---------
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-08-07 11:08:04 +02:00
|
|
|
|
enabled?: boolean;
|
experimental: portfolio features (justified layout, unlisted pages, captions, per-album grid, focal point, nav links, cover hero) (#431)
## Was ist das?
Sieben neue Portfolio-Features, alle als **experimental** gekennzeichnet
— in YAML-Kommentaren, Admin-Panel-Labels und Commit-Scopes, damit sie
einzeln nachvollziehbar und revertierbar bleiben.
## Features (je ein Commit)
| Commit | Feature |
| --- | --- |
| `justified rows gallery layout` | Neues Grid-Layout `justified`:
zeilenbasiert, gleiche Höhen, volle Breite — Flexbox ohne JS-Messung,
letzte Zeile bleibt natürlich klein |
| `hide subpages from navigation` | `hidden: true`: Seite aus
Nav/Homepage raus, per Direktlink erreichbar — im Gegensatz zu `enabled:
false` (404) |
| `lightbox captions` | Immich-Asset-Description als Bildunterschrift im
Info-Panel; EXIF-Route liefert bei `exifOnHover: false` jetzt nur noch
die Caption statt 403 |
| `per-album grid overrides` | `grid:` pro Album-Eintrag, Präzedenz
global < Subpage < Album |
| `per-album cover focal point` | `coverPosition:` → `object-position`
auf Cover-Karten, strikt validiert |
| `external links in header navigation` | `navLinks:` in settings.yaml,
nur http(s), sanitisiert |
| `cover splash hero style` | `heroStyle: cover`: Fullscreen-Splash mit
Enter-Link ins Portfolio |
Alle Optionen sind im Admin-Panel editierbar (PageBuilder /
SettingsEditor).
## Tests
- 356 Unit-Tests grün (13 neue: deriveGallery hidden/grid/coverPosition,
sanitizeNavLinks, EXIF-Route-Captions, justified-Layout-Validierung)
- `npx tsc --noEmit`: 0 Fehler
- `npm run build`: sauber
- Justified-Zeilenmathematik und Cover-Splash per Browser-Harness
visuell/numerisch verifiziert (volle Zeilen enden exakt an der
Containerkante, letzte Zeile bleibt natürlich)
---------
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
2026-08-14 17:56:22 +02:00
|
|
|
|
/** EXPERIMENTAL: reachable by direct link, but not shown in navigation */
|
|
|
|
|
|
hidden?: boolean;
|
security: add Trivy container scan to Docker publish workflow (#399)
* feat(admin): add backup manager UI with 1-click restore
* feat(admin): collapse older backup entries by default
* fix(theme): isolate admin layout, instant DOM theme updates, and add Light/Dark mode toggle
* feat(admin): replace text controls for Photo Frame and Hero Style with visual preview cards
* fix(admin): define missing CSS rules for button system (.btn, .preset-btn)
* feat(admin): redesign theme settings with segmented mode toggle, accent color swatches, and custom iOS-style toggle cards
* feat(admin): upgrade all settings tabs with visual grid previews, Google SEO snippet preview, and toggle cards
* feat(admin): overhaul Pages Builder UX with slide-over drawer, card hover badges, real-time search, and floating save bar
* fix(admin): remove leftover dangling syntax snippet in PageBuilder.tsx
* fix(admin): add position: relative to subpage-tile so hover overlay is contained inside the tile
* style(admin): replace all emojis with clean Leica-style vector SVG icons
* fix(types): extend IconProps with SVGProps to allow style prop on Leica SVG icons
* feat(admin): add subpage live-preview, privacy analytics, and asset protection settings
* fix(typecheck): fix AlbumEntry property access in subpage drawer preview mode
* fix(types): fix ImmichAlbumInfo property names thumbnailAssetId and albumName in PageBuilder.tsx
* fix(types): add protection and watermark optional properties to AppConfig interface
* feat(settings): add toggle for disabling analytics tracking (defaults to enabled)
* feat(ux): show status banner when analytics tracking is disabled + add live sync indicator
* feat(watermark): render customizable watermark overlay on Lightbox images + rename section to Portfolio Features & Modules
* fix(types): import type LightboxWatermark in PhotoGrid.tsx
* fix(types): destructure watermark prop in PhotoGrid function signature
* feat(seo): add configurable subpage title template and metadata descriptions
* feat(seo): add generateMetadata to about page for title template support
* feat(proofing): add client proofing, favorites selection, compact URL bitmasking, and export modal
* feat(essay): add Photo Essay storytelling mode with RSC markdown parser and fullbleed/pair layouts
* feat(subpages): add page enabled toggle to deactivate subpages without deleting them
* feat(admin): add visual essay block builder for photo essay storytelling pages
* security: add Trivy container scan to Docker publish workflow
Scans the built image for CRITICAL/HIGH CVEs on every release and
uploads results to the GitHub Security tab. Non-blocking for now
(exit-code 0) so releases aren't gated on findings. Also documents
the scan and existing Dependabot coverage in the README.
---------
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-08-07 11:08:04 +02:00
|
|
|
|
essayText?: string;
|
|
|
|
|
|
essayFile?: string;
|
feat: add visual admin panel with page builder and settings editor
- Add /admin route with password-protected visual page builder
- Page Builder: manage hero images, standalone albums, subpages, and sections
- Album Picker: browse all shared Immich albums with search and filtering
- Settings Editor: theme, grid, footer, legal, SEO configuration
- YAML service with atomic writes and automatic backups (content/.backups/)
- HMAC-signed admin sessions (24h expiry, HttpOnly cookies)
- API endpoints: /api/admin/{auth,gallery,settings,albums,reload}
- Enable with ADMIN_PASSWORD env var; disabled by default
- invalidateConfigCache() export for hot-reload after saves
2026-05-29 17:04:37 +02:00
|
|
|
|
sections?: Section[];
|
|
|
|
|
|
albums: AlbumEntry[];
|
|
|
|
|
|
grid?: { columns?: number; gap?: number; aspectRatio?: string; layout?: string };
|
|
|
|
|
|
}
|
|
|
|
|
|
|
2026-08-23 23:18:14 +02:00
|
|
|
|
/**
|
|
|
|
|
|
* Drops keys the editor cleared so an emptied field never persists as `null`
|
|
|
|
|
|
* in gallery.yaml, and returns undefined once nothing is left — `handleSave`
|
|
|
|
|
|
* only writes `grid` when it is truthy.
|
|
|
|
|
|
*/
|
|
|
|
|
|
function normalizeSubpageGrid(grid: Subpage['grid']): Subpage['grid'] {
|
|
|
|
|
|
if (!grid) return undefined;
|
|
|
|
|
|
const next = { ...grid };
|
|
|
|
|
|
for (const key of Object.keys(next) as Array<keyof typeof next>) {
|
|
|
|
|
|
const value = next[key];
|
|
|
|
|
|
if (value === undefined || value === '') delete next[key];
|
|
|
|
|
|
}
|
|
|
|
|
|
return Object.keys(next).length > 0 ? next : undefined;
|
|
|
|
|
|
}
|
|
|
|
|
|
|
feat: add visual admin panel with page builder and settings editor
- Add /admin route with password-protected visual page builder
- Page Builder: manage hero images, standalone albums, subpages, and sections
- Album Picker: browse all shared Immich albums with search and filtering
- Settings Editor: theme, grid, footer, legal, SEO configuration
- YAML service with atomic writes and automatic backups (content/.backups/)
- HMAC-signed admin sessions (24h expiry, HttpOnly cookies)
- API endpoints: /api/admin/{auth,gallery,settings,albums,reload}
- Enable with ADMIN_PASSWORD env var; disabled by default
- invalidateConfigCache() export for hot-reload after saves
2026-05-29 17:04:37 +02:00
|
|
|
|
interface GalleryState {
|
|
|
|
|
|
hero: string[];
|
|
|
|
|
|
albums: AlbumEntry[];
|
|
|
|
|
|
subpages: Subpage[];
|
|
|
|
|
|
}
|
|
|
|
|
|
|
2026-05-31 21:27:13 +02:00
|
|
|
|
interface ActiveEditAlbumAddress {
|
|
|
|
|
|
type: 'standalone' | 'subpage' | 'section';
|
|
|
|
|
|
subpageIndex?: number;
|
|
|
|
|
|
sectionIndex?: number;
|
|
|
|
|
|
albumIndex: number;
|
|
|
|
|
|
}
|
|
|
|
|
|
|
feat: add visual admin panel with page builder and settings editor
- Add /admin route with password-protected visual page builder
- Page Builder: manage hero images, standalone albums, subpages, and sections
- Album Picker: browse all shared Immich albums with search and filtering
- Settings Editor: theme, grid, footer, legal, SEO configuration
- YAML service with atomic writes and automatic backups (content/.backups/)
- HMAC-signed admin sessions (24h expiry, HttpOnly cookies)
- API endpoints: /api/admin/{auth,gallery,settings,albums,reload}
- Enable with ADMIN_PASSWORD env var; disabled by default
- invalidateConfigCache() export for hot-reload after saves
2026-05-29 17:04:37 +02:00
|
|
|
|
interface ImmichAlbumInfo {
|
|
|
|
|
|
id: string;
|
|
|
|
|
|
albumName: string;
|
|
|
|
|
|
description: string;
|
|
|
|
|
|
thumbnailAssetId: string | null;
|
|
|
|
|
|
assetCount: number;
|
|
|
|
|
|
isConfigured: boolean;
|
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
// ── Helpers ────────────────────────────────────────────────────
|
|
|
|
|
|
|
2026-08-14 11:10:42 +02:00
|
|
|
|
type RawAlbumEntry = string | Record<string, string | AlbumEntryObject>;
|
|
|
|
|
|
|
|
|
|
|
|
/**
|
|
|
|
|
|
* Whether an entry carries anything beyond its ID.
|
|
|
|
|
|
*
|
|
|
|
|
|
* Both collapse rules below depend on this, and they are the reason every new
|
|
|
|
|
|
* per-album option has to be listed here: an entry that looks "empty" is
|
|
|
|
|
|
* serialized back to a bare UUID string, so a field missing from this check is
|
|
|
|
|
|
* silently dropped on the next save.
|
|
|
|
|
|
*/
|
|
|
|
|
|
function hasAlbumOptions(entry: AlbumEntry): boolean {
|
|
|
|
|
|
return Boolean(
|
|
|
|
|
|
entry.description ||
|
|
|
|
|
|
entry.password ||
|
|
|
|
|
|
entry.heroImage ||
|
|
|
|
|
|
(entry.sort && entry.sort !== DEFAULT_ALBUM_SORT) ||
|
experimental: portfolio features (justified layout, unlisted pages, captions, per-album grid, focal point, nav links, cover hero) (#431)
## Was ist das?
Sieben neue Portfolio-Features, alle als **experimental** gekennzeichnet
— in YAML-Kommentaren, Admin-Panel-Labels und Commit-Scopes, damit sie
einzeln nachvollziehbar und revertierbar bleiben.
## Features (je ein Commit)
| Commit | Feature |
| --- | --- |
| `justified rows gallery layout` | Neues Grid-Layout `justified`:
zeilenbasiert, gleiche Höhen, volle Breite — Flexbox ohne JS-Messung,
letzte Zeile bleibt natürlich klein |
| `hide subpages from navigation` | `hidden: true`: Seite aus
Nav/Homepage raus, per Direktlink erreichbar — im Gegensatz zu `enabled:
false` (404) |
| `lightbox captions` | Immich-Asset-Description als Bildunterschrift im
Info-Panel; EXIF-Route liefert bei `exifOnHover: false` jetzt nur noch
die Caption statt 403 |
| `per-album grid overrides` | `grid:` pro Album-Eintrag, Präzedenz
global < Subpage < Album |
| `per-album cover focal point` | `coverPosition:` → `object-position`
auf Cover-Karten, strikt validiert |
| `external links in header navigation` | `navLinks:` in settings.yaml,
nur http(s), sanitisiert |
| `cover splash hero style` | `heroStyle: cover`: Fullscreen-Splash mit
Enter-Link ins Portfolio |
Alle Optionen sind im Admin-Panel editierbar (PageBuilder /
SettingsEditor).
## Tests
- 356 Unit-Tests grün (13 neue: deriveGallery hidden/grid/coverPosition,
sanitizeNavLinks, EXIF-Route-Captions, justified-Layout-Validierung)
- `npx tsc --noEmit`: 0 Fehler
- `npm run build`: sauber
- Justified-Zeilenmathematik und Cover-Splash per Browser-Harness
visuell/numerisch verifiziert (volle Zeilen enden exakt an der
Containerkante, letzte Zeile bleibt natürlich)
---------
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
2026-08-14 17:56:22 +02:00
|
|
|
|
entry.assetOrder?.length ||
|
|
|
|
|
|
entry.grid ||
|
|
|
|
|
|
entry.coverPosition,
|
2026-08-14 11:10:42 +02:00
|
|
|
|
);
|
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
function parseAlbumEntries(raw: RawAlbumEntry[] | undefined): AlbumEntry[] {
|
feat: add visual admin panel with page builder and settings editor
- Add /admin route with password-protected visual page builder
- Page Builder: manage hero images, standalone albums, subpages, and sections
- Album Picker: browse all shared Immich albums with search and filtering
- Settings Editor: theme, grid, footer, legal, SEO configuration
- YAML service with atomic writes and automatic backups (content/.backups/)
- HMAC-signed admin sessions (24h expiry, HttpOnly cookies)
- API endpoints: /api/admin/{auth,gallery,settings,albums,reload}
- Enable with ADMIN_PASSWORD env var; disabled by default
- invalidateConfigCache() export for hot-reload after saves
2026-05-29 17:04:37 +02:00
|
|
|
|
if (!raw) return [];
|
|
|
|
|
|
return raw.map((entry) => {
|
|
|
|
|
|
if (typeof entry === 'string') return { id: entry };
|
|
|
|
|
|
const [id, value] = Object.entries(entry)[0];
|
|
|
|
|
|
if (typeof value === 'string') return { id, title: value };
|
2026-05-30 15:33:43 +02:00
|
|
|
|
return {
|
|
|
|
|
|
id,
|
|
|
|
|
|
title: value.title,
|
|
|
|
|
|
description: value.description,
|
|
|
|
|
|
password: value.password,
|
|
|
|
|
|
heroImage: value.heroImage,
|
2026-08-14 11:10:42 +02:00
|
|
|
|
sort: isAlbumSortMode(value.sort) ? value.sort : undefined,
|
|
|
|
|
|
assetOrder: value.assetOrder,
|
experimental: portfolio features (justified layout, unlisted pages, captions, per-album grid, focal point, nav links, cover hero) (#431)
## Was ist das?
Sieben neue Portfolio-Features, alle als **experimental** gekennzeichnet
— in YAML-Kommentaren, Admin-Panel-Labels und Commit-Scopes, damit sie
einzeln nachvollziehbar und revertierbar bleiben.
## Features (je ein Commit)
| Commit | Feature |
| --- | --- |
| `justified rows gallery layout` | Neues Grid-Layout `justified`:
zeilenbasiert, gleiche Höhen, volle Breite — Flexbox ohne JS-Messung,
letzte Zeile bleibt natürlich klein |
| `hide subpages from navigation` | `hidden: true`: Seite aus
Nav/Homepage raus, per Direktlink erreichbar — im Gegensatz zu `enabled:
false` (404) |
| `lightbox captions` | Immich-Asset-Description als Bildunterschrift im
Info-Panel; EXIF-Route liefert bei `exifOnHover: false` jetzt nur noch
die Caption statt 403 |
| `per-album grid overrides` | `grid:` pro Album-Eintrag, Präzedenz
global < Subpage < Album |
| `per-album cover focal point` | `coverPosition:` → `object-position`
auf Cover-Karten, strikt validiert |
| `external links in header navigation` | `navLinks:` in settings.yaml,
nur http(s), sanitisiert |
| `cover splash hero style` | `heroStyle: cover`: Fullscreen-Splash mit
Enter-Link ins Portfolio |
Alle Optionen sind im Admin-Panel editierbar (PageBuilder /
SettingsEditor).
## Tests
- 356 Unit-Tests grün (13 neue: deriveGallery hidden/grid/coverPosition,
sanitizeNavLinks, EXIF-Route-Captions, justified-Layout-Validierung)
- `npx tsc --noEmit`: 0 Fehler
- `npm run build`: sauber
- Justified-Zeilenmathematik und Cover-Splash per Browser-Harness
visuell/numerisch verifiziert (volle Zeilen enden exakt an der
Containerkante, letzte Zeile bleibt natürlich)
---------
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
2026-08-14 17:56:22 +02:00
|
|
|
|
grid: value.grid,
|
|
|
|
|
|
coverPosition: value.coverPosition,
|
2026-05-30 15:33:43 +02:00
|
|
|
|
};
|
feat: add visual admin panel with page builder and settings editor
- Add /admin route with password-protected visual page builder
- Page Builder: manage hero images, standalone albums, subpages, and sections
- Album Picker: browse all shared Immich albums with search and filtering
- Settings Editor: theme, grid, footer, legal, SEO configuration
- YAML service with atomic writes and automatic backups (content/.backups/)
- HMAC-signed admin sessions (24h expiry, HttpOnly cookies)
- API endpoints: /api/admin/{auth,gallery,settings,albums,reload}
- Enable with ADMIN_PASSWORD env var; disabled by default
- invalidateConfigCache() export for hot-reload after saves
2026-05-29 17:04:37 +02:00
|
|
|
|
});
|
|
|
|
|
|
}
|
|
|
|
|
|
|
2026-08-14 11:10:42 +02:00
|
|
|
|
function serializeAlbumEntries(entries: AlbumEntry[]): RawAlbumEntry[] {
|
feat: add visual admin panel with page builder and settings editor
- Add /admin route with password-protected visual page builder
- Page Builder: manage hero images, standalone albums, subpages, and sections
- Album Picker: browse all shared Immich albums with search and filtering
- Settings Editor: theme, grid, footer, legal, SEO configuration
- YAML service with atomic writes and automatic backups (content/.backups/)
- HMAC-signed admin sessions (24h expiry, HttpOnly cookies)
- API endpoints: /api/admin/{auth,gallery,settings,albums,reload}
- Enable with ADMIN_PASSWORD env var; disabled by default
- invalidateConfigCache() export for hot-reload after saves
2026-05-29 17:04:37 +02:00
|
|
|
|
return entries.map((entry) => {
|
2026-08-14 11:10:42 +02:00
|
|
|
|
const extras = hasAlbumOptions(entry);
|
|
|
|
|
|
if (!entry.title && !extras) return entry.id;
|
|
|
|
|
|
if (entry.title && !extras) return { [entry.id]: entry.title };
|
|
|
|
|
|
|
|
|
|
|
|
const val: AlbumEntryObject = {};
|
|
|
|
|
|
// Only when set: a sort-only entry would otherwise be written with an empty
|
|
|
|
|
|
// title, which deriveGallery ignores but which still lands in the YAML.
|
|
|
|
|
|
if (entry.title) val.title = entry.title;
|
feat: add visual admin panel with page builder and settings editor
- Add /admin route with password-protected visual page builder
- Page Builder: manage hero images, standalone albums, subpages, and sections
- Album Picker: browse all shared Immich albums with search and filtering
- Settings Editor: theme, grid, footer, legal, SEO configuration
- YAML service with atomic writes and automatic backups (content/.backups/)
- HMAC-signed admin sessions (24h expiry, HttpOnly cookies)
- API endpoints: /api/admin/{auth,gallery,settings,albums,reload}
- Enable with ADMIN_PASSWORD env var; disabled by default
- invalidateConfigCache() export for hot-reload after saves
2026-05-29 17:04:37 +02:00
|
|
|
|
if (entry.description) val.description = entry.description;
|
|
|
|
|
|
if (entry.password) val.password = entry.password;
|
2026-05-30 15:33:43 +02:00
|
|
|
|
if (entry.heroImage) val.heroImage = entry.heroImage;
|
2026-08-14 11:10:42 +02:00
|
|
|
|
if (entry.sort && entry.sort !== DEFAULT_ALBUM_SORT) val.sort = entry.sort;
|
|
|
|
|
|
// Persisted regardless of the mode, so manual → newest → manual does not
|
|
|
|
|
|
// throw away a hand-curated order.
|
|
|
|
|
|
if (entry.assetOrder?.length) val.assetOrder = entry.assetOrder;
|
experimental: portfolio features (justified layout, unlisted pages, captions, per-album grid, focal point, nav links, cover hero) (#431)
## Was ist das?
Sieben neue Portfolio-Features, alle als **experimental** gekennzeichnet
— in YAML-Kommentaren, Admin-Panel-Labels und Commit-Scopes, damit sie
einzeln nachvollziehbar und revertierbar bleiben.
## Features (je ein Commit)
| Commit | Feature |
| --- | --- |
| `justified rows gallery layout` | Neues Grid-Layout `justified`:
zeilenbasiert, gleiche Höhen, volle Breite — Flexbox ohne JS-Messung,
letzte Zeile bleibt natürlich klein |
| `hide subpages from navigation` | `hidden: true`: Seite aus
Nav/Homepage raus, per Direktlink erreichbar — im Gegensatz zu `enabled:
false` (404) |
| `lightbox captions` | Immich-Asset-Description als Bildunterschrift im
Info-Panel; EXIF-Route liefert bei `exifOnHover: false` jetzt nur noch
die Caption statt 403 |
| `per-album grid overrides` | `grid:` pro Album-Eintrag, Präzedenz
global < Subpage < Album |
| `per-album cover focal point` | `coverPosition:` → `object-position`
auf Cover-Karten, strikt validiert |
| `external links in header navigation` | `navLinks:` in settings.yaml,
nur http(s), sanitisiert |
| `cover splash hero style` | `heroStyle: cover`: Fullscreen-Splash mit
Enter-Link ins Portfolio |
Alle Optionen sind im Admin-Panel editierbar (PageBuilder /
SettingsEditor).
## Tests
- 356 Unit-Tests grün (13 neue: deriveGallery hidden/grid/coverPosition,
sanitizeNavLinks, EXIF-Route-Captions, justified-Layout-Validierung)
- `npx tsc --noEmit`: 0 Fehler
- `npm run build`: sauber
- Justified-Zeilenmathematik und Cover-Splash per Browser-Harness
visuell/numerisch verifiziert (volle Zeilen enden exakt an der
Containerkante, letzte Zeile bleibt natürlich)
---------
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
2026-08-14 17:56:22 +02:00
|
|
|
|
if (entry.grid) val.grid = entry.grid;
|
|
|
|
|
|
if (entry.coverPosition) val.coverPosition = entry.coverPosition;
|
feat: add visual admin panel with page builder and settings editor
- Add /admin route with password-protected visual page builder
- Page Builder: manage hero images, standalone albums, subpages, and sections
- Album Picker: browse all shared Immich albums with search and filtering
- Settings Editor: theme, grid, footer, legal, SEO configuration
- YAML service with atomic writes and automatic backups (content/.backups/)
- HMAC-signed admin sessions (24h expiry, HttpOnly cookies)
- API endpoints: /api/admin/{auth,gallery,settings,albums,reload}
- Enable with ADMIN_PASSWORD env var; disabled by default
- invalidateConfigCache() export for hot-reload after saves
2026-05-29 17:04:37 +02:00
|
|
|
|
return { [entry.id]: val };
|
|
|
|
|
|
});
|
|
|
|
|
|
}
|
|
|
|
|
|
|
2026-05-29 17:59:25 +02:00
|
|
|
|
// ── Sortable Hero Tile ─────────────────────────────────────────
|
|
|
|
|
|
|
|
|
|
|
|
function SortableHeroTile({
|
|
|
|
|
|
id,
|
|
|
|
|
|
index,
|
|
|
|
|
|
onRemove,
|
|
|
|
|
|
}: {
|
|
|
|
|
|
id: string;
|
|
|
|
|
|
index: number;
|
|
|
|
|
|
onRemove: () => void;
|
|
|
|
|
|
}) {
|
|
|
|
|
|
const { attributes, listeners, setNodeRef, transform, transition, isDragging } = useSortable({
|
|
|
|
|
|
id: `hero-${index}`,
|
|
|
|
|
|
});
|
|
|
|
|
|
|
|
|
|
|
|
const style = {
|
|
|
|
|
|
transform: CSS.Transform.toString(transform),
|
|
|
|
|
|
transition,
|
|
|
|
|
|
opacity: isDragging ? 0.5 : 1,
|
|
|
|
|
|
zIndex: isDragging ? 10 : undefined,
|
|
|
|
|
|
};
|
|
|
|
|
|
|
|
|
|
|
|
return (
|
|
|
|
|
|
<div ref={setNodeRef} style={style} className="hero-tile" {...attributes}>
|
|
|
|
|
|
<div className="hero-tile-drag" {...listeners} title="Drag to reorder">
|
2026-08-14 11:10:42 +02:00
|
|
|
|
<IconGripVertical size={18} className="svg-icon svg-drag" />
|
2026-05-29 17:59:25 +02:00
|
|
|
|
</div>
|
|
|
|
|
|
<img src={`/api/admin/thumbnail/${id}`} alt="" loading="lazy" />
|
|
|
|
|
|
<button className="hero-tile-remove" onClick={onRemove} title="Remove">
|
2026-08-14 11:10:42 +02:00
|
|
|
|
<IconX size={14} />
|
2026-05-29 17:59:25 +02:00
|
|
|
|
</button>
|
|
|
|
|
|
<span className="hero-tile-index">{index + 1}</span>
|
|
|
|
|
|
</div>
|
|
|
|
|
|
);
|
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
// ── Sortable Album Card ────────────────────────────────────────
|
|
|
|
|
|
|
|
|
|
|
|
function SortableAlbumCard({
|
|
|
|
|
|
album,
|
|
|
|
|
|
index,
|
|
|
|
|
|
name,
|
|
|
|
|
|
count,
|
|
|
|
|
|
thumbnailId,
|
|
|
|
|
|
onRemove,
|
2026-05-31 21:27:13 +02:00
|
|
|
|
onEdit,
|
2026-05-29 17:59:25 +02:00
|
|
|
|
}: {
|
|
|
|
|
|
album: AlbumEntry;
|
|
|
|
|
|
index: number;
|
|
|
|
|
|
name: string;
|
|
|
|
|
|
count: number;
|
|
|
|
|
|
thumbnailId: string | null;
|
|
|
|
|
|
onRemove: () => void;
|
2026-05-31 21:27:13 +02:00
|
|
|
|
onEdit: () => void;
|
2026-05-29 17:59:25 +02:00
|
|
|
|
}) {
|
|
|
|
|
|
const { attributes, listeners, setNodeRef, transform, transition, isDragging } = useSortable({
|
|
|
|
|
|
id: `album-${album.id}-${index}`,
|
|
|
|
|
|
});
|
|
|
|
|
|
|
|
|
|
|
|
const style = {
|
|
|
|
|
|
transform: CSS.Transform.toString(transform),
|
|
|
|
|
|
transition,
|
|
|
|
|
|
opacity: isDragging ? 0.5 : 1,
|
|
|
|
|
|
zIndex: isDragging ? 10 : undefined,
|
|
|
|
|
|
};
|
|
|
|
|
|
|
|
|
|
|
|
return (
|
|
|
|
|
|
<div ref={setNodeRef} style={style} {...attributes}>
|
|
|
|
|
|
<AlbumCard
|
|
|
|
|
|
album={album}
|
|
|
|
|
|
name={name}
|
|
|
|
|
|
count={count}
|
|
|
|
|
|
thumbnailId={thumbnailId}
|
|
|
|
|
|
onRemove={onRemove}
|
2026-05-31 21:27:13 +02:00
|
|
|
|
onEdit={onEdit}
|
2026-05-29 17:59:25 +02:00
|
|
|
|
dragListeners={listeners}
|
|
|
|
|
|
/>
|
|
|
|
|
|
</div>
|
|
|
|
|
|
);
|
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
// ── Sortable Subpage Tile ──────────────────────────────────────
|
|
|
|
|
|
|
|
|
|
|
|
function SortableSubpageTile({
|
|
|
|
|
|
sp,
|
|
|
|
|
|
spIndex,
|
|
|
|
|
|
isActive,
|
|
|
|
|
|
onClick,
|
|
|
|
|
|
getFirstThumb,
|
|
|
|
|
|
}: {
|
|
|
|
|
|
sp: Subpage;
|
|
|
|
|
|
spIndex: number;
|
|
|
|
|
|
isActive: boolean;
|
|
|
|
|
|
onClick: () => void;
|
|
|
|
|
|
getFirstThumb: (sp: Subpage) => string | null;
|
|
|
|
|
|
}) {
|
|
|
|
|
|
const { attributes, listeners, setNodeRef, transform, transition, isDragging } = useSortable({
|
|
|
|
|
|
id: `subpage-${spIndex}`,
|
|
|
|
|
|
});
|
|
|
|
|
|
|
|
|
|
|
|
const style = {
|
|
|
|
|
|
transform: CSS.Transform.toString(transform),
|
|
|
|
|
|
transition,
|
|
|
|
|
|
opacity: isDragging ? 0.5 : 1,
|
|
|
|
|
|
zIndex: isDragging ? 10 : undefined,
|
|
|
|
|
|
};
|
|
|
|
|
|
|
|
|
|
|
|
const totalAlbums =
|
|
|
|
|
|
sp.albums.length + (sp.sections?.reduce((sum, sec) => sum + sec.albums.length, 0) || 0);
|
|
|
|
|
|
const firstThumb = getFirstThumb(sp);
|
release: v0.11.0 (#459)
Ships `dev` as **v0.11.0**. `main` contains nothing that `dev` does not,
so this is a clean sync.
## Headline changes since v0.10.0
- **Journal & Journal Studio** — photo essays at `/journal`,
split-screen block editor with live preview, drafts, per-entry
passwords, cover images
- **First-run setup wizard at `/install`** — configure a fresh
deployment from the browser; credentials are verified against Immich
before anything is written, and the wizard is gated by a one-time token
- **About page editor and toggle** in the admin panel
- **Per-album photo order** independent of Immich, with a drag & drop
editor
- **Custom favicon upload**
- **Experimental portfolio features** — justified grid, `cover` hero,
unlisted subpages, per-album grid overrides, cover focal points,
external nav links
- **Security** — asset tokens length-capped before decoding (#423),
journal author markdown escaped rather than filtered, journal file paths
contained, admin session key derived with scrypt (#432), Next.js 16.3.0
for CVE-2025-13465
- **Fixed** — client proofing honours its own configuration again
(#454); journal photo rendering (#432)
Full detail in [CHANGELOG.md](CHANGELOG.md#0110--2026-08-15).
## Verified
`npx tsc --noEmit` clean · `npx vitest run` 435 tests pass · `npm run
build` succeeds · lint 0 errors · `prettier --check` clean · local
`docker build` of the release tree.
## After merge
Tag `v0.11.0` on `main` and publish the release — that triggers
`docker-publish.yml`, which pushes the image and moves `latest`.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
---------
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
2026-08-15 09:09:18 +02:00
|
|
|
|
const slug = sp.name
|
|
|
|
|
|
.toLowerCase()
|
|
|
|
|
|
.replace(/[^a-z0-9]+/g, '-')
|
|
|
|
|
|
.replace(/^-|-$/g, '');
|
2026-05-29 17:59:25 +02:00
|
|
|
|
|
|
|
|
|
|
return (
|
|
|
|
|
|
<div
|
|
|
|
|
|
ref={setNodeRef}
|
|
|
|
|
|
style={style}
|
|
|
|
|
|
className={`subpage-tile ${isActive ? 'active' : ''}`}
|
|
|
|
|
|
onClick={onClick}
|
|
|
|
|
|
{...attributes}
|
|
|
|
|
|
>
|
|
|
|
|
|
<div className="subpage-tile-drag" {...listeners} title="Drag to reorder">
|
2026-08-14 11:10:42 +02:00
|
|
|
|
<IconGripVertical size={18} className="svg-icon svg-drag" />
|
2026-05-29 17:59:25 +02:00
|
|
|
|
</div>
|
security: add Trivy container scan to Docker publish workflow (#399)
* feat(admin): add backup manager UI with 1-click restore
* feat(admin): collapse older backup entries by default
* fix(theme): isolate admin layout, instant DOM theme updates, and add Light/Dark mode toggle
* feat(admin): replace text controls for Photo Frame and Hero Style with visual preview cards
* fix(admin): define missing CSS rules for button system (.btn, .preset-btn)
* feat(admin): redesign theme settings with segmented mode toggle, accent color swatches, and custom iOS-style toggle cards
* feat(admin): upgrade all settings tabs with visual grid previews, Google SEO snippet preview, and toggle cards
* feat(admin): overhaul Pages Builder UX with slide-over drawer, card hover badges, real-time search, and floating save bar
* fix(admin): remove leftover dangling syntax snippet in PageBuilder.tsx
* fix(admin): add position: relative to subpage-tile so hover overlay is contained inside the tile
* style(admin): replace all emojis with clean Leica-style vector SVG icons
* fix(types): extend IconProps with SVGProps to allow style prop on Leica SVG icons
* feat(admin): add subpage live-preview, privacy analytics, and asset protection settings
* fix(typecheck): fix AlbumEntry property access in subpage drawer preview mode
* fix(types): fix ImmichAlbumInfo property names thumbnailAssetId and albumName in PageBuilder.tsx
* fix(types): add protection and watermark optional properties to AppConfig interface
* feat(settings): add toggle for disabling analytics tracking (defaults to enabled)
* feat(ux): show status banner when analytics tracking is disabled + add live sync indicator
* feat(watermark): render customizable watermark overlay on Lightbox images + rename section to Portfolio Features & Modules
* fix(types): import type LightboxWatermark in PhotoGrid.tsx
* fix(types): destructure watermark prop in PhotoGrid function signature
* feat(seo): add configurable subpage title template and metadata descriptions
* feat(seo): add generateMetadata to about page for title template support
* feat(proofing): add client proofing, favorites selection, compact URL bitmasking, and export modal
* feat(essay): add Photo Essay storytelling mode with RSC markdown parser and fullbleed/pair layouts
* feat(subpages): add page enabled toggle to deactivate subpages without deleting them
* feat(admin): add visual essay block builder for photo essay storytelling pages
* security: add Trivy container scan to Docker publish workflow
Scans the built image for CRITICAL/HIGH CVEs on every release and
uploads results to the GitHub Security tab. Non-blocking for now
(exit-code 0) so releases aren't gated on findings. Also documents
the scan and existing Dependabot coverage in the README.
---------
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-08-07 11:08:04 +02:00
|
|
|
|
|
|
|
|
|
|
{sp.enabled === false && (
|
release: v0.11.0 (#459)
Ships `dev` as **v0.11.0**. `main` contains nothing that `dev` does not,
so this is a clean sync.
## Headline changes since v0.10.0
- **Journal & Journal Studio** — photo essays at `/journal`,
split-screen block editor with live preview, drafts, per-entry
passwords, cover images
- **First-run setup wizard at `/install`** — configure a fresh
deployment from the browser; credentials are verified against Immich
before anything is written, and the wizard is gated by a one-time token
- **About page editor and toggle** in the admin panel
- **Per-album photo order** independent of Immich, with a drag & drop
editor
- **Custom favicon upload**
- **Experimental portfolio features** — justified grid, `cover` hero,
unlisted subpages, per-album grid overrides, cover focal points,
external nav links
- **Security** — asset tokens length-capped before decoding (#423),
journal author markdown escaped rather than filtered, journal file paths
contained, admin session key derived with scrypt (#432), Next.js 16.3.0
for CVE-2025-13465
- **Fixed** — client proofing honours its own configuration again
(#454); journal photo rendering (#432)
Full detail in [CHANGELOG.md](CHANGELOG.md#0110--2026-08-15).
## Verified
`npx tsc --noEmit` clean · `npx vitest run` 435 tests pass · `npm run
build` succeeds · lint 0 errors · `prettier --check` clean · local
`docker build` of the release tree.
## After merge
Tag `v0.11.0` on `main` and publish the release — that triggers
`docker-publish.yml`, which pushes the image and moves `latest`.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
---------
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
2026-08-15 09:09:18 +02:00
|
|
|
|
<span
|
|
|
|
|
|
className="subpage-badge-protected"
|
|
|
|
|
|
style={{ background: '#e60012', color: '#fff' }}
|
|
|
|
|
|
title="Page is disabled"
|
|
|
|
|
|
>
|
security: add Trivy container scan to Docker publish workflow (#399)
* feat(admin): add backup manager UI with 1-click restore
* feat(admin): collapse older backup entries by default
* fix(theme): isolate admin layout, instant DOM theme updates, and add Light/Dark mode toggle
* feat(admin): replace text controls for Photo Frame and Hero Style with visual preview cards
* fix(admin): define missing CSS rules for button system (.btn, .preset-btn)
* feat(admin): redesign theme settings with segmented mode toggle, accent color swatches, and custom iOS-style toggle cards
* feat(admin): upgrade all settings tabs with visual grid previews, Google SEO snippet preview, and toggle cards
* feat(admin): overhaul Pages Builder UX with slide-over drawer, card hover badges, real-time search, and floating save bar
* fix(admin): remove leftover dangling syntax snippet in PageBuilder.tsx
* fix(admin): add position: relative to subpage-tile so hover overlay is contained inside the tile
* style(admin): replace all emojis with clean Leica-style vector SVG icons
* fix(types): extend IconProps with SVGProps to allow style prop on Leica SVG icons
* feat(admin): add subpage live-preview, privacy analytics, and asset protection settings
* fix(typecheck): fix AlbumEntry property access in subpage drawer preview mode
* fix(types): fix ImmichAlbumInfo property names thumbnailAssetId and albumName in PageBuilder.tsx
* fix(types): add protection and watermark optional properties to AppConfig interface
* feat(settings): add toggle for disabling analytics tracking (defaults to enabled)
* feat(ux): show status banner when analytics tracking is disabled + add live sync indicator
* feat(watermark): render customizable watermark overlay on Lightbox images + rename section to Portfolio Features & Modules
* fix(types): import type LightboxWatermark in PhotoGrid.tsx
* fix(types): destructure watermark prop in PhotoGrid function signature
* feat(seo): add configurable subpage title template and metadata descriptions
* feat(seo): add generateMetadata to about page for title template support
* feat(proofing): add client proofing, favorites selection, compact URL bitmasking, and export modal
* feat(essay): add Photo Essay storytelling mode with RSC markdown parser and fullbleed/pair layouts
* feat(subpages): add page enabled toggle to deactivate subpages without deleting them
* feat(admin): add visual essay block builder for photo essay storytelling pages
* security: add Trivy container scan to Docker publish workflow
Scans the built image for CRITICAL/HIGH CVEs on every release and
uploads results to the GitHub Security tab. Non-blocking for now
(exit-code 0) so releases aren't gated on findings. Also documents
the scan and existing Dependabot coverage in the README.
---------
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-08-07 11:08:04 +02:00
|
|
|
|
Disabled
|
|
|
|
|
|
</span>
|
|
|
|
|
|
)}
|
|
|
|
|
|
|
experimental: portfolio features (justified layout, unlisted pages, captions, per-album grid, focal point, nav links, cover hero) (#431)
## Was ist das?
Sieben neue Portfolio-Features, alle als **experimental** gekennzeichnet
— in YAML-Kommentaren, Admin-Panel-Labels und Commit-Scopes, damit sie
einzeln nachvollziehbar und revertierbar bleiben.
## Features (je ein Commit)
| Commit | Feature |
| --- | --- |
| `justified rows gallery layout` | Neues Grid-Layout `justified`:
zeilenbasiert, gleiche Höhen, volle Breite — Flexbox ohne JS-Messung,
letzte Zeile bleibt natürlich klein |
| `hide subpages from navigation` | `hidden: true`: Seite aus
Nav/Homepage raus, per Direktlink erreichbar — im Gegensatz zu `enabled:
false` (404) |
| `lightbox captions` | Immich-Asset-Description als Bildunterschrift im
Info-Panel; EXIF-Route liefert bei `exifOnHover: false` jetzt nur noch
die Caption statt 403 |
| `per-album grid overrides` | `grid:` pro Album-Eintrag, Präzedenz
global < Subpage < Album |
| `per-album cover focal point` | `coverPosition:` → `object-position`
auf Cover-Karten, strikt validiert |
| `external links in header navigation` | `navLinks:` in settings.yaml,
nur http(s), sanitisiert |
| `cover splash hero style` | `heroStyle: cover`: Fullscreen-Splash mit
Enter-Link ins Portfolio |
Alle Optionen sind im Admin-Panel editierbar (PageBuilder /
SettingsEditor).
## Tests
- 356 Unit-Tests grün (13 neue: deriveGallery hidden/grid/coverPosition,
sanitizeNavLinks, EXIF-Route-Captions, justified-Layout-Validierung)
- `npx tsc --noEmit`: 0 Fehler
- `npm run build`: sauber
- Justified-Zeilenmathematik und Cover-Splash per Browser-Harness
visuell/numerisch verifiziert (volle Zeilen enden exakt an der
Containerkante, letzte Zeile bleibt natürlich)
---------
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
2026-08-14 17:56:22 +02:00
|
|
|
|
{sp.hidden === true && sp.enabled !== false && (
|
release: v0.11.0 (#459)
Ships `dev` as **v0.11.0**. `main` contains nothing that `dev` does not,
so this is a clean sync.
## Headline changes since v0.10.0
- **Journal & Journal Studio** — photo essays at `/journal`,
split-screen block editor with live preview, drafts, per-entry
passwords, cover images
- **First-run setup wizard at `/install`** — configure a fresh
deployment from the browser; credentials are verified against Immich
before anything is written, and the wizard is gated by a one-time token
- **About page editor and toggle** in the admin panel
- **Per-album photo order** independent of Immich, with a drag & drop
editor
- **Custom favicon upload**
- **Experimental portfolio features** — justified grid, `cover` hero,
unlisted subpages, per-album grid overrides, cover focal points,
external nav links
- **Security** — asset tokens length-capped before decoding (#423),
journal author markdown escaped rather than filtered, journal file paths
contained, admin session key derived with scrypt (#432), Next.js 16.3.0
for CVE-2025-13465
- **Fixed** — client proofing honours its own configuration again
(#454); journal photo rendering (#432)
Full detail in [CHANGELOG.md](CHANGELOG.md#0110--2026-08-15).
## Verified
`npx tsc --noEmit` clean · `npx vitest run` 435 tests pass · `npm run
build` succeeds · lint 0 errors · `prettier --check` clean · local
`docker build` of the release tree.
## After merge
Tag `v0.11.0` on `main` and publish the release — that triggers
`docker-publish.yml`, which pushes the image and moves `latest`.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
---------
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
2026-08-15 09:09:18 +02:00
|
|
|
|
<span
|
|
|
|
|
|
className="subpage-badge-protected"
|
|
|
|
|
|
title="Hidden from navigation, reachable by direct link"
|
|
|
|
|
|
>
|
experimental: portfolio features (justified layout, unlisted pages, captions, per-album grid, focal point, nav links, cover hero) (#431)
## Was ist das?
Sieben neue Portfolio-Features, alle als **experimental** gekennzeichnet
— in YAML-Kommentaren, Admin-Panel-Labels und Commit-Scopes, damit sie
einzeln nachvollziehbar und revertierbar bleiben.
## Features (je ein Commit)
| Commit | Feature |
| --- | --- |
| `justified rows gallery layout` | Neues Grid-Layout `justified`:
zeilenbasiert, gleiche Höhen, volle Breite — Flexbox ohne JS-Messung,
letzte Zeile bleibt natürlich klein |
| `hide subpages from navigation` | `hidden: true`: Seite aus
Nav/Homepage raus, per Direktlink erreichbar — im Gegensatz zu `enabled:
false` (404) |
| `lightbox captions` | Immich-Asset-Description als Bildunterschrift im
Info-Panel; EXIF-Route liefert bei `exifOnHover: false` jetzt nur noch
die Caption statt 403 |
| `per-album grid overrides` | `grid:` pro Album-Eintrag, Präzedenz
global < Subpage < Album |
| `per-album cover focal point` | `coverPosition:` → `object-position`
auf Cover-Karten, strikt validiert |
| `external links in header navigation` | `navLinks:` in settings.yaml,
nur http(s), sanitisiert |
| `cover splash hero style` | `heroStyle: cover`: Fullscreen-Splash mit
Enter-Link ins Portfolio |
Alle Optionen sind im Admin-Panel editierbar (PageBuilder /
SettingsEditor).
## Tests
- 356 Unit-Tests grün (13 neue: deriveGallery hidden/grid/coverPosition,
sanitizeNavLinks, EXIF-Route-Captions, justified-Layout-Validierung)
- `npx tsc --noEmit`: 0 Fehler
- `npm run build`: sauber
- Justified-Zeilenmathematik und Cover-Splash per Browser-Harness
visuell/numerisch verifiziert (volle Zeilen enden exakt an der
Containerkante, letzte Zeile bleibt natürlich)
---------
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
2026-08-14 17:56:22 +02:00
|
|
|
|
Unlisted
|
|
|
|
|
|
</span>
|
|
|
|
|
|
)}
|
|
|
|
|
|
|
security: add Trivy container scan to Docker publish workflow (#399)
* feat(admin): add backup manager UI with 1-click restore
* feat(admin): collapse older backup entries by default
* fix(theme): isolate admin layout, instant DOM theme updates, and add Light/Dark mode toggle
* feat(admin): replace text controls for Photo Frame and Hero Style with visual preview cards
* fix(admin): define missing CSS rules for button system (.btn, .preset-btn)
* feat(admin): redesign theme settings with segmented mode toggle, accent color swatches, and custom iOS-style toggle cards
* feat(admin): upgrade all settings tabs with visual grid previews, Google SEO snippet preview, and toggle cards
* feat(admin): overhaul Pages Builder UX with slide-over drawer, card hover badges, real-time search, and floating save bar
* fix(admin): remove leftover dangling syntax snippet in PageBuilder.tsx
* fix(admin): add position: relative to subpage-tile so hover overlay is contained inside the tile
* style(admin): replace all emojis with clean Leica-style vector SVG icons
* fix(types): extend IconProps with SVGProps to allow style prop on Leica SVG icons
* feat(admin): add subpage live-preview, privacy analytics, and asset protection settings
* fix(typecheck): fix AlbumEntry property access in subpage drawer preview mode
* fix(types): fix ImmichAlbumInfo property names thumbnailAssetId and albumName in PageBuilder.tsx
* fix(types): add protection and watermark optional properties to AppConfig interface
* feat(settings): add toggle for disabling analytics tracking (defaults to enabled)
* feat(ux): show status banner when analytics tracking is disabled + add live sync indicator
* feat(watermark): render customizable watermark overlay on Lightbox images + rename section to Portfolio Features & Modules
* fix(types): import type LightboxWatermark in PhotoGrid.tsx
* fix(types): destructure watermark prop in PhotoGrid function signature
* feat(seo): add configurable subpage title template and metadata descriptions
* feat(seo): add generateMetadata to about page for title template support
* feat(proofing): add client proofing, favorites selection, compact URL bitmasking, and export modal
* feat(essay): add Photo Essay storytelling mode with RSC markdown parser and fullbleed/pair layouts
* feat(subpages): add page enabled toggle to deactivate subpages without deleting them
* feat(admin): add visual essay block builder for photo essay storytelling pages
* security: add Trivy container scan to Docker publish workflow
Scans the built image for CRITICAL/HIGH CVEs on every release and
uploads results to the GitHub Security tab. Non-blocking for now
(exit-code 0) so releases aren't gated on findings. Also documents
the scan and existing Dependabot coverage in the README.
---------
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-08-07 11:08:04 +02:00
|
|
|
|
{sp.password && (
|
|
|
|
|
|
<span className="subpage-badge-protected" title="Password protected">
|
2026-08-14 11:10:42 +02:00
|
|
|
|
<IconLock size={12} /> Password
|
security: add Trivy container scan to Docker publish workflow (#399)
* feat(admin): add backup manager UI with 1-click restore
* feat(admin): collapse older backup entries by default
* fix(theme): isolate admin layout, instant DOM theme updates, and add Light/Dark mode toggle
* feat(admin): replace text controls for Photo Frame and Hero Style with visual preview cards
* fix(admin): define missing CSS rules for button system (.btn, .preset-btn)
* feat(admin): redesign theme settings with segmented mode toggle, accent color swatches, and custom iOS-style toggle cards
* feat(admin): upgrade all settings tabs with visual grid previews, Google SEO snippet preview, and toggle cards
* feat(admin): overhaul Pages Builder UX with slide-over drawer, card hover badges, real-time search, and floating save bar
* fix(admin): remove leftover dangling syntax snippet in PageBuilder.tsx
* fix(admin): add position: relative to subpage-tile so hover overlay is contained inside the tile
* style(admin): replace all emojis with clean Leica-style vector SVG icons
* fix(types): extend IconProps with SVGProps to allow style prop on Leica SVG icons
* feat(admin): add subpage live-preview, privacy analytics, and asset protection settings
* fix(typecheck): fix AlbumEntry property access in subpage drawer preview mode
* fix(types): fix ImmichAlbumInfo property names thumbnailAssetId and albumName in PageBuilder.tsx
* fix(types): add protection and watermark optional properties to AppConfig interface
* feat(settings): add toggle for disabling analytics tracking (defaults to enabled)
* feat(ux): show status banner when analytics tracking is disabled + add live sync indicator
* feat(watermark): render customizable watermark overlay on Lightbox images + rename section to Portfolio Features & Modules
* fix(types): import type LightboxWatermark in PhotoGrid.tsx
* fix(types): destructure watermark prop in PhotoGrid function signature
* feat(seo): add configurable subpage title template and metadata descriptions
* feat(seo): add generateMetadata to about page for title template support
* feat(proofing): add client proofing, favorites selection, compact URL bitmasking, and export modal
* feat(essay): add Photo Essay storytelling mode with RSC markdown parser and fullbleed/pair layouts
* feat(subpages): add page enabled toggle to deactivate subpages without deleting them
* feat(admin): add visual essay block builder for photo essay storytelling pages
* security: add Trivy container scan to Docker publish workflow
Scans the built image for CRITICAL/HIGH CVEs on every release and
uploads results to the GitHub Security tab. Non-blocking for now
(exit-code 0) so releases aren't gated on findings. Also documents
the scan and existing Dependabot coverage in the README.
---------
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-08-07 11:08:04 +02:00
|
|
|
|
</span>
|
|
|
|
|
|
)}
|
|
|
|
|
|
|
2026-05-29 17:59:25 +02:00
|
|
|
|
<div className="subpage-tile-cover">
|
|
|
|
|
|
{firstThumb ? (
|
|
|
|
|
|
<img src={`/api/admin/thumbnail/${firstThumb}`} alt="" loading="lazy" />
|
|
|
|
|
|
) : (
|
2026-05-31 21:27:13 +02:00
|
|
|
|
<div className="subpage-tile-placeholder">
|
2026-08-14 11:10:42 +02:00
|
|
|
|
<IconFolder />
|
2026-05-31 21:27:13 +02:00
|
|
|
|
</div>
|
2026-05-29 17:59:25 +02:00
|
|
|
|
)}
|
security: add Trivy container scan to Docker publish workflow (#399)
* feat(admin): add backup manager UI with 1-click restore
* feat(admin): collapse older backup entries by default
* fix(theme): isolate admin layout, instant DOM theme updates, and add Light/Dark mode toggle
* feat(admin): replace text controls for Photo Frame and Hero Style with visual preview cards
* fix(admin): define missing CSS rules for button system (.btn, .preset-btn)
* feat(admin): redesign theme settings with segmented mode toggle, accent color swatches, and custom iOS-style toggle cards
* feat(admin): upgrade all settings tabs with visual grid previews, Google SEO snippet preview, and toggle cards
* feat(admin): overhaul Pages Builder UX with slide-over drawer, card hover badges, real-time search, and floating save bar
* fix(admin): remove leftover dangling syntax snippet in PageBuilder.tsx
* fix(admin): add position: relative to subpage-tile so hover overlay is contained inside the tile
* style(admin): replace all emojis with clean Leica-style vector SVG icons
* fix(types): extend IconProps with SVGProps to allow style prop on Leica SVG icons
* feat(admin): add subpage live-preview, privacy analytics, and asset protection settings
* fix(typecheck): fix AlbumEntry property access in subpage drawer preview mode
* fix(types): fix ImmichAlbumInfo property names thumbnailAssetId and albumName in PageBuilder.tsx
* fix(types): add protection and watermark optional properties to AppConfig interface
* feat(settings): add toggle for disabling analytics tracking (defaults to enabled)
* feat(ux): show status banner when analytics tracking is disabled + add live sync indicator
* feat(watermark): render customizable watermark overlay on Lightbox images + rename section to Portfolio Features & Modules
* fix(types): import type LightboxWatermark in PhotoGrid.tsx
* fix(types): destructure watermark prop in PhotoGrid function signature
* feat(seo): add configurable subpage title template and metadata descriptions
* feat(seo): add generateMetadata to about page for title template support
* feat(proofing): add client proofing, favorites selection, compact URL bitmasking, and export modal
* feat(essay): add Photo Essay storytelling mode with RSC markdown parser and fullbleed/pair layouts
* feat(subpages): add page enabled toggle to deactivate subpages without deleting them
* feat(admin): add visual essay block builder for photo essay storytelling pages
* security: add Trivy container scan to Docker publish workflow
Scans the built image for CRITICAL/HIGH CVEs on every release and
uploads results to the GitHub Security tab. Non-blocking for now
(exit-code 0) so releases aren't gated on findings. Also documents
the scan and existing Dependabot coverage in the README.
---------
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-08-07 11:08:04 +02:00
|
|
|
|
<div className="subpage-hover-overlay">
|
release: v0.11.0 (#459)
Ships `dev` as **v0.11.0**. `main` contains nothing that `dev` does not,
so this is a clean sync.
## Headline changes since v0.10.0
- **Journal & Journal Studio** — photo essays at `/journal`,
split-screen block editor with live preview, drafts, per-entry
passwords, cover images
- **First-run setup wizard at `/install`** — configure a fresh
deployment from the browser; credentials are verified against Immich
before anything is written, and the wizard is gated by a one-time token
- **About page editor and toggle** in the admin panel
- **Per-album photo order** independent of Immich, with a drag & drop
editor
- **Custom favicon upload**
- **Experimental portfolio features** — justified grid, `cover` hero,
unlisted subpages, per-album grid overrides, cover focal points,
external nav links
- **Security** — asset tokens length-capped before decoding (#423),
journal author markdown escaped rather than filtered, journal file paths
contained, admin session key derived with scrypt (#432), Next.js 16.3.0
for CVE-2025-13465
- **Fixed** — client proofing honours its own configuration again
(#454); journal photo rendering (#432)
Full detail in [CHANGELOG.md](CHANGELOG.md#0110--2026-08-15).
## Verified
`npx tsc --noEmit` clean · `npx vitest run` 435 tests pass · `npm run
build` succeeds · lint 0 errors · `prettier --check` clean · local
`docker build` of the release tree.
## After merge
Tag `v0.11.0` on `main` and publish the release — that triggers
`docker-publish.yml`, which pushes the image and moves `latest`.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
---------
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
2026-08-15 09:09:18 +02:00
|
|
|
|
<span className="hover-action-btn">
|
|
|
|
|
|
<IconPencil size={14} /> Edit Page
|
|
|
|
|
|
</span>
|
security: add Trivy container scan to Docker publish workflow (#399)
* feat(admin): add backup manager UI with 1-click restore
* feat(admin): collapse older backup entries by default
* fix(theme): isolate admin layout, instant DOM theme updates, and add Light/Dark mode toggle
* feat(admin): replace text controls for Photo Frame and Hero Style with visual preview cards
* fix(admin): define missing CSS rules for button system (.btn, .preset-btn)
* feat(admin): redesign theme settings with segmented mode toggle, accent color swatches, and custom iOS-style toggle cards
* feat(admin): upgrade all settings tabs with visual grid previews, Google SEO snippet preview, and toggle cards
* feat(admin): overhaul Pages Builder UX with slide-over drawer, card hover badges, real-time search, and floating save bar
* fix(admin): remove leftover dangling syntax snippet in PageBuilder.tsx
* fix(admin): add position: relative to subpage-tile so hover overlay is contained inside the tile
* style(admin): replace all emojis with clean Leica-style vector SVG icons
* fix(types): extend IconProps with SVGProps to allow style prop on Leica SVG icons
* feat(admin): add subpage live-preview, privacy analytics, and asset protection settings
* fix(typecheck): fix AlbumEntry property access in subpage drawer preview mode
* fix(types): fix ImmichAlbumInfo property names thumbnailAssetId and albumName in PageBuilder.tsx
* fix(types): add protection and watermark optional properties to AppConfig interface
* feat(settings): add toggle for disabling analytics tracking (defaults to enabled)
* feat(ux): show status banner when analytics tracking is disabled + add live sync indicator
* feat(watermark): render customizable watermark overlay on Lightbox images + rename section to Portfolio Features & Modules
* fix(types): import type LightboxWatermark in PhotoGrid.tsx
* fix(types): destructure watermark prop in PhotoGrid function signature
* feat(seo): add configurable subpage title template and metadata descriptions
* feat(seo): add generateMetadata to about page for title template support
* feat(proofing): add client proofing, favorites selection, compact URL bitmasking, and export modal
* feat(essay): add Photo Essay storytelling mode with RSC markdown parser and fullbleed/pair layouts
* feat(subpages): add page enabled toggle to deactivate subpages without deleting them
* feat(admin): add visual essay block builder for photo essay storytelling pages
* security: add Trivy container scan to Docker publish workflow
Scans the built image for CRITICAL/HIGH CVEs on every release and
uploads results to the GitHub Security tab. Non-blocking for now
(exit-code 0) so releases aren't gated on findings. Also documents
the scan and existing Dependabot coverage in the README.
---------
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-08-07 11:08:04 +02:00
|
|
|
|
</div>
|
2026-05-29 17:59:25 +02:00
|
|
|
|
</div>
|
|
|
|
|
|
<div className="subpage-tile-info">
|
security: add Trivy container scan to Docker publish workflow (#399)
* feat(admin): add backup manager UI with 1-click restore
* feat(admin): collapse older backup entries by default
* fix(theme): isolate admin layout, instant DOM theme updates, and add Light/Dark mode toggle
* feat(admin): replace text controls for Photo Frame and Hero Style with visual preview cards
* fix(admin): define missing CSS rules for button system (.btn, .preset-btn)
* feat(admin): redesign theme settings with segmented mode toggle, accent color swatches, and custom iOS-style toggle cards
* feat(admin): upgrade all settings tabs with visual grid previews, Google SEO snippet preview, and toggle cards
* feat(admin): overhaul Pages Builder UX with slide-over drawer, card hover badges, real-time search, and floating save bar
* fix(admin): remove leftover dangling syntax snippet in PageBuilder.tsx
* fix(admin): add position: relative to subpage-tile so hover overlay is contained inside the tile
* style(admin): replace all emojis with clean Leica-style vector SVG icons
* fix(types): extend IconProps with SVGProps to allow style prop on Leica SVG icons
* feat(admin): add subpage live-preview, privacy analytics, and asset protection settings
* fix(typecheck): fix AlbumEntry property access in subpage drawer preview mode
* fix(types): fix ImmichAlbumInfo property names thumbnailAssetId and albumName in PageBuilder.tsx
* fix(types): add protection and watermark optional properties to AppConfig interface
* feat(settings): add toggle for disabling analytics tracking (defaults to enabled)
* feat(ux): show status banner when analytics tracking is disabled + add live sync indicator
* feat(watermark): render customizable watermark overlay on Lightbox images + rename section to Portfolio Features & Modules
* fix(types): import type LightboxWatermark in PhotoGrid.tsx
* fix(types): destructure watermark prop in PhotoGrid function signature
* feat(seo): add configurable subpage title template and metadata descriptions
* feat(seo): add generateMetadata to about page for title template support
* feat(proofing): add client proofing, favorites selection, compact URL bitmasking, and export modal
* feat(essay): add Photo Essay storytelling mode with RSC markdown parser and fullbleed/pair layouts
* feat(subpages): add page enabled toggle to deactivate subpages without deleting them
* feat(admin): add visual essay block builder for photo essay storytelling pages
* security: add Trivy container scan to Docker publish workflow
Scans the built image for CRITICAL/HIGH CVEs on every release and
uploads results to the GitHub Security tab. Non-blocking for now
(exit-code 0) so releases aren't gated on findings. Also documents
the scan and existing Dependabot coverage in the README.
---------
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-08-07 11:08:04 +02:00
|
|
|
|
<div className="subpage-tile-title-row">
|
|
|
|
|
|
<span className="subpage-tile-name">{sp.title || sp.name}</span>
|
|
|
|
|
|
<span className="subpage-tile-slug">/{slug}</span>
|
|
|
|
|
|
</div>
|
2026-05-29 17:59:25 +02:00
|
|
|
|
<span className="subpage-tile-meta">
|
2026-08-14 11:10:42 +02:00
|
|
|
|
<IconFolder /> {totalAlbums} album{totalAlbums !== 1 ? 's' : ''}
|
2026-05-29 17:59:25 +02:00
|
|
|
|
</span>
|
|
|
|
|
|
</div>
|
|
|
|
|
|
</div>
|
|
|
|
|
|
);
|
|
|
|
|
|
}
|
|
|
|
|
|
|
feat: add visual admin panel with page builder and settings editor
- Add /admin route with password-protected visual page builder
- Page Builder: manage hero images, standalone albums, subpages, and sections
- Album Picker: browse all shared Immich albums with search and filtering
- Settings Editor: theme, grid, footer, legal, SEO configuration
- YAML service with atomic writes and automatic backups (content/.backups/)
- HMAC-signed admin sessions (24h expiry, HttpOnly cookies)
- API endpoints: /api/admin/{auth,gallery,settings,albums,reload}
- Enable with ADMIN_PASSWORD env var; disabled by default
- invalidateConfigCache() export for hot-reload after saves
2026-05-29 17:04:37 +02:00
|
|
|
|
// ── Component ──────────────────────────────────────────────────
|
|
|
|
|
|
|
|
|
|
|
|
export default function PageBuilder() {
|
|
|
|
|
|
const [gallery, setGallery] = useState<GalleryState>({ hero: [], albums: [], subpages: [] });
|
|
|
|
|
|
const [immichAlbums, setImmichAlbums] = useState<ImmichAlbumInfo[]>([]);
|
|
|
|
|
|
const [loading, setLoading] = useState(true);
|
|
|
|
|
|
const [saving, setSaving] = useState(false);
|
|
|
|
|
|
const [dirty, setDirty] = useState(false);
|
|
|
|
|
|
const [saveMessage, setSaveMessage] = useState('');
|
2026-05-29 17:29:26 +02:00
|
|
|
|
const [expandedSubpage, setExpandedSubpage] = useState<number | null>(null);
|
security: add Trivy container scan to Docker publish workflow (#399)
* feat(admin): add backup manager UI with 1-click restore
* feat(admin): collapse older backup entries by default
* fix(theme): isolate admin layout, instant DOM theme updates, and add Light/Dark mode toggle
* feat(admin): replace text controls for Photo Frame and Hero Style with visual preview cards
* fix(admin): define missing CSS rules for button system (.btn, .preset-btn)
* feat(admin): redesign theme settings with segmented mode toggle, accent color swatches, and custom iOS-style toggle cards
* feat(admin): upgrade all settings tabs with visual grid previews, Google SEO snippet preview, and toggle cards
* feat(admin): overhaul Pages Builder UX with slide-over drawer, card hover badges, real-time search, and floating save bar
* fix(admin): remove leftover dangling syntax snippet in PageBuilder.tsx
* fix(admin): add position: relative to subpage-tile so hover overlay is contained inside the tile
* style(admin): replace all emojis with clean Leica-style vector SVG icons
* fix(types): extend IconProps with SVGProps to allow style prop on Leica SVG icons
* feat(admin): add subpage live-preview, privacy analytics, and asset protection settings
* fix(typecheck): fix AlbumEntry property access in subpage drawer preview mode
* fix(types): fix ImmichAlbumInfo property names thumbnailAssetId and albumName in PageBuilder.tsx
* fix(types): add protection and watermark optional properties to AppConfig interface
* feat(settings): add toggle for disabling analytics tracking (defaults to enabled)
* feat(ux): show status banner when analytics tracking is disabled + add live sync indicator
* feat(watermark): render customizable watermark overlay on Lightbox images + rename section to Portfolio Features & Modules
* fix(types): import type LightboxWatermark in PhotoGrid.tsx
* fix(types): destructure watermark prop in PhotoGrid function signature
* feat(seo): add configurable subpage title template and metadata descriptions
* feat(seo): add generateMetadata to about page for title template support
* feat(proofing): add client proofing, favorites selection, compact URL bitmasking, and export modal
* feat(essay): add Photo Essay storytelling mode with RSC markdown parser and fullbleed/pair layouts
* feat(subpages): add page enabled toggle to deactivate subpages without deleting them
* feat(admin): add visual essay block builder for photo essay storytelling pages
* security: add Trivy container scan to Docker publish workflow
Scans the built image for CRITICAL/HIGH CVEs on every release and
uploads results to the GitHub Security tab. Non-blocking for now
(exit-code 0) so releases aren't gated on findings. Also documents
the scan and existing Dependabot coverage in the README.
---------
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-08-07 11:08:04 +02:00
|
|
|
|
const [drawerMode, setDrawerMode] = useState<'edit' | 'preview'>('edit');
|
feat: add visual admin panel with page builder and settings editor
- Add /admin route with password-protected visual page builder
- Page Builder: manage hero images, standalone albums, subpages, and sections
- Album Picker: browse all shared Immich albums with search and filtering
- Settings Editor: theme, grid, footer, legal, SEO configuration
- YAML service with atomic writes and automatic backups (content/.backups/)
- HMAC-signed admin sessions (24h expiry, HttpOnly cookies)
- API endpoints: /api/admin/{auth,gallery,settings,albums,reload}
- Enable with ADMIN_PASSWORD env var; disabled by default
- invalidateConfigCache() export for hot-reload after saves
2026-05-29 17:04:37 +02:00
|
|
|
|
const [pickerTarget, setPickerTarget] = useState<{
|
|
|
|
|
|
type: 'standalone' | 'subpage' | 'section';
|
|
|
|
|
|
subpageIndex?: number;
|
|
|
|
|
|
sectionIndex?: number;
|
|
|
|
|
|
} | null>(null);
|
2026-05-31 21:27:13 +02:00
|
|
|
|
const [heroPickerTarget, setHeroPickerTarget] = useState<{
|
|
|
|
|
|
albumId?: string;
|
|
|
|
|
|
onSelect: (assetId: string) => void;
|
|
|
|
|
|
currentAssetIds?: string[];
|
|
|
|
|
|
title?: string;
|
|
|
|
|
|
} | null>(null);
|
2026-08-14 11:10:42 +02:00
|
|
|
|
const [orderEditorTarget, setOrderEditorTarget] = useState<{
|
|
|
|
|
|
albumId: string;
|
|
|
|
|
|
albumName: string;
|
|
|
|
|
|
assetOrder: string[];
|
|
|
|
|
|
onSave: (assetOrder: string[]) => void;
|
|
|
|
|
|
} | null>(null);
|
2026-05-31 21:17:52 +02:00
|
|
|
|
const [searchQuery, setSearchQuery] = useState('');
|
release: v0.11.0 (#459)
Ships `dev` as **v0.11.0**. `main` contains nothing that `dev` does not,
so this is a clean sync.
## Headline changes since v0.10.0
- **Journal & Journal Studio** — photo essays at `/journal`,
split-screen block editor with live preview, drafts, per-entry
passwords, cover images
- **First-run setup wizard at `/install`** — configure a fresh
deployment from the browser; credentials are verified against Immich
before anything is written, and the wizard is gated by a one-time token
- **About page editor and toggle** in the admin panel
- **Per-album photo order** independent of Immich, with a drag & drop
editor
- **Custom favicon upload**
- **Experimental portfolio features** — justified grid, `cover` hero,
unlisted subpages, per-album grid overrides, cover focal points,
external nav links
- **Security** — asset tokens length-capped before decoding (#423),
journal author markdown escaped rather than filtered, journal file paths
contained, admin session key derived with scrypt (#432), Next.js 16.3.0
for CVE-2025-13465
- **Fixed** — client proofing honours its own configuration again
(#454); journal photo rendering (#432)
Full detail in [CHANGELOG.md](CHANGELOG.md#0110--2026-08-15).
## Verified
`npx tsc --noEmit` clean · `npx vitest run` 435 tests pass · `npm run
build` succeeds · lint 0 errors · `prettier --check` clean · local
`docker build` of the release tree.
## After merge
Tag `v0.11.0` on `main` and publish the release — that triggers
`docker-publish.yml`, which pushes the image and moves `latest`.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
---------
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
2026-08-15 09:09:18 +02:00
|
|
|
|
const [editingAlbumAddress, setEditingAlbumAddress] = useState<ActiveEditAlbumAddress | null>(
|
|
|
|
|
|
null,
|
|
|
|
|
|
);
|
2026-05-29 17:59:25 +02:00
|
|
|
|
|
release: v0.11.0 — journal fixes, admin URLs, design system cleanup (#432)
* fix(screenshots): sharp-Typen fuer 0.34 und 0.35 gleichzeitig (#410)
sharp 0.35 ist von `export =` auf ESM umgestellt: der Modul-Namespace
ist nicht mehr aufrufbar, die Factory sitzt unter .default. Der
Type-Check brach damit in scripts/screenshots.ts weg, sobald der
Next-Bump (#402) sharp von 0.34.5 auf 0.35.3 mitzieht -- sharp ist hier
keine deklarierte Dependency, sondern kommt ueber Next mit.
Die Form wird jetzt aus dem installierten Paket abgeleitet statt
festgeschrieben, zur Laufzeit wie im Typ. Geprueft mit beiden
Versionen: tsc laeuft mit 0.34.5 und mit 0.35.3 fehlerfrei durch.
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
* chore(deps): bump the nextjs group across 1 directory with 2 updates (#402)
Bumps the nextjs group with 2 updates in the / directory: [next](https://github.com/vercel/next.js) and [eslint-config-next](https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next).
Updates `next` from 16.2.12 to 16.3.0
- [Release notes](https://github.com/vercel/next.js/releases)
- [Commits](https://github.com/vercel/next.js/compare/v16.2.12...v16.3.0)
Updates `eslint-config-next` from 16.2.12 to 16.3.0
- [Release notes](https://github.com/vercel/next.js/releases)
- [Commits](https://github.com/vercel/next.js/commits/v16.3.0/packages/eslint-config-next)
---
updated-dependencies:
- dependency-name: eslint-config-next
dependency-version: 16.3.0
dependency-type: direct:development
update-type: version-update:semver-minor
dependency-group: nextjs
- dependency-name: next
dependency-version: 16.3.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: nextjs
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* chore(deps-dev): bump prettier from 3.8.3 to 3.9.6 (#405)
Bumps [prettier](https://github.com/prettier/prettier) from 3.8.3 to 3.9.6.
- [Release notes](https://github.com/prettier/prettier/releases)
- [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md)
- [Commits](https://github.com/prettier/prettier/compare/3.8.3...3.9.6)
---
updated-dependencies:
- dependency-name: prettier
dependency-version: 3.9.6
dependency-type: direct:development
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* docs(changelog): Unreleased-Sektion fuer die Bumps nach v0.10.0 (#413)
Die Dependency-PRs sind nach dem Release auf dev gelandet, teils auch
auf main. Ohne Eintrag waeren sie beim naechsten Release unsichtbar --
inklusive Next 16.3.0, das CVE-2025-13465 mitbringt.
Ausserdem im 0.10.0-Abschnitt nachgetragen, dass der Trivy-Scan bis
#409 nie gelaufen ist. Der Fix steckt im Tag v0.10.0, fehlte aber in der
Aufzaehlung -- und "Images werden bei jedem Publish gescannt" stand im
Changelog, waehrend der Job im Action-Setup abbrach.
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
* feat(gallery): per-album sort order, independent of Immich (#408) (#414)
Album order was dictated entirely by Immich: getAlbum() sorted by the
album's own asc/desc flag, so a Folio album always mirrored the archive.
A curated series has a narrative order that has nothing to do with
capture time, and changing the Immich album's sort to fit the website
changes it for the archive too.
Adds an optional per-album `sort` in gallery.yaml, editable in /admin,
defaulting to today's behaviour so every existing config is unchanged:
immich (default) | newest | oldest | filename | manual
`manual` is a pinned *prefix*: `assetOrder` lists only the photos placed
by hand, everything else follows in the album's Immich order. A full
permutation of a 2,000-photo album would be ~80 KB of UUIDs in a file
that is rewritten and copied to content/.backups/ on every admin save.
It also makes drift fall out for free — photos removed in Immich never
match, new ones land in the tail rather than being hidden.
Sorting is applied after the cache read, not before the cache write, so
the LRU keeps one canonical Immich-ordered copy per album. That avoids
putting the mode in the cache key, lets a config change take effect
without depending on invalidation, and keeps the stale-serving path
correct. cache.get() returns the stored object by reference, so
withSort() returns a shallow clone with a new array — sorting in place
would reorder the shared entry, and under request coalescing every
concurrent caller would be sorting the same array.
Also fixes a prerequisite bug: /api/admin/albums/[albumId]/assets read
album.assets from GET /albums/:id, which Immich 3.x no longer populates
(lib/immich.ts:507). The hero picker's "This Album" tab returned nothing
and threw outright when the key was absent. It now goes through the
client's paginated metadata search, with ?types=all to opt videos in for
the reorder editor.
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
* refactor(admin): drop decorative emoji from the sort select labels (#415)
An <option> cannot contain markup, so the SVG set in Icons is not
reachable there — but a decorative emoji is not a substitute for it.
Plain text instead; the album card badge already uses a real icon.
The remaining emoji in the admin panel (asset picker tabs, section
headings, layout picker options) predate this branch and are left for a
separate cleanup.
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
* refactor(admin): replace emoji icons with the shared SVG icon set (#416)
The admin panel mixed two icon conventions: inline SVGs from
`Icons.tsx` in most components, and decorative emoji in the asset
picker and a few PageBuilder labels. Emoji render inconsistently
across platforms, ignore the accent colour, and cannot inherit the
`.svg-icon` sizing rules.
- Icons.tsx: add `IconStar` (filled — it marks a state, not an
action) and `IconImage`.
- AssetPicker: the three tab labels and the favourite tile badge now
use IconFolder / IconStar / IconImage.
- PageBuilder: the "Standalone Albums" and "Subpages" headings use
the icon set instead of an emoji.
- PageBuilder: the layout picker drops its emoji for plain text. An
<option> cannot contain markup, so an SVG is impossible there and a
decorative glyph is not a substitute.
- admin.css: align icon and label in the picker tabs, and swap the
favourite badge's text-shadow for drop-shadow, which is what
applies to an inline SVG.
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
* refactor(admin): fold PageBuilder's local icons into the shared Icons module (#418)
* refactor(admin): fold PageBuilder's local icons into the shared module
PageBuilder.tsx carried its own `Icons` object duplicating most of the
glyphs already exported by Icons.tsx, with hardcoded sizes and slightly
divergent paths. Migrate all 32 call sites to the shared module and
delete the local object.
Five glyphs had no counterpart and are added to Icons.tsx as 1:1 ports
of the local paths: IconX, IconPlus, IconHome, IconCopy, IconImage.
The local ExternalLink and Check are dropped rather than ported — both
had zero call sites.
Two glyphs change shape slightly, which is the point of consolidating:
the shared IconCamera includes the viewfinder bump the local copy
omitted, and drag handles now use IconGripVertical.
IconGripVertical uses the module's square 24x24 viewBox, so `.svg-drag`
goes from 12x18 to 18x18 — the old non-square box would letterbox the
glyph down to 12x12 and shrink the handle.
* fix(admin): resolve icon-module integration after #416
Merging dev brought in #416, which added a second IconImage to Icons.tsx
and two <Icons.Camera>/<Icons.Folder> section headers that reference the
local Icons object this PR removes. Git merged both cleanly but the result
did not type-check.
- drop the duplicate IconImage (both copies were byte-identical)
- point the two section headers at the imported IconCamera/IconFolder
- refresh the SORT_LABELS comment: the icon set is imported now, not
declared below
---------
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
* fix(config): allow an empty gallery, guard against a double /api suffix (#421)
An empty gallery is now a valid, rendered state instead of a throw: deriveGallery() no longer requires at least one album or subpage, so a deployment with no albums yet renders a bare homepage the owner can fill in via /admin.
getConfig() also stops appending /api to an Immich URL that already ends in it, which previously produced .../api/api and broke every upstream request.
Includes a restore of the per-album sort test cases, which the branch had lost by being cut before #408/#414.
* feat(admin): favicon upload, served from the content volume (#422)
Adds a bundled default favicon, an upload widget in admin Settings > General, and a route that serves the icon from the writable content/ volume with a fallback to the bundled default. Raster uploads (PNG/ICO/JPEG) are wrapped in an SVG container; the response carries its own CSP so an uploaded SVG cannot execute script on the origin.
The GET route revalidates with an ETag instead of caching immutably, so a newly uploaded icon shows up immediately. Uploads are written via temp file + rename, and a Reset button restores the bundled default.
* ci: flag unformatted files in a PR, without blocking it (#424)
Prettier is configured as an error rule in eslint.config.mjs but has never run in CI, so part of the tree predates it. A final CI step now diffs against the PR base, runs prettier --list-different over the changed files, and emits a warning annotation per offender plus a job summary.
Advisory by design: it never fails the job. Blocking would turn a PR red for merely touching a file that was already unformatted, and normalising the tree in one commit would wreck git blame and conflict with the PRs in flight.
Requires fetch-depth: 0, since diffing against the base needs its history.
* feat(install): first-run wizard gated by a one-time setup token (#419)
Adds /install, a four-step first-run wizard: connect to Immich, optionally pick albums, name the site, finish. It verifies the credentials against the Immich server before writing anything, then writes gallery.yaml, settings.yaml and a content/install.json carrying the Immich credentials and a generated site secret.
install.json exists because a running process cannot pick up new env vars — the wizard has to write configuration that takes effect without a restart. getInstallCredentials() merges it under the real environment, so env vars always win and rotation stays a matter of setting one.
Both the page and the API routes are gated by a one-time setup token printed to the server log, so a deployment that is reachable before gallery.yaml exists cannot be configured by whoever finds it first. The token is stored in content/.setup-token (0600) rather than a module variable: Next.js bundles the page and each route handler separately, so a module-level token left the page and the API disagreeing inside one process and the wizard stuck on step 1. It is removed once the install completes.
The admin password is stored as an scrypt hash using the scheme lib/auth.ts already applies to album passwords; a plaintext ADMIN_PASSWORD env var keeps working.
* docs: document the setup wizard, fix the read-only content mount (#425)
Quick Start now leads with the /install wizard, with the hand-written YAML route kept alongside it, and a First-Run Setup section covers the setup token, the files the wizard writes, and env-var precedence.
Two corrections: both Docker examples mounted content/ as :ro, which silently breaks the wizard, the admin panel and the backup rotation alike — docs/admin-panel.md already said so and the README contradicted it. And nothing documented that content/install.json holds the Immich API key, so a backup of content/ is a backup of credentials.
Also adds a Contributors section crediting the people whose work is in the project.
* feat(admin): floating save bar pinned to the bottom of the viewport (#426)
The save bar was the first, static element inside .admin-main. Since the
document itself scrolls, it left the viewport as soon as you scrolled down
— editing a subpage section or a settings block far below gave no visible
dirty hint and no reachable save button.
Replace it with a bottom-pinned floating bar shared by both editors. It
only mounts while there is something to act on (unsaved changes, an
in-flight save, or a result message), so it never covers content while
idle. The success message clears after 5s, which hides the bar again.
- new SaveBar component, replacing the duplicated markup in PageBuilder
and SettingsEditor
- adopt the previously unused .floating-save-bar CSS: slide-in keyframes
(carrying translateX(-50%)), dirty border, wrap/gap, mobile variant and
a prefers-reduced-motion opt-out; z-index 900 keeps it below modals
- .admin-main gains bottom padding so the bar never covers page content
- drop the now-unreachable idle hints: the ⌘S hint becomes a button title,
the Live Sync note becomes a static line above the settings layout
- header "Site" link now bypasses the cache (/?fresh=1), so the preview
stays reachable when the bar is hidden
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
* feat(admin): themed listbox for the album sort control (#427)
The per-album "Photo order" control was a native <select>. Because an
<option> cannot contain markup, its choices could not use the admin
panel's currentColor SVG set — the reason #415 had to fall back to plain
text after dropping the emoji labels.
Adds a Listbox component implementing the ARIA combobox/listbox pattern,
so options can render a glyph beside their label:
- DOM focus stays on the trigger button; the active option is announced
through aria-activedescendant, keeping focus management to one element
- Keyboard: arrows (clamped at the ends, like a native select),
Home/End, Enter/Space to commit, Escape to cancel, Tab commits and
moves on, and prefix type-ahead with a repeat-key cycle
- Outside dismissal on pointerdown, so a press starting outside closes
the popup before the click retargets
The sort options now carry an icon each: calendar, arrow-down, arrow-up,
an A→Z marker, and the drag glyph for manual — matching the badge the
album card already shows. SORT_LABELS stays plain text because the badge
feeds it to a title attribute.
Closes #417
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
* chore(git): ignore generated design handoff folders
* fix(admin): stop the album sort dropdown clipping, and simplify the panel (#428)
* fix(admin): render listbox popup in a portal so it escapes modal clipping
The sort control's popup was position:absolute inside three clipping ancestors
(.album-drawer overflow:hidden > .album-drawer-body overflow-y:auto >
.modal-right-column overflow-y:auto), so it was cut off at the bottom of the
Edit Album Details modal. z-index could not help: clipping happens before
stacking. It also always hung below the trigger, with no flip.
Portal the popup to document.body and position it from the trigger's viewport
rect, flipping above when there is more room there and capping max-height to the
space available so it scrolls internally rather than overflowing. It is
dismissed on scroll and resize, since the anchor is only measured on open.
The outside-pointerdown handler now also treats the popup as inside; without
that the portalled list counts as outside, and a click on an option would close
it before the selection commits.
* refactor(admin): single-column album details panel
The left column spent 1.2fr on a cover thumbnail and three stat rows, two of
which (Status, Custom Hero) only restated the form fields opposite them, while
the form itself was squeezed into 1.8fr behind a second nested scroller.
Stack the drawer in one column instead: cover as a banner, then the form at full
width, with the UUID moved into the footer. The body is now the only scroll
container, which also removes one of the ancestors that was clipping the sort
popup.
---------
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
* fix(admin): give the portalled listbox its theme back, lock the page behind modals (#429)
Two defects in the album editor.
The sort listbox popup painted transparent. Every --admin-* variable is
scoped to .admin-layout, and since the popup moved into document.body it
sits outside that subtree, so background/border/text all resolved to
nothing. It now carries its own copy of the palette in both colour
schemes, plus the font it no longer inherits.
Scrolling inside a modal also moved the page behind it. No admin modal
ever locked body scroll: the overlay covers the page but does not absorb
wheel events, so a scroll starting on the backdrop — or continuing past
the end of the modal's own scroller — reaches the document.
overscroll-behavior cannot cover that case on its own, because it only
applies to scroll containers and the backdrop is not one.
useScrollLock freezes body while a modal is open and compensates for the
width the scrollbar gives up, so nothing shifts underneath. Each lock
restores the inline value it found, which makes nesting work without a
counter — a picker opened from the drawer restores the drawer's hidden
state instead of clearing it. Applied to both drawers and all four
picker modals, which share the defect. overscroll-behavior: contain on
the scrollers stops the chaining they can handle themselves.
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
* fix(security): allow unsafe-eval in CSP script-src during dev mode
* feat(journal): add Journal Studio with split-screen editor, live preview and dedicated routes
* fix(build): separate client parser from server journal-service and fix build type errors
* fix(journal): Fotos rendern, Layout und Lightbox-Steuerung korrigieren
Fünf unabhängige Fehler in der öffentlichen Journal- und Essay-Ansicht:
* Foto-Blöcke wurden nie angezeigt. EssayView löst ein Foto über
PhotoItem.id auf, und das sind verschlüsselte Tokens — die Blöcke aus
dem Markdown tragen aber rohe Asset-UUIDs. Jede Zuordnung lief ins
Leere, und nicht auflösbare Blöcke werden still verworfen. Die IDs
werden jetzt serverseitig übersetzt; damit verschwinden nebenbei die
rohen UUIDs aus dem Client-Payload, die dort laut Projektregel nie
auftauchen dürfen. Nicht auflösbare Referenzen werden geloggt.
* Überschriften standen weiter links als der Fließtext. Jeder Block
hatte einzeln `max-width: 68ch`, und `ch` ist relativ zur Schrift des
Elements — die Serif-Überschrift ergab eine breitere Spalte. Ersetzt
durch eine gemeinsame, font-unabhängige `--essay-measure`.
* Fullbleed-Fotos bluteten nur nach links aus: `.essay-figure` ist
`width: 100%`, wodurch die Box überbestimmt ist und der negative
rechte Margin verworfen wird.
* Foto-Paare stellten beide Bilder gleich breit dar, wodurch ein
Hochformat neben einem Querformat doppelt so hoch wurde. Jetzt eine
Justified-Reihe: Breite proportional zum Seitenverhältnis, dadurch
exakt gleiche Höhen ohne Beschnitt.
* Die Lightbox hatte im Journal keine Tastatursteuerung und keine
Scroll-Sperre — beides lag in PhotoGrid, also nur im Album-Raster.
Verlagert in die Lightbox selbst, der doppelte Handler in PhotoGrid
entfernt (sonst wäre pro Pfeildruck zwei Bilder weitergesprungen).
Zusätzlich sind Proofing-Herzen und das EXIF-Panel im redaktionellen
Modus abschaltbar und im Journal aus: Client-Proofing ist ein
Übergabe-Workflow für Alben, keine Funktion einer Reportage. Auf der
Übersicht wurde der Untertitel doppelt gerendert, weil extractExcerpt()
auf ihn zurückfällt.
* feat(admin): eigene URLs für alle Bereiche und überarbeiteter Journal Studio
Das Panel war eine einzige Client-Komponente, die ihre Tabs über
useState umschaltet: keine Route pro Bereich, kein Deep-Link, kein
Zurück-Button, und nach jedem Reload landete man wieder auf "Pages".
Auch der Journal-Editor hatte keine eigene URL.
Jetzt sieben echte Routen (/admin, /admin/pages, /admin/journal,
/admin/journal/<slug>, /admin/settings, /admin/settings/<section>,
/admin/analytics). Die Shell mit Auth-Prüfung und Kopfzeile sitzt im
Layout und umschließt children — so bleibt die Session-Prüfung über
Routenwechsel montiert, statt bei jedem Tab-Wechsel neu zu laufen und
den Spinner aufblitzen zu lassen. Unbekannte Settings-Sections fallen
auf General zurück.
Im selben Zug der Journal Studio, der die Routing-Änderung ohnehin
berührt:
* Alle Eingabefelder nutzten die Klasse `admin-input`, die in keinem
CSS definiert war — sie fielen auf Browser-Defaults zurück. Jetzt
gestylt, gescoped, damit der generische Name nicht ins übrige Panel
leckt.
* Der Split View ist per Divider verschiebbar (Maus, Tastatur,
Doppelklick zum Zurücksetzen), Breite in localStorage.
* Das Studio bricht aus der 1120px-Spalte aus, die Preview hat Platz.
* Die Preview zeigte für jedes Foto fest 3:2 und log damit über das
Layout der veröffentlichten Seite; die echten Verhältnisse werden
jetzt an den Thumbnails gemessen.
* Blöcke mit alten positionsbasierten Foto-Referenzen werden markiert —
die lassen sich auf einer eigenständigen Journal-Seite nicht auflösen
und verschwanden bisher stillschweigend.
* Blocktyp-Chips als gemeinsame Komponente, monochrom und per Icon
unterschieden statt in einer eigenen Blau/Lila/Orange-Palette, die
sonst nirgends im Panel vorkommt.
* Emojis raus, SVG-Icons rein.
* fix(admin): Designsystem-Lücken im Panel schließen
Eine systematische Suche nach Klassen, die im TSX benutzt, aber in
keinem CSS definiert sind, hat vier Stellen mit demselben Muster
gefunden:
* `admin-btn-secondary` und `admin-btn-danger` existierten nicht.
Sämtliche Löschen-Buttons sahen aus wie normale Buttons — keine
Warnwirkung. Als `.admin-btn.admin-btn-danger` geschrieben, weil die
Varianten mit den Größenklassen kombiniert werden, die weiter unten
ihren eigenen Hintergrund setzen.
* `page-progress-fill` fehlte: die Balken im Analytics-Panel waren
leere Rinnen, der Wert unsichtbar. Ebenso `analytics-empty` und
`admin-loading-container`.
* `subpage-drawer-section`, `subpage-drawer-title-group` und
`input-with-icon` im PageBuilder waren wirkungslos und teils mit
Inline-Styles notdürftig kompensiert.
* `grid-card-preview` fehlte, wodurch alle Layout-Vorschauen auf Höhe
null kollabierten. Nur "Showcase" war sichtbar — und das aus Versehen,
weil sein Tile `hero-tile` hieß und damit die `aspect-ratio` einer
fremden PageBuilder-Klasse erbte. Umbenannt.
Dazu die Theme-Vorschauen, die praktisch identisch aussahen: alle
sieben zeigten dieselben drei quadratischen Kacheln, einziger
Unterschied war die Hintergrundfarbe. Sie spiegeln jetzt die echten
Preset-Daten aus lib/config/theme.ts — Schriftcharakter, Eckradius,
Rasterdichte, Passepartout bzw. Schatten.
Die Kopfzeile richtet sich an einer gemeinsamen Steuerhöhe aus. Der
"Site"-Link war höher als die Buttons daneben: `.admin-btn` hatte keine
explizite line-height, und <button> bekommt box-sizing: border-box vom
Browser, <a> nicht. Die Statusanzeige setzte weder Schriftfamilie noch
-größe und fiel auf den Browser-Default zurück — sie war nie Teil des
Designsystems. Jetzt gleiche Höhe und Typografie, Pillenform als
Zustandsanzeige, Trenner zur Aktionsgruppe. Das dauerhafte Pulsieren
des grünen Punkts entfällt; Animation bleibt den Zuständen vorbehalten,
die Aufmerksamkeit brauchen.
Restliche Emojis durch SVG-Icons ersetzt.
* feat(admin): add scroll-to-top toggle and SVG arrow
The back-to-top button was always on and drew its arrow with the ↑ text
character. Add a `scrollToTop` setting (General section in the admin
panel, defaults to on so existing sites are unaffected) and replace the
glyph with a stroked SVG that inherits currentColor across all presets.
Scroll handling is now rAF-throttled, and prefers-reduced-motion turns
off both the hover lift and the smooth scroll.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
* security(journal): escape author HTML instead of filtering it
CodeQL flags 26 high-severity alerts on the release PR; the bulk of them
point at sanitizeHtml(), a denylist of three regexes whose output goes
into dangerouslySetInnerHTML. I reproduced the bypasses before changing
anything — all four pass the old filter:
<img src=x onerror=alert(1)> unquoted handler, regex wants quotes
<img src=x onerror='alert(1)'> single quotes, same reason
<svg onload=alert(1)> not a <script> tag
javasjavascript:cript:alert(1) one-pass replace, the rest recombines
Plus an attribute breakout in the link renderer, which interpolated the
URL into href="${url}" unescaped:
[x](" onmouseover=alert(1) x=") -> <a href="" onmouseover=alert(1" ...>
Replaced with escaping. Every `&<>"'` in author text becomes an entity
before any markdown rule runs, so the only tags in the output are the
ones renderInlineMarkdown builds itself and a URL cannot leave its
attribute. Link schemes are now an allowlist (http, https, mailto, tel,
relative, anchor); anything else renders as plain text.
The serializer needed decodeHtmlEntities to match: without it a save
would write `<` into the Markdown file and the next parse would
escape the `&` again, corrupting the text further on every round trip.
A test covers parse -> serialize -> parse stability.
Two existing tests asserted the old behaviour and were rewritten rather
than deleted: one expected the script tag to be *removed* from the
output, the other expected the substring "onerror" to be absent. Both
now assert the property that matters — that no tag can form — because
`onerror` surviving as inert text is fine.
Exploitation required admin access either way: journal and essay text
comes from the studio or from content/*.md. This removes the weakness,
it does not close an open door.
* fix(journal): contain file paths, fix frontmatter escaping, defuse two regexes
Follow-up to the CodeQL findings on release PR #432. I went through all 23
alerts individually; this addresses the ones that are worth addressing and
documents the ones that are not.
Path containment (12 alerts, all false positives). Every path built from a
slug goes through isValidSlug(), a strict `/^[a-zA-Z0-9_-]+$/` allowlist —
verified against `../../etc/passwd`, `foo/../../bar`, `a/b`, `..` and
friends, all rejected. CodeQL cannot see it because the check lives in
another module. Added a containedPath() helper that resolves the path and
refuses anything landing outside the content directory: a second lock on a
door that was already locked, and a barrier the analysis can follow. Also
removed the dead `slug.endsWith('.md')` branches — isValidSlug rejects
dots, so they could never be taken.
Frontmatter escaping (1 alert, a real bug). The serializer escaped `"` but
not `\`, and the parser never unescaped anything. A title containing either
character gained a backslash on every save/load cycle:
Path C:\Users "quoted" -> Path C:\\Users \"quoted\" -> ...
Escaping now covers the backslash first and the parser undoes both. A round
trip test covers quotes, backslashes, colons and apostrophes.
Two of three ReDoS regexes (2 alerts). The heading pattern had `\s+` next to
`(.+)`, which overlap, so the engine tried every split of the whitespace run
before failing; it is `[ \t]+` and `(\S.*)` now. The quote author pattern
wrapped a lazy group around an optional group — the quadratic case — and is
an index split on the first separator now.
The third regex, the bold/italic pass, is deliberately left alone. Rewriting
it with a negated class removes the backtracking but breaks nesting:
`**bold *and italic* here**` renders as `*<em>bold </em>and italic<em> here</em>*`.
The input is Markdown from an authenticated admin, never a visitor, so the
worst case is an author slowing down their own page. The comment in the code
says so.
Not addressed: 5 js/insufficient-password-hash alerts. They ask for a slow
KDF where the code uses SHA-256/HMAC — correct in general, but the admin
password comes from an environment variable and is never stored, so a
stronger KDF protects nothing that is not already in plaintext in the
environment.
399 unit tests pass (18 new), build and tsc clean.
* fix(journal): split the quote author by scanning, not by pattern
Cleaning up after myself. #439 replaced the quote author regex
`/^(.*?)(?:\s+--\s+(.+))?$/` — a lazy group around an optional one, the
quadratic case — with `/\s+--\s+/`, and CodeQL promptly flagged the
replacement for the same reason. One reported pattern traded for another.
splitQuoteAuthor() scans for the first `--` that has whitespace on both
sides. Linear, and it needs no reasoning about the regex engine at all.
Behaviour is identical to the original regex, checked case by case
against it: separator, no separator, several separators, tabs, wide gaps,
`a--b` without spaces, leading and trailing separators, empty string. All
nine are covered by tests, plus one asserting it stays fast on a 50k
whitespace run.
* security(admin): derive the session signing key with scrypt
getSigningKey() ran the admin password through a single SHA-256 digest.
It is key derivation rather than password storage, so it was never a
stored-hash problem — but if the derived key ever leaked, one fast hash
makes recovering the password by brute force cheap. CodeQL flags it as
js/insufficient-password-hash and, for this particular alert, has a
point.
scrypt now. Two details that matter:
The salt has to be stable. A random salt would produce a different key on
every call and invalidate every session; it is derived from AUTH_SECRET,
which is deployment-specific. Verified across separate processes: same
inputs produce a verifying token, so a restart or redeploy does not log
everyone out.
The result is cached for the process lifetime. scrypt is deliberately
slow and getSigningKey() runs on every admin request — deriving per call
would add ~24ms to each one. The cache key is a digest of secret plus
password, so a rotation misses the cache and derives again, and no extra
plaintext copy of the password is kept around.
Measured: first derivation 24ms, subsequent calls 0.12ms. Password
change and secret change both invalidate an existing token, checked in
separate processes.
Note the one-time effect: existing admin sessions are invalidated by the
change in derivation, so everyone logs in once more.
* security(admin): key the signing-key cache on its inputs, not a digest
#441 removed the SHA-256 digest of the admin password from the key
derivation and introduced a new one three lines above it, as the cache
key. Same rule, same file: CodeQL reported it immediately.
The comment justifying it was wrong too. It claimed no second plaintext
copy of the password was retained, while building the digest input
allocates exactly that in order to hash it.
The cache now holds the two input strings and compares them directly.
They are the same objects the env and install caches already hold, so
nothing extra is retained, and no fast hash of the password exists in
memory for the life of the process.
Re-verified after the change, in separate processes: a token from one
process verifies in another with the same inputs, a changed password or
secret rejects it, first derivation 24ms, cached calls 0.001ms.
That leaves scrypt as the only place the password is hashed here. The
two HMACs further down operate on the derived key and on token data, not
on the password; the constant-time comparison in verifyAdminPassword is
the previously dismissed one.
---------
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
2026-08-14 16:55:07 +02:00
|
|
|
|
// Keep the builder still behind either drawer. One combined lock rather than
|
|
|
|
|
|
// one per drawer: the album drawer opens from inside the subpage drawer, and
|
|
|
|
|
|
// a single condition avoids two locks racing over the same inline style.
|
|
|
|
|
|
useScrollLock(editingAlbumAddress !== null || expandedSubpage !== null);
|
|
|
|
|
|
|
2026-05-29 17:59:25 +02:00
|
|
|
|
// DnD sensors
|
|
|
|
|
|
const sensors = useSensors(
|
|
|
|
|
|
useSensor(PointerSensor, { activationConstraint: { distance: 5 } }),
|
|
|
|
|
|
useSensor(KeyboardSensor, { coordinateGetter: sortableKeyboardCoordinates }),
|
|
|
|
|
|
);
|
feat: add visual admin panel with page builder and settings editor
- Add /admin route with password-protected visual page builder
- Page Builder: manage hero images, standalone albums, subpages, and sections
- Album Picker: browse all shared Immich albums with search and filtering
- Settings Editor: theme, grid, footer, legal, SEO configuration
- YAML service with atomic writes and automatic backups (content/.backups/)
- HMAC-signed admin sessions (24h expiry, HttpOnly cookies)
- API endpoints: /api/admin/{auth,gallery,settings,albums,reload}
- Enable with ADMIN_PASSWORD env var; disabled by default
- invalidateConfigCache() export for hot-reload after saves
2026-05-29 17:04:37 +02:00
|
|
|
|
|
|
|
|
|
|
// Load data
|
|
|
|
|
|
useEffect(() => {
|
|
|
|
|
|
loadData();
|
|
|
|
|
|
// eslint-disable-next-line react-hooks/exhaustive-deps
|
|
|
|
|
|
}, []);
|
|
|
|
|
|
|
2026-05-29 17:59:25 +02:00
|
|
|
|
// ── Keyboard shortcut: ⌘+S / Ctrl+S ─────────────────────────
|
|
|
|
|
|
useEffect(() => {
|
|
|
|
|
|
function handleKeyDown(e: KeyboardEvent) {
|
|
|
|
|
|
if ((e.metaKey || e.ctrlKey) && e.key === 's') {
|
|
|
|
|
|
e.preventDefault();
|
|
|
|
|
|
if (dirty && !saving) {
|
|
|
|
|
|
handleSave();
|
|
|
|
|
|
}
|
|
|
|
|
|
}
|
|
|
|
|
|
}
|
|
|
|
|
|
window.addEventListener('keydown', handleKeyDown);
|
|
|
|
|
|
return () => window.removeEventListener('keydown', handleKeyDown);
|
|
|
|
|
|
// eslint-disable-next-line react-hooks/exhaustive-deps
|
|
|
|
|
|
}, [dirty, saving, gallery]);
|
|
|
|
|
|
|
experimental: portfolio features (justified layout, unlisted pages, captions, per-album grid, focal point, nav links, cover hero) (#431)
## Was ist das?
Sieben neue Portfolio-Features, alle als **experimental** gekennzeichnet
— in YAML-Kommentaren, Admin-Panel-Labels und Commit-Scopes, damit sie
einzeln nachvollziehbar und revertierbar bleiben.
## Features (je ein Commit)
| Commit | Feature |
| --- | --- |
| `justified rows gallery layout` | Neues Grid-Layout `justified`:
zeilenbasiert, gleiche Höhen, volle Breite — Flexbox ohne JS-Messung,
letzte Zeile bleibt natürlich klein |
| `hide subpages from navigation` | `hidden: true`: Seite aus
Nav/Homepage raus, per Direktlink erreichbar — im Gegensatz zu `enabled:
false` (404) |
| `lightbox captions` | Immich-Asset-Description als Bildunterschrift im
Info-Panel; EXIF-Route liefert bei `exifOnHover: false` jetzt nur noch
die Caption statt 403 |
| `per-album grid overrides` | `grid:` pro Album-Eintrag, Präzedenz
global < Subpage < Album |
| `per-album cover focal point` | `coverPosition:` → `object-position`
auf Cover-Karten, strikt validiert |
| `external links in header navigation` | `navLinks:` in settings.yaml,
nur http(s), sanitisiert |
| `cover splash hero style` | `heroStyle: cover`: Fullscreen-Splash mit
Enter-Link ins Portfolio |
Alle Optionen sind im Admin-Panel editierbar (PageBuilder /
SettingsEditor).
## Tests
- 356 Unit-Tests grün (13 neue: deriveGallery hidden/grid/coverPosition,
sanitizeNavLinks, EXIF-Route-Captions, justified-Layout-Validierung)
- `npx tsc --noEmit`: 0 Fehler
- `npm run build`: sauber
- Justified-Zeilenmathematik und Cover-Splash per Browser-Harness
visuell/numerisch verifiziert (volle Zeilen enden exakt an der
Containerkante, letzte Zeile bleibt natürlich)
---------
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
2026-08-14 17:56:22 +02:00
|
|
|
|
// ── Escape closes the subpage sheet — only when it is topmost ─
|
|
|
|
|
|
useEffect(() => {
|
|
|
|
|
|
if (expandedSubpage === null) return;
|
|
|
|
|
|
function handleEscape(e: KeyboardEvent) {
|
|
|
|
|
|
if (e.key !== 'Escape') return;
|
|
|
|
|
|
// Listbox preventDefaults its own Escape but does not stopPropagation —
|
|
|
|
|
|
// respect that so closing a popup never also closes the sheet.
|
|
|
|
|
|
if (e.defaultPrevented) return;
|
|
|
|
|
|
// A higher layer (album editor, pickers, order editor) owns the key.
|
|
|
|
|
|
if (editingAlbumAddress || pickerTarget || heroPickerTarget || orderEditorTarget) return;
|
|
|
|
|
|
setExpandedSubpage(null);
|
|
|
|
|
|
}
|
|
|
|
|
|
window.addEventListener('keydown', handleEscape);
|
|
|
|
|
|
return () => window.removeEventListener('keydown', handleEscape);
|
|
|
|
|
|
}, [expandedSubpage, editingAlbumAddress, pickerTarget, heroPickerTarget, orderEditorTarget]);
|
|
|
|
|
|
|
2026-05-29 17:59:25 +02:00
|
|
|
|
// ── Unsaved changes guard ────────────────────────────────────
|
|
|
|
|
|
useEffect(() => {
|
|
|
|
|
|
function handleBeforeUnload(e: BeforeUnloadEvent) {
|
|
|
|
|
|
if (dirty) {
|
|
|
|
|
|
e.preventDefault();
|
|
|
|
|
|
e.returnValue = '';
|
|
|
|
|
|
}
|
|
|
|
|
|
}
|
|
|
|
|
|
window.addEventListener('beforeunload', handleBeforeUnload);
|
|
|
|
|
|
return () => window.removeEventListener('beforeunload', handleBeforeUnload);
|
|
|
|
|
|
}, [dirty]);
|
|
|
|
|
|
|
feat: add visual admin panel with page builder and settings editor
- Add /admin route with password-protected visual page builder
- Page Builder: manage hero images, standalone albums, subpages, and sections
- Album Picker: browse all shared Immich albums with search and filtering
- Settings Editor: theme, grid, footer, legal, SEO configuration
- YAML service with atomic writes and automatic backups (content/.backups/)
- HMAC-signed admin sessions (24h expiry, HttpOnly cookies)
- API endpoints: /api/admin/{auth,gallery,settings,albums,reload}
- Enable with ADMIN_PASSWORD env var; disabled by default
- invalidateConfigCache() export for hot-reload after saves
2026-05-29 17:04:37 +02:00
|
|
|
|
async function loadData() {
|
|
|
|
|
|
setLoading(true);
|
|
|
|
|
|
try {
|
|
|
|
|
|
const [galleryRes, albumsRes] = await Promise.all([
|
|
|
|
|
|
fetch('/api/admin/gallery'),
|
|
|
|
|
|
fetch('/api/admin/albums'),
|
|
|
|
|
|
]);
|
|
|
|
|
|
|
|
|
|
|
|
if (galleryRes.ok) {
|
|
|
|
|
|
const { gallery: raw } = await galleryRes.json();
|
|
|
|
|
|
setGallery(parseGalleryYaml(raw));
|
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
if (albumsRes.ok) {
|
|
|
|
|
|
const { albums } = await albumsRes.json();
|
|
|
|
|
|
setImmichAlbums(albums);
|
|
|
|
|
|
}
|
|
|
|
|
|
} catch (err) {
|
|
|
|
|
|
console.error('Failed to load admin data:', err);
|
|
|
|
|
|
} finally {
|
|
|
|
|
|
setLoading(false);
|
|
|
|
|
|
}
|
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
function parseGalleryYaml(raw: Record<string, unknown>): GalleryState {
|
|
|
|
|
|
const hero = Array.isArray(raw.hero) ? raw.hero : raw.hero ? [raw.hero as string] : [];
|
|
|
|
|
|
const albums = parseAlbumEntries(
|
|
|
|
|
|
raw.albums as Array<string | Record<string, string>> | undefined,
|
|
|
|
|
|
);
|
|
|
|
|
|
|
|
|
|
|
|
let subpages: Subpage[] = [];
|
|
|
|
|
|
if (Array.isArray(raw.subpages)) {
|
|
|
|
|
|
subpages = (raw.subpages as Array<Record<string, unknown>>).map((sp) => ({
|
|
|
|
|
|
name: (sp.name as string) || '',
|
|
|
|
|
|
title: sp.title as string | undefined,
|
|
|
|
|
|
subtitle: sp.subtitle as string | undefined,
|
|
|
|
|
|
password: sp.password as string | undefined,
|
security: add Trivy container scan to Docker publish workflow (#399)
* feat(admin): add backup manager UI with 1-click restore
* feat(admin): collapse older backup entries by default
* fix(theme): isolate admin layout, instant DOM theme updates, and add Light/Dark mode toggle
* feat(admin): replace text controls for Photo Frame and Hero Style with visual preview cards
* fix(admin): define missing CSS rules for button system (.btn, .preset-btn)
* feat(admin): redesign theme settings with segmented mode toggle, accent color swatches, and custom iOS-style toggle cards
* feat(admin): upgrade all settings tabs with visual grid previews, Google SEO snippet preview, and toggle cards
* feat(admin): overhaul Pages Builder UX with slide-over drawer, card hover badges, real-time search, and floating save bar
* fix(admin): remove leftover dangling syntax snippet in PageBuilder.tsx
* fix(admin): add position: relative to subpage-tile so hover overlay is contained inside the tile
* style(admin): replace all emojis with clean Leica-style vector SVG icons
* fix(types): extend IconProps with SVGProps to allow style prop on Leica SVG icons
* feat(admin): add subpage live-preview, privacy analytics, and asset protection settings
* fix(typecheck): fix AlbumEntry property access in subpage drawer preview mode
* fix(types): fix ImmichAlbumInfo property names thumbnailAssetId and albumName in PageBuilder.tsx
* fix(types): add protection and watermark optional properties to AppConfig interface
* feat(settings): add toggle for disabling analytics tracking (defaults to enabled)
* feat(ux): show status banner when analytics tracking is disabled + add live sync indicator
* feat(watermark): render customizable watermark overlay on Lightbox images + rename section to Portfolio Features & Modules
* fix(types): import type LightboxWatermark in PhotoGrid.tsx
* fix(types): destructure watermark prop in PhotoGrid function signature
* feat(seo): add configurable subpage title template and metadata descriptions
* feat(seo): add generateMetadata to about page for title template support
* feat(proofing): add client proofing, favorites selection, compact URL bitmasking, and export modal
* feat(essay): add Photo Essay storytelling mode with RSC markdown parser and fullbleed/pair layouts
* feat(subpages): add page enabled toggle to deactivate subpages without deleting them
* feat(admin): add visual essay block builder for photo essay storytelling pages
* security: add Trivy container scan to Docker publish workflow
Scans the built image for CRITICAL/HIGH CVEs on every release and
uploads results to the GitHub Security tab. Non-blocking for now
(exit-code 0) so releases aren't gated on findings. Also documents
the scan and existing Dependabot coverage in the README.
---------
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-08-07 11:08:04 +02:00
|
|
|
|
enabled: sp.enabled !== false,
|
experimental: portfolio features (justified layout, unlisted pages, captions, per-album grid, focal point, nav links, cover hero) (#431)
## Was ist das?
Sieben neue Portfolio-Features, alle als **experimental** gekennzeichnet
— in YAML-Kommentaren, Admin-Panel-Labels und Commit-Scopes, damit sie
einzeln nachvollziehbar und revertierbar bleiben.
## Features (je ein Commit)
| Commit | Feature |
| --- | --- |
| `justified rows gallery layout` | Neues Grid-Layout `justified`:
zeilenbasiert, gleiche Höhen, volle Breite — Flexbox ohne JS-Messung,
letzte Zeile bleibt natürlich klein |
| `hide subpages from navigation` | `hidden: true`: Seite aus
Nav/Homepage raus, per Direktlink erreichbar — im Gegensatz zu `enabled:
false` (404) |
| `lightbox captions` | Immich-Asset-Description als Bildunterschrift im
Info-Panel; EXIF-Route liefert bei `exifOnHover: false` jetzt nur noch
die Caption statt 403 |
| `per-album grid overrides` | `grid:` pro Album-Eintrag, Präzedenz
global < Subpage < Album |
| `per-album cover focal point` | `coverPosition:` → `object-position`
auf Cover-Karten, strikt validiert |
| `external links in header navigation` | `navLinks:` in settings.yaml,
nur http(s), sanitisiert |
| `cover splash hero style` | `heroStyle: cover`: Fullscreen-Splash mit
Enter-Link ins Portfolio |
Alle Optionen sind im Admin-Panel editierbar (PageBuilder /
SettingsEditor).
## Tests
- 356 Unit-Tests grün (13 neue: deriveGallery hidden/grid/coverPosition,
sanitizeNavLinks, EXIF-Route-Captions, justified-Layout-Validierung)
- `npx tsc --noEmit`: 0 Fehler
- `npm run build`: sauber
- Justified-Zeilenmathematik und Cover-Splash per Browser-Harness
visuell/numerisch verifiziert (volle Zeilen enden exakt an der
Containerkante, letzte Zeile bleibt natürlich)
---------
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
2026-08-14 17:56:22 +02:00
|
|
|
|
hidden: sp.hidden === true,
|
security: add Trivy container scan to Docker publish workflow (#399)
* feat(admin): add backup manager UI with 1-click restore
* feat(admin): collapse older backup entries by default
* fix(theme): isolate admin layout, instant DOM theme updates, and add Light/Dark mode toggle
* feat(admin): replace text controls for Photo Frame and Hero Style with visual preview cards
* fix(admin): define missing CSS rules for button system (.btn, .preset-btn)
* feat(admin): redesign theme settings with segmented mode toggle, accent color swatches, and custom iOS-style toggle cards
* feat(admin): upgrade all settings tabs with visual grid previews, Google SEO snippet preview, and toggle cards
* feat(admin): overhaul Pages Builder UX with slide-over drawer, card hover badges, real-time search, and floating save bar
* fix(admin): remove leftover dangling syntax snippet in PageBuilder.tsx
* fix(admin): add position: relative to subpage-tile so hover overlay is contained inside the tile
* style(admin): replace all emojis with clean Leica-style vector SVG icons
* fix(types): extend IconProps with SVGProps to allow style prop on Leica SVG icons
* feat(admin): add subpage live-preview, privacy analytics, and asset protection settings
* fix(typecheck): fix AlbumEntry property access in subpage drawer preview mode
* fix(types): fix ImmichAlbumInfo property names thumbnailAssetId and albumName in PageBuilder.tsx
* fix(types): add protection and watermark optional properties to AppConfig interface
* feat(settings): add toggle for disabling analytics tracking (defaults to enabled)
* feat(ux): show status banner when analytics tracking is disabled + add live sync indicator
* feat(watermark): render customizable watermark overlay on Lightbox images + rename section to Portfolio Features & Modules
* fix(types): import type LightboxWatermark in PhotoGrid.tsx
* fix(types): destructure watermark prop in PhotoGrid function signature
* feat(seo): add configurable subpage title template and metadata descriptions
* feat(seo): add generateMetadata to about page for title template support
* feat(proofing): add client proofing, favorites selection, compact URL bitmasking, and export modal
* feat(essay): add Photo Essay storytelling mode with RSC markdown parser and fullbleed/pair layouts
* feat(subpages): add page enabled toggle to deactivate subpages without deleting them
* feat(admin): add visual essay block builder for photo essay storytelling pages
* security: add Trivy container scan to Docker publish workflow
Scans the built image for CRITICAL/HIGH CVEs on every release and
uploads results to the GitHub Security tab. Non-blocking for now
(exit-code 0) so releases aren't gated on findings. Also documents
the scan and existing Dependabot coverage in the README.
---------
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-08-07 11:08:04 +02:00
|
|
|
|
essayText: sp.essayText as string | undefined,
|
|
|
|
|
|
essayFile: sp.essayFile as string | undefined,
|
feat: add visual admin panel with page builder and settings editor
- Add /admin route with password-protected visual page builder
- Page Builder: manage hero images, standalone albums, subpages, and sections
- Album Picker: browse all shared Immich albums with search and filtering
- Settings Editor: theme, grid, footer, legal, SEO configuration
- YAML service with atomic writes and automatic backups (content/.backups/)
- HMAC-signed admin sessions (24h expiry, HttpOnly cookies)
- API endpoints: /api/admin/{auth,gallery,settings,albums,reload}
- Enable with ADMIN_PASSWORD env var; disabled by default
- invalidateConfigCache() export for hot-reload after saves
2026-05-29 17:04:37 +02:00
|
|
|
|
albums: parseAlbumEntries(sp.albums as Array<string | Record<string, string>> | undefined),
|
|
|
|
|
|
sections: sp.sections
|
|
|
|
|
|
? (sp.sections as Array<Record<string, unknown>>).map((sec) => ({
|
|
|
|
|
|
title: (sec.title as string) || '',
|
|
|
|
|
|
description: sec.description as string | undefined,
|
|
|
|
|
|
albums: parseAlbumEntries(sec.albums as Array<string | Record<string, string>>),
|
|
|
|
|
|
}))
|
|
|
|
|
|
: undefined,
|
|
|
|
|
|
grid: sp.grid as Subpage['grid'],
|
|
|
|
|
|
}));
|
|
|
|
|
|
} else if (raw.subpages && typeof raw.subpages === 'object') {
|
|
|
|
|
|
subpages = Object.entries(raw.subpages as Record<string, unknown>).map(([name, value]) => {
|
|
|
|
|
|
if (Array.isArray(value)) {
|
security: add Trivy container scan to Docker publish workflow (#399)
* feat(admin): add backup manager UI with 1-click restore
* feat(admin): collapse older backup entries by default
* fix(theme): isolate admin layout, instant DOM theme updates, and add Light/Dark mode toggle
* feat(admin): replace text controls for Photo Frame and Hero Style with visual preview cards
* fix(admin): define missing CSS rules for button system (.btn, .preset-btn)
* feat(admin): redesign theme settings with segmented mode toggle, accent color swatches, and custom iOS-style toggle cards
* feat(admin): upgrade all settings tabs with visual grid previews, Google SEO snippet preview, and toggle cards
* feat(admin): overhaul Pages Builder UX with slide-over drawer, card hover badges, real-time search, and floating save bar
* fix(admin): remove leftover dangling syntax snippet in PageBuilder.tsx
* fix(admin): add position: relative to subpage-tile so hover overlay is contained inside the tile
* style(admin): replace all emojis with clean Leica-style vector SVG icons
* fix(types): extend IconProps with SVGProps to allow style prop on Leica SVG icons
* feat(admin): add subpage live-preview, privacy analytics, and asset protection settings
* fix(typecheck): fix AlbumEntry property access in subpage drawer preview mode
* fix(types): fix ImmichAlbumInfo property names thumbnailAssetId and albumName in PageBuilder.tsx
* fix(types): add protection and watermark optional properties to AppConfig interface
* feat(settings): add toggle for disabling analytics tracking (defaults to enabled)
* feat(ux): show status banner when analytics tracking is disabled + add live sync indicator
* feat(watermark): render customizable watermark overlay on Lightbox images + rename section to Portfolio Features & Modules
* fix(types): import type LightboxWatermark in PhotoGrid.tsx
* fix(types): destructure watermark prop in PhotoGrid function signature
* feat(seo): add configurable subpage title template and metadata descriptions
* feat(seo): add generateMetadata to about page for title template support
* feat(proofing): add client proofing, favorites selection, compact URL bitmasking, and export modal
* feat(essay): add Photo Essay storytelling mode with RSC markdown parser and fullbleed/pair layouts
* feat(subpages): add page enabled toggle to deactivate subpages without deleting them
* feat(admin): add visual essay block builder for photo essay storytelling pages
* security: add Trivy container scan to Docker publish workflow
Scans the built image for CRITICAL/HIGH CVEs on every release and
uploads results to the GitHub Security tab. Non-blocking for now
(exit-code 0) so releases aren't gated on findings. Also documents
the scan and existing Dependabot coverage in the README.
---------
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-08-07 11:08:04 +02:00
|
|
|
|
return { name, albums: parseAlbumEntries(value), sections: undefined, enabled: true };
|
feat: add visual admin panel with page builder and settings editor
- Add /admin route with password-protected visual page builder
- Page Builder: manage hero images, standalone albums, subpages, and sections
- Album Picker: browse all shared Immich albums with search and filtering
- Settings Editor: theme, grid, footer, legal, SEO configuration
- YAML service with atomic writes and automatic backups (content/.backups/)
- HMAC-signed admin sessions (24h expiry, HttpOnly cookies)
- API endpoints: /api/admin/{auth,gallery,settings,albums,reload}
- Enable with ADMIN_PASSWORD env var; disabled by default
- invalidateConfigCache() export for hot-reload after saves
2026-05-29 17:04:37 +02:00
|
|
|
|
}
|
|
|
|
|
|
const sp = value as Record<string, unknown>;
|
|
|
|
|
|
return {
|
|
|
|
|
|
name,
|
|
|
|
|
|
title: sp.title as string | undefined,
|
|
|
|
|
|
subtitle: sp.subtitle as string | undefined,
|
|
|
|
|
|
password: sp.password as string | undefined,
|
security: add Trivy container scan to Docker publish workflow (#399)
* feat(admin): add backup manager UI with 1-click restore
* feat(admin): collapse older backup entries by default
* fix(theme): isolate admin layout, instant DOM theme updates, and add Light/Dark mode toggle
* feat(admin): replace text controls for Photo Frame and Hero Style with visual preview cards
* fix(admin): define missing CSS rules for button system (.btn, .preset-btn)
* feat(admin): redesign theme settings with segmented mode toggle, accent color swatches, and custom iOS-style toggle cards
* feat(admin): upgrade all settings tabs with visual grid previews, Google SEO snippet preview, and toggle cards
* feat(admin): overhaul Pages Builder UX with slide-over drawer, card hover badges, real-time search, and floating save bar
* fix(admin): remove leftover dangling syntax snippet in PageBuilder.tsx
* fix(admin): add position: relative to subpage-tile so hover overlay is contained inside the tile
* style(admin): replace all emojis with clean Leica-style vector SVG icons
* fix(types): extend IconProps with SVGProps to allow style prop on Leica SVG icons
* feat(admin): add subpage live-preview, privacy analytics, and asset protection settings
* fix(typecheck): fix AlbumEntry property access in subpage drawer preview mode
* fix(types): fix ImmichAlbumInfo property names thumbnailAssetId and albumName in PageBuilder.tsx
* fix(types): add protection and watermark optional properties to AppConfig interface
* feat(settings): add toggle for disabling analytics tracking (defaults to enabled)
* feat(ux): show status banner when analytics tracking is disabled + add live sync indicator
* feat(watermark): render customizable watermark overlay on Lightbox images + rename section to Portfolio Features & Modules
* fix(types): import type LightboxWatermark in PhotoGrid.tsx
* fix(types): destructure watermark prop in PhotoGrid function signature
* feat(seo): add configurable subpage title template and metadata descriptions
* feat(seo): add generateMetadata to about page for title template support
* feat(proofing): add client proofing, favorites selection, compact URL bitmasking, and export modal
* feat(essay): add Photo Essay storytelling mode with RSC markdown parser and fullbleed/pair layouts
* feat(subpages): add page enabled toggle to deactivate subpages without deleting them
* feat(admin): add visual essay block builder for photo essay storytelling pages
* security: add Trivy container scan to Docker publish workflow
Scans the built image for CRITICAL/HIGH CVEs on every release and
uploads results to the GitHub Security tab. Non-blocking for now
(exit-code 0) so releases aren't gated on findings. Also documents
the scan and existing Dependabot coverage in the README.
---------
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-08-07 11:08:04 +02:00
|
|
|
|
enabled: sp.enabled !== false,
|
experimental: portfolio features (justified layout, unlisted pages, captions, per-album grid, focal point, nav links, cover hero) (#431)
## Was ist das?
Sieben neue Portfolio-Features, alle als **experimental** gekennzeichnet
— in YAML-Kommentaren, Admin-Panel-Labels und Commit-Scopes, damit sie
einzeln nachvollziehbar und revertierbar bleiben.
## Features (je ein Commit)
| Commit | Feature |
| --- | --- |
| `justified rows gallery layout` | Neues Grid-Layout `justified`:
zeilenbasiert, gleiche Höhen, volle Breite — Flexbox ohne JS-Messung,
letzte Zeile bleibt natürlich klein |
| `hide subpages from navigation` | `hidden: true`: Seite aus
Nav/Homepage raus, per Direktlink erreichbar — im Gegensatz zu `enabled:
false` (404) |
| `lightbox captions` | Immich-Asset-Description als Bildunterschrift im
Info-Panel; EXIF-Route liefert bei `exifOnHover: false` jetzt nur noch
die Caption statt 403 |
| `per-album grid overrides` | `grid:` pro Album-Eintrag, Präzedenz
global < Subpage < Album |
| `per-album cover focal point` | `coverPosition:` → `object-position`
auf Cover-Karten, strikt validiert |
| `external links in header navigation` | `navLinks:` in settings.yaml,
nur http(s), sanitisiert |
| `cover splash hero style` | `heroStyle: cover`: Fullscreen-Splash mit
Enter-Link ins Portfolio |
Alle Optionen sind im Admin-Panel editierbar (PageBuilder /
SettingsEditor).
## Tests
- 356 Unit-Tests grün (13 neue: deriveGallery hidden/grid/coverPosition,
sanitizeNavLinks, EXIF-Route-Captions, justified-Layout-Validierung)
- `npx tsc --noEmit`: 0 Fehler
- `npm run build`: sauber
- Justified-Zeilenmathematik und Cover-Splash per Browser-Harness
visuell/numerisch verifiziert (volle Zeilen enden exakt an der
Containerkante, letzte Zeile bleibt natürlich)
---------
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
2026-08-14 17:56:22 +02:00
|
|
|
|
hidden: sp.hidden === true,
|
security: add Trivy container scan to Docker publish workflow (#399)
* feat(admin): add backup manager UI with 1-click restore
* feat(admin): collapse older backup entries by default
* fix(theme): isolate admin layout, instant DOM theme updates, and add Light/Dark mode toggle
* feat(admin): replace text controls for Photo Frame and Hero Style with visual preview cards
* fix(admin): define missing CSS rules for button system (.btn, .preset-btn)
* feat(admin): redesign theme settings with segmented mode toggle, accent color swatches, and custom iOS-style toggle cards
* feat(admin): upgrade all settings tabs with visual grid previews, Google SEO snippet preview, and toggle cards
* feat(admin): overhaul Pages Builder UX with slide-over drawer, card hover badges, real-time search, and floating save bar
* fix(admin): remove leftover dangling syntax snippet in PageBuilder.tsx
* fix(admin): add position: relative to subpage-tile so hover overlay is contained inside the tile
* style(admin): replace all emojis with clean Leica-style vector SVG icons
* fix(types): extend IconProps with SVGProps to allow style prop on Leica SVG icons
* feat(admin): add subpage live-preview, privacy analytics, and asset protection settings
* fix(typecheck): fix AlbumEntry property access in subpage drawer preview mode
* fix(types): fix ImmichAlbumInfo property names thumbnailAssetId and albumName in PageBuilder.tsx
* fix(types): add protection and watermark optional properties to AppConfig interface
* feat(settings): add toggle for disabling analytics tracking (defaults to enabled)
* feat(ux): show status banner when analytics tracking is disabled + add live sync indicator
* feat(watermark): render customizable watermark overlay on Lightbox images + rename section to Portfolio Features & Modules
* fix(types): import type LightboxWatermark in PhotoGrid.tsx
* fix(types): destructure watermark prop in PhotoGrid function signature
* feat(seo): add configurable subpage title template and metadata descriptions
* feat(seo): add generateMetadata to about page for title template support
* feat(proofing): add client proofing, favorites selection, compact URL bitmasking, and export modal
* feat(essay): add Photo Essay storytelling mode with RSC markdown parser and fullbleed/pair layouts
* feat(subpages): add page enabled toggle to deactivate subpages without deleting them
* feat(admin): add visual essay block builder for photo essay storytelling pages
* security: add Trivy container scan to Docker publish workflow
Scans the built image for CRITICAL/HIGH CVEs on every release and
uploads results to the GitHub Security tab. Non-blocking for now
(exit-code 0) so releases aren't gated on findings. Also documents
the scan and existing Dependabot coverage in the README.
---------
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-08-07 11:08:04 +02:00
|
|
|
|
essayText: sp.essayText as string | undefined,
|
|
|
|
|
|
essayFile: sp.essayFile as string | undefined,
|
feat: add visual admin panel with page builder and settings editor
- Add /admin route with password-protected visual page builder
- Page Builder: manage hero images, standalone albums, subpages, and sections
- Album Picker: browse all shared Immich albums with search and filtering
- Settings Editor: theme, grid, footer, legal, SEO configuration
- YAML service with atomic writes and automatic backups (content/.backups/)
- HMAC-signed admin sessions (24h expiry, HttpOnly cookies)
- API endpoints: /api/admin/{auth,gallery,settings,albums,reload}
- Enable with ADMIN_PASSWORD env var; disabled by default
- invalidateConfigCache() export for hot-reload after saves
2026-05-29 17:04:37 +02:00
|
|
|
|
albums: parseAlbumEntries(
|
|
|
|
|
|
sp.albums as Array<string | Record<string, string>> | undefined,
|
|
|
|
|
|
),
|
|
|
|
|
|
sections: undefined,
|
|
|
|
|
|
grid: sp.grid as Subpage['grid'],
|
|
|
|
|
|
};
|
|
|
|
|
|
});
|
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
return { hero, albums, subpages };
|
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
const markDirty = useCallback(() => {
|
|
|
|
|
|
setDirty(true);
|
|
|
|
|
|
setSaveMessage('');
|
|
|
|
|
|
}, []);
|
|
|
|
|
|
|
|
|
|
|
|
// ── Save ──────────────────────────────────────────────────────
|
|
|
|
|
|
async function handleSave() {
|
|
|
|
|
|
setSaving(true);
|
|
|
|
|
|
setSaveMessage('');
|
|
|
|
|
|
|
|
|
|
|
|
const yamlData: Record<string, unknown> = {};
|
|
|
|
|
|
|
|
|
|
|
|
if (gallery.hero.length > 0) {
|
|
|
|
|
|
yamlData.hero = gallery.hero;
|
|
|
|
|
|
}
|
|
|
|
|
|
if (gallery.albums.length > 0) {
|
|
|
|
|
|
yamlData.albums = serializeAlbumEntries(gallery.albums);
|
|
|
|
|
|
}
|
|
|
|
|
|
if (gallery.subpages.length > 0) {
|
|
|
|
|
|
yamlData.subpages = gallery.subpages.map((sp) => {
|
|
|
|
|
|
const entry: Record<string, unknown> = { name: sp.name };
|
|
|
|
|
|
if (sp.title) entry.title = sp.title;
|
|
|
|
|
|
if (sp.subtitle) entry.subtitle = sp.subtitle;
|
|
|
|
|
|
if (sp.password) entry.password = sp.password;
|
security: add Trivy container scan to Docker publish workflow (#399)
* feat(admin): add backup manager UI with 1-click restore
* feat(admin): collapse older backup entries by default
* fix(theme): isolate admin layout, instant DOM theme updates, and add Light/Dark mode toggle
* feat(admin): replace text controls for Photo Frame and Hero Style with visual preview cards
* fix(admin): define missing CSS rules for button system (.btn, .preset-btn)
* feat(admin): redesign theme settings with segmented mode toggle, accent color swatches, and custom iOS-style toggle cards
* feat(admin): upgrade all settings tabs with visual grid previews, Google SEO snippet preview, and toggle cards
* feat(admin): overhaul Pages Builder UX with slide-over drawer, card hover badges, real-time search, and floating save bar
* fix(admin): remove leftover dangling syntax snippet in PageBuilder.tsx
* fix(admin): add position: relative to subpage-tile so hover overlay is contained inside the tile
* style(admin): replace all emojis with clean Leica-style vector SVG icons
* fix(types): extend IconProps with SVGProps to allow style prop on Leica SVG icons
* feat(admin): add subpage live-preview, privacy analytics, and asset protection settings
* fix(typecheck): fix AlbumEntry property access in subpage drawer preview mode
* fix(types): fix ImmichAlbumInfo property names thumbnailAssetId and albumName in PageBuilder.tsx
* fix(types): add protection and watermark optional properties to AppConfig interface
* feat(settings): add toggle for disabling analytics tracking (defaults to enabled)
* feat(ux): show status banner when analytics tracking is disabled + add live sync indicator
* feat(watermark): render customizable watermark overlay on Lightbox images + rename section to Portfolio Features & Modules
* fix(types): import type LightboxWatermark in PhotoGrid.tsx
* fix(types): destructure watermark prop in PhotoGrid function signature
* feat(seo): add configurable subpage title template and metadata descriptions
* feat(seo): add generateMetadata to about page for title template support
* feat(proofing): add client proofing, favorites selection, compact URL bitmasking, and export modal
* feat(essay): add Photo Essay storytelling mode with RSC markdown parser and fullbleed/pair layouts
* feat(subpages): add page enabled toggle to deactivate subpages without deleting them
* feat(admin): add visual essay block builder for photo essay storytelling pages
* security: add Trivy container scan to Docker publish workflow
Scans the built image for CRITICAL/HIGH CVEs on every release and
uploads results to the GitHub Security tab. Non-blocking for now
(exit-code 0) so releases aren't gated on findings. Also documents
the scan and existing Dependabot coverage in the README.
---------
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-08-07 11:08:04 +02:00
|
|
|
|
if (sp.enabled === false) entry.enabled = false;
|
experimental: portfolio features (justified layout, unlisted pages, captions, per-album grid, focal point, nav links, cover hero) (#431)
## Was ist das?
Sieben neue Portfolio-Features, alle als **experimental** gekennzeichnet
— in YAML-Kommentaren, Admin-Panel-Labels und Commit-Scopes, damit sie
einzeln nachvollziehbar und revertierbar bleiben.
## Features (je ein Commit)
| Commit | Feature |
| --- | --- |
| `justified rows gallery layout` | Neues Grid-Layout `justified`:
zeilenbasiert, gleiche Höhen, volle Breite — Flexbox ohne JS-Messung,
letzte Zeile bleibt natürlich klein |
| `hide subpages from navigation` | `hidden: true`: Seite aus
Nav/Homepage raus, per Direktlink erreichbar — im Gegensatz zu `enabled:
false` (404) |
| `lightbox captions` | Immich-Asset-Description als Bildunterschrift im
Info-Panel; EXIF-Route liefert bei `exifOnHover: false` jetzt nur noch
die Caption statt 403 |
| `per-album grid overrides` | `grid:` pro Album-Eintrag, Präzedenz
global < Subpage < Album |
| `per-album cover focal point` | `coverPosition:` → `object-position`
auf Cover-Karten, strikt validiert |
| `external links in header navigation` | `navLinks:` in settings.yaml,
nur http(s), sanitisiert |
| `cover splash hero style` | `heroStyle: cover`: Fullscreen-Splash mit
Enter-Link ins Portfolio |
Alle Optionen sind im Admin-Panel editierbar (PageBuilder /
SettingsEditor).
## Tests
- 356 Unit-Tests grün (13 neue: deriveGallery hidden/grid/coverPosition,
sanitizeNavLinks, EXIF-Route-Captions, justified-Layout-Validierung)
- `npx tsc --noEmit`: 0 Fehler
- `npm run build`: sauber
- Justified-Zeilenmathematik und Cover-Splash per Browser-Harness
visuell/numerisch verifiziert (volle Zeilen enden exakt an der
Containerkante, letzte Zeile bleibt natürlich)
---------
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
2026-08-14 17:56:22 +02:00
|
|
|
|
if (sp.hidden === true) entry.hidden = true;
|
security: add Trivy container scan to Docker publish workflow (#399)
* feat(admin): add backup manager UI with 1-click restore
* feat(admin): collapse older backup entries by default
* fix(theme): isolate admin layout, instant DOM theme updates, and add Light/Dark mode toggle
* feat(admin): replace text controls for Photo Frame and Hero Style with visual preview cards
* fix(admin): define missing CSS rules for button system (.btn, .preset-btn)
* feat(admin): redesign theme settings with segmented mode toggle, accent color swatches, and custom iOS-style toggle cards
* feat(admin): upgrade all settings tabs with visual grid previews, Google SEO snippet preview, and toggle cards
* feat(admin): overhaul Pages Builder UX with slide-over drawer, card hover badges, real-time search, and floating save bar
* fix(admin): remove leftover dangling syntax snippet in PageBuilder.tsx
* fix(admin): add position: relative to subpage-tile so hover overlay is contained inside the tile
* style(admin): replace all emojis with clean Leica-style vector SVG icons
* fix(types): extend IconProps with SVGProps to allow style prop on Leica SVG icons
* feat(admin): add subpage live-preview, privacy analytics, and asset protection settings
* fix(typecheck): fix AlbumEntry property access in subpage drawer preview mode
* fix(types): fix ImmichAlbumInfo property names thumbnailAssetId and albumName in PageBuilder.tsx
* fix(types): add protection and watermark optional properties to AppConfig interface
* feat(settings): add toggle for disabling analytics tracking (defaults to enabled)
* feat(ux): show status banner when analytics tracking is disabled + add live sync indicator
* feat(watermark): render customizable watermark overlay on Lightbox images + rename section to Portfolio Features & Modules
* fix(types): import type LightboxWatermark in PhotoGrid.tsx
* fix(types): destructure watermark prop in PhotoGrid function signature
* feat(seo): add configurable subpage title template and metadata descriptions
* feat(seo): add generateMetadata to about page for title template support
* feat(proofing): add client proofing, favorites selection, compact URL bitmasking, and export modal
* feat(essay): add Photo Essay storytelling mode with RSC markdown parser and fullbleed/pair layouts
* feat(subpages): add page enabled toggle to deactivate subpages without deleting them
* feat(admin): add visual essay block builder for photo essay storytelling pages
* security: add Trivy container scan to Docker publish workflow
Scans the built image for CRITICAL/HIGH CVEs on every release and
uploads results to the GitHub Security tab. Non-blocking for now
(exit-code 0) so releases aren't gated on findings. Also documents
the scan and existing Dependabot coverage in the README.
---------
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-08-07 11:08:04 +02:00
|
|
|
|
if (sp.essayText) entry.essayText = sp.essayText;
|
|
|
|
|
|
if (sp.essayFile) entry.essayFile = sp.essayFile;
|
feat: add visual admin panel with page builder and settings editor
- Add /admin route with password-protected visual page builder
- Page Builder: manage hero images, standalone albums, subpages, and sections
- Album Picker: browse all shared Immich albums with search and filtering
- Settings Editor: theme, grid, footer, legal, SEO configuration
- YAML service with atomic writes and automatic backups (content/.backups/)
- HMAC-signed admin sessions (24h expiry, HttpOnly cookies)
- API endpoints: /api/admin/{auth,gallery,settings,albums,reload}
- Enable with ADMIN_PASSWORD env var; disabled by default
- invalidateConfigCache() export for hot-reload after saves
2026-05-29 17:04:37 +02:00
|
|
|
|
if (sp.grid) entry.grid = sp.grid;
|
|
|
|
|
|
|
|
|
|
|
|
if (sp.sections && sp.sections.length > 0) {
|
|
|
|
|
|
entry.sections = sp.sections.map((sec) => {
|
|
|
|
|
|
const s: Record<string, unknown> = {
|
|
|
|
|
|
title: sec.title,
|
|
|
|
|
|
albums: serializeAlbumEntries(sec.albums),
|
|
|
|
|
|
};
|
|
|
|
|
|
if (sec.description) s.description = sec.description;
|
|
|
|
|
|
return s;
|
|
|
|
|
|
});
|
|
|
|
|
|
if (sp.albums.length > 0) {
|
|
|
|
|
|
entry.albums = serializeAlbumEntries(sp.albums);
|
|
|
|
|
|
}
|
|
|
|
|
|
} else {
|
|
|
|
|
|
entry.albums = serializeAlbumEntries(sp.albums);
|
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
return entry;
|
|
|
|
|
|
});
|
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
try {
|
|
|
|
|
|
const res = await fetch('/api/admin/gallery', {
|
|
|
|
|
|
method: 'PUT',
|
|
|
|
|
|
headers: { 'Content-Type': 'application/json' },
|
|
|
|
|
|
body: JSON.stringify({ gallery: yamlData }),
|
|
|
|
|
|
});
|
|
|
|
|
|
|
|
|
|
|
|
if (res.ok) {
|
2026-05-29 17:20:56 +02:00
|
|
|
|
const data = await res.json();
|
feat: add visual admin panel with page builder and settings editor
- Add /admin route with password-protected visual page builder
- Page Builder: manage hero images, standalone albums, subpages, and sections
- Album Picker: browse all shared Immich albums with search and filtering
- Settings Editor: theme, grid, footer, legal, SEO configuration
- YAML service with atomic writes and automatic backups (content/.backups/)
- HMAC-signed admin sessions (24h expiry, HttpOnly cookies)
- API endpoints: /api/admin/{auth,gallery,settings,albums,reload}
- Enable with ADMIN_PASSWORD env var; disabled by default
- invalidateConfigCache() export for hot-reload after saves
2026-05-29 17:04:37 +02:00
|
|
|
|
setDirty(false);
|
2026-05-29 17:20:56 +02:00
|
|
|
|
setSaveMessage(data.message || 'Saved successfully!');
|
|
|
|
|
|
setTimeout(() => setSaveMessage(''), 5000);
|
feat: add visual admin panel with page builder and settings editor
- Add /admin route with password-protected visual page builder
- Page Builder: manage hero images, standalone albums, subpages, and sections
- Album Picker: browse all shared Immich albums with search and filtering
- Settings Editor: theme, grid, footer, legal, SEO configuration
- YAML service with atomic writes and automatic backups (content/.backups/)
- HMAC-signed admin sessions (24h expiry, HttpOnly cookies)
- API endpoints: /api/admin/{auth,gallery,settings,albums,reload}
- Enable with ADMIN_PASSWORD env var; disabled by default
- invalidateConfigCache() export for hot-reload after saves
2026-05-29 17:04:37 +02:00
|
|
|
|
} else {
|
|
|
|
|
|
const err = await res.json();
|
|
|
|
|
|
setSaveMessage(`Error: ${err.error}`);
|
|
|
|
|
|
}
|
|
|
|
|
|
} catch {
|
|
|
|
|
|
setSaveMessage('Error: Failed to save');
|
|
|
|
|
|
} finally {
|
|
|
|
|
|
setSaving(false);
|
|
|
|
|
|
}
|
|
|
|
|
|
}
|
|
|
|
|
|
|
2026-05-29 17:59:25 +02:00
|
|
|
|
// ── Hero Picker ──────────────────────────────────────────────
|
|
|
|
|
|
function handleHeroSelect(assetId: string) {
|
|
|
|
|
|
setGallery((g) => ({ ...g, hero: [...g.hero, assetId] }));
|
2026-05-31 21:27:13 +02:00
|
|
|
|
setHeroPickerTarget(null);
|
2026-05-29 17:59:25 +02:00
|
|
|
|
markDirty();
|
|
|
|
|
|
}
|
|
|
|
|
|
|
feat: add visual admin panel with page builder and settings editor
- Add /admin route with password-protected visual page builder
- Page Builder: manage hero images, standalone albums, subpages, and sections
- Album Picker: browse all shared Immich albums with search and filtering
- Settings Editor: theme, grid, footer, legal, SEO configuration
- YAML service with atomic writes and automatic backups (content/.backups/)
- HMAC-signed admin sessions (24h expiry, HttpOnly cookies)
- API endpoints: /api/admin/{auth,gallery,settings,albums,reload}
- Enable with ADMIN_PASSWORD env var; disabled by default
- invalidateConfigCache() export for hot-reload after saves
2026-05-29 17:04:37 +02:00
|
|
|
|
// ── Album Picker Handlers ────────────────────────────────────
|
|
|
|
|
|
function handlePickAlbum(albumId: string) {
|
|
|
|
|
|
if (!pickerTarget) return;
|
|
|
|
|
|
|
|
|
|
|
|
const entry: AlbumEntry = { id: albumId };
|
|
|
|
|
|
|
|
|
|
|
|
if (pickerTarget.type === 'standalone') {
|
|
|
|
|
|
setGallery((g) => ({ ...g, albums: [...g.albums, entry] }));
|
|
|
|
|
|
} else if (pickerTarget.type === 'subpage' && pickerTarget.subpageIndex != null) {
|
|
|
|
|
|
setGallery((g) => {
|
|
|
|
|
|
const subpages = [...g.subpages];
|
|
|
|
|
|
const sp = { ...subpages[pickerTarget.subpageIndex!] };
|
|
|
|
|
|
sp.albums = [...sp.albums, entry];
|
|
|
|
|
|
subpages[pickerTarget.subpageIndex!] = sp;
|
|
|
|
|
|
return { ...g, subpages };
|
|
|
|
|
|
});
|
|
|
|
|
|
} else if (
|
|
|
|
|
|
pickerTarget.type === 'section' &&
|
|
|
|
|
|
pickerTarget.subpageIndex != null &&
|
|
|
|
|
|
pickerTarget.sectionIndex != null
|
|
|
|
|
|
) {
|
|
|
|
|
|
setGallery((g) => {
|
|
|
|
|
|
const subpages = [...g.subpages];
|
|
|
|
|
|
const sp = { ...subpages[pickerTarget.subpageIndex!] };
|
|
|
|
|
|
const sections = [...(sp.sections || [])];
|
|
|
|
|
|
const sec = { ...sections[pickerTarget.sectionIndex!] };
|
|
|
|
|
|
sec.albums = [...sec.albums, entry];
|
|
|
|
|
|
sections[pickerTarget.sectionIndex!] = sec;
|
|
|
|
|
|
sp.sections = sections;
|
|
|
|
|
|
subpages[pickerTarget.subpageIndex!] = sp;
|
|
|
|
|
|
return { ...g, subpages };
|
|
|
|
|
|
});
|
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
setPickerTarget(null);
|
|
|
|
|
|
markDirty();
|
|
|
|
|
|
}
|
|
|
|
|
|
|
2026-05-29 17:59:25 +02:00
|
|
|
|
// ── Drag & Drop Handlers ─────────────────────────────────────
|
|
|
|
|
|
function handleHeroDragEnd(event: DragEndEvent) {
|
|
|
|
|
|
const { active, over } = event;
|
|
|
|
|
|
if (!over || active.id === over.id) return;
|
|
|
|
|
|
|
|
|
|
|
|
const oldIndex = gallery.hero.findIndex((_, i) => `hero-${i}` === active.id);
|
|
|
|
|
|
const newIndex = gallery.hero.findIndex((_, i) => `hero-${i}` === over.id);
|
|
|
|
|
|
|
|
|
|
|
|
if (oldIndex !== -1 && newIndex !== -1) {
|
|
|
|
|
|
setGallery((g) => ({ ...g, hero: arrayMove(g.hero, oldIndex, newIndex) }));
|
|
|
|
|
|
markDirty();
|
|
|
|
|
|
}
|
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
function handleAlbumDragEnd(event: DragEndEvent) {
|
|
|
|
|
|
const { active, over } = event;
|
|
|
|
|
|
if (!over || active.id === over.id) return;
|
|
|
|
|
|
|
|
|
|
|
|
const oldIndex = gallery.albums.findIndex((a, i) => `album-${a.id}-${i}` === active.id);
|
|
|
|
|
|
const newIndex = gallery.albums.findIndex((a, i) => `album-${a.id}-${i}` === over.id);
|
|
|
|
|
|
|
|
|
|
|
|
if (oldIndex !== -1 && newIndex !== -1) {
|
|
|
|
|
|
setGallery((g) => ({ ...g, albums: arrayMove(g.albums, oldIndex, newIndex) }));
|
|
|
|
|
|
markDirty();
|
|
|
|
|
|
}
|
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
function handleSubpageDragEnd(event: DragEndEvent) {
|
|
|
|
|
|
const { active, over } = event;
|
|
|
|
|
|
if (!over || active.id === over.id) return;
|
|
|
|
|
|
|
|
|
|
|
|
const oldIndex = gallery.subpages.findIndex((_, i) => `subpage-${i}` === active.id);
|
|
|
|
|
|
const newIndex = gallery.subpages.findIndex((_, i) => `subpage-${i}` === over.id);
|
|
|
|
|
|
|
|
|
|
|
|
if (oldIndex !== -1 && newIndex !== -1) {
|
|
|
|
|
|
setGallery((g) => ({ ...g, subpages: arrayMove(g.subpages, oldIndex, newIndex) }));
|
|
|
|
|
|
if (expandedSubpage === oldIndex) setExpandedSubpage(newIndex);
|
|
|
|
|
|
else if (expandedSubpage !== null) {
|
|
|
|
|
|
if (oldIndex < expandedSubpage && newIndex >= expandedSubpage)
|
|
|
|
|
|
setExpandedSubpage(expandedSubpage - 1);
|
|
|
|
|
|
else if (oldIndex > expandedSubpage && newIndex <= expandedSubpage)
|
|
|
|
|
|
setExpandedSubpage(expandedSubpage + 1);
|
|
|
|
|
|
}
|
|
|
|
|
|
markDirty();
|
|
|
|
|
|
}
|
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
function handleSubpageAlbumDragEnd(spIndex: number) {
|
|
|
|
|
|
return (event: DragEndEvent) => {
|
|
|
|
|
|
const { active, over } = event;
|
|
|
|
|
|
if (!over || active.id === over.id) return;
|
|
|
|
|
|
|
|
|
|
|
|
const sp = gallery.subpages[spIndex];
|
|
|
|
|
|
const oldIndex = sp.albums.findIndex((a, i) => `album-${a.id}-${i}` === active.id);
|
|
|
|
|
|
const newIndex = sp.albums.findIndex((a, i) => `album-${a.id}-${i}` === over.id);
|
|
|
|
|
|
|
|
|
|
|
|
if (oldIndex !== -1 && newIndex !== -1) {
|
|
|
|
|
|
setGallery((g) => {
|
|
|
|
|
|
const subpages = [...g.subpages];
|
|
|
|
|
|
const sp2 = { ...subpages[spIndex] };
|
|
|
|
|
|
sp2.albums = arrayMove(sp2.albums, oldIndex, newIndex);
|
|
|
|
|
|
subpages[spIndex] = sp2;
|
|
|
|
|
|
return { ...g, subpages };
|
|
|
|
|
|
});
|
|
|
|
|
|
markDirty();
|
|
|
|
|
|
}
|
|
|
|
|
|
};
|
|
|
|
|
|
}
|
|
|
|
|
|
|
feat: add visual admin panel with page builder and settings editor
- Add /admin route with password-protected visual page builder
- Page Builder: manage hero images, standalone albums, subpages, and sections
- Album Picker: browse all shared Immich albums with search and filtering
- Settings Editor: theme, grid, footer, legal, SEO configuration
- YAML service with atomic writes and automatic backups (content/.backups/)
- HMAC-signed admin sessions (24h expiry, HttpOnly cookies)
- API endpoints: /api/admin/{auth,gallery,settings,albums,reload}
- Enable with ADMIN_PASSWORD env var; disabled by default
- invalidateConfigCache() export for hot-reload after saves
2026-05-29 17:04:37 +02:00
|
|
|
|
// ── Subpage Management ────────────────────────────────────────
|
|
|
|
|
|
function addSubpage() {
|
|
|
|
|
|
setGallery((g) => ({
|
|
|
|
|
|
...g,
|
|
|
|
|
|
subpages: [
|
|
|
|
|
|
...g.subpages,
|
|
|
|
|
|
{ name: `New Page ${g.subpages.length + 1}`, albums: [], sections: undefined },
|
|
|
|
|
|
],
|
|
|
|
|
|
}));
|
|
|
|
|
|
markDirty();
|
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
function removeSubpage(index: number) {
|
|
|
|
|
|
if (!confirm('Remove this subpage?')) return;
|
|
|
|
|
|
setGallery((g) => ({
|
|
|
|
|
|
...g,
|
|
|
|
|
|
subpages: g.subpages.filter((_, i) => i !== index),
|
|
|
|
|
|
}));
|
|
|
|
|
|
markDirty();
|
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
function updateSubpage(index: number, updates: Partial<Subpage>) {
|
|
|
|
|
|
setGallery((g) => {
|
|
|
|
|
|
const subpages = [...g.subpages];
|
|
|
|
|
|
subpages[index] = { ...subpages[index], ...updates };
|
|
|
|
|
|
return { ...g, subpages };
|
|
|
|
|
|
});
|
|
|
|
|
|
markDirty();
|
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
// ── Section Management ────────────────────────────────────────
|
|
|
|
|
|
function addSection(subpageIndex: number) {
|
|
|
|
|
|
setGallery((g) => {
|
|
|
|
|
|
const subpages = [...g.subpages];
|
|
|
|
|
|
const sp = { ...subpages[subpageIndex] };
|
|
|
|
|
|
sp.sections = [...(sp.sections || []), { title: 'New Section', albums: [] }];
|
|
|
|
|
|
subpages[subpageIndex] = sp;
|
|
|
|
|
|
return { ...g, subpages };
|
|
|
|
|
|
});
|
|
|
|
|
|
markDirty();
|
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
function removeSection(subpageIndex: number, sectionIndex: number) {
|
|
|
|
|
|
setGallery((g) => {
|
|
|
|
|
|
const subpages = [...g.subpages];
|
|
|
|
|
|
const sp = { ...subpages[subpageIndex] };
|
|
|
|
|
|
sp.sections = (sp.sections || []).filter((_, i) => i !== sectionIndex);
|
|
|
|
|
|
subpages[subpageIndex] = sp;
|
|
|
|
|
|
return { ...g, subpages };
|
|
|
|
|
|
});
|
|
|
|
|
|
markDirty();
|
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
function updateSection(subpageIndex: number, sectionIndex: number, updates: Partial<Section>) {
|
|
|
|
|
|
setGallery((g) => {
|
|
|
|
|
|
const subpages = [...g.subpages];
|
|
|
|
|
|
const sp = { ...subpages[subpageIndex] };
|
|
|
|
|
|
const sections = [...(sp.sections || [])];
|
|
|
|
|
|
sections[sectionIndex] = { ...sections[sectionIndex], ...updates };
|
|
|
|
|
|
sp.sections = sections;
|
|
|
|
|
|
subpages[subpageIndex] = sp;
|
|
|
|
|
|
return { ...g, subpages };
|
|
|
|
|
|
});
|
|
|
|
|
|
markDirty();
|
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
// ── Album Removal ────────────────────────────────────────────
|
|
|
|
|
|
function removeStandaloneAlbum(index: number) {
|
|
|
|
|
|
setGallery((g) => ({
|
|
|
|
|
|
...g,
|
|
|
|
|
|
albums: g.albums.filter((_, i) => i !== index),
|
|
|
|
|
|
}));
|
|
|
|
|
|
markDirty();
|
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
function removeSubpageAlbum(subpageIndex: number, albumIndex: number) {
|
|
|
|
|
|
setGallery((g) => {
|
|
|
|
|
|
const subpages = [...g.subpages];
|
|
|
|
|
|
const sp = { ...subpages[subpageIndex] };
|
|
|
|
|
|
sp.albums = sp.albums.filter((_, i) => i !== albumIndex);
|
|
|
|
|
|
subpages[subpageIndex] = sp;
|
|
|
|
|
|
return { ...g, subpages };
|
|
|
|
|
|
});
|
|
|
|
|
|
markDirty();
|
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
function removeSectionAlbum(subpageIndex: number, sectionIndex: number, albumIndex: number) {
|
|
|
|
|
|
setGallery((g) => {
|
|
|
|
|
|
const subpages = [...g.subpages];
|
|
|
|
|
|
const sp = { ...subpages[subpageIndex] };
|
|
|
|
|
|
const sections = [...(sp.sections || [])];
|
|
|
|
|
|
const sec = { ...sections[sectionIndex] };
|
|
|
|
|
|
sec.albums = sec.albums.filter((_, i) => i !== albumIndex);
|
|
|
|
|
|
sections[sectionIndex] = sec;
|
|
|
|
|
|
sp.sections = sections;
|
|
|
|
|
|
subpages[subpageIndex] = sp;
|
|
|
|
|
|
return { ...g, subpages };
|
|
|
|
|
|
});
|
|
|
|
|
|
markDirty();
|
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
// ── Hero Management ──────────────────────────────────────────
|
|
|
|
|
|
function removeHero(index: number) {
|
|
|
|
|
|
setGallery((g) => ({
|
|
|
|
|
|
...g,
|
|
|
|
|
|
hero: g.hero.filter((_, i) => i !== index),
|
|
|
|
|
|
}));
|
|
|
|
|
|
markDirty();
|
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
// ── Helpers ──────────────────────────────────────────────────
|
|
|
|
|
|
function getAlbumName(id: string): string {
|
|
|
|
|
|
const found = immichAlbums.find((a) => a.id === id);
|
|
|
|
|
|
return found?.albumName || id.slice(0, 8) + '...';
|
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
function getAlbumCount(id: string): number {
|
|
|
|
|
|
const found = immichAlbums.find((a) => a.id === id);
|
|
|
|
|
|
return found?.assetCount || 0;
|
|
|
|
|
|
}
|
|
|
|
|
|
|
2026-05-29 17:14:58 +02:00
|
|
|
|
function getAlbumThumbnailId(id: string): string | null {
|
|
|
|
|
|
const found = immichAlbums.find((a) => a.id === id);
|
|
|
|
|
|
return found?.thumbnailAssetId || null;
|
|
|
|
|
|
}
|
|
|
|
|
|
|
2026-05-29 17:29:26 +02:00
|
|
|
|
function getFirstSubpageThumb(sp: Subpage): string | null {
|
|
|
|
|
|
for (const album of sp.albums) {
|
|
|
|
|
|
const thumb = getAlbumThumbnailId(album.id);
|
|
|
|
|
|
if (thumb) return thumb;
|
|
|
|
|
|
}
|
|
|
|
|
|
if (sp.sections) {
|
|
|
|
|
|
for (const sec of sp.sections) {
|
|
|
|
|
|
for (const album of sec.albums) {
|
|
|
|
|
|
const thumb = getAlbumThumbnailId(album.id);
|
|
|
|
|
|
if (thumb) return thumb;
|
|
|
|
|
|
}
|
|
|
|
|
|
}
|
|
|
|
|
|
}
|
|
|
|
|
|
return null;
|
|
|
|
|
|
}
|
|
|
|
|
|
|
2026-05-29 17:59:25 +02:00
|
|
|
|
function slugify(str: string): string {
|
|
|
|
|
|
return str
|
|
|
|
|
|
.toLowerCase()
|
|
|
|
|
|
.replace(/[^a-z0-9]+/g, '-')
|
|
|
|
|
|
.replace(/^-|-$/g, '');
|
|
|
|
|
|
}
|
|
|
|
|
|
|
feat: add visual admin panel with page builder and settings editor
- Add /admin route with password-protected visual page builder
- Page Builder: manage hero images, standalone albums, subpages, and sections
- Album Picker: browse all shared Immich albums with search and filtering
- Settings Editor: theme, grid, footer, legal, SEO configuration
- YAML service with atomic writes and automatic backups (content/.backups/)
- HMAC-signed admin sessions (24h expiry, HttpOnly cookies)
- API endpoints: /api/admin/{auth,gallery,settings,albums,reload}
- Enable with ADMIN_PASSWORD env var; disabled by default
- invalidateConfigCache() export for hot-reload after saves
2026-05-29 17:04:37 +02:00
|
|
|
|
// ── Render ───────────────────────────────────────────────────
|
|
|
|
|
|
if (loading) {
|
|
|
|
|
|
return (
|
|
|
|
|
|
<div className="admin-loading">
|
|
|
|
|
|
<div className="admin-spinner" />
|
|
|
|
|
|
</div>
|
|
|
|
|
|
);
|
|
|
|
|
|
}
|
|
|
|
|
|
|
2026-05-31 21:17:52 +02:00
|
|
|
|
// Filter standalone albums
|
|
|
|
|
|
const filteredAlbums = gallery.albums.filter((album) => {
|
|
|
|
|
|
if (!searchQuery) return true;
|
|
|
|
|
|
const name = getAlbumName(album.id).toLowerCase();
|
|
|
|
|
|
const description = (album.description || '').toLowerCase();
|
|
|
|
|
|
const overrideTitle = (album.title || '').toLowerCase();
|
|
|
|
|
|
const query = searchQuery.toLowerCase();
|
release: v0.11.0 (#459)
Ships `dev` as **v0.11.0**. `main` contains nothing that `dev` does not,
so this is a clean sync.
## Headline changes since v0.10.0
- **Journal & Journal Studio** — photo essays at `/journal`,
split-screen block editor with live preview, drafts, per-entry
passwords, cover images
- **First-run setup wizard at `/install`** — configure a fresh
deployment from the browser; credentials are verified against Immich
before anything is written, and the wizard is gated by a one-time token
- **About page editor and toggle** in the admin panel
- **Per-album photo order** independent of Immich, with a drag & drop
editor
- **Custom favicon upload**
- **Experimental portfolio features** — justified grid, `cover` hero,
unlisted subpages, per-album grid overrides, cover focal points,
external nav links
- **Security** — asset tokens length-capped before decoding (#423),
journal author markdown escaped rather than filtered, journal file paths
contained, admin session key derived with scrypt (#432), Next.js 16.3.0
for CVE-2025-13465
- **Fixed** — client proofing honours its own configuration again
(#454); journal photo rendering (#432)
Full detail in [CHANGELOG.md](CHANGELOG.md#0110--2026-08-15).
## Verified
`npx tsc --noEmit` clean · `npx vitest run` 435 tests pass · `npm run
build` succeeds · lint 0 errors · `prettier --check` clean · local
`docker build` of the release tree.
## After merge
Tag `v0.11.0` on `main` and publish the release — that triggers
`docker-publish.yml`, which pushes the image and moves `latest`.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
---------
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
2026-08-15 09:09:18 +02:00
|
|
|
|
return (
|
|
|
|
|
|
name.includes(query) ||
|
|
|
|
|
|
description.includes(query) ||
|
|
|
|
|
|
overrideTitle.includes(query) ||
|
|
|
|
|
|
album.id.toLowerCase().includes(query)
|
|
|
|
|
|
);
|
2026-05-31 21:17:52 +02:00
|
|
|
|
});
|
|
|
|
|
|
|
|
|
|
|
|
// Filter subpages
|
|
|
|
|
|
const filteredSubpages = gallery.subpages
|
|
|
|
|
|
.map((sp, index) => ({ sp, index }))
|
|
|
|
|
|
.filter(({ sp }) => {
|
|
|
|
|
|
if (!searchQuery) return true;
|
|
|
|
|
|
const query = searchQuery.toLowerCase();
|
|
|
|
|
|
const name = sp.name.toLowerCase();
|
|
|
|
|
|
const title = (sp.title || '').toLowerCase();
|
|
|
|
|
|
const subtitle = (sp.subtitle || '').toLowerCase();
|
release: v0.11.0 (#459)
Ships `dev` as **v0.11.0**. `main` contains nothing that `dev` does not,
so this is a clean sync.
## Headline changes since v0.10.0
- **Journal & Journal Studio** — photo essays at `/journal`,
split-screen block editor with live preview, drafts, per-entry
passwords, cover images
- **First-run setup wizard at `/install`** — configure a fresh
deployment from the browser; credentials are verified against Immich
before anything is written, and the wizard is gated by a one-time token
- **About page editor and toggle** in the admin panel
- **Per-album photo order** independent of Immich, with a drag & drop
editor
- **Custom favicon upload**
- **Experimental portfolio features** — justified grid, `cover` hero,
unlisted subpages, per-album grid overrides, cover focal points,
external nav links
- **Security** — asset tokens length-capped before decoding (#423),
journal author markdown escaped rather than filtered, journal file paths
contained, admin session key derived with scrypt (#432), Next.js 16.3.0
for CVE-2025-13465
- **Fixed** — client proofing honours its own configuration again
(#454); journal photo rendering (#432)
Full detail in [CHANGELOG.md](CHANGELOG.md#0110--2026-08-15).
## Verified
`npx tsc --noEmit` clean · `npx vitest run` 435 tests pass · `npm run
build` succeeds · lint 0 errors · `prettier --check` clean · local
`docker build` of the release tree.
## After merge
Tag `v0.11.0` on `main` and publish the release — that triggers
`docker-publish.yml`, which pushes the image and moves `latest`.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
---------
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
2026-08-15 09:09:18 +02:00
|
|
|
|
|
2026-05-31 21:17:52 +02:00
|
|
|
|
if (name.includes(query) || title.includes(query) || subtitle.includes(query)) return true;
|
release: v0.11.0 (#459)
Ships `dev` as **v0.11.0**. `main` contains nothing that `dev` does not,
so this is a clean sync.
## Headline changes since v0.10.0
- **Journal & Journal Studio** — photo essays at `/journal`,
split-screen block editor with live preview, drafts, per-entry
passwords, cover images
- **First-run setup wizard at `/install`** — configure a fresh
deployment from the browser; credentials are verified against Immich
before anything is written, and the wizard is gated by a one-time token
- **About page editor and toggle** in the admin panel
- **Per-album photo order** independent of Immich, with a drag & drop
editor
- **Custom favicon upload**
- **Experimental portfolio features** — justified grid, `cover` hero,
unlisted subpages, per-album grid overrides, cover focal points,
external nav links
- **Security** — asset tokens length-capped before decoding (#423),
journal author markdown escaped rather than filtered, journal file paths
contained, admin session key derived with scrypt (#432), Next.js 16.3.0
for CVE-2025-13465
- **Fixed** — client proofing honours its own configuration again
(#454); journal photo rendering (#432)
Full detail in [CHANGELOG.md](CHANGELOG.md#0110--2026-08-15).
## Verified
`npx tsc --noEmit` clean · `npx vitest run` 435 tests pass · `npm run
build` succeeds · lint 0 errors · `prettier --check` clean · local
`docker build` of the release tree.
## After merge
Tag `v0.11.0` on `main` and publish the release — that triggers
`docker-publish.yml`, which pushes the image and moves `latest`.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
---------
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
2026-08-15 09:09:18 +02:00
|
|
|
|
|
2026-05-31 21:17:52 +02:00
|
|
|
|
const albums = sp.albums || [];
|
|
|
|
|
|
const hasMatchingAlbum = albums.some((a) => {
|
|
|
|
|
|
const aName = getAlbumName(a.id).toLowerCase();
|
|
|
|
|
|
const aTitle = (a.title || '').toLowerCase();
|
|
|
|
|
|
const aDesc = (a.description || '').toLowerCase();
|
release: v0.11.0 (#459)
Ships `dev` as **v0.11.0**. `main` contains nothing that `dev` does not,
so this is a clean sync.
## Headline changes since v0.10.0
- **Journal & Journal Studio** — photo essays at `/journal`,
split-screen block editor with live preview, drafts, per-entry
passwords, cover images
- **First-run setup wizard at `/install`** — configure a fresh
deployment from the browser; credentials are verified against Immich
before anything is written, and the wizard is gated by a one-time token
- **About page editor and toggle** in the admin panel
- **Per-album photo order** independent of Immich, with a drag & drop
editor
- **Custom favicon upload**
- **Experimental portfolio features** — justified grid, `cover` hero,
unlisted subpages, per-album grid overrides, cover focal points,
external nav links
- **Security** — asset tokens length-capped before decoding (#423),
journal author markdown escaped rather than filtered, journal file paths
contained, admin session key derived with scrypt (#432), Next.js 16.3.0
for CVE-2025-13465
- **Fixed** — client proofing honours its own configuration again
(#454); journal photo rendering (#432)
Full detail in [CHANGELOG.md](CHANGELOG.md#0110--2026-08-15).
## Verified
`npx tsc --noEmit` clean · `npx vitest run` 435 tests pass · `npm run
build` succeeds · lint 0 errors · `prettier --check` clean · local
`docker build` of the release tree.
## After merge
Tag `v0.11.0` on `main` and publish the release — that triggers
`docker-publish.yml`, which pushes the image and moves `latest`.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
---------
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
2026-08-15 09:09:18 +02:00
|
|
|
|
return (
|
|
|
|
|
|
aName.includes(query) ||
|
|
|
|
|
|
aTitle.includes(query) ||
|
|
|
|
|
|
aDesc.includes(query) ||
|
|
|
|
|
|
a.id.toLowerCase().includes(query)
|
|
|
|
|
|
);
|
2026-05-31 21:17:52 +02:00
|
|
|
|
});
|
release: v0.11.0 (#459)
Ships `dev` as **v0.11.0**. `main` contains nothing that `dev` does not,
so this is a clean sync.
## Headline changes since v0.10.0
- **Journal & Journal Studio** — photo essays at `/journal`,
split-screen block editor with live preview, drafts, per-entry
passwords, cover images
- **First-run setup wizard at `/install`** — configure a fresh
deployment from the browser; credentials are verified against Immich
before anything is written, and the wizard is gated by a one-time token
- **About page editor and toggle** in the admin panel
- **Per-album photo order** independent of Immich, with a drag & drop
editor
- **Custom favicon upload**
- **Experimental portfolio features** — justified grid, `cover` hero,
unlisted subpages, per-album grid overrides, cover focal points,
external nav links
- **Security** — asset tokens length-capped before decoding (#423),
journal author markdown escaped rather than filtered, journal file paths
contained, admin session key derived with scrypt (#432), Next.js 16.3.0
for CVE-2025-13465
- **Fixed** — client proofing honours its own configuration again
(#454); journal photo rendering (#432)
Full detail in [CHANGELOG.md](CHANGELOG.md#0110--2026-08-15).
## Verified
`npx tsc --noEmit` clean · `npx vitest run` 435 tests pass · `npm run
build` succeeds · lint 0 errors · `prettier --check` clean · local
`docker build` of the release tree.
## After merge
Tag `v0.11.0` on `main` and publish the release — that triggers
`docker-publish.yml`, which pushes the image and moves `latest`.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
---------
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
2026-08-15 09:09:18 +02:00
|
|
|
|
|
2026-05-31 21:17:52 +02:00
|
|
|
|
return hasMatchingAlbum;
|
|
|
|
|
|
});
|
|
|
|
|
|
|
feat: add visual admin panel with page builder and settings editor
- Add /admin route with password-protected visual page builder
- Page Builder: manage hero images, standalone albums, subpages, and sections
- Album Picker: browse all shared Immich albums with search and filtering
- Settings Editor: theme, grid, footer, legal, SEO configuration
- YAML service with atomic writes and automatic backups (content/.backups/)
- HMAC-signed admin sessions (24h expiry, HttpOnly cookies)
- API endpoints: /api/admin/{auth,gallery,settings,albums,reload}
- Enable with ADMIN_PASSWORD env var; disabled by default
- invalidateConfigCache() export for hot-reload after saves
2026-05-29 17:04:37 +02:00
|
|
|
|
return (
|
|
|
|
|
|
<div className="page-builder">
|
release: v0.11.0 — journal fixes, admin URLs, design system cleanup (#432)
* fix(screenshots): sharp-Typen fuer 0.34 und 0.35 gleichzeitig (#410)
sharp 0.35 ist von `export =` auf ESM umgestellt: der Modul-Namespace
ist nicht mehr aufrufbar, die Factory sitzt unter .default. Der
Type-Check brach damit in scripts/screenshots.ts weg, sobald der
Next-Bump (#402) sharp von 0.34.5 auf 0.35.3 mitzieht -- sharp ist hier
keine deklarierte Dependency, sondern kommt ueber Next mit.
Die Form wird jetzt aus dem installierten Paket abgeleitet statt
festgeschrieben, zur Laufzeit wie im Typ. Geprueft mit beiden
Versionen: tsc laeuft mit 0.34.5 und mit 0.35.3 fehlerfrei durch.
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
* chore(deps): bump the nextjs group across 1 directory with 2 updates (#402)
Bumps the nextjs group with 2 updates in the / directory: [next](https://github.com/vercel/next.js) and [eslint-config-next](https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next).
Updates `next` from 16.2.12 to 16.3.0
- [Release notes](https://github.com/vercel/next.js/releases)
- [Commits](https://github.com/vercel/next.js/compare/v16.2.12...v16.3.0)
Updates `eslint-config-next` from 16.2.12 to 16.3.0
- [Release notes](https://github.com/vercel/next.js/releases)
- [Commits](https://github.com/vercel/next.js/commits/v16.3.0/packages/eslint-config-next)
---
updated-dependencies:
- dependency-name: eslint-config-next
dependency-version: 16.3.0
dependency-type: direct:development
update-type: version-update:semver-minor
dependency-group: nextjs
- dependency-name: next
dependency-version: 16.3.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: nextjs
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* chore(deps-dev): bump prettier from 3.8.3 to 3.9.6 (#405)
Bumps [prettier](https://github.com/prettier/prettier) from 3.8.3 to 3.9.6.
- [Release notes](https://github.com/prettier/prettier/releases)
- [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md)
- [Commits](https://github.com/prettier/prettier/compare/3.8.3...3.9.6)
---
updated-dependencies:
- dependency-name: prettier
dependency-version: 3.9.6
dependency-type: direct:development
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* docs(changelog): Unreleased-Sektion fuer die Bumps nach v0.10.0 (#413)
Die Dependency-PRs sind nach dem Release auf dev gelandet, teils auch
auf main. Ohne Eintrag waeren sie beim naechsten Release unsichtbar --
inklusive Next 16.3.0, das CVE-2025-13465 mitbringt.
Ausserdem im 0.10.0-Abschnitt nachgetragen, dass der Trivy-Scan bis
#409 nie gelaufen ist. Der Fix steckt im Tag v0.10.0, fehlte aber in der
Aufzaehlung -- und "Images werden bei jedem Publish gescannt" stand im
Changelog, waehrend der Job im Action-Setup abbrach.
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
* feat(gallery): per-album sort order, independent of Immich (#408) (#414)
Album order was dictated entirely by Immich: getAlbum() sorted by the
album's own asc/desc flag, so a Folio album always mirrored the archive.
A curated series has a narrative order that has nothing to do with
capture time, and changing the Immich album's sort to fit the website
changes it for the archive too.
Adds an optional per-album `sort` in gallery.yaml, editable in /admin,
defaulting to today's behaviour so every existing config is unchanged:
immich (default) | newest | oldest | filename | manual
`manual` is a pinned *prefix*: `assetOrder` lists only the photos placed
by hand, everything else follows in the album's Immich order. A full
permutation of a 2,000-photo album would be ~80 KB of UUIDs in a file
that is rewritten and copied to content/.backups/ on every admin save.
It also makes drift fall out for free — photos removed in Immich never
match, new ones land in the tail rather than being hidden.
Sorting is applied after the cache read, not before the cache write, so
the LRU keeps one canonical Immich-ordered copy per album. That avoids
putting the mode in the cache key, lets a config change take effect
without depending on invalidation, and keeps the stale-serving path
correct. cache.get() returns the stored object by reference, so
withSort() returns a shallow clone with a new array — sorting in place
would reorder the shared entry, and under request coalescing every
concurrent caller would be sorting the same array.
Also fixes a prerequisite bug: /api/admin/albums/[albumId]/assets read
album.assets from GET /albums/:id, which Immich 3.x no longer populates
(lib/immich.ts:507). The hero picker's "This Album" tab returned nothing
and threw outright when the key was absent. It now goes through the
client's paginated metadata search, with ?types=all to opt videos in for
the reorder editor.
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
* refactor(admin): drop decorative emoji from the sort select labels (#415)
An <option> cannot contain markup, so the SVG set in Icons is not
reachable there — but a decorative emoji is not a substitute for it.
Plain text instead; the album card badge already uses a real icon.
The remaining emoji in the admin panel (asset picker tabs, section
headings, layout picker options) predate this branch and are left for a
separate cleanup.
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
* refactor(admin): replace emoji icons with the shared SVG icon set (#416)
The admin panel mixed two icon conventions: inline SVGs from
`Icons.tsx` in most components, and decorative emoji in the asset
picker and a few PageBuilder labels. Emoji render inconsistently
across platforms, ignore the accent colour, and cannot inherit the
`.svg-icon` sizing rules.
- Icons.tsx: add `IconStar` (filled — it marks a state, not an
action) and `IconImage`.
- AssetPicker: the three tab labels and the favourite tile badge now
use IconFolder / IconStar / IconImage.
- PageBuilder: the "Standalone Albums" and "Subpages" headings use
the icon set instead of an emoji.
- PageBuilder: the layout picker drops its emoji for plain text. An
<option> cannot contain markup, so an SVG is impossible there and a
decorative glyph is not a substitute.
- admin.css: align icon and label in the picker tabs, and swap the
favourite badge's text-shadow for drop-shadow, which is what
applies to an inline SVG.
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
* refactor(admin): fold PageBuilder's local icons into the shared Icons module (#418)
* refactor(admin): fold PageBuilder's local icons into the shared module
PageBuilder.tsx carried its own `Icons` object duplicating most of the
glyphs already exported by Icons.tsx, with hardcoded sizes and slightly
divergent paths. Migrate all 32 call sites to the shared module and
delete the local object.
Five glyphs had no counterpart and are added to Icons.tsx as 1:1 ports
of the local paths: IconX, IconPlus, IconHome, IconCopy, IconImage.
The local ExternalLink and Check are dropped rather than ported — both
had zero call sites.
Two glyphs change shape slightly, which is the point of consolidating:
the shared IconCamera includes the viewfinder bump the local copy
omitted, and drag handles now use IconGripVertical.
IconGripVertical uses the module's square 24x24 viewBox, so `.svg-drag`
goes from 12x18 to 18x18 — the old non-square box would letterbox the
glyph down to 12x12 and shrink the handle.
* fix(admin): resolve icon-module integration after #416
Merging dev brought in #416, which added a second IconImage to Icons.tsx
and two <Icons.Camera>/<Icons.Folder> section headers that reference the
local Icons object this PR removes. Git merged both cleanly but the result
did not type-check.
- drop the duplicate IconImage (both copies were byte-identical)
- point the two section headers at the imported IconCamera/IconFolder
- refresh the SORT_LABELS comment: the icon set is imported now, not
declared below
---------
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
* fix(config): allow an empty gallery, guard against a double /api suffix (#421)
An empty gallery is now a valid, rendered state instead of a throw: deriveGallery() no longer requires at least one album or subpage, so a deployment with no albums yet renders a bare homepage the owner can fill in via /admin.
getConfig() also stops appending /api to an Immich URL that already ends in it, which previously produced .../api/api and broke every upstream request.
Includes a restore of the per-album sort test cases, which the branch had lost by being cut before #408/#414.
* feat(admin): favicon upload, served from the content volume (#422)
Adds a bundled default favicon, an upload widget in admin Settings > General, and a route that serves the icon from the writable content/ volume with a fallback to the bundled default. Raster uploads (PNG/ICO/JPEG) are wrapped in an SVG container; the response carries its own CSP so an uploaded SVG cannot execute script on the origin.
The GET route revalidates with an ETag instead of caching immutably, so a newly uploaded icon shows up immediately. Uploads are written via temp file + rename, and a Reset button restores the bundled default.
* ci: flag unformatted files in a PR, without blocking it (#424)
Prettier is configured as an error rule in eslint.config.mjs but has never run in CI, so part of the tree predates it. A final CI step now diffs against the PR base, runs prettier --list-different over the changed files, and emits a warning annotation per offender plus a job summary.
Advisory by design: it never fails the job. Blocking would turn a PR red for merely touching a file that was already unformatted, and normalising the tree in one commit would wreck git blame and conflict with the PRs in flight.
Requires fetch-depth: 0, since diffing against the base needs its history.
* feat(install): first-run wizard gated by a one-time setup token (#419)
Adds /install, a four-step first-run wizard: connect to Immich, optionally pick albums, name the site, finish. It verifies the credentials against the Immich server before writing anything, then writes gallery.yaml, settings.yaml and a content/install.json carrying the Immich credentials and a generated site secret.
install.json exists because a running process cannot pick up new env vars — the wizard has to write configuration that takes effect without a restart. getInstallCredentials() merges it under the real environment, so env vars always win and rotation stays a matter of setting one.
Both the page and the API routes are gated by a one-time setup token printed to the server log, so a deployment that is reachable before gallery.yaml exists cannot be configured by whoever finds it first. The token is stored in content/.setup-token (0600) rather than a module variable: Next.js bundles the page and each route handler separately, so a module-level token left the page and the API disagreeing inside one process and the wizard stuck on step 1. It is removed once the install completes.
The admin password is stored as an scrypt hash using the scheme lib/auth.ts already applies to album passwords; a plaintext ADMIN_PASSWORD env var keeps working.
* docs: document the setup wizard, fix the read-only content mount (#425)
Quick Start now leads with the /install wizard, with the hand-written YAML route kept alongside it, and a First-Run Setup section covers the setup token, the files the wizard writes, and env-var precedence.
Two corrections: both Docker examples mounted content/ as :ro, which silently breaks the wizard, the admin panel and the backup rotation alike — docs/admin-panel.md already said so and the README contradicted it. And nothing documented that content/install.json holds the Immich API key, so a backup of content/ is a backup of credentials.
Also adds a Contributors section crediting the people whose work is in the project.
* feat(admin): floating save bar pinned to the bottom of the viewport (#426)
The save bar was the first, static element inside .admin-main. Since the
document itself scrolls, it left the viewport as soon as you scrolled down
— editing a subpage section or a settings block far below gave no visible
dirty hint and no reachable save button.
Replace it with a bottom-pinned floating bar shared by both editors. It
only mounts while there is something to act on (unsaved changes, an
in-flight save, or a result message), so it never covers content while
idle. The success message clears after 5s, which hides the bar again.
- new SaveBar component, replacing the duplicated markup in PageBuilder
and SettingsEditor
- adopt the previously unused .floating-save-bar CSS: slide-in keyframes
(carrying translateX(-50%)), dirty border, wrap/gap, mobile variant and
a prefers-reduced-motion opt-out; z-index 900 keeps it below modals
- .admin-main gains bottom padding so the bar never covers page content
- drop the now-unreachable idle hints: the ⌘S hint becomes a button title,
the Live Sync note becomes a static line above the settings layout
- header "Site" link now bypasses the cache (/?fresh=1), so the preview
stays reachable when the bar is hidden
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
* feat(admin): themed listbox for the album sort control (#427)
The per-album "Photo order" control was a native <select>. Because an
<option> cannot contain markup, its choices could not use the admin
panel's currentColor SVG set — the reason #415 had to fall back to plain
text after dropping the emoji labels.
Adds a Listbox component implementing the ARIA combobox/listbox pattern,
so options can render a glyph beside their label:
- DOM focus stays on the trigger button; the active option is announced
through aria-activedescendant, keeping focus management to one element
- Keyboard: arrows (clamped at the ends, like a native select),
Home/End, Enter/Space to commit, Escape to cancel, Tab commits and
moves on, and prefix type-ahead with a repeat-key cycle
- Outside dismissal on pointerdown, so a press starting outside closes
the popup before the click retargets
The sort options now carry an icon each: calendar, arrow-down, arrow-up,
an A→Z marker, and the drag glyph for manual — matching the badge the
album card already shows. SORT_LABELS stays plain text because the badge
feeds it to a title attribute.
Closes #417
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
* chore(git): ignore generated design handoff folders
* fix(admin): stop the album sort dropdown clipping, and simplify the panel (#428)
* fix(admin): render listbox popup in a portal so it escapes modal clipping
The sort control's popup was position:absolute inside three clipping ancestors
(.album-drawer overflow:hidden > .album-drawer-body overflow-y:auto >
.modal-right-column overflow-y:auto), so it was cut off at the bottom of the
Edit Album Details modal. z-index could not help: clipping happens before
stacking. It also always hung below the trigger, with no flip.
Portal the popup to document.body and position it from the trigger's viewport
rect, flipping above when there is more room there and capping max-height to the
space available so it scrolls internally rather than overflowing. It is
dismissed on scroll and resize, since the anchor is only measured on open.
The outside-pointerdown handler now also treats the popup as inside; without
that the portalled list counts as outside, and a click on an option would close
it before the selection commits.
* refactor(admin): single-column album details panel
The left column spent 1.2fr on a cover thumbnail and three stat rows, two of
which (Status, Custom Hero) only restated the form fields opposite them, while
the form itself was squeezed into 1.8fr behind a second nested scroller.
Stack the drawer in one column instead: cover as a banner, then the form at full
width, with the UUID moved into the footer. The body is now the only scroll
container, which also removes one of the ancestors that was clipping the sort
popup.
---------
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
* fix(admin): give the portalled listbox its theme back, lock the page behind modals (#429)
Two defects in the album editor.
The sort listbox popup painted transparent. Every --admin-* variable is
scoped to .admin-layout, and since the popup moved into document.body it
sits outside that subtree, so background/border/text all resolved to
nothing. It now carries its own copy of the palette in both colour
schemes, plus the font it no longer inherits.
Scrolling inside a modal also moved the page behind it. No admin modal
ever locked body scroll: the overlay covers the page but does not absorb
wheel events, so a scroll starting on the backdrop — or continuing past
the end of the modal's own scroller — reaches the document.
overscroll-behavior cannot cover that case on its own, because it only
applies to scroll containers and the backdrop is not one.
useScrollLock freezes body while a modal is open and compensates for the
width the scrollbar gives up, so nothing shifts underneath. Each lock
restores the inline value it found, which makes nesting work without a
counter — a picker opened from the drawer restores the drawer's hidden
state instead of clearing it. Applied to both drawers and all four
picker modals, which share the defect. overscroll-behavior: contain on
the scrollers stops the chaining they can handle themselves.
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
* fix(security): allow unsafe-eval in CSP script-src during dev mode
* feat(journal): add Journal Studio with split-screen editor, live preview and dedicated routes
* fix(build): separate client parser from server journal-service and fix build type errors
* fix(journal): Fotos rendern, Layout und Lightbox-Steuerung korrigieren
Fünf unabhängige Fehler in der öffentlichen Journal- und Essay-Ansicht:
* Foto-Blöcke wurden nie angezeigt. EssayView löst ein Foto über
PhotoItem.id auf, und das sind verschlüsselte Tokens — die Blöcke aus
dem Markdown tragen aber rohe Asset-UUIDs. Jede Zuordnung lief ins
Leere, und nicht auflösbare Blöcke werden still verworfen. Die IDs
werden jetzt serverseitig übersetzt; damit verschwinden nebenbei die
rohen UUIDs aus dem Client-Payload, die dort laut Projektregel nie
auftauchen dürfen. Nicht auflösbare Referenzen werden geloggt.
* Überschriften standen weiter links als der Fließtext. Jeder Block
hatte einzeln `max-width: 68ch`, und `ch` ist relativ zur Schrift des
Elements — die Serif-Überschrift ergab eine breitere Spalte. Ersetzt
durch eine gemeinsame, font-unabhängige `--essay-measure`.
* Fullbleed-Fotos bluteten nur nach links aus: `.essay-figure` ist
`width: 100%`, wodurch die Box überbestimmt ist und der negative
rechte Margin verworfen wird.
* Foto-Paare stellten beide Bilder gleich breit dar, wodurch ein
Hochformat neben einem Querformat doppelt so hoch wurde. Jetzt eine
Justified-Reihe: Breite proportional zum Seitenverhältnis, dadurch
exakt gleiche Höhen ohne Beschnitt.
* Die Lightbox hatte im Journal keine Tastatursteuerung und keine
Scroll-Sperre — beides lag in PhotoGrid, also nur im Album-Raster.
Verlagert in die Lightbox selbst, der doppelte Handler in PhotoGrid
entfernt (sonst wäre pro Pfeildruck zwei Bilder weitergesprungen).
Zusätzlich sind Proofing-Herzen und das EXIF-Panel im redaktionellen
Modus abschaltbar und im Journal aus: Client-Proofing ist ein
Übergabe-Workflow für Alben, keine Funktion einer Reportage. Auf der
Übersicht wurde der Untertitel doppelt gerendert, weil extractExcerpt()
auf ihn zurückfällt.
* feat(admin): eigene URLs für alle Bereiche und überarbeiteter Journal Studio
Das Panel war eine einzige Client-Komponente, die ihre Tabs über
useState umschaltet: keine Route pro Bereich, kein Deep-Link, kein
Zurück-Button, und nach jedem Reload landete man wieder auf "Pages".
Auch der Journal-Editor hatte keine eigene URL.
Jetzt sieben echte Routen (/admin, /admin/pages, /admin/journal,
/admin/journal/<slug>, /admin/settings, /admin/settings/<section>,
/admin/analytics). Die Shell mit Auth-Prüfung und Kopfzeile sitzt im
Layout und umschließt children — so bleibt die Session-Prüfung über
Routenwechsel montiert, statt bei jedem Tab-Wechsel neu zu laufen und
den Spinner aufblitzen zu lassen. Unbekannte Settings-Sections fallen
auf General zurück.
Im selben Zug der Journal Studio, der die Routing-Änderung ohnehin
berührt:
* Alle Eingabefelder nutzten die Klasse `admin-input`, die in keinem
CSS definiert war — sie fielen auf Browser-Defaults zurück. Jetzt
gestylt, gescoped, damit der generische Name nicht ins übrige Panel
leckt.
* Der Split View ist per Divider verschiebbar (Maus, Tastatur,
Doppelklick zum Zurücksetzen), Breite in localStorage.
* Das Studio bricht aus der 1120px-Spalte aus, die Preview hat Platz.
* Die Preview zeigte für jedes Foto fest 3:2 und log damit über das
Layout der veröffentlichten Seite; die echten Verhältnisse werden
jetzt an den Thumbnails gemessen.
* Blöcke mit alten positionsbasierten Foto-Referenzen werden markiert —
die lassen sich auf einer eigenständigen Journal-Seite nicht auflösen
und verschwanden bisher stillschweigend.
* Blocktyp-Chips als gemeinsame Komponente, monochrom und per Icon
unterschieden statt in einer eigenen Blau/Lila/Orange-Palette, die
sonst nirgends im Panel vorkommt.
* Emojis raus, SVG-Icons rein.
* fix(admin): Designsystem-Lücken im Panel schließen
Eine systematische Suche nach Klassen, die im TSX benutzt, aber in
keinem CSS definiert sind, hat vier Stellen mit demselben Muster
gefunden:
* `admin-btn-secondary` und `admin-btn-danger` existierten nicht.
Sämtliche Löschen-Buttons sahen aus wie normale Buttons — keine
Warnwirkung. Als `.admin-btn.admin-btn-danger` geschrieben, weil die
Varianten mit den Größenklassen kombiniert werden, die weiter unten
ihren eigenen Hintergrund setzen.
* `page-progress-fill` fehlte: die Balken im Analytics-Panel waren
leere Rinnen, der Wert unsichtbar. Ebenso `analytics-empty` und
`admin-loading-container`.
* `subpage-drawer-section`, `subpage-drawer-title-group` und
`input-with-icon` im PageBuilder waren wirkungslos und teils mit
Inline-Styles notdürftig kompensiert.
* `grid-card-preview` fehlte, wodurch alle Layout-Vorschauen auf Höhe
null kollabierten. Nur "Showcase" war sichtbar — und das aus Versehen,
weil sein Tile `hero-tile` hieß und damit die `aspect-ratio` einer
fremden PageBuilder-Klasse erbte. Umbenannt.
Dazu die Theme-Vorschauen, die praktisch identisch aussahen: alle
sieben zeigten dieselben drei quadratischen Kacheln, einziger
Unterschied war die Hintergrundfarbe. Sie spiegeln jetzt die echten
Preset-Daten aus lib/config/theme.ts — Schriftcharakter, Eckradius,
Rasterdichte, Passepartout bzw. Schatten.
Die Kopfzeile richtet sich an einer gemeinsamen Steuerhöhe aus. Der
"Site"-Link war höher als die Buttons daneben: `.admin-btn` hatte keine
explizite line-height, und <button> bekommt box-sizing: border-box vom
Browser, <a> nicht. Die Statusanzeige setzte weder Schriftfamilie noch
-größe und fiel auf den Browser-Default zurück — sie war nie Teil des
Designsystems. Jetzt gleiche Höhe und Typografie, Pillenform als
Zustandsanzeige, Trenner zur Aktionsgruppe. Das dauerhafte Pulsieren
des grünen Punkts entfällt; Animation bleibt den Zuständen vorbehalten,
die Aufmerksamkeit brauchen.
Restliche Emojis durch SVG-Icons ersetzt.
* feat(admin): add scroll-to-top toggle and SVG arrow
The back-to-top button was always on and drew its arrow with the ↑ text
character. Add a `scrollToTop` setting (General section in the admin
panel, defaults to on so existing sites are unaffected) and replace the
glyph with a stroked SVG that inherits currentColor across all presets.
Scroll handling is now rAF-throttled, and prefers-reduced-motion turns
off both the hover lift and the smooth scroll.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
* security(journal): escape author HTML instead of filtering it
CodeQL flags 26 high-severity alerts on the release PR; the bulk of them
point at sanitizeHtml(), a denylist of three regexes whose output goes
into dangerouslySetInnerHTML. I reproduced the bypasses before changing
anything — all four pass the old filter:
<img src=x onerror=alert(1)> unquoted handler, regex wants quotes
<img src=x onerror='alert(1)'> single quotes, same reason
<svg onload=alert(1)> not a <script> tag
javasjavascript:cript:alert(1) one-pass replace, the rest recombines
Plus an attribute breakout in the link renderer, which interpolated the
URL into href="${url}" unescaped:
[x](" onmouseover=alert(1) x=") -> <a href="" onmouseover=alert(1" ...>
Replaced with escaping. Every `&<>"'` in author text becomes an entity
before any markdown rule runs, so the only tags in the output are the
ones renderInlineMarkdown builds itself and a URL cannot leave its
attribute. Link schemes are now an allowlist (http, https, mailto, tel,
relative, anchor); anything else renders as plain text.
The serializer needed decodeHtmlEntities to match: without it a save
would write `<` into the Markdown file and the next parse would
escape the `&` again, corrupting the text further on every round trip.
A test covers parse -> serialize -> parse stability.
Two existing tests asserted the old behaviour and were rewritten rather
than deleted: one expected the script tag to be *removed* from the
output, the other expected the substring "onerror" to be absent. Both
now assert the property that matters — that no tag can form — because
`onerror` surviving as inert text is fine.
Exploitation required admin access either way: journal and essay text
comes from the studio or from content/*.md. This removes the weakness,
it does not close an open door.
* fix(journal): contain file paths, fix frontmatter escaping, defuse two regexes
Follow-up to the CodeQL findings on release PR #432. I went through all 23
alerts individually; this addresses the ones that are worth addressing and
documents the ones that are not.
Path containment (12 alerts, all false positives). Every path built from a
slug goes through isValidSlug(), a strict `/^[a-zA-Z0-9_-]+$/` allowlist —
verified against `../../etc/passwd`, `foo/../../bar`, `a/b`, `..` and
friends, all rejected. CodeQL cannot see it because the check lives in
another module. Added a containedPath() helper that resolves the path and
refuses anything landing outside the content directory: a second lock on a
door that was already locked, and a barrier the analysis can follow. Also
removed the dead `slug.endsWith('.md')` branches — isValidSlug rejects
dots, so they could never be taken.
Frontmatter escaping (1 alert, a real bug). The serializer escaped `"` but
not `\`, and the parser never unescaped anything. A title containing either
character gained a backslash on every save/load cycle:
Path C:\Users "quoted" -> Path C:\\Users \"quoted\" -> ...
Escaping now covers the backslash first and the parser undoes both. A round
trip test covers quotes, backslashes, colons and apostrophes.
Two of three ReDoS regexes (2 alerts). The heading pattern had `\s+` next to
`(.+)`, which overlap, so the engine tried every split of the whitespace run
before failing; it is `[ \t]+` and `(\S.*)` now. The quote author pattern
wrapped a lazy group around an optional group — the quadratic case — and is
an index split on the first separator now.
The third regex, the bold/italic pass, is deliberately left alone. Rewriting
it with a negated class removes the backtracking but breaks nesting:
`**bold *and italic* here**` renders as `*<em>bold </em>and italic<em> here</em>*`.
The input is Markdown from an authenticated admin, never a visitor, so the
worst case is an author slowing down their own page. The comment in the code
says so.
Not addressed: 5 js/insufficient-password-hash alerts. They ask for a slow
KDF where the code uses SHA-256/HMAC — correct in general, but the admin
password comes from an environment variable and is never stored, so a
stronger KDF protects nothing that is not already in plaintext in the
environment.
399 unit tests pass (18 new), build and tsc clean.
* fix(journal): split the quote author by scanning, not by pattern
Cleaning up after myself. #439 replaced the quote author regex
`/^(.*?)(?:\s+--\s+(.+))?$/` — a lazy group around an optional one, the
quadratic case — with `/\s+--\s+/`, and CodeQL promptly flagged the
replacement for the same reason. One reported pattern traded for another.
splitQuoteAuthor() scans for the first `--` that has whitespace on both
sides. Linear, and it needs no reasoning about the regex engine at all.
Behaviour is identical to the original regex, checked case by case
against it: separator, no separator, several separators, tabs, wide gaps,
`a--b` without spaces, leading and trailing separators, empty string. All
nine are covered by tests, plus one asserting it stays fast on a 50k
whitespace run.
* security(admin): derive the session signing key with scrypt
getSigningKey() ran the admin password through a single SHA-256 digest.
It is key derivation rather than password storage, so it was never a
stored-hash problem — but if the derived key ever leaked, one fast hash
makes recovering the password by brute force cheap. CodeQL flags it as
js/insufficient-password-hash and, for this particular alert, has a
point.
scrypt now. Two details that matter:
The salt has to be stable. A random salt would produce a different key on
every call and invalidate every session; it is derived from AUTH_SECRET,
which is deployment-specific. Verified across separate processes: same
inputs produce a verifying token, so a restart or redeploy does not log
everyone out.
The result is cached for the process lifetime. scrypt is deliberately
slow and getSigningKey() runs on every admin request — deriving per call
would add ~24ms to each one. The cache key is a digest of secret plus
password, so a rotation misses the cache and derives again, and no extra
plaintext copy of the password is kept around.
Measured: first derivation 24ms, subsequent calls 0.12ms. Password
change and secret change both invalidate an existing token, checked in
separate processes.
Note the one-time effect: existing admin sessions are invalidated by the
change in derivation, so everyone logs in once more.
* security(admin): key the signing-key cache on its inputs, not a digest
#441 removed the SHA-256 digest of the admin password from the key
derivation and introduced a new one three lines above it, as the cache
key. Same rule, same file: CodeQL reported it immediately.
The comment justifying it was wrong too. It claimed no second plaintext
copy of the password was retained, while building the digest input
allocates exactly that in order to hash it.
The cache now holds the two input strings and compares them directly.
They are the same objects the env and install caches already hold, so
nothing extra is retained, and no fast hash of the password exists in
memory for the life of the process.
Re-verified after the change, in separate processes: a token from one
process verifies in another with the same inputs, a changed password or
secret rejects it, first derivation 24ms, cached calls 0.001ms.
That leaves scrypt as the only place the password is hashed here. The
two HMACs further down operate on the derived key and on token data, not
on the password; the constant-time comparison in verifyAdminPassword is
the previously dismissed one.
---------
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
2026-08-14 16:55:07 +02:00
|
|
|
|
<SaveBar
|
|
|
|
|
|
dirty={dirty}
|
|
|
|
|
|
saving={saving}
|
|
|
|
|
|
saveMessage={saveMessage}
|
|
|
|
|
|
onSave={handleSave}
|
|
|
|
|
|
label="Save Changes"
|
|
|
|
|
|
showPreview
|
|
|
|
|
|
/>
|
feat: add visual admin panel with page builder and settings editor
- Add /admin route with password-protected visual page builder
- Page Builder: manage hero images, standalone albums, subpages, and sections
- Album Picker: browse all shared Immich albums with search and filtering
- Settings Editor: theme, grid, footer, legal, SEO configuration
- YAML service with atomic writes and automatic backups (content/.backups/)
- HMAC-signed admin sessions (24h expiry, HttpOnly cookies)
- API endpoints: /api/admin/{auth,gallery,settings,albums,reload}
- Enable with ADMIN_PASSWORD env var; disabled by default
- invalidateConfigCache() export for hot-reload after saves
2026-05-29 17:04:37 +02:00
|
|
|
|
|
2026-05-31 21:17:52 +02:00
|
|
|
|
{/* Search Bar */}
|
|
|
|
|
|
<div className="builder-search-container">
|
|
|
|
|
|
<div className="builder-search-wrapper">
|
release: v0.11.0 (#459)
Ships `dev` as **v0.11.0**. `main` contains nothing that `dev` does not,
so this is a clean sync.
## Headline changes since v0.10.0
- **Journal & Journal Studio** — photo essays at `/journal`,
split-screen block editor with live preview, drafts, per-entry
passwords, cover images
- **First-run setup wizard at `/install`** — configure a fresh
deployment from the browser; credentials are verified against Immich
before anything is written, and the wizard is gated by a one-time token
- **About page editor and toggle** in the admin panel
- **Per-album photo order** independent of Immich, with a drag & drop
editor
- **Custom favicon upload**
- **Experimental portfolio features** — justified grid, `cover` hero,
unlisted subpages, per-album grid overrides, cover focal points,
external nav links
- **Security** — asset tokens length-capped before decoding (#423),
journal author markdown escaped rather than filtered, journal file paths
contained, admin session key derived with scrypt (#432), Next.js 16.3.0
for CVE-2025-13465
- **Fixed** — client proofing honours its own configuration again
(#454); journal photo rendering (#432)
Full detail in [CHANGELOG.md](CHANGELOG.md#0110--2026-08-15).
## Verified
`npx tsc --noEmit` clean · `npx vitest run` 435 tests pass · `npm run
build` succeeds · lint 0 errors · `prettier --check` clean · local
`docker build` of the release tree.
## After merge
Tag `v0.11.0` on `main` and publish the release — that triggers
`docker-publish.yml`, which pushes the image and moves `latest`.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
---------
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
2026-08-15 09:09:18 +02:00
|
|
|
|
<span className="builder-search-icon">
|
|
|
|
|
|
<IconSearch size={14} />
|
|
|
|
|
|
</span>
|
2026-05-31 21:17:52 +02:00
|
|
|
|
<input
|
|
|
|
|
|
type="text"
|
|
|
|
|
|
className="builder-search-input"
|
|
|
|
|
|
placeholder="Search albums or subpages..."
|
|
|
|
|
|
value={searchQuery}
|
|
|
|
|
|
onChange={(e) => setSearchQuery(e.target.value)}
|
|
|
|
|
|
/>
|
|
|
|
|
|
{searchQuery && (
|
release: v0.11.0 (#459)
Ships `dev` as **v0.11.0**. `main` contains nothing that `dev` does not,
so this is a clean sync.
## Headline changes since v0.10.0
- **Journal & Journal Studio** — photo essays at `/journal`,
split-screen block editor with live preview, drafts, per-entry
passwords, cover images
- **First-run setup wizard at `/install`** — configure a fresh
deployment from the browser; credentials are verified against Immich
before anything is written, and the wizard is gated by a one-time token
- **About page editor and toggle** in the admin panel
- **Per-album photo order** independent of Immich, with a drag & drop
editor
- **Custom favicon upload**
- **Experimental portfolio features** — justified grid, `cover` hero,
unlisted subpages, per-album grid overrides, cover focal points,
external nav links
- **Security** — asset tokens length-capped before decoding (#423),
journal author markdown escaped rather than filtered, journal file paths
contained, admin session key derived with scrypt (#432), Next.js 16.3.0
for CVE-2025-13465
- **Fixed** — client proofing honours its own configuration again
(#454); journal photo rendering (#432)
Full detail in [CHANGELOG.md](CHANGELOG.md#0110--2026-08-15).
## Verified
`npx tsc --noEmit` clean · `npx vitest run` 435 tests pass · `npm run
build` succeeds · lint 0 errors · `prettier --check` clean · local
`docker build` of the release tree.
## After merge
Tag `v0.11.0` on `main` and publish the release — that triggers
`docker-publish.yml`, which pushes the image and moves `latest`.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
---------
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
2026-08-15 09:09:18 +02:00
|
|
|
|
<button
|
|
|
|
|
|
className="builder-search-clear"
|
|
|
|
|
|
onClick={() => setSearchQuery('')}
|
|
|
|
|
|
title="Clear search"
|
|
|
|
|
|
>
|
2026-05-31 21:17:52 +02:00
|
|
|
|
×
|
|
|
|
|
|
</button>
|
|
|
|
|
|
)}
|
|
|
|
|
|
</div>
|
|
|
|
|
|
</div>
|
|
|
|
|
|
|
feat: add visual admin panel with page builder and settings editor
- Add /admin route with password-protected visual page builder
- Page Builder: manage hero images, standalone albums, subpages, and sections
- Album Picker: browse all shared Immich albums with search and filtering
- Settings Editor: theme, grid, footer, legal, SEO configuration
- YAML service with atomic writes and automatic backups (content/.backups/)
- HMAC-signed admin sessions (24h expiry, HttpOnly cookies)
- API endpoints: /api/admin/{auth,gallery,settings,albums,reload}
- Enable with ADMIN_PASSWORD env var; disabled by default
- invalidateConfigCache() export for hot-reload after saves
2026-05-29 17:04:37 +02:00
|
|
|
|
{/* Hero Section */}
|
|
|
|
|
|
<section className="builder-section">
|
|
|
|
|
|
<div className="builder-section-header">
|
release: v0.11.0 (#459)
Ships `dev` as **v0.11.0**. `main` contains nothing that `dev` does not,
so this is a clean sync.
## Headline changes since v0.10.0
- **Journal & Journal Studio** — photo essays at `/journal`,
split-screen block editor with live preview, drafts, per-entry
passwords, cover images
- **First-run setup wizard at `/install`** — configure a fresh
deployment from the browser; credentials are verified against Immich
before anything is written, and the wizard is gated by a one-time token
- **About page editor and toggle** in the admin panel
- **Per-album photo order** independent of Immich, with a drag & drop
editor
- **Custom favicon upload**
- **Experimental portfolio features** — justified grid, `cover` hero,
unlisted subpages, per-album grid overrides, cover focal points,
external nav links
- **Security** — asset tokens length-capped before decoding (#423),
journal author markdown escaped rather than filtered, journal file paths
contained, admin session key derived with scrypt (#432), Next.js 16.3.0
for CVE-2025-13465
- **Fixed** — client proofing honours its own configuration again
(#454); journal photo rendering (#432)
Full detail in [CHANGELOG.md](CHANGELOG.md#0110--2026-08-15).
## Verified
`npx tsc --noEmit` clean · `npx vitest run` 435 tests pass · `npm run
build` succeeds · lint 0 errors · `prettier --check` clean · local
`docker build` of the release tree.
## After merge
Tag `v0.11.0` on `main` and publish the release — that triggers
`docker-publish.yml`, which pushes the image and moves `latest`.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
---------
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
2026-08-15 09:09:18 +02:00
|
|
|
|
<h2>
|
|
|
|
|
|
<IconHome /> Homepage Hero
|
|
|
|
|
|
</h2>
|
2026-05-31 21:27:13 +02:00
|
|
|
|
<button
|
|
|
|
|
|
className="admin-btn admin-btn-sm"
|
|
|
|
|
|
onClick={() =>
|
|
|
|
|
|
setHeroPickerTarget({
|
|
|
|
|
|
onSelect: handleHeroSelect,
|
|
|
|
|
|
currentAssetIds: gallery.hero,
|
|
|
|
|
|
title: 'Pick Hero Image for Homepage',
|
|
|
|
|
|
})
|
|
|
|
|
|
}
|
|
|
|
|
|
>
|
2026-08-14 11:10:42 +02:00
|
|
|
|
<IconPlus size={14} /> Add Hero
|
feat: add visual admin panel with page builder and settings editor
- Add /admin route with password-protected visual page builder
- Page Builder: manage hero images, standalone albums, subpages, and sections
- Album Picker: browse all shared Immich albums with search and filtering
- Settings Editor: theme, grid, footer, legal, SEO configuration
- YAML service with atomic writes and automatic backups (content/.backups/)
- HMAC-signed admin sessions (24h expiry, HttpOnly cookies)
- API endpoints: /api/admin/{auth,gallery,settings,albums,reload}
- Enable with ADMIN_PASSWORD env var; disabled by default
- invalidateConfigCache() export for hot-reload after saves
2026-05-29 17:04:37 +02:00
|
|
|
|
</button>
|
|
|
|
|
|
</div>
|
2026-05-29 17:59:25 +02:00
|
|
|
|
<DndContext
|
|
|
|
|
|
sensors={sensors}
|
|
|
|
|
|
collisionDetection={closestCenter}
|
|
|
|
|
|
onDragEnd={handleHeroDragEnd}
|
|
|
|
|
|
>
|
|
|
|
|
|
<SortableContext
|
|
|
|
|
|
items={gallery.hero.map((_, i) => `hero-${i}`)}
|
|
|
|
|
|
strategy={horizontalListSortingStrategy}
|
|
|
|
|
|
>
|
|
|
|
|
|
<div className="hero-grid">
|
|
|
|
|
|
{gallery.hero.length === 0 && (
|
|
|
|
|
|
<p className="empty-hint">
|
|
|
|
|
|
No hero images configured. Add photos to show a hero carousel on the homepage.
|
|
|
|
|
|
</p>
|
|
|
|
|
|
)}
|
|
|
|
|
|
{gallery.hero.map((id, i) => (
|
|
|
|
|
|
<SortableHeroTile
|
|
|
|
|
|
key={`hero-${i}`}
|
|
|
|
|
|
id={id}
|
|
|
|
|
|
index={i}
|
|
|
|
|
|
onRemove={() => removeHero(i)}
|
|
|
|
|
|
/>
|
|
|
|
|
|
))}
|
feat: add visual admin panel with page builder and settings editor
- Add /admin route with password-protected visual page builder
- Page Builder: manage hero images, standalone albums, subpages, and sections
- Album Picker: browse all shared Immich albums with search and filtering
- Settings Editor: theme, grid, footer, legal, SEO configuration
- YAML service with atomic writes and automatic backups (content/.backups/)
- HMAC-signed admin sessions (24h expiry, HttpOnly cookies)
- API endpoints: /api/admin/{auth,gallery,settings,albums,reload}
- Enable with ADMIN_PASSWORD env var; disabled by default
- invalidateConfigCache() export for hot-reload after saves
2026-05-29 17:04:37 +02:00
|
|
|
|
</div>
|
2026-05-29 17:59:25 +02:00
|
|
|
|
</SortableContext>
|
|
|
|
|
|
</DndContext>
|
feat: add visual admin panel with page builder and settings editor
- Add /admin route with password-protected visual page builder
- Page Builder: manage hero images, standalone albums, subpages, and sections
- Album Picker: browse all shared Immich albums with search and filtering
- Settings Editor: theme, grid, footer, legal, SEO configuration
- YAML service with atomic writes and automatic backups (content/.backups/)
- HMAC-signed admin sessions (24h expiry, HttpOnly cookies)
- API endpoints: /api/admin/{auth,gallery,settings,albums,reload}
- Enable with ADMIN_PASSWORD env var; disabled by default
- invalidateConfigCache() export for hot-reload after saves
2026-05-29 17:04:37 +02:00
|
|
|
|
</section>
|
|
|
|
|
|
|
|
|
|
|
|
{/* Standalone Albums */}
|
|
|
|
|
|
<section className="builder-section">
|
|
|
|
|
|
<div className="builder-section-header">
|
2026-08-14 11:10:42 +02:00
|
|
|
|
<h2>
|
|
|
|
|
|
<IconCamera />
|
|
|
|
|
|
Standalone Albums
|
|
|
|
|
|
</h2>
|
feat: add visual admin panel with page builder and settings editor
- Add /admin route with password-protected visual page builder
- Page Builder: manage hero images, standalone albums, subpages, and sections
- Album Picker: browse all shared Immich albums with search and filtering
- Settings Editor: theme, grid, footer, legal, SEO configuration
- YAML service with atomic writes and automatic backups (content/.backups/)
- HMAC-signed admin sessions (24h expiry, HttpOnly cookies)
- API endpoints: /api/admin/{auth,gallery,settings,albums,reload}
- Enable with ADMIN_PASSWORD env var; disabled by default
- invalidateConfigCache() export for hot-reload after saves
2026-05-29 17:04:37 +02:00
|
|
|
|
<button
|
|
|
|
|
|
className="admin-btn admin-btn-sm"
|
|
|
|
|
|
onClick={() => setPickerTarget({ type: 'standalone' })}
|
|
|
|
|
|
>
|
|
|
|
|
|
+ Add Album
|
|
|
|
|
|
</button>
|
|
|
|
|
|
</div>
|
2026-05-29 17:59:25 +02:00
|
|
|
|
<DndContext
|
|
|
|
|
|
sensors={sensors}
|
|
|
|
|
|
collisionDetection={closestCenter}
|
|
|
|
|
|
onDragEnd={handleAlbumDragEnd}
|
|
|
|
|
|
>
|
|
|
|
|
|
<SortableContext
|
2026-05-31 21:17:52 +02:00
|
|
|
|
items={filteredAlbums.map((a) => {
|
|
|
|
|
|
const originalIndex = gallery.albums.findIndex((x) => x.id === a.id);
|
|
|
|
|
|
return `album-${a.id}-${originalIndex}`;
|
|
|
|
|
|
})}
|
2026-05-29 17:59:25 +02:00
|
|
|
|
strategy={verticalListSortingStrategy}
|
|
|
|
|
|
>
|
|
|
|
|
|
<div className="album-list">
|
2026-05-31 21:17:52 +02:00
|
|
|
|
{filteredAlbums.length === 0 && (
|
2026-05-29 17:59:25 +02:00
|
|
|
|
<p className="empty-hint">
|
release: v0.11.0 (#459)
Ships `dev` as **v0.11.0**. `main` contains nothing that `dev` does not,
so this is a clean sync.
## Headline changes since v0.10.0
- **Journal & Journal Studio** — photo essays at `/journal`,
split-screen block editor with live preview, drafts, per-entry
passwords, cover images
- **First-run setup wizard at `/install`** — configure a fresh
deployment from the browser; credentials are verified against Immich
before anything is written, and the wizard is gated by a one-time token
- **About page editor and toggle** in the admin panel
- **Per-album photo order** independent of Immich, with a drag & drop
editor
- **Custom favicon upload**
- **Experimental portfolio features** — justified grid, `cover` hero,
unlisted subpages, per-album grid overrides, cover focal points,
external nav links
- **Security** — asset tokens length-capped before decoding (#423),
journal author markdown escaped rather than filtered, journal file paths
contained, admin session key derived with scrypt (#432), Next.js 16.3.0
for CVE-2025-13465
- **Fixed** — client proofing honours its own configuration again
(#454); journal photo rendering (#432)
Full detail in [CHANGELOG.md](CHANGELOG.md#0110--2026-08-15).
## Verified
`npx tsc --noEmit` clean · `npx vitest run` 435 tests pass · `npm run
build` succeeds · lint 0 errors · `prettier --check` clean · local
`docker build` of the release tree.
## After merge
Tag `v0.11.0` on `main` and publish the release — that triggers
`docker-publish.yml`, which pushes the image and moves `latest`.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
---------
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
2026-08-15 09:09:18 +02:00
|
|
|
|
{searchQuery
|
|
|
|
|
|
? 'No matching standalone albums found.'
|
|
|
|
|
|
: 'No standalone albums. These show directly on the homepage.'}
|
2026-05-29 17:59:25 +02:00
|
|
|
|
</p>
|
|
|
|
|
|
)}
|
2026-05-31 21:17:52 +02:00
|
|
|
|
{filteredAlbums.map((album) => {
|
|
|
|
|
|
const originalIndex = gallery.albums.findIndex((a) => a.id === album.id);
|
|
|
|
|
|
return (
|
|
|
|
|
|
<SortableAlbumCard
|
|
|
|
|
|
key={`${album.id}-${originalIndex}`}
|
|
|
|
|
|
album={album}
|
|
|
|
|
|
index={originalIndex}
|
|
|
|
|
|
name={getAlbumName(album.id)}
|
|
|
|
|
|
count={getAlbumCount(album.id)}
|
|
|
|
|
|
thumbnailId={getAlbumThumbnailId(album.id)}
|
|
|
|
|
|
onRemove={() => removeStandaloneAlbum(originalIndex)}
|
release: v0.11.0 (#459)
Ships `dev` as **v0.11.0**. `main` contains nothing that `dev` does not,
so this is a clean sync.
## Headline changes since v0.10.0
- **Journal & Journal Studio** — photo essays at `/journal`,
split-screen block editor with live preview, drafts, per-entry
passwords, cover images
- **First-run setup wizard at `/install`** — configure a fresh
deployment from the browser; credentials are verified against Immich
before anything is written, and the wizard is gated by a one-time token
- **About page editor and toggle** in the admin panel
- **Per-album photo order** independent of Immich, with a drag & drop
editor
- **Custom favicon upload**
- **Experimental portfolio features** — justified grid, `cover` hero,
unlisted subpages, per-album grid overrides, cover focal points,
external nav links
- **Security** — asset tokens length-capped before decoding (#423),
journal author markdown escaped rather than filtered, journal file paths
contained, admin session key derived with scrypt (#432), Next.js 16.3.0
for CVE-2025-13465
- **Fixed** — client proofing honours its own configuration again
(#454); journal photo rendering (#432)
Full detail in [CHANGELOG.md](CHANGELOG.md#0110--2026-08-15).
## Verified
`npx tsc --noEmit` clean · `npx vitest run` 435 tests pass · `npm run
build` succeeds · lint 0 errors · `prettier --check` clean · local
`docker build` of the release tree.
## After merge
Tag `v0.11.0` on `main` and publish the release — that triggers
`docker-publish.yml`, which pushes the image and moves `latest`.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
---------
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
2026-08-15 09:09:18 +02:00
|
|
|
|
onEdit={() =>
|
|
|
|
|
|
setEditingAlbumAddress({ type: 'standalone', albumIndex: originalIndex })
|
|
|
|
|
|
}
|
2026-05-31 21:17:52 +02:00
|
|
|
|
/>
|
|
|
|
|
|
);
|
|
|
|
|
|
})}
|
2026-05-29 17:59:25 +02:00
|
|
|
|
</div>
|
|
|
|
|
|
</SortableContext>
|
|
|
|
|
|
</DndContext>
|
feat: add visual admin panel with page builder and settings editor
- Add /admin route with password-protected visual page builder
- Page Builder: manage hero images, standalone albums, subpages, and sections
- Album Picker: browse all shared Immich albums with search and filtering
- Settings Editor: theme, grid, footer, legal, SEO configuration
- YAML service with atomic writes and automatic backups (content/.backups/)
- HMAC-signed admin sessions (24h expiry, HttpOnly cookies)
- API endpoints: /api/admin/{auth,gallery,settings,albums,reload}
- Enable with ADMIN_PASSWORD env var; disabled by default
- invalidateConfigCache() export for hot-reload after saves
2026-05-29 17:04:37 +02:00
|
|
|
|
</section>
|
|
|
|
|
|
|
|
|
|
|
|
{/* Subpages */}
|
|
|
|
|
|
<section className="builder-section">
|
|
|
|
|
|
<div className="builder-section-header">
|
2026-08-14 11:10:42 +02:00
|
|
|
|
<h2>
|
|
|
|
|
|
<IconFolder />
|
|
|
|
|
|
Subpages
|
|
|
|
|
|
</h2>
|
feat: add visual admin panel with page builder and settings editor
- Add /admin route with password-protected visual page builder
- Page Builder: manage hero images, standalone albums, subpages, and sections
- Album Picker: browse all shared Immich albums with search and filtering
- Settings Editor: theme, grid, footer, legal, SEO configuration
- YAML service with atomic writes and automatic backups (content/.backups/)
- HMAC-signed admin sessions (24h expiry, HttpOnly cookies)
- API endpoints: /api/admin/{auth,gallery,settings,albums,reload}
- Enable with ADMIN_PASSWORD env var; disabled by default
- invalidateConfigCache() export for hot-reload after saves
2026-05-29 17:04:37 +02:00
|
|
|
|
<button className="admin-btn admin-btn-sm" onClick={addSubpage}>
|
|
|
|
|
|
+ New Subpage
|
|
|
|
|
|
</button>
|
|
|
|
|
|
</div>
|
|
|
|
|
|
|
|
|
|
|
|
{gallery.subpages.length === 0 && (
|
|
|
|
|
|
<p className="empty-hint">
|
|
|
|
|
|
No subpages. Create one to group albums under a custom URL path.
|
|
|
|
|
|
</p>
|
|
|
|
|
|
)}
|
|
|
|
|
|
|
2026-05-31 21:17:52 +02:00
|
|
|
|
{gallery.subpages.length > 0 && filteredSubpages.length === 0 && (
|
release: v0.11.0 (#459)
Ships `dev` as **v0.11.0**. `main` contains nothing that `dev` does not,
so this is a clean sync.
## Headline changes since v0.10.0
- **Journal & Journal Studio** — photo essays at `/journal`,
split-screen block editor with live preview, drafts, per-entry
passwords, cover images
- **First-run setup wizard at `/install`** — configure a fresh
deployment from the browser; credentials are verified against Immich
before anything is written, and the wizard is gated by a one-time token
- **About page editor and toggle** in the admin panel
- **Per-album photo order** independent of Immich, with a drag & drop
editor
- **Custom favicon upload**
- **Experimental portfolio features** — justified grid, `cover` hero,
unlisted subpages, per-album grid overrides, cover focal points,
external nav links
- **Security** — asset tokens length-capped before decoding (#423),
journal author markdown escaped rather than filtered, journal file paths
contained, admin session key derived with scrypt (#432), Next.js 16.3.0
for CVE-2025-13465
- **Fixed** — client proofing honours its own configuration again
(#454); journal photo rendering (#432)
Full detail in [CHANGELOG.md](CHANGELOG.md#0110--2026-08-15).
## Verified
`npx tsc --noEmit` clean · `npx vitest run` 435 tests pass · `npm run
build` succeeds · lint 0 errors · `prettier --check` clean · local
`docker build` of the release tree.
## After merge
Tag `v0.11.0` on `main` and publish the release — that triggers
`docker-publish.yml`, which pushes the image and moves `latest`.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
---------
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
2026-08-15 09:09:18 +02:00
|
|
|
|
<p className="empty-hint">No matching subpages found.</p>
|
2026-05-31 21:17:52 +02:00
|
|
|
|
)}
|
|
|
|
|
|
|
2026-05-29 17:59:25 +02:00
|
|
|
|
{/* Collapsed overview grid with DnD */}
|
|
|
|
|
|
<DndContext
|
|
|
|
|
|
sensors={sensors}
|
|
|
|
|
|
collisionDetection={closestCenter}
|
|
|
|
|
|
onDragEnd={handleSubpageDragEnd}
|
|
|
|
|
|
>
|
|
|
|
|
|
<SortableContext
|
2026-05-31 21:17:52 +02:00
|
|
|
|
items={filteredSubpages.map(({ index }) => `subpage-${index}`)}
|
2026-05-29 17:59:25 +02:00
|
|
|
|
strategy={horizontalListSortingStrategy}
|
|
|
|
|
|
>
|
|
|
|
|
|
<div className="subpage-grid">
|
2026-05-31 21:17:52 +02:00
|
|
|
|
{filteredSubpages.map(({ sp, index }) => (
|
2026-05-29 17:59:25 +02:00
|
|
|
|
<SortableSubpageTile
|
2026-05-31 21:17:52 +02:00
|
|
|
|
key={`subpage-${index}`}
|
2026-05-29 17:59:25 +02:00
|
|
|
|
sp={sp}
|
2026-05-31 21:17:52 +02:00
|
|
|
|
spIndex={index}
|
|
|
|
|
|
isActive={expandedSubpage === index}
|
|
|
|
|
|
onClick={() => setExpandedSubpage(expandedSubpage === index ? null : index)}
|
2026-05-29 17:59:25 +02:00
|
|
|
|
getFirstThumb={getFirstSubpageThumb}
|
|
|
|
|
|
/>
|
|
|
|
|
|
))}
|
|
|
|
|
|
</div>
|
|
|
|
|
|
</SortableContext>
|
|
|
|
|
|
</DndContext>
|
feat: add visual admin panel with page builder and settings editor
- Add /admin route with password-protected visual page builder
- Page Builder: manage hero images, standalone albums, subpages, and sections
- Album Picker: browse all shared Immich albums with search and filtering
- Settings Editor: theme, grid, footer, legal, SEO configuration
- YAML service with atomic writes and automatic backups (content/.backups/)
- HMAC-signed admin sessions (24h expiry, HttpOnly cookies)
- API endpoints: /api/admin/{auth,gallery,settings,albums,reload}
- Enable with ADMIN_PASSWORD env var; disabled by default
- invalidateConfigCache() export for hot-reload after saves
2026-05-29 17:04:37 +02:00
|
|
|
|
|
security: add Trivy container scan to Docker publish workflow (#399)
* feat(admin): add backup manager UI with 1-click restore
* feat(admin): collapse older backup entries by default
* fix(theme): isolate admin layout, instant DOM theme updates, and add Light/Dark mode toggle
* feat(admin): replace text controls for Photo Frame and Hero Style with visual preview cards
* fix(admin): define missing CSS rules for button system (.btn, .preset-btn)
* feat(admin): redesign theme settings with segmented mode toggle, accent color swatches, and custom iOS-style toggle cards
* feat(admin): upgrade all settings tabs with visual grid previews, Google SEO snippet preview, and toggle cards
* feat(admin): overhaul Pages Builder UX with slide-over drawer, card hover badges, real-time search, and floating save bar
* fix(admin): remove leftover dangling syntax snippet in PageBuilder.tsx
* fix(admin): add position: relative to subpage-tile so hover overlay is contained inside the tile
* style(admin): replace all emojis with clean Leica-style vector SVG icons
* fix(types): extend IconProps with SVGProps to allow style prop on Leica SVG icons
* feat(admin): add subpage live-preview, privacy analytics, and asset protection settings
* fix(typecheck): fix AlbumEntry property access in subpage drawer preview mode
* fix(types): fix ImmichAlbumInfo property names thumbnailAssetId and albumName in PageBuilder.tsx
* fix(types): add protection and watermark optional properties to AppConfig interface
* feat(settings): add toggle for disabling analytics tracking (defaults to enabled)
* feat(ux): show status banner when analytics tracking is disabled + add live sync indicator
* feat(watermark): render customizable watermark overlay on Lightbox images + rename section to Portfolio Features & Modules
* fix(types): import type LightboxWatermark in PhotoGrid.tsx
* fix(types): destructure watermark prop in PhotoGrid function signature
* feat(seo): add configurable subpage title template and metadata descriptions
* feat(seo): add generateMetadata to about page for title template support
* feat(proofing): add client proofing, favorites selection, compact URL bitmasking, and export modal
* feat(essay): add Photo Essay storytelling mode with RSC markdown parser and fullbleed/pair layouts
* feat(subpages): add page enabled toggle to deactivate subpages without deleting them
* feat(admin): add visual essay block builder for photo essay storytelling pages
* security: add Trivy container scan to Docker publish workflow
Scans the built image for CRITICAL/HIGH CVEs on every release and
uploads results to the GitHub Security tab. Non-blocking for now
(exit-code 0) so releases aren't gated on findings. Also documents
the scan and existing Dependabot coverage in the README.
---------
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-08-07 11:08:04 +02:00
|
|
|
|
{/* Expanded subpage detail (Slide-Over Drawer) */}
|
2026-05-29 17:29:26 +02:00
|
|
|
|
{expandedSubpage !== null && gallery.subpages[expandedSubpage] && (
|
security: add Trivy container scan to Docker publish workflow (#399)
* feat(admin): add backup manager UI with 1-click restore
* feat(admin): collapse older backup entries by default
* fix(theme): isolate admin layout, instant DOM theme updates, and add Light/Dark mode toggle
* feat(admin): replace text controls for Photo Frame and Hero Style with visual preview cards
* fix(admin): define missing CSS rules for button system (.btn, .preset-btn)
* feat(admin): redesign theme settings with segmented mode toggle, accent color swatches, and custom iOS-style toggle cards
* feat(admin): upgrade all settings tabs with visual grid previews, Google SEO snippet preview, and toggle cards
* feat(admin): overhaul Pages Builder UX with slide-over drawer, card hover badges, real-time search, and floating save bar
* fix(admin): remove leftover dangling syntax snippet in PageBuilder.tsx
* fix(admin): add position: relative to subpage-tile so hover overlay is contained inside the tile
* style(admin): replace all emojis with clean Leica-style vector SVG icons
* fix(types): extend IconProps with SVGProps to allow style prop on Leica SVG icons
* feat(admin): add subpage live-preview, privacy analytics, and asset protection settings
* fix(typecheck): fix AlbumEntry property access in subpage drawer preview mode
* fix(types): fix ImmichAlbumInfo property names thumbnailAssetId and albumName in PageBuilder.tsx
* fix(types): add protection and watermark optional properties to AppConfig interface
* feat(settings): add toggle for disabling analytics tracking (defaults to enabled)
* feat(ux): show status banner when analytics tracking is disabled + add live sync indicator
* feat(watermark): render customizable watermark overlay on Lightbox images + rename section to Portfolio Features & Modules
* fix(types): import type LightboxWatermark in PhotoGrid.tsx
* fix(types): destructure watermark prop in PhotoGrid function signature
* feat(seo): add configurable subpage title template and metadata descriptions
* feat(seo): add generateMetadata to about page for title template support
* feat(proofing): add client proofing, favorites selection, compact URL bitmasking, and export modal
* feat(essay): add Photo Essay storytelling mode with RSC markdown parser and fullbleed/pair layouts
* feat(subpages): add page enabled toggle to deactivate subpages without deleting them
* feat(admin): add visual essay block builder for photo essay storytelling pages
* security: add Trivy container scan to Docker publish workflow
Scans the built image for CRITICAL/HIGH CVEs on every release and
uploads results to the GitHub Security tab. Non-blocking for now
(exit-code 0) so releases aren't gated on findings. Also documents
the scan and existing Dependabot coverage in the README.
---------
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-08-07 11:08:04 +02:00
|
|
|
|
<div className="subpage-drawer-backdrop" onClick={() => setExpandedSubpage(null)}>
|
|
|
|
|
|
<div className="subpage-drawer-container" onClick={(e) => e.stopPropagation()}>
|
|
|
|
|
|
{(() => {
|
|
|
|
|
|
const sp = gallery.subpages[expandedSubpage];
|
|
|
|
|
|
const spIndex = expandedSubpage;
|
|
|
|
|
|
return (
|
|
|
|
|
|
<>
|
|
|
|
|
|
<div className="subpage-drawer-header">
|
|
|
|
|
|
<div className="subpage-drawer-title-group">
|
|
|
|
|
|
<span className="subpage-drawer-breadcrumb">Pages / Subpages</span>
|
release: v0.11.0 (#459)
Ships `dev` as **v0.11.0**. `main` contains nothing that `dev` does not,
so this is a clean sync.
## Headline changes since v0.10.0
- **Journal & Journal Studio** — photo essays at `/journal`,
split-screen block editor with live preview, drafts, per-entry
passwords, cover images
- **First-run setup wizard at `/install`** — configure a fresh
deployment from the browser; credentials are verified against Immich
before anything is written, and the wizard is gated by a one-time token
- **About page editor and toggle** in the admin panel
- **Per-album photo order** independent of Immich, with a drag & drop
editor
- **Custom favicon upload**
- **Experimental portfolio features** — justified grid, `cover` hero,
unlisted subpages, per-album grid overrides, cover focal points,
external nav links
- **Security** — asset tokens length-capped before decoding (#423),
journal author markdown escaped rather than filtered, journal file paths
contained, admin session key derived with scrypt (#432), Next.js 16.3.0
for CVE-2025-13465
- **Fixed** — client proofing honours its own configuration again
(#454); journal photo rendering (#432)
Full detail in [CHANGELOG.md](CHANGELOG.md#0110--2026-08-15).
## Verified
`npx tsc --noEmit` clean · `npx vitest run` 435 tests pass · `npm run
build` succeeds · lint 0 errors · `prettier --check` clean · local
`docker build` of the release tree.
## After merge
Tag `v0.11.0` on `main` and publish the release — that triggers
`docker-publish.yml`, which pushes the image and moves `latest`.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
---------
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
2026-08-15 09:09:18 +02:00
|
|
|
|
<h3 className="subpage-drawer-title">
|
|
|
|
|
|
{sp.title || sp.name || 'Untitled Page'}
|
|
|
|
|
|
</h3>
|
2026-05-29 17:29:26 +02:00
|
|
|
|
</div>
|
security: add Trivy container scan to Docker publish workflow (#399)
* feat(admin): add backup manager UI with 1-click restore
* feat(admin): collapse older backup entries by default
* fix(theme): isolate admin layout, instant DOM theme updates, and add Light/Dark mode toggle
* feat(admin): replace text controls for Photo Frame and Hero Style with visual preview cards
* fix(admin): define missing CSS rules for button system (.btn, .preset-btn)
* feat(admin): redesign theme settings with segmented mode toggle, accent color swatches, and custom iOS-style toggle cards
* feat(admin): upgrade all settings tabs with visual grid previews, Google SEO snippet preview, and toggle cards
* feat(admin): overhaul Pages Builder UX with slide-over drawer, card hover badges, real-time search, and floating save bar
* fix(admin): remove leftover dangling syntax snippet in PageBuilder.tsx
* fix(admin): add position: relative to subpage-tile so hover overlay is contained inside the tile
* style(admin): replace all emojis with clean Leica-style vector SVG icons
* fix(types): extend IconProps with SVGProps to allow style prop on Leica SVG icons
* feat(admin): add subpage live-preview, privacy analytics, and asset protection settings
* fix(typecheck): fix AlbumEntry property access in subpage drawer preview mode
* fix(types): fix ImmichAlbumInfo property names thumbnailAssetId and albumName in PageBuilder.tsx
* fix(types): add protection and watermark optional properties to AppConfig interface
* feat(settings): add toggle for disabling analytics tracking (defaults to enabled)
* feat(ux): show status banner when analytics tracking is disabled + add live sync indicator
* feat(watermark): render customizable watermark overlay on Lightbox images + rename section to Portfolio Features & Modules
* fix(types): import type LightboxWatermark in PhotoGrid.tsx
* fix(types): destructure watermark prop in PhotoGrid function signature
* feat(seo): add configurable subpage title template and metadata descriptions
* feat(seo): add generateMetadata to about page for title template support
* feat(proofing): add client proofing, favorites selection, compact URL bitmasking, and export modal
* feat(essay): add Photo Essay storytelling mode with RSC markdown parser and fullbleed/pair layouts
* feat(subpages): add page enabled toggle to deactivate subpages without deleting them
* feat(admin): add visual essay block builder for photo essay storytelling pages
* security: add Trivy container scan to Docker publish workflow
Scans the built image for CRITICAL/HIGH CVEs on every release and
uploads results to the GitHub Security tab. Non-blocking for now
(exit-code 0) so releases aren't gated on findings. Also documents
the scan and existing Dependabot coverage in the README.
---------
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-08-07 11:08:04 +02:00
|
|
|
|
<div className="subpage-drawer-header-actions">
|
|
|
|
|
|
<div className="segmented-control" style={{ padding: '2px' }}>
|
|
|
|
|
|
<button
|
|
|
|
|
|
type="button"
|
|
|
|
|
|
className={`segment-btn ${drawerMode === 'edit' ? 'active' : ''}`}
|
|
|
|
|
|
onClick={() => setDrawerMode('edit')}
|
|
|
|
|
|
style={{ padding: '0.2rem 0.6rem', fontSize: '0.75rem' }}
|
|
|
|
|
|
>
|
2026-08-14 11:10:42 +02:00
|
|
|
|
<IconPencil size={14} /> Edit
|
security: add Trivy container scan to Docker publish workflow (#399)
* feat(admin): add backup manager UI with 1-click restore
* feat(admin): collapse older backup entries by default
* fix(theme): isolate admin layout, instant DOM theme updates, and add Light/Dark mode toggle
* feat(admin): replace text controls for Photo Frame and Hero Style with visual preview cards
* fix(admin): define missing CSS rules for button system (.btn, .preset-btn)
* feat(admin): redesign theme settings with segmented mode toggle, accent color swatches, and custom iOS-style toggle cards
* feat(admin): upgrade all settings tabs with visual grid previews, Google SEO snippet preview, and toggle cards
* feat(admin): overhaul Pages Builder UX with slide-over drawer, card hover badges, real-time search, and floating save bar
* fix(admin): remove leftover dangling syntax snippet in PageBuilder.tsx
* fix(admin): add position: relative to subpage-tile so hover overlay is contained inside the tile
* style(admin): replace all emojis with clean Leica-style vector SVG icons
* fix(types): extend IconProps with SVGProps to allow style prop on Leica SVG icons
* feat(admin): add subpage live-preview, privacy analytics, and asset protection settings
* fix(typecheck): fix AlbumEntry property access in subpage drawer preview mode
* fix(types): fix ImmichAlbumInfo property names thumbnailAssetId and albumName in PageBuilder.tsx
* fix(types): add protection and watermark optional properties to AppConfig interface
* feat(settings): add toggle for disabling analytics tracking (defaults to enabled)
* feat(ux): show status banner when analytics tracking is disabled + add live sync indicator
* feat(watermark): render customizable watermark overlay on Lightbox images + rename section to Portfolio Features & Modules
* fix(types): import type LightboxWatermark in PhotoGrid.tsx
* fix(types): destructure watermark prop in PhotoGrid function signature
* feat(seo): add configurable subpage title template and metadata descriptions
* feat(seo): add generateMetadata to about page for title template support
* feat(proofing): add client proofing, favorites selection, compact URL bitmasking, and export modal
* feat(essay): add Photo Essay storytelling mode with RSC markdown parser and fullbleed/pair layouts
* feat(subpages): add page enabled toggle to deactivate subpages without deleting them
* feat(admin): add visual essay block builder for photo essay storytelling pages
* security: add Trivy container scan to Docker publish workflow
Scans the built image for CRITICAL/HIGH CVEs on every release and
uploads results to the GitHub Security tab. Non-blocking for now
(exit-code 0) so releases aren't gated on findings. Also documents
the scan and existing Dependabot coverage in the README.
---------
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-08-07 11:08:04 +02:00
|
|
|
|
</button>
|
|
|
|
|
|
<button
|
|
|
|
|
|
type="button"
|
|
|
|
|
|
className={`segment-btn ${drawerMode === 'preview' ? 'active' : ''}`}
|
|
|
|
|
|
onClick={() => setDrawerMode('preview')}
|
|
|
|
|
|
style={{ padding: '0.2rem 0.6rem', fontSize: '0.75rem' }}
|
|
|
|
|
|
>
|
2026-08-14 11:10:42 +02:00
|
|
|
|
<IconSearch size={14} /> Live Preview
|
security: add Trivy container scan to Docker publish workflow (#399)
* feat(admin): add backup manager UI with 1-click restore
* feat(admin): collapse older backup entries by default
* fix(theme): isolate admin layout, instant DOM theme updates, and add Light/Dark mode toggle
* feat(admin): replace text controls for Photo Frame and Hero Style with visual preview cards
* fix(admin): define missing CSS rules for button system (.btn, .preset-btn)
* feat(admin): redesign theme settings with segmented mode toggle, accent color swatches, and custom iOS-style toggle cards
* feat(admin): upgrade all settings tabs with visual grid previews, Google SEO snippet preview, and toggle cards
* feat(admin): overhaul Pages Builder UX with slide-over drawer, card hover badges, real-time search, and floating save bar
* fix(admin): remove leftover dangling syntax snippet in PageBuilder.tsx
* fix(admin): add position: relative to subpage-tile so hover overlay is contained inside the tile
* style(admin): replace all emojis with clean Leica-style vector SVG icons
* fix(types): extend IconProps with SVGProps to allow style prop on Leica SVG icons
* feat(admin): add subpage live-preview, privacy analytics, and asset protection settings
* fix(typecheck): fix AlbumEntry property access in subpage drawer preview mode
* fix(types): fix ImmichAlbumInfo property names thumbnailAssetId and albumName in PageBuilder.tsx
* fix(types): add protection and watermark optional properties to AppConfig interface
* feat(settings): add toggle for disabling analytics tracking (defaults to enabled)
* feat(ux): show status banner when analytics tracking is disabled + add live sync indicator
* feat(watermark): render customizable watermark overlay on Lightbox images + rename section to Portfolio Features & Modules
* fix(types): import type LightboxWatermark in PhotoGrid.tsx
* fix(types): destructure watermark prop in PhotoGrid function signature
* feat(seo): add configurable subpage title template and metadata descriptions
* feat(seo): add generateMetadata to about page for title template support
* feat(proofing): add client proofing, favorites selection, compact URL bitmasking, and export modal
* feat(essay): add Photo Essay storytelling mode with RSC markdown parser and fullbleed/pair layouts
* feat(subpages): add page enabled toggle to deactivate subpages without deleting them
* feat(admin): add visual essay block builder for photo essay storytelling pages
* security: add Trivy container scan to Docker publish workflow
Scans the built image for CRITICAL/HIGH CVEs on every release and
uploads results to the GitHub Security tab. Non-blocking for now
(exit-code 0) so releases aren't gated on findings. Also documents
the scan and existing Dependabot coverage in the README.
---------
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-08-07 11:08:04 +02:00
|
|
|
|
</button>
|
|
|
|
|
|
</div>
|
2026-05-29 17:29:26 +02:00
|
|
|
|
|
security: add Trivy container scan to Docker publish workflow (#399)
* feat(admin): add backup manager UI with 1-click restore
* feat(admin): collapse older backup entries by default
* fix(theme): isolate admin layout, instant DOM theme updates, and add Light/Dark mode toggle
* feat(admin): replace text controls for Photo Frame and Hero Style with visual preview cards
* fix(admin): define missing CSS rules for button system (.btn, .preset-btn)
* feat(admin): redesign theme settings with segmented mode toggle, accent color swatches, and custom iOS-style toggle cards
* feat(admin): upgrade all settings tabs with visual grid previews, Google SEO snippet preview, and toggle cards
* feat(admin): overhaul Pages Builder UX with slide-over drawer, card hover badges, real-time search, and floating save bar
* fix(admin): remove leftover dangling syntax snippet in PageBuilder.tsx
* fix(admin): add position: relative to subpage-tile so hover overlay is contained inside the tile
* style(admin): replace all emojis with clean Leica-style vector SVG icons
* fix(types): extend IconProps with SVGProps to allow style prop on Leica SVG icons
* feat(admin): add subpage live-preview, privacy analytics, and asset protection settings
* fix(typecheck): fix AlbumEntry property access in subpage drawer preview mode
* fix(types): fix ImmichAlbumInfo property names thumbnailAssetId and albumName in PageBuilder.tsx
* fix(types): add protection and watermark optional properties to AppConfig interface
* feat(settings): add toggle for disabling analytics tracking (defaults to enabled)
* feat(ux): show status banner when analytics tracking is disabled + add live sync indicator
* feat(watermark): render customizable watermark overlay on Lightbox images + rename section to Portfolio Features & Modules
* fix(types): import type LightboxWatermark in PhotoGrid.tsx
* fix(types): destructure watermark prop in PhotoGrid function signature
* feat(seo): add configurable subpage title template and metadata descriptions
* feat(seo): add generateMetadata to about page for title template support
* feat(proofing): add client proofing, favorites selection, compact URL bitmasking, and export modal
* feat(essay): add Photo Essay storytelling mode with RSC markdown parser and fullbleed/pair layouts
* feat(subpages): add page enabled toggle to deactivate subpages without deleting them
* feat(admin): add visual essay block builder for photo essay storytelling pages
* security: add Trivy container scan to Docker publish workflow
Scans the built image for CRITICAL/HIGH CVEs on every release and
uploads results to the GitHub Security tab. Non-blocking for now
(exit-code 0) so releases aren't gated on findings. Also documents
the scan and existing Dependabot coverage in the README.
---------
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-08-07 11:08:04 +02:00
|
|
|
|
<a
|
chore(release): v0.10.0 (#400)
Photo Essay mode, client proofing, studio-modern preset, admin panel overhaul, watermark, cookieless analytics, subpage toggle, SEO title templates. Analytics API now admin-only, Trivy scan on publish. Album order mirrors the Immich timeline; map theme, admin status panel, lightbox counter and Docker health check fixed.
See CHANGELOG.md for the full list and the health-check upgrade note.
2026-08-10 09:56:20 +02:00
|
|
|
|
href={`/${slugify(sp.name)}?fresh=1`}
|
security: add Trivy container scan to Docker publish workflow (#399)
* feat(admin): add backup manager UI with 1-click restore
* feat(admin): collapse older backup entries by default
* fix(theme): isolate admin layout, instant DOM theme updates, and add Light/Dark mode toggle
* feat(admin): replace text controls for Photo Frame and Hero Style with visual preview cards
* fix(admin): define missing CSS rules for button system (.btn, .preset-btn)
* feat(admin): redesign theme settings with segmented mode toggle, accent color swatches, and custom iOS-style toggle cards
* feat(admin): upgrade all settings tabs with visual grid previews, Google SEO snippet preview, and toggle cards
* feat(admin): overhaul Pages Builder UX with slide-over drawer, card hover badges, real-time search, and floating save bar
* fix(admin): remove leftover dangling syntax snippet in PageBuilder.tsx
* fix(admin): add position: relative to subpage-tile so hover overlay is contained inside the tile
* style(admin): replace all emojis with clean Leica-style vector SVG icons
* fix(types): extend IconProps with SVGProps to allow style prop on Leica SVG icons
* feat(admin): add subpage live-preview, privacy analytics, and asset protection settings
* fix(typecheck): fix AlbumEntry property access in subpage drawer preview mode
* fix(types): fix ImmichAlbumInfo property names thumbnailAssetId and albumName in PageBuilder.tsx
* fix(types): add protection and watermark optional properties to AppConfig interface
* feat(settings): add toggle for disabling analytics tracking (defaults to enabled)
* feat(ux): show status banner when analytics tracking is disabled + add live sync indicator
* feat(watermark): render customizable watermark overlay on Lightbox images + rename section to Portfolio Features & Modules
* fix(types): import type LightboxWatermark in PhotoGrid.tsx
* fix(types): destructure watermark prop in PhotoGrid function signature
* feat(seo): add configurable subpage title template and metadata descriptions
* feat(seo): add generateMetadata to about page for title template support
* feat(proofing): add client proofing, favorites selection, compact URL bitmasking, and export modal
* feat(essay): add Photo Essay storytelling mode with RSC markdown parser and fullbleed/pair layouts
* feat(subpages): add page enabled toggle to deactivate subpages without deleting them
* feat(admin): add visual essay block builder for photo essay storytelling pages
* security: add Trivy container scan to Docker publish workflow
Scans the built image for CRITICAL/HIGH CVEs on every release and
uploads results to the GitHub Security tab. Non-blocking for now
(exit-code 0) so releases aren't gated on findings. Also documents
the scan and existing Dependabot coverage in the README.
---------
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-08-07 11:08:04 +02:00
|
|
|
|
target="_blank"
|
|
|
|
|
|
rel="noopener noreferrer"
|
|
|
|
|
|
className="admin-btn admin-btn-xs admin-btn-ghost"
|
chore(release): v0.10.0 (#400)
Photo Essay mode, client proofing, studio-modern preset, admin panel overhaul, watermark, cookieless analytics, subpage toggle, SEO title templates. Analytics API now admin-only, Trivy scan on publish. Album order mirrors the Immich timeline; map theme, admin status panel, lightbox counter and Docker health check fixed.
See CHANGELOG.md for the full list and the health-check upgrade note.
2026-08-10 09:56:20 +02:00
|
|
|
|
title="Open live page in new tab (bypassing cache)"
|
security: add Trivy container scan to Docker publish workflow (#399)
* feat(admin): add backup manager UI with 1-click restore
* feat(admin): collapse older backup entries by default
* fix(theme): isolate admin layout, instant DOM theme updates, and add Light/Dark mode toggle
* feat(admin): replace text controls for Photo Frame and Hero Style with visual preview cards
* fix(admin): define missing CSS rules for button system (.btn, .preset-btn)
* feat(admin): redesign theme settings with segmented mode toggle, accent color swatches, and custom iOS-style toggle cards
* feat(admin): upgrade all settings tabs with visual grid previews, Google SEO snippet preview, and toggle cards
* feat(admin): overhaul Pages Builder UX with slide-over drawer, card hover badges, real-time search, and floating save bar
* fix(admin): remove leftover dangling syntax snippet in PageBuilder.tsx
* fix(admin): add position: relative to subpage-tile so hover overlay is contained inside the tile
* style(admin): replace all emojis with clean Leica-style vector SVG icons
* fix(types): extend IconProps with SVGProps to allow style prop on Leica SVG icons
* feat(admin): add subpage live-preview, privacy analytics, and asset protection settings
* fix(typecheck): fix AlbumEntry property access in subpage drawer preview mode
* fix(types): fix ImmichAlbumInfo property names thumbnailAssetId and albumName in PageBuilder.tsx
* fix(types): add protection and watermark optional properties to AppConfig interface
* feat(settings): add toggle for disabling analytics tracking (defaults to enabled)
* feat(ux): show status banner when analytics tracking is disabled + add live sync indicator
* feat(watermark): render customizable watermark overlay on Lightbox images + rename section to Portfolio Features & Modules
* fix(types): import type LightboxWatermark in PhotoGrid.tsx
* fix(types): destructure watermark prop in PhotoGrid function signature
* feat(seo): add configurable subpage title template and metadata descriptions
* feat(seo): add generateMetadata to about page for title template support
* feat(proofing): add client proofing, favorites selection, compact URL bitmasking, and export modal
* feat(essay): add Photo Essay storytelling mode with RSC markdown parser and fullbleed/pair layouts
* feat(subpages): add page enabled toggle to deactivate subpages without deleting them
* feat(admin): add visual essay block builder for photo essay storytelling pages
* security: add Trivy container scan to Docker publish workflow
Scans the built image for CRITICAL/HIGH CVEs on every release and
uploads results to the GitHub Security tab. Non-blocking for now
(exit-code 0) so releases aren't gated on findings. Also documents
the scan and existing Dependabot coverage in the README.
---------
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-08-07 11:08:04 +02:00
|
|
|
|
>
|
|
|
|
|
|
/{slugify(sp.name)} ↗
|
|
|
|
|
|
</a>
|
2026-05-29 17:29:26 +02:00
|
|
|
|
<button
|
security: add Trivy container scan to Docker publish workflow (#399)
* feat(admin): add backup manager UI with 1-click restore
* feat(admin): collapse older backup entries by default
* fix(theme): isolate admin layout, instant DOM theme updates, and add Light/Dark mode toggle
* feat(admin): replace text controls for Photo Frame and Hero Style with visual preview cards
* fix(admin): define missing CSS rules for button system (.btn, .preset-btn)
* feat(admin): redesign theme settings with segmented mode toggle, accent color swatches, and custom iOS-style toggle cards
* feat(admin): upgrade all settings tabs with visual grid previews, Google SEO snippet preview, and toggle cards
* feat(admin): overhaul Pages Builder UX with slide-over drawer, card hover badges, real-time search, and floating save bar
* fix(admin): remove leftover dangling syntax snippet in PageBuilder.tsx
* fix(admin): add position: relative to subpage-tile so hover overlay is contained inside the tile
* style(admin): replace all emojis with clean Leica-style vector SVG icons
* fix(types): extend IconProps with SVGProps to allow style prop on Leica SVG icons
* feat(admin): add subpage live-preview, privacy analytics, and asset protection settings
* fix(typecheck): fix AlbumEntry property access in subpage drawer preview mode
* fix(types): fix ImmichAlbumInfo property names thumbnailAssetId and albumName in PageBuilder.tsx
* fix(types): add protection and watermark optional properties to AppConfig interface
* feat(settings): add toggle for disabling analytics tracking (defaults to enabled)
* feat(ux): show status banner when analytics tracking is disabled + add live sync indicator
* feat(watermark): render customizable watermark overlay on Lightbox images + rename section to Portfolio Features & Modules
* fix(types): import type LightboxWatermark in PhotoGrid.tsx
* fix(types): destructure watermark prop in PhotoGrid function signature
* feat(seo): add configurable subpage title template and metadata descriptions
* feat(seo): add generateMetadata to about page for title template support
* feat(proofing): add client proofing, favorites selection, compact URL bitmasking, and export modal
* feat(essay): add Photo Essay storytelling mode with RSC markdown parser and fullbleed/pair layouts
* feat(subpages): add page enabled toggle to deactivate subpages without deleting them
* feat(admin): add visual essay block builder for photo essay storytelling pages
* security: add Trivy container scan to Docker publish workflow
Scans the built image for CRITICAL/HIGH CVEs on every release and
uploads results to the GitHub Security tab. Non-blocking for now
(exit-code 0) so releases aren't gated on findings. Also documents
the scan and existing Dependabot coverage in the README.
---------
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-08-07 11:08:04 +02:00
|
|
|
|
className="admin-btn-icon"
|
|
|
|
|
|
onClick={() => setExpandedSubpage(null)}
|
|
|
|
|
|
title="Close drawer"
|
2026-05-29 17:29:26 +02:00
|
|
|
|
>
|
release: v0.11.0 — journal fixes, admin URLs, design system cleanup (#432)
* fix(screenshots): sharp-Typen fuer 0.34 und 0.35 gleichzeitig (#410)
sharp 0.35 ist von `export =` auf ESM umgestellt: der Modul-Namespace
ist nicht mehr aufrufbar, die Factory sitzt unter .default. Der
Type-Check brach damit in scripts/screenshots.ts weg, sobald der
Next-Bump (#402) sharp von 0.34.5 auf 0.35.3 mitzieht -- sharp ist hier
keine deklarierte Dependency, sondern kommt ueber Next mit.
Die Form wird jetzt aus dem installierten Paket abgeleitet statt
festgeschrieben, zur Laufzeit wie im Typ. Geprueft mit beiden
Versionen: tsc laeuft mit 0.34.5 und mit 0.35.3 fehlerfrei durch.
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
* chore(deps): bump the nextjs group across 1 directory with 2 updates (#402)
Bumps the nextjs group with 2 updates in the / directory: [next](https://github.com/vercel/next.js) and [eslint-config-next](https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next).
Updates `next` from 16.2.12 to 16.3.0
- [Release notes](https://github.com/vercel/next.js/releases)
- [Commits](https://github.com/vercel/next.js/compare/v16.2.12...v16.3.0)
Updates `eslint-config-next` from 16.2.12 to 16.3.0
- [Release notes](https://github.com/vercel/next.js/releases)
- [Commits](https://github.com/vercel/next.js/commits/v16.3.0/packages/eslint-config-next)
---
updated-dependencies:
- dependency-name: eslint-config-next
dependency-version: 16.3.0
dependency-type: direct:development
update-type: version-update:semver-minor
dependency-group: nextjs
- dependency-name: next
dependency-version: 16.3.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: nextjs
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* chore(deps-dev): bump prettier from 3.8.3 to 3.9.6 (#405)
Bumps [prettier](https://github.com/prettier/prettier) from 3.8.3 to 3.9.6.
- [Release notes](https://github.com/prettier/prettier/releases)
- [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md)
- [Commits](https://github.com/prettier/prettier/compare/3.8.3...3.9.6)
---
updated-dependencies:
- dependency-name: prettier
dependency-version: 3.9.6
dependency-type: direct:development
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* docs(changelog): Unreleased-Sektion fuer die Bumps nach v0.10.0 (#413)
Die Dependency-PRs sind nach dem Release auf dev gelandet, teils auch
auf main. Ohne Eintrag waeren sie beim naechsten Release unsichtbar --
inklusive Next 16.3.0, das CVE-2025-13465 mitbringt.
Ausserdem im 0.10.0-Abschnitt nachgetragen, dass der Trivy-Scan bis
#409 nie gelaufen ist. Der Fix steckt im Tag v0.10.0, fehlte aber in der
Aufzaehlung -- und "Images werden bei jedem Publish gescannt" stand im
Changelog, waehrend der Job im Action-Setup abbrach.
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
* feat(gallery): per-album sort order, independent of Immich (#408) (#414)
Album order was dictated entirely by Immich: getAlbum() sorted by the
album's own asc/desc flag, so a Folio album always mirrored the archive.
A curated series has a narrative order that has nothing to do with
capture time, and changing the Immich album's sort to fit the website
changes it for the archive too.
Adds an optional per-album `sort` in gallery.yaml, editable in /admin,
defaulting to today's behaviour so every existing config is unchanged:
immich (default) | newest | oldest | filename | manual
`manual` is a pinned *prefix*: `assetOrder` lists only the photos placed
by hand, everything else follows in the album's Immich order. A full
permutation of a 2,000-photo album would be ~80 KB of UUIDs in a file
that is rewritten and copied to content/.backups/ on every admin save.
It also makes drift fall out for free — photos removed in Immich never
match, new ones land in the tail rather than being hidden.
Sorting is applied after the cache read, not before the cache write, so
the LRU keeps one canonical Immich-ordered copy per album. That avoids
putting the mode in the cache key, lets a config change take effect
without depending on invalidation, and keeps the stale-serving path
correct. cache.get() returns the stored object by reference, so
withSort() returns a shallow clone with a new array — sorting in place
would reorder the shared entry, and under request coalescing every
concurrent caller would be sorting the same array.
Also fixes a prerequisite bug: /api/admin/albums/[albumId]/assets read
album.assets from GET /albums/:id, which Immich 3.x no longer populates
(lib/immich.ts:507). The hero picker's "This Album" tab returned nothing
and threw outright when the key was absent. It now goes through the
client's paginated metadata search, with ?types=all to opt videos in for
the reorder editor.
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
* refactor(admin): drop decorative emoji from the sort select labels (#415)
An <option> cannot contain markup, so the SVG set in Icons is not
reachable there — but a decorative emoji is not a substitute for it.
Plain text instead; the album card badge already uses a real icon.
The remaining emoji in the admin panel (asset picker tabs, section
headings, layout picker options) predate this branch and are left for a
separate cleanup.
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
* refactor(admin): replace emoji icons with the shared SVG icon set (#416)
The admin panel mixed two icon conventions: inline SVGs from
`Icons.tsx` in most components, and decorative emoji in the asset
picker and a few PageBuilder labels. Emoji render inconsistently
across platforms, ignore the accent colour, and cannot inherit the
`.svg-icon` sizing rules.
- Icons.tsx: add `IconStar` (filled — it marks a state, not an
action) and `IconImage`.
- AssetPicker: the three tab labels and the favourite tile badge now
use IconFolder / IconStar / IconImage.
- PageBuilder: the "Standalone Albums" and "Subpages" headings use
the icon set instead of an emoji.
- PageBuilder: the layout picker drops its emoji for plain text. An
<option> cannot contain markup, so an SVG is impossible there and a
decorative glyph is not a substitute.
- admin.css: align icon and label in the picker tabs, and swap the
favourite badge's text-shadow for drop-shadow, which is what
applies to an inline SVG.
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
* refactor(admin): fold PageBuilder's local icons into the shared Icons module (#418)
* refactor(admin): fold PageBuilder's local icons into the shared module
PageBuilder.tsx carried its own `Icons` object duplicating most of the
glyphs already exported by Icons.tsx, with hardcoded sizes and slightly
divergent paths. Migrate all 32 call sites to the shared module and
delete the local object.
Five glyphs had no counterpart and are added to Icons.tsx as 1:1 ports
of the local paths: IconX, IconPlus, IconHome, IconCopy, IconImage.
The local ExternalLink and Check are dropped rather than ported — both
had zero call sites.
Two glyphs change shape slightly, which is the point of consolidating:
the shared IconCamera includes the viewfinder bump the local copy
omitted, and drag handles now use IconGripVertical.
IconGripVertical uses the module's square 24x24 viewBox, so `.svg-drag`
goes from 12x18 to 18x18 — the old non-square box would letterbox the
glyph down to 12x12 and shrink the handle.
* fix(admin): resolve icon-module integration after #416
Merging dev brought in #416, which added a second IconImage to Icons.tsx
and two <Icons.Camera>/<Icons.Folder> section headers that reference the
local Icons object this PR removes. Git merged both cleanly but the result
did not type-check.
- drop the duplicate IconImage (both copies were byte-identical)
- point the two section headers at the imported IconCamera/IconFolder
- refresh the SORT_LABELS comment: the icon set is imported now, not
declared below
---------
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
* fix(config): allow an empty gallery, guard against a double /api suffix (#421)
An empty gallery is now a valid, rendered state instead of a throw: deriveGallery() no longer requires at least one album or subpage, so a deployment with no albums yet renders a bare homepage the owner can fill in via /admin.
getConfig() also stops appending /api to an Immich URL that already ends in it, which previously produced .../api/api and broke every upstream request.
Includes a restore of the per-album sort test cases, which the branch had lost by being cut before #408/#414.
* feat(admin): favicon upload, served from the content volume (#422)
Adds a bundled default favicon, an upload widget in admin Settings > General, and a route that serves the icon from the writable content/ volume with a fallback to the bundled default. Raster uploads (PNG/ICO/JPEG) are wrapped in an SVG container; the response carries its own CSP so an uploaded SVG cannot execute script on the origin.
The GET route revalidates with an ETag instead of caching immutably, so a newly uploaded icon shows up immediately. Uploads are written via temp file + rename, and a Reset button restores the bundled default.
* ci: flag unformatted files in a PR, without blocking it (#424)
Prettier is configured as an error rule in eslint.config.mjs but has never run in CI, so part of the tree predates it. A final CI step now diffs against the PR base, runs prettier --list-different over the changed files, and emits a warning annotation per offender plus a job summary.
Advisory by design: it never fails the job. Blocking would turn a PR red for merely touching a file that was already unformatted, and normalising the tree in one commit would wreck git blame and conflict with the PRs in flight.
Requires fetch-depth: 0, since diffing against the base needs its history.
* feat(install): first-run wizard gated by a one-time setup token (#419)
Adds /install, a four-step first-run wizard: connect to Immich, optionally pick albums, name the site, finish. It verifies the credentials against the Immich server before writing anything, then writes gallery.yaml, settings.yaml and a content/install.json carrying the Immich credentials and a generated site secret.
install.json exists because a running process cannot pick up new env vars — the wizard has to write configuration that takes effect without a restart. getInstallCredentials() merges it under the real environment, so env vars always win and rotation stays a matter of setting one.
Both the page and the API routes are gated by a one-time setup token printed to the server log, so a deployment that is reachable before gallery.yaml exists cannot be configured by whoever finds it first. The token is stored in content/.setup-token (0600) rather than a module variable: Next.js bundles the page and each route handler separately, so a module-level token left the page and the API disagreeing inside one process and the wizard stuck on step 1. It is removed once the install completes.
The admin password is stored as an scrypt hash using the scheme lib/auth.ts already applies to album passwords; a plaintext ADMIN_PASSWORD env var keeps working.
* docs: document the setup wizard, fix the read-only content mount (#425)
Quick Start now leads with the /install wizard, with the hand-written YAML route kept alongside it, and a First-Run Setup section covers the setup token, the files the wizard writes, and env-var precedence.
Two corrections: both Docker examples mounted content/ as :ro, which silently breaks the wizard, the admin panel and the backup rotation alike — docs/admin-panel.md already said so and the README contradicted it. And nothing documented that content/install.json holds the Immich API key, so a backup of content/ is a backup of credentials.
Also adds a Contributors section crediting the people whose work is in the project.
* feat(admin): floating save bar pinned to the bottom of the viewport (#426)
The save bar was the first, static element inside .admin-main. Since the
document itself scrolls, it left the viewport as soon as you scrolled down
— editing a subpage section or a settings block far below gave no visible
dirty hint and no reachable save button.
Replace it with a bottom-pinned floating bar shared by both editors. It
only mounts while there is something to act on (unsaved changes, an
in-flight save, or a result message), so it never covers content while
idle. The success message clears after 5s, which hides the bar again.
- new SaveBar component, replacing the duplicated markup in PageBuilder
and SettingsEditor
- adopt the previously unused .floating-save-bar CSS: slide-in keyframes
(carrying translateX(-50%)), dirty border, wrap/gap, mobile variant and
a prefers-reduced-motion opt-out; z-index 900 keeps it below modals
- .admin-main gains bottom padding so the bar never covers page content
- drop the now-unreachable idle hints: the ⌘S hint becomes a button title,
the Live Sync note becomes a static line above the settings layout
- header "Site" link now bypasses the cache (/?fresh=1), so the preview
stays reachable when the bar is hidden
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
* feat(admin): themed listbox for the album sort control (#427)
The per-album "Photo order" control was a native <select>. Because an
<option> cannot contain markup, its choices could not use the admin
panel's currentColor SVG set — the reason #415 had to fall back to plain
text after dropping the emoji labels.
Adds a Listbox component implementing the ARIA combobox/listbox pattern,
so options can render a glyph beside their label:
- DOM focus stays on the trigger button; the active option is announced
through aria-activedescendant, keeping focus management to one element
- Keyboard: arrows (clamped at the ends, like a native select),
Home/End, Enter/Space to commit, Escape to cancel, Tab commits and
moves on, and prefix type-ahead with a repeat-key cycle
- Outside dismissal on pointerdown, so a press starting outside closes
the popup before the click retargets
The sort options now carry an icon each: calendar, arrow-down, arrow-up,
an A→Z marker, and the drag glyph for manual — matching the badge the
album card already shows. SORT_LABELS stays plain text because the badge
feeds it to a title attribute.
Closes #417
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
* chore(git): ignore generated design handoff folders
* fix(admin): stop the album sort dropdown clipping, and simplify the panel (#428)
* fix(admin): render listbox popup in a portal so it escapes modal clipping
The sort control's popup was position:absolute inside three clipping ancestors
(.album-drawer overflow:hidden > .album-drawer-body overflow-y:auto >
.modal-right-column overflow-y:auto), so it was cut off at the bottom of the
Edit Album Details modal. z-index could not help: clipping happens before
stacking. It also always hung below the trigger, with no flip.
Portal the popup to document.body and position it from the trigger's viewport
rect, flipping above when there is more room there and capping max-height to the
space available so it scrolls internally rather than overflowing. It is
dismissed on scroll and resize, since the anchor is only measured on open.
The outside-pointerdown handler now also treats the popup as inside; without
that the portalled list counts as outside, and a click on an option would close
it before the selection commits.
* refactor(admin): single-column album details panel
The left column spent 1.2fr on a cover thumbnail and three stat rows, two of
which (Status, Custom Hero) only restated the form fields opposite them, while
the form itself was squeezed into 1.8fr behind a second nested scroller.
Stack the drawer in one column instead: cover as a banner, then the form at full
width, with the UUID moved into the footer. The body is now the only scroll
container, which also removes one of the ancestors that was clipping the sort
popup.
---------
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
* fix(admin): give the portalled listbox its theme back, lock the page behind modals (#429)
Two defects in the album editor.
The sort listbox popup painted transparent. Every --admin-* variable is
scoped to .admin-layout, and since the popup moved into document.body it
sits outside that subtree, so background/border/text all resolved to
nothing. It now carries its own copy of the palette in both colour
schemes, plus the font it no longer inherits.
Scrolling inside a modal also moved the page behind it. No admin modal
ever locked body scroll: the overlay covers the page but does not absorb
wheel events, so a scroll starting on the backdrop — or continuing past
the end of the modal's own scroller — reaches the document.
overscroll-behavior cannot cover that case on its own, because it only
applies to scroll containers and the backdrop is not one.
useScrollLock freezes body while a modal is open and compensates for the
width the scrollbar gives up, so nothing shifts underneath. Each lock
restores the inline value it found, which makes nesting work without a
counter — a picker opened from the drawer restores the drawer's hidden
state instead of clearing it. Applied to both drawers and all four
picker modals, which share the defect. overscroll-behavior: contain on
the scrollers stops the chaining they can handle themselves.
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
* fix(security): allow unsafe-eval in CSP script-src during dev mode
* feat(journal): add Journal Studio with split-screen editor, live preview and dedicated routes
* fix(build): separate client parser from server journal-service and fix build type errors
* fix(journal): Fotos rendern, Layout und Lightbox-Steuerung korrigieren
Fünf unabhängige Fehler in der öffentlichen Journal- und Essay-Ansicht:
* Foto-Blöcke wurden nie angezeigt. EssayView löst ein Foto über
PhotoItem.id auf, und das sind verschlüsselte Tokens — die Blöcke aus
dem Markdown tragen aber rohe Asset-UUIDs. Jede Zuordnung lief ins
Leere, und nicht auflösbare Blöcke werden still verworfen. Die IDs
werden jetzt serverseitig übersetzt; damit verschwinden nebenbei die
rohen UUIDs aus dem Client-Payload, die dort laut Projektregel nie
auftauchen dürfen. Nicht auflösbare Referenzen werden geloggt.
* Überschriften standen weiter links als der Fließtext. Jeder Block
hatte einzeln `max-width: 68ch`, und `ch` ist relativ zur Schrift des
Elements — die Serif-Überschrift ergab eine breitere Spalte. Ersetzt
durch eine gemeinsame, font-unabhängige `--essay-measure`.
* Fullbleed-Fotos bluteten nur nach links aus: `.essay-figure` ist
`width: 100%`, wodurch die Box überbestimmt ist und der negative
rechte Margin verworfen wird.
* Foto-Paare stellten beide Bilder gleich breit dar, wodurch ein
Hochformat neben einem Querformat doppelt so hoch wurde. Jetzt eine
Justified-Reihe: Breite proportional zum Seitenverhältnis, dadurch
exakt gleiche Höhen ohne Beschnitt.
* Die Lightbox hatte im Journal keine Tastatursteuerung und keine
Scroll-Sperre — beides lag in PhotoGrid, also nur im Album-Raster.
Verlagert in die Lightbox selbst, der doppelte Handler in PhotoGrid
entfernt (sonst wäre pro Pfeildruck zwei Bilder weitergesprungen).
Zusätzlich sind Proofing-Herzen und das EXIF-Panel im redaktionellen
Modus abschaltbar und im Journal aus: Client-Proofing ist ein
Übergabe-Workflow für Alben, keine Funktion einer Reportage. Auf der
Übersicht wurde der Untertitel doppelt gerendert, weil extractExcerpt()
auf ihn zurückfällt.
* feat(admin): eigene URLs für alle Bereiche und überarbeiteter Journal Studio
Das Panel war eine einzige Client-Komponente, die ihre Tabs über
useState umschaltet: keine Route pro Bereich, kein Deep-Link, kein
Zurück-Button, und nach jedem Reload landete man wieder auf "Pages".
Auch der Journal-Editor hatte keine eigene URL.
Jetzt sieben echte Routen (/admin, /admin/pages, /admin/journal,
/admin/journal/<slug>, /admin/settings, /admin/settings/<section>,
/admin/analytics). Die Shell mit Auth-Prüfung und Kopfzeile sitzt im
Layout und umschließt children — so bleibt die Session-Prüfung über
Routenwechsel montiert, statt bei jedem Tab-Wechsel neu zu laufen und
den Spinner aufblitzen zu lassen. Unbekannte Settings-Sections fallen
auf General zurück.
Im selben Zug der Journal Studio, der die Routing-Änderung ohnehin
berührt:
* Alle Eingabefelder nutzten die Klasse `admin-input`, die in keinem
CSS definiert war — sie fielen auf Browser-Defaults zurück. Jetzt
gestylt, gescoped, damit der generische Name nicht ins übrige Panel
leckt.
* Der Split View ist per Divider verschiebbar (Maus, Tastatur,
Doppelklick zum Zurücksetzen), Breite in localStorage.
* Das Studio bricht aus der 1120px-Spalte aus, die Preview hat Platz.
* Die Preview zeigte für jedes Foto fest 3:2 und log damit über das
Layout der veröffentlichten Seite; die echten Verhältnisse werden
jetzt an den Thumbnails gemessen.
* Blöcke mit alten positionsbasierten Foto-Referenzen werden markiert —
die lassen sich auf einer eigenständigen Journal-Seite nicht auflösen
und verschwanden bisher stillschweigend.
* Blocktyp-Chips als gemeinsame Komponente, monochrom und per Icon
unterschieden statt in einer eigenen Blau/Lila/Orange-Palette, die
sonst nirgends im Panel vorkommt.
* Emojis raus, SVG-Icons rein.
* fix(admin): Designsystem-Lücken im Panel schließen
Eine systematische Suche nach Klassen, die im TSX benutzt, aber in
keinem CSS definiert sind, hat vier Stellen mit demselben Muster
gefunden:
* `admin-btn-secondary` und `admin-btn-danger` existierten nicht.
Sämtliche Löschen-Buttons sahen aus wie normale Buttons — keine
Warnwirkung. Als `.admin-btn.admin-btn-danger` geschrieben, weil die
Varianten mit den Größenklassen kombiniert werden, die weiter unten
ihren eigenen Hintergrund setzen.
* `page-progress-fill` fehlte: die Balken im Analytics-Panel waren
leere Rinnen, der Wert unsichtbar. Ebenso `analytics-empty` und
`admin-loading-container`.
* `subpage-drawer-section`, `subpage-drawer-title-group` und
`input-with-icon` im PageBuilder waren wirkungslos und teils mit
Inline-Styles notdürftig kompensiert.
* `grid-card-preview` fehlte, wodurch alle Layout-Vorschauen auf Höhe
null kollabierten. Nur "Showcase" war sichtbar — und das aus Versehen,
weil sein Tile `hero-tile` hieß und damit die `aspect-ratio` einer
fremden PageBuilder-Klasse erbte. Umbenannt.
Dazu die Theme-Vorschauen, die praktisch identisch aussahen: alle
sieben zeigten dieselben drei quadratischen Kacheln, einziger
Unterschied war die Hintergrundfarbe. Sie spiegeln jetzt die echten
Preset-Daten aus lib/config/theme.ts — Schriftcharakter, Eckradius,
Rasterdichte, Passepartout bzw. Schatten.
Die Kopfzeile richtet sich an einer gemeinsamen Steuerhöhe aus. Der
"Site"-Link war höher als die Buttons daneben: `.admin-btn` hatte keine
explizite line-height, und <button> bekommt box-sizing: border-box vom
Browser, <a> nicht. Die Statusanzeige setzte weder Schriftfamilie noch
-größe und fiel auf den Browser-Default zurück — sie war nie Teil des
Designsystems. Jetzt gleiche Höhe und Typografie, Pillenform als
Zustandsanzeige, Trenner zur Aktionsgruppe. Das dauerhafte Pulsieren
des grünen Punkts entfällt; Animation bleibt den Zuständen vorbehalten,
die Aufmerksamkeit brauchen.
Restliche Emojis durch SVG-Icons ersetzt.
* feat(admin): add scroll-to-top toggle and SVG arrow
The back-to-top button was always on and drew its arrow with the ↑ text
character. Add a `scrollToTop` setting (General section in the admin
panel, defaults to on so existing sites are unaffected) and replace the
glyph with a stroked SVG that inherits currentColor across all presets.
Scroll handling is now rAF-throttled, and prefers-reduced-motion turns
off both the hover lift and the smooth scroll.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
* security(journal): escape author HTML instead of filtering it
CodeQL flags 26 high-severity alerts on the release PR; the bulk of them
point at sanitizeHtml(), a denylist of three regexes whose output goes
into dangerouslySetInnerHTML. I reproduced the bypasses before changing
anything — all four pass the old filter:
<img src=x onerror=alert(1)> unquoted handler, regex wants quotes
<img src=x onerror='alert(1)'> single quotes, same reason
<svg onload=alert(1)> not a <script> tag
javasjavascript:cript:alert(1) one-pass replace, the rest recombines
Plus an attribute breakout in the link renderer, which interpolated the
URL into href="${url}" unescaped:
[x](" onmouseover=alert(1) x=") -> <a href="" onmouseover=alert(1" ...>
Replaced with escaping. Every `&<>"'` in author text becomes an entity
before any markdown rule runs, so the only tags in the output are the
ones renderInlineMarkdown builds itself and a URL cannot leave its
attribute. Link schemes are now an allowlist (http, https, mailto, tel,
relative, anchor); anything else renders as plain text.
The serializer needed decodeHtmlEntities to match: without it a save
would write `<` into the Markdown file and the next parse would
escape the `&` again, corrupting the text further on every round trip.
A test covers parse -> serialize -> parse stability.
Two existing tests asserted the old behaviour and were rewritten rather
than deleted: one expected the script tag to be *removed* from the
output, the other expected the substring "onerror" to be absent. Both
now assert the property that matters — that no tag can form — because
`onerror` surviving as inert text is fine.
Exploitation required admin access either way: journal and essay text
comes from the studio or from content/*.md. This removes the weakness,
it does not close an open door.
* fix(journal): contain file paths, fix frontmatter escaping, defuse two regexes
Follow-up to the CodeQL findings on release PR #432. I went through all 23
alerts individually; this addresses the ones that are worth addressing and
documents the ones that are not.
Path containment (12 alerts, all false positives). Every path built from a
slug goes through isValidSlug(), a strict `/^[a-zA-Z0-9_-]+$/` allowlist —
verified against `../../etc/passwd`, `foo/../../bar`, `a/b`, `..` and
friends, all rejected. CodeQL cannot see it because the check lives in
another module. Added a containedPath() helper that resolves the path and
refuses anything landing outside the content directory: a second lock on a
door that was already locked, and a barrier the analysis can follow. Also
removed the dead `slug.endsWith('.md')` branches — isValidSlug rejects
dots, so they could never be taken.
Frontmatter escaping (1 alert, a real bug). The serializer escaped `"` but
not `\`, and the parser never unescaped anything. A title containing either
character gained a backslash on every save/load cycle:
Path C:\Users "quoted" -> Path C:\\Users \"quoted\" -> ...
Escaping now covers the backslash first and the parser undoes both. A round
trip test covers quotes, backslashes, colons and apostrophes.
Two of three ReDoS regexes (2 alerts). The heading pattern had `\s+` next to
`(.+)`, which overlap, so the engine tried every split of the whitespace run
before failing; it is `[ \t]+` and `(\S.*)` now. The quote author pattern
wrapped a lazy group around an optional group — the quadratic case — and is
an index split on the first separator now.
The third regex, the bold/italic pass, is deliberately left alone. Rewriting
it with a negated class removes the backtracking but breaks nesting:
`**bold *and italic* here**` renders as `*<em>bold </em>and italic<em> here</em>*`.
The input is Markdown from an authenticated admin, never a visitor, so the
worst case is an author slowing down their own page. The comment in the code
says so.
Not addressed: 5 js/insufficient-password-hash alerts. They ask for a slow
KDF where the code uses SHA-256/HMAC — correct in general, but the admin
password comes from an environment variable and is never stored, so a
stronger KDF protects nothing that is not already in plaintext in the
environment.
399 unit tests pass (18 new), build and tsc clean.
* fix(journal): split the quote author by scanning, not by pattern
Cleaning up after myself. #439 replaced the quote author regex
`/^(.*?)(?:\s+--\s+(.+))?$/` — a lazy group around an optional one, the
quadratic case — with `/\s+--\s+/`, and CodeQL promptly flagged the
replacement for the same reason. One reported pattern traded for another.
splitQuoteAuthor() scans for the first `--` that has whitespace on both
sides. Linear, and it needs no reasoning about the regex engine at all.
Behaviour is identical to the original regex, checked case by case
against it: separator, no separator, several separators, tabs, wide gaps,
`a--b` without spaces, leading and trailing separators, empty string. All
nine are covered by tests, plus one asserting it stays fast on a 50k
whitespace run.
* security(admin): derive the session signing key with scrypt
getSigningKey() ran the admin password through a single SHA-256 digest.
It is key derivation rather than password storage, so it was never a
stored-hash problem — but if the derived key ever leaked, one fast hash
makes recovering the password by brute force cheap. CodeQL flags it as
js/insufficient-password-hash and, for this particular alert, has a
point.
scrypt now. Two details that matter:
The salt has to be stable. A random salt would produce a different key on
every call and invalidate every session; it is derived from AUTH_SECRET,
which is deployment-specific. Verified across separate processes: same
inputs produce a verifying token, so a restart or redeploy does not log
everyone out.
The result is cached for the process lifetime. scrypt is deliberately
slow and getSigningKey() runs on every admin request — deriving per call
would add ~24ms to each one. The cache key is a digest of secret plus
password, so a rotation misses the cache and derives again, and no extra
plaintext copy of the password is kept around.
Measured: first derivation 24ms, subsequent calls 0.12ms. Password
change and secret change both invalidate an existing token, checked in
separate processes.
Note the one-time effect: existing admin sessions are invalidated by the
change in derivation, so everyone logs in once more.
* security(admin): key the signing-key cache on its inputs, not a digest
#441 removed the SHA-256 digest of the admin password from the key
derivation and introduced a new one three lines above it, as the cache
key. Same rule, same file: CodeQL reported it immediately.
The comment justifying it was wrong too. It claimed no second plaintext
copy of the password was retained, while building the digest input
allocates exactly that in order to hash it.
The cache now holds the two input strings and compares them directly.
They are the same objects the env and install caches already hold, so
nothing extra is retained, and no fast hash of the password exists in
memory for the life of the process.
Re-verified after the change, in separate processes: a token from one
process verifies in another with the same inputs, a changed password or
secret rejects it, first derivation 24ms, cached calls 0.001ms.
That leaves scrypt as the only place the password is hashed here. The
two HMACs further down operate on the derived key and on token data, not
on the password; the constant-time comparison in verifyAdminPassword is
the previously dismissed one.
---------
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
2026-08-14 16:55:07 +02:00
|
|
|
|
<IconX size={14} />
|
2026-05-29 17:29:26 +02:00
|
|
|
|
</button>
|
|
|
|
|
|
</div>
|
|
|
|
|
|
</div>
|
security: add Trivy container scan to Docker publish workflow (#399)
* feat(admin): add backup manager UI with 1-click restore
* feat(admin): collapse older backup entries by default
* fix(theme): isolate admin layout, instant DOM theme updates, and add Light/Dark mode toggle
* feat(admin): replace text controls for Photo Frame and Hero Style with visual preview cards
* fix(admin): define missing CSS rules for button system (.btn, .preset-btn)
* feat(admin): redesign theme settings with segmented mode toggle, accent color swatches, and custom iOS-style toggle cards
* feat(admin): upgrade all settings tabs with visual grid previews, Google SEO snippet preview, and toggle cards
* feat(admin): overhaul Pages Builder UX with slide-over drawer, card hover badges, real-time search, and floating save bar
* fix(admin): remove leftover dangling syntax snippet in PageBuilder.tsx
* fix(admin): add position: relative to subpage-tile so hover overlay is contained inside the tile
* style(admin): replace all emojis with clean Leica-style vector SVG icons
* fix(types): extend IconProps with SVGProps to allow style prop on Leica SVG icons
* feat(admin): add subpage live-preview, privacy analytics, and asset protection settings
* fix(typecheck): fix AlbumEntry property access in subpage drawer preview mode
* fix(types): fix ImmichAlbumInfo property names thumbnailAssetId and albumName in PageBuilder.tsx
* fix(types): add protection and watermark optional properties to AppConfig interface
* feat(settings): add toggle for disabling analytics tracking (defaults to enabled)
* feat(ux): show status banner when analytics tracking is disabled + add live sync indicator
* feat(watermark): render customizable watermark overlay on Lightbox images + rename section to Portfolio Features & Modules
* fix(types): import type LightboxWatermark in PhotoGrid.tsx
* fix(types): destructure watermark prop in PhotoGrid function signature
* feat(seo): add configurable subpage title template and metadata descriptions
* feat(seo): add generateMetadata to about page for title template support
* feat(proofing): add client proofing, favorites selection, compact URL bitmasking, and export modal
* feat(essay): add Photo Essay storytelling mode with RSC markdown parser and fullbleed/pair layouts
* feat(subpages): add page enabled toggle to deactivate subpages without deleting them
* feat(admin): add visual essay block builder for photo essay storytelling pages
* security: add Trivy container scan to Docker publish workflow
Scans the built image for CRITICAL/HIGH CVEs on every release and
uploads results to the GitHub Security tab. Non-blocking for now
(exit-code 0) so releases aren't gated on findings. Also documents
the scan and existing Dependabot coverage in the README.
---------
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-08-07 11:08:04 +02:00
|
|
|
|
|
|
|
|
|
|
<div className="subpage-drawer-body">
|
|
|
|
|
|
{drawerMode === 'preview' ? (
|
|
|
|
|
|
<div className="drawer-live-preview-panel">
|
|
|
|
|
|
<div className="preview-hero-banner">
|
release: v0.11.0 (#459)
Ships `dev` as **v0.11.0**. `main` contains nothing that `dev` does not,
so this is a clean sync.
## Headline changes since v0.10.0
- **Journal & Journal Studio** — photo essays at `/journal`,
split-screen block editor with live preview, drafts, per-entry
passwords, cover images
- **First-run setup wizard at `/install`** — configure a fresh
deployment from the browser; credentials are verified against Immich
before anything is written, and the wizard is gated by a one-time token
- **About page editor and toggle** in the admin panel
- **Per-album photo order** independent of Immich, with a drag & drop
editor
- **Custom favicon upload**
- **Experimental portfolio features** — justified grid, `cover` hero,
unlisted subpages, per-album grid overrides, cover focal points,
external nav links
- **Security** — asset tokens length-capped before decoding (#423),
journal author markdown escaped rather than filtered, journal file paths
contained, admin session key derived with scrypt (#432), Next.js 16.3.0
for CVE-2025-13465
- **Fixed** — client proofing honours its own configuration again
(#454); journal photo rendering (#432)
Full detail in [CHANGELOG.md](CHANGELOG.md#0110--2026-08-15).
## Verified
`npx tsc --noEmit` clean · `npx vitest run` 435 tests pass · `npm run
build` succeeds · lint 0 errors · `prettier --check` clean · local
`docker build` of the release tree.
## After merge
Tag `v0.11.0` on `main` and publish the release — that triggers
`docker-publish.yml`, which pushes the image and moves `latest`.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
---------
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
2026-08-15 09:09:18 +02:00
|
|
|
|
<h2 className="preview-hero-title">
|
|
|
|
|
|
{sp.title || sp.name || 'Untitled Page'}
|
|
|
|
|
|
</h2>
|
security: add Trivy container scan to Docker publish workflow (#399)
* feat(admin): add backup manager UI with 1-click restore
* feat(admin): collapse older backup entries by default
* fix(theme): isolate admin layout, instant DOM theme updates, and add Light/Dark mode toggle
* feat(admin): replace text controls for Photo Frame and Hero Style with visual preview cards
* fix(admin): define missing CSS rules for button system (.btn, .preset-btn)
* feat(admin): redesign theme settings with segmented mode toggle, accent color swatches, and custom iOS-style toggle cards
* feat(admin): upgrade all settings tabs with visual grid previews, Google SEO snippet preview, and toggle cards
* feat(admin): overhaul Pages Builder UX with slide-over drawer, card hover badges, real-time search, and floating save bar
* fix(admin): remove leftover dangling syntax snippet in PageBuilder.tsx
* fix(admin): add position: relative to subpage-tile so hover overlay is contained inside the tile
* style(admin): replace all emojis with clean Leica-style vector SVG icons
* fix(types): extend IconProps with SVGProps to allow style prop on Leica SVG icons
* feat(admin): add subpage live-preview, privacy analytics, and asset protection settings
* fix(typecheck): fix AlbumEntry property access in subpage drawer preview mode
* fix(types): fix ImmichAlbumInfo property names thumbnailAssetId and albumName in PageBuilder.tsx
* fix(types): add protection and watermark optional properties to AppConfig interface
* feat(settings): add toggle for disabling analytics tracking (defaults to enabled)
* feat(ux): show status banner when analytics tracking is disabled + add live sync indicator
* feat(watermark): render customizable watermark overlay on Lightbox images + rename section to Portfolio Features & Modules
* fix(types): import type LightboxWatermark in PhotoGrid.tsx
* fix(types): destructure watermark prop in PhotoGrid function signature
* feat(seo): add configurable subpage title template and metadata descriptions
* feat(seo): add generateMetadata to about page for title template support
* feat(proofing): add client proofing, favorites selection, compact URL bitmasking, and export modal
* feat(essay): add Photo Essay storytelling mode with RSC markdown parser and fullbleed/pair layouts
* feat(subpages): add page enabled toggle to deactivate subpages without deleting them
* feat(admin): add visual essay block builder for photo essay storytelling pages
* security: add Trivy container scan to Docker publish workflow
Scans the built image for CRITICAL/HIGH CVEs on every release and
uploads results to the GitHub Security tab. Non-blocking for now
(exit-code 0) so releases aren't gated on findings. Also documents
the scan and existing Dependabot coverage in the README.
---------
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-08-07 11:08:04 +02:00
|
|
|
|
{sp.subtitle && <p className="preview-hero-sub">{sp.subtitle}</p>}
|
|
|
|
|
|
</div>
|
|
|
|
|
|
|
|
|
|
|
|
{sp.sections && sp.sections.length > 0 ? (
|
|
|
|
|
|
sp.sections.map((sec, sIdx) => (
|
|
|
|
|
|
<div key={sIdx} className="preview-section-group">
|
release: v0.11.0 (#459)
Ships `dev` as **v0.11.0**. `main` contains nothing that `dev` does not,
so this is a clean sync.
## Headline changes since v0.10.0
- **Journal & Journal Studio** — photo essays at `/journal`,
split-screen block editor with live preview, drafts, per-entry
passwords, cover images
- **First-run setup wizard at `/install`** — configure a fresh
deployment from the browser; credentials are verified against Immich
before anything is written, and the wizard is gated by a one-time token
- **About page editor and toggle** in the admin panel
- **Per-album photo order** independent of Immich, with a drag & drop
editor
- **Custom favicon upload**
- **Experimental portfolio features** — justified grid, `cover` hero,
unlisted subpages, per-album grid overrides, cover focal points,
external nav links
- **Security** — asset tokens length-capped before decoding (#423),
journal author markdown escaped rather than filtered, journal file paths
contained, admin session key derived with scrypt (#432), Next.js 16.3.0
for CVE-2025-13465
- **Fixed** — client proofing honours its own configuration again
(#454); journal photo rendering (#432)
Full detail in [CHANGELOG.md](CHANGELOG.md#0110--2026-08-15).
## Verified
`npx tsc --noEmit` clean · `npx vitest run` 435 tests pass · `npm run
build` succeeds · lint 0 errors · `prettier --check` clean · local
`docker build` of the release tree.
## After merge
Tag `v0.11.0` on `main` and publish the release — that triggers
`docker-publish.yml`, which pushes the image and moves `latest`.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
---------
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
2026-08-15 09:09:18 +02:00
|
|
|
|
<h3 className="preview-section-title">
|
|
|
|
|
|
{sec.title || 'Untitled Section'}
|
|
|
|
|
|
</h3>
|
|
|
|
|
|
{sec.description && (
|
|
|
|
|
|
<p className="preview-section-desc">{sec.description}</p>
|
|
|
|
|
|
)}
|
security: add Trivy container scan to Docker publish workflow (#399)
* feat(admin): add backup manager UI with 1-click restore
* feat(admin): collapse older backup entries by default
* fix(theme): isolate admin layout, instant DOM theme updates, and add Light/Dark mode toggle
* feat(admin): replace text controls for Photo Frame and Hero Style with visual preview cards
* fix(admin): define missing CSS rules for button system (.btn, .preset-btn)
* feat(admin): redesign theme settings with segmented mode toggle, accent color swatches, and custom iOS-style toggle cards
* feat(admin): upgrade all settings tabs with visual grid previews, Google SEO snippet preview, and toggle cards
* feat(admin): overhaul Pages Builder UX with slide-over drawer, card hover badges, real-time search, and floating save bar
* fix(admin): remove leftover dangling syntax snippet in PageBuilder.tsx
* fix(admin): add position: relative to subpage-tile so hover overlay is contained inside the tile
* style(admin): replace all emojis with clean Leica-style vector SVG icons
* fix(types): extend IconProps with SVGProps to allow style prop on Leica SVG icons
* feat(admin): add subpage live-preview, privacy analytics, and asset protection settings
* fix(typecheck): fix AlbumEntry property access in subpage drawer preview mode
* fix(types): fix ImmichAlbumInfo property names thumbnailAssetId and albumName in PageBuilder.tsx
* fix(types): add protection and watermark optional properties to AppConfig interface
* feat(settings): add toggle for disabling analytics tracking (defaults to enabled)
* feat(ux): show status banner when analytics tracking is disabled + add live sync indicator
* feat(watermark): render customizable watermark overlay on Lightbox images + rename section to Portfolio Features & Modules
* fix(types): import type LightboxWatermark in PhotoGrid.tsx
* fix(types): destructure watermark prop in PhotoGrid function signature
* feat(seo): add configurable subpage title template and metadata descriptions
* feat(seo): add generateMetadata to about page for title template support
* feat(proofing): add client proofing, favorites selection, compact URL bitmasking, and export modal
* feat(essay): add Photo Essay storytelling mode with RSC markdown parser and fullbleed/pair layouts
* feat(subpages): add page enabled toggle to deactivate subpages without deleting them
* feat(admin): add visual essay block builder for photo essay storytelling pages
* security: add Trivy container scan to Docker publish workflow
Scans the built image for CRITICAL/HIGH CVEs on every release and
uploads results to the GitHub Security tab. Non-blocking for now
(exit-code 0) so releases aren't gated on findings. Also documents
the scan and existing Dependabot coverage in the README.
---------
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-08-07 11:08:04 +02:00
|
|
|
|
<div className="preview-albums-grid">
|
|
|
|
|
|
{sec.albums.map((alb, aIdx) => {
|
|
|
|
|
|
const immichAlb = immichAlbums.find((a) => a.id === alb.id);
|
|
|
|
|
|
const thumb = alb.heroImage || immichAlb?.thumbnailAssetId;
|
|
|
|
|
|
|
|
|
|
|
|
return (
|
|
|
|
|
|
<div key={aIdx} className="preview-album-tile">
|
|
|
|
|
|
<div className="preview-album-cover">
|
|
|
|
|
|
{thumb ? (
|
|
|
|
|
|
<img src={`/api/admin/thumbnail/${thumb}`} alt="" />
|
|
|
|
|
|
) : (
|
release: v0.11.0 (#459)
Ships `dev` as **v0.11.0**. `main` contains nothing that `dev` does not,
so this is a clean sync.
## Headline changes since v0.10.0
- **Journal & Journal Studio** — photo essays at `/journal`,
split-screen block editor with live preview, drafts, per-entry
passwords, cover images
- **First-run setup wizard at `/install`** — configure a fresh
deployment from the browser; credentials are verified against Immich
before anything is written, and the wizard is gated by a one-time token
- **About page editor and toggle** in the admin panel
- **Per-album photo order** independent of Immich, with a drag & drop
editor
- **Custom favicon upload**
- **Experimental portfolio features** — justified grid, `cover` hero,
unlisted subpages, per-album grid overrides, cover focal points,
external nav links
- **Security** — asset tokens length-capped before decoding (#423),
journal author markdown escaped rather than filtered, journal file paths
contained, admin session key derived with scrypt (#432), Next.js 16.3.0
for CVE-2025-13465
- **Fixed** — client proofing honours its own configuration again
(#454); journal photo rendering (#432)
Full detail in [CHANGELOG.md](CHANGELOG.md#0110--2026-08-15).
## Verified
`npx tsc --noEmit` clean · `npx vitest run` 435 tests pass · `npm run
build` succeeds · lint 0 errors · `prettier --check` clean · local
`docker build` of the release tree.
## After merge
Tag `v0.11.0` on `main` and publish the release — that triggers
`docker-publish.yml`, which pushes the image and moves `latest`.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
---------
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
2026-08-15 09:09:18 +02:00
|
|
|
|
<div className="subpage-tile-placeholder">
|
|
|
|
|
|
<IconFolder />
|
|
|
|
|
|
</div>
|
security: add Trivy container scan to Docker publish workflow (#399)
* feat(admin): add backup manager UI with 1-click restore
* feat(admin): collapse older backup entries by default
* fix(theme): isolate admin layout, instant DOM theme updates, and add Light/Dark mode toggle
* feat(admin): replace text controls for Photo Frame and Hero Style with visual preview cards
* fix(admin): define missing CSS rules for button system (.btn, .preset-btn)
* feat(admin): redesign theme settings with segmented mode toggle, accent color swatches, and custom iOS-style toggle cards
* feat(admin): upgrade all settings tabs with visual grid previews, Google SEO snippet preview, and toggle cards
* feat(admin): overhaul Pages Builder UX with slide-over drawer, card hover badges, real-time search, and floating save bar
* fix(admin): remove leftover dangling syntax snippet in PageBuilder.tsx
* fix(admin): add position: relative to subpage-tile so hover overlay is contained inside the tile
* style(admin): replace all emojis with clean Leica-style vector SVG icons
* fix(types): extend IconProps with SVGProps to allow style prop on Leica SVG icons
* feat(admin): add subpage live-preview, privacy analytics, and asset protection settings
* fix(typecheck): fix AlbumEntry property access in subpage drawer preview mode
* fix(types): fix ImmichAlbumInfo property names thumbnailAssetId and albumName in PageBuilder.tsx
* fix(types): add protection and watermark optional properties to AppConfig interface
* feat(settings): add toggle for disabling analytics tracking (defaults to enabled)
* feat(ux): show status banner when analytics tracking is disabled + add live sync indicator
* feat(watermark): render customizable watermark overlay on Lightbox images + rename section to Portfolio Features & Modules
* fix(types): import type LightboxWatermark in PhotoGrid.tsx
* fix(types): destructure watermark prop in PhotoGrid function signature
* feat(seo): add configurable subpage title template and metadata descriptions
* feat(seo): add generateMetadata to about page for title template support
* feat(proofing): add client proofing, favorites selection, compact URL bitmasking, and export modal
* feat(essay): add Photo Essay storytelling mode with RSC markdown parser and fullbleed/pair layouts
* feat(subpages): add page enabled toggle to deactivate subpages without deleting them
* feat(admin): add visual essay block builder for photo essay storytelling pages
* security: add Trivy container scan to Docker publish workflow
Scans the built image for CRITICAL/HIGH CVEs on every release and
uploads results to the GitHub Security tab. Non-blocking for now
(exit-code 0) so releases aren't gated on findings. Also documents
the scan and existing Dependabot coverage in the README.
---------
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-08-07 11:08:04 +02:00
|
|
|
|
)}
|
|
|
|
|
|
</div>
|
|
|
|
|
|
<span className="preview-album-title">
|
|
|
|
|
|
{alb.title || immichAlb?.albumName || alb.id}
|
|
|
|
|
|
</span>
|
|
|
|
|
|
</div>
|
|
|
|
|
|
);
|
|
|
|
|
|
})}
|
|
|
|
|
|
</div>
|
|
|
|
|
|
</div>
|
|
|
|
|
|
))
|
|
|
|
|
|
) : (
|
|
|
|
|
|
<div className="preview-albums-grid">
|
|
|
|
|
|
{sp.albums.map((alb, aIdx) => {
|
|
|
|
|
|
const immichAlb = immichAlbums.find((a) => a.id === alb.id);
|
|
|
|
|
|
const thumb = alb.heroImage || immichAlb?.thumbnailAssetId;
|
|
|
|
|
|
|
|
|
|
|
|
return (
|
|
|
|
|
|
<div key={aIdx} className="preview-album-tile">
|
|
|
|
|
|
<div className="preview-album-cover">
|
|
|
|
|
|
{thumb ? (
|
|
|
|
|
|
<img src={`/api/admin/thumbnail/${thumb}`} alt="" />
|
|
|
|
|
|
) : (
|
release: v0.11.0 (#459)
Ships `dev` as **v0.11.0**. `main` contains nothing that `dev` does not,
so this is a clean sync.
## Headline changes since v0.10.0
- **Journal & Journal Studio** — photo essays at `/journal`,
split-screen block editor with live preview, drafts, per-entry
passwords, cover images
- **First-run setup wizard at `/install`** — configure a fresh
deployment from the browser; credentials are verified against Immich
before anything is written, and the wizard is gated by a one-time token
- **About page editor and toggle** in the admin panel
- **Per-album photo order** independent of Immich, with a drag & drop
editor
- **Custom favicon upload**
- **Experimental portfolio features** — justified grid, `cover` hero,
unlisted subpages, per-album grid overrides, cover focal points,
external nav links
- **Security** — asset tokens length-capped before decoding (#423),
journal author markdown escaped rather than filtered, journal file paths
contained, admin session key derived with scrypt (#432), Next.js 16.3.0
for CVE-2025-13465
- **Fixed** — client proofing honours its own configuration again
(#454); journal photo rendering (#432)
Full detail in [CHANGELOG.md](CHANGELOG.md#0110--2026-08-15).
## Verified
`npx tsc --noEmit` clean · `npx vitest run` 435 tests pass · `npm run
build` succeeds · lint 0 errors · `prettier --check` clean · local
`docker build` of the release tree.
## After merge
Tag `v0.11.0` on `main` and publish the release — that triggers
`docker-publish.yml`, which pushes the image and moves `latest`.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
---------
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
2026-08-15 09:09:18 +02:00
|
|
|
|
<div className="subpage-tile-placeholder">
|
|
|
|
|
|
<IconFolder />
|
|
|
|
|
|
</div>
|
security: add Trivy container scan to Docker publish workflow (#399)
* feat(admin): add backup manager UI with 1-click restore
* feat(admin): collapse older backup entries by default
* fix(theme): isolate admin layout, instant DOM theme updates, and add Light/Dark mode toggle
* feat(admin): replace text controls for Photo Frame and Hero Style with visual preview cards
* fix(admin): define missing CSS rules for button system (.btn, .preset-btn)
* feat(admin): redesign theme settings with segmented mode toggle, accent color swatches, and custom iOS-style toggle cards
* feat(admin): upgrade all settings tabs with visual grid previews, Google SEO snippet preview, and toggle cards
* feat(admin): overhaul Pages Builder UX with slide-over drawer, card hover badges, real-time search, and floating save bar
* fix(admin): remove leftover dangling syntax snippet in PageBuilder.tsx
* fix(admin): add position: relative to subpage-tile so hover overlay is contained inside the tile
* style(admin): replace all emojis with clean Leica-style vector SVG icons
* fix(types): extend IconProps with SVGProps to allow style prop on Leica SVG icons
* feat(admin): add subpage live-preview, privacy analytics, and asset protection settings
* fix(typecheck): fix AlbumEntry property access in subpage drawer preview mode
* fix(types): fix ImmichAlbumInfo property names thumbnailAssetId and albumName in PageBuilder.tsx
* fix(types): add protection and watermark optional properties to AppConfig interface
* feat(settings): add toggle for disabling analytics tracking (defaults to enabled)
* feat(ux): show status banner when analytics tracking is disabled + add live sync indicator
* feat(watermark): render customizable watermark overlay on Lightbox images + rename section to Portfolio Features & Modules
* fix(types): import type LightboxWatermark in PhotoGrid.tsx
* fix(types): destructure watermark prop in PhotoGrid function signature
* feat(seo): add configurable subpage title template and metadata descriptions
* feat(seo): add generateMetadata to about page for title template support
* feat(proofing): add client proofing, favorites selection, compact URL bitmasking, and export modal
* feat(essay): add Photo Essay storytelling mode with RSC markdown parser and fullbleed/pair layouts
* feat(subpages): add page enabled toggle to deactivate subpages without deleting them
* feat(admin): add visual essay block builder for photo essay storytelling pages
* security: add Trivy container scan to Docker publish workflow
Scans the built image for CRITICAL/HIGH CVEs on every release and
uploads results to the GitHub Security tab. Non-blocking for now
(exit-code 0) so releases aren't gated on findings. Also documents
the scan and existing Dependabot coverage in the README.
---------
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-08-07 11:08:04 +02:00
|
|
|
|
)}
|
|
|
|
|
|
</div>
|
|
|
|
|
|
<span className="preview-album-title">
|
|
|
|
|
|
{alb.title || immichAlb?.albumName || alb.id}
|
|
|
|
|
|
</span>
|
|
|
|
|
|
</div>
|
|
|
|
|
|
);
|
|
|
|
|
|
})}
|
|
|
|
|
|
</div>
|
|
|
|
|
|
)}
|
|
|
|
|
|
</div>
|
|
|
|
|
|
) : (
|
experimental: portfolio features (justified layout, unlisted pages, captions, per-album grid, focal point, nav links, cover hero) (#431)
## Was ist das?
Sieben neue Portfolio-Features, alle als **experimental** gekennzeichnet
— in YAML-Kommentaren, Admin-Panel-Labels und Commit-Scopes, damit sie
einzeln nachvollziehbar und revertierbar bleiben.
## Features (je ein Commit)
| Commit | Feature |
| --- | --- |
| `justified rows gallery layout` | Neues Grid-Layout `justified`:
zeilenbasiert, gleiche Höhen, volle Breite — Flexbox ohne JS-Messung,
letzte Zeile bleibt natürlich klein |
| `hide subpages from navigation` | `hidden: true`: Seite aus
Nav/Homepage raus, per Direktlink erreichbar — im Gegensatz zu `enabled:
false` (404) |
| `lightbox captions` | Immich-Asset-Description als Bildunterschrift im
Info-Panel; EXIF-Route liefert bei `exifOnHover: false` jetzt nur noch
die Caption statt 403 |
| `per-album grid overrides` | `grid:` pro Album-Eintrag, Präzedenz
global < Subpage < Album |
| `per-album cover focal point` | `coverPosition:` → `object-position`
auf Cover-Karten, strikt validiert |
| `external links in header navigation` | `navLinks:` in settings.yaml,
nur http(s), sanitisiert |
| `cover splash hero style` | `heroStyle: cover`: Fullscreen-Splash mit
Enter-Link ins Portfolio |
Alle Optionen sind im Admin-Panel editierbar (PageBuilder /
SettingsEditor).
## Tests
- 356 Unit-Tests grün (13 neue: deriveGallery hidden/grid/coverPosition,
sanitizeNavLinks, EXIF-Route-Captions, justified-Layout-Validierung)
- `npx tsc --noEmit`: 0 Fehler
- `npm run build`: sauber
- Justified-Zeilenmathematik und Cover-Splash per Browser-Harness
visuell/numerisch verifiziert (volle Zeilen enden exakt an der
Containerkante, letzte Zeile bleibt natürlich)
---------
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
2026-08-14 17:56:22 +02:00
|
|
|
|
<div className="admin-sheet-columns admin-sheet-columns--settings-aside">
|
release: v0.11.0 (#459)
Ships `dev` as **v0.11.0**. `main` contains nothing that `dev` does not,
so this is a clean sync.
## Headline changes since v0.10.0
- **Journal & Journal Studio** — photo essays at `/journal`,
split-screen block editor with live preview, drafts, per-entry
passwords, cover images
- **First-run setup wizard at `/install`** — configure a fresh
deployment from the browser; credentials are verified against Immich
before anything is written, and the wizard is gated by a one-time token
- **About page editor and toggle** in the admin panel
- **Per-album photo order** independent of Immich, with a drag & drop
editor
- **Custom favicon upload**
- **Experimental portfolio features** — justified grid, `cover` hero,
unlisted subpages, per-album grid overrides, cover focal points,
external nav links
- **Security** — asset tokens length-capped before decoding (#423),
journal author markdown escaped rather than filtered, journal file paths
contained, admin session key derived with scrypt (#432), Next.js 16.3.0
for CVE-2025-13465
- **Fixed** — client proofing honours its own configuration again
(#454); journal photo rendering (#432)
Full detail in [CHANGELOG.md](CHANGELOG.md#0110--2026-08-15).
## Verified
`npx tsc --noEmit` clean · `npx vitest run` 435 tests pass · `npm run
build` succeeds · lint 0 errors · `prettier --check` clean · local
`docker build` of the release tree.
## After merge
Tag `v0.11.0` on `main` and publish the release — that triggers
`docker-publish.yml`, which pushes the image and moves `latest`.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
---------
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
2026-08-15 09:09:18 +02:00
|
|
|
|
<div className="admin-sheet-col">
|
|
|
|
|
|
<div className="subpage-drawer-section">
|
|
|
|
|
|
<div className="admin-field">
|
|
|
|
|
|
<label>Page Name (URL Identifier)</label>
|
|
|
|
|
|
<div className="input-slug-wrapper">
|
|
|
|
|
|
<input
|
|
|
|
|
|
className="subpage-name-input"
|
|
|
|
|
|
value={sp.name}
|
|
|
|
|
|
onChange={(e) =>
|
|
|
|
|
|
updateSubpage(spIndex, { name: e.target.value })
|
|
|
|
|
|
}
|
|
|
|
|
|
placeholder="e.g. dubai, travel, weddings"
|
|
|
|
|
|
/>
|
|
|
|
|
|
<span className="input-slug-preview">/{slugify(sp.name)}</span>
|
|
|
|
|
|
</div>
|
|
|
|
|
|
</div>
|
|
|
|
|
|
</div>
|
security: add Trivy container scan to Docker publish workflow (#399)
* feat(admin): add backup manager UI with 1-click restore
* feat(admin): collapse older backup entries by default
* fix(theme): isolate admin layout, instant DOM theme updates, and add Light/Dark mode toggle
* feat(admin): replace text controls for Photo Frame and Hero Style with visual preview cards
* fix(admin): define missing CSS rules for button system (.btn, .preset-btn)
* feat(admin): redesign theme settings with segmented mode toggle, accent color swatches, and custom iOS-style toggle cards
* feat(admin): upgrade all settings tabs with visual grid previews, Google SEO snippet preview, and toggle cards
* feat(admin): overhaul Pages Builder UX with slide-over drawer, card hover badges, real-time search, and floating save bar
* fix(admin): remove leftover dangling syntax snippet in PageBuilder.tsx
* fix(admin): add position: relative to subpage-tile so hover overlay is contained inside the tile
* style(admin): replace all emojis with clean Leica-style vector SVG icons
* fix(types): extend IconProps with SVGProps to allow style prop on Leica SVG icons
* feat(admin): add subpage live-preview, privacy analytics, and asset protection settings
* fix(typecheck): fix AlbumEntry property access in subpage drawer preview mode
* fix(types): fix ImmichAlbumInfo property names thumbnailAssetId and albumName in PageBuilder.tsx
* fix(types): add protection and watermark optional properties to AppConfig interface
* feat(settings): add toggle for disabling analytics tracking (defaults to enabled)
* feat(ux): show status banner when analytics tracking is disabled + add live sync indicator
* feat(watermark): render customizable watermark overlay on Lightbox images + rename section to Portfolio Features & Modules
* fix(types): import type LightboxWatermark in PhotoGrid.tsx
* fix(types): destructure watermark prop in PhotoGrid function signature
* feat(seo): add configurable subpage title template and metadata descriptions
* feat(seo): add generateMetadata to about page for title template support
* feat(proofing): add client proofing, favorites selection, compact URL bitmasking, and export modal
* feat(essay): add Photo Essay storytelling mode with RSC markdown parser and fullbleed/pair layouts
* feat(subpages): add page enabled toggle to deactivate subpages without deleting them
* feat(admin): add visual essay block builder for photo essay storytelling pages
* security: add Trivy container scan to Docker publish workflow
Scans the built image for CRITICAL/HIGH CVEs on every release and
uploads results to the GitHub Security tab. Non-blocking for now
(exit-code 0) so releases aren't gated on findings. Also documents
the scan and existing Dependabot coverage in the README.
---------
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-08-07 11:08:04 +02:00
|
|
|
|
|
release: v0.11.0 (#459)
Ships `dev` as **v0.11.0**. `main` contains nothing that `dev` does not,
so this is a clean sync.
## Headline changes since v0.10.0
- **Journal & Journal Studio** — photo essays at `/journal`,
split-screen block editor with live preview, drafts, per-entry
passwords, cover images
- **First-run setup wizard at `/install`** — configure a fresh
deployment from the browser; credentials are verified against Immich
before anything is written, and the wizard is gated by a one-time token
- **About page editor and toggle** in the admin panel
- **Per-album photo order** independent of Immich, with a drag & drop
editor
- **Custom favicon upload**
- **Experimental portfolio features** — justified grid, `cover` hero,
unlisted subpages, per-album grid overrides, cover focal points,
external nav links
- **Security** — asset tokens length-capped before decoding (#423),
journal author markdown escaped rather than filtered, journal file paths
contained, admin session key derived with scrypt (#432), Next.js 16.3.0
for CVE-2025-13465
- **Fixed** — client proofing honours its own configuration again
(#454); journal photo rendering (#432)
Full detail in [CHANGELOG.md](CHANGELOG.md#0110--2026-08-15).
## Verified
`npx tsc --noEmit` clean · `npx vitest run` 435 tests pass · `npm run
build` succeeds · lint 0 errors · `prettier --check` clean · local
`docker build` of the release tree.
## After merge
Tag `v0.11.0` on `main` and publish the release — that triggers
`docker-publish.yml`, which pushes the image and moves `latest`.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
---------
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
2026-08-15 09:09:18 +02:00
|
|
|
|
{/* Subpage metadata */}
|
|
|
|
|
|
<div className="subpage-drawer-section">
|
|
|
|
|
|
<div className="admin-field-row">
|
|
|
|
|
|
<div className="admin-field">
|
|
|
|
|
|
<label>Display Title (optional)</label>
|
|
|
|
|
|
<input
|
|
|
|
|
|
value={sp.title || ''}
|
|
|
|
|
|
onChange={(e) =>
|
|
|
|
|
|
updateSubpage(spIndex, { title: e.target.value || undefined })
|
|
|
|
|
|
}
|
|
|
|
|
|
placeholder="Display title (defaults to name)"
|
|
|
|
|
|
/>
|
|
|
|
|
|
</div>
|
|
|
|
|
|
<div className="admin-field">
|
|
|
|
|
|
<label>Subtitle</label>
|
|
|
|
|
|
<input
|
|
|
|
|
|
value={sp.subtitle || ''}
|
|
|
|
|
|
onChange={(e) =>
|
|
|
|
|
|
updateSubpage(spIndex, {
|
|
|
|
|
|
subtitle: e.target.value || undefined,
|
|
|
|
|
|
})
|
|
|
|
|
|
}
|
|
|
|
|
|
placeholder="Subtitle text"
|
|
|
|
|
|
/>
|
|
|
|
|
|
</div>
|
|
|
|
|
|
</div>
|
|
|
|
|
|
<div className="admin-field" style={{ marginTop: '1rem' }}>
|
|
|
|
|
|
<label>Visibility & Access</label>
|
|
|
|
|
|
{/*
|
experimental: portfolio features (justified layout, unlisted pages, captions, per-album grid, focal point, nav links, cover hero) (#431)
## Was ist das?
Sieben neue Portfolio-Features, alle als **experimental** gekennzeichnet
— in YAML-Kommentaren, Admin-Panel-Labels und Commit-Scopes, damit sie
einzeln nachvollziehbar und revertierbar bleiben.
## Features (je ein Commit)
| Commit | Feature |
| --- | --- |
| `justified rows gallery layout` | Neues Grid-Layout `justified`:
zeilenbasiert, gleiche Höhen, volle Breite — Flexbox ohne JS-Messung,
letzte Zeile bleibt natürlich klein |
| `hide subpages from navigation` | `hidden: true`: Seite aus
Nav/Homepage raus, per Direktlink erreichbar — im Gegensatz zu `enabled:
false` (404) |
| `lightbox captions` | Immich-Asset-Description als Bildunterschrift im
Info-Panel; EXIF-Route liefert bei `exifOnHover: false` jetzt nur noch
die Caption statt 403 |
| `per-album grid overrides` | `grid:` pro Album-Eintrag, Präzedenz
global < Subpage < Album |
| `per-album cover focal point` | `coverPosition:` → `object-position`
auf Cover-Karten, strikt validiert |
| `external links in header navigation` | `navLinks:` in settings.yaml,
nur http(s), sanitisiert |
| `cover splash hero style` | `heroStyle: cover`: Fullscreen-Splash mit
Enter-Link ins Portfolio |
Alle Optionen sind im Admin-Panel editierbar (PageBuilder /
SettingsEditor).
## Tests
- 356 Unit-Tests grün (13 neue: deriveGallery hidden/grid/coverPosition,
sanitizeNavLinks, EXIF-Route-Captions, justified-Layout-Validierung)
- `npx tsc --noEmit`: 0 Fehler
- `npm run build`: sauber
- Justified-Zeilenmathematik und Cover-Splash per Browser-Harness
visuell/numerisch verifiziert (volle Zeilen enden exakt an der
Containerkante, letzte Zeile bleibt natürlich)
---------
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
2026-08-14 17:56:22 +02:00
|
|
|
|
One field, three states — enabled/hidden are two YAML flags,
|
|
|
|
|
|
but for the owner it is a single question: how visible is
|
|
|
|
|
|
this page? Splitting it across two toggles produced
|
|
|
|
|
|
contradictory copy ("Disabled (Hidden)" vs "Unlisted").
|
|
|
|
|
|
*/}
|
release: v0.11.0 (#459)
Ships `dev` as **v0.11.0**. `main` contains nothing that `dev` does not,
so this is a clean sync.
## Headline changes since v0.10.0
- **Journal & Journal Studio** — photo essays at `/journal`,
split-screen block editor with live preview, drafts, per-entry
passwords, cover images
- **First-run setup wizard at `/install`** — configure a fresh
deployment from the browser; credentials are verified against Immich
before anything is written, and the wizard is gated by a one-time token
- **About page editor and toggle** in the admin panel
- **Per-album photo order** independent of Immich, with a drag & drop
editor
- **Custom favicon upload**
- **Experimental portfolio features** — justified grid, `cover` hero,
unlisted subpages, per-album grid overrides, cover focal points,
external nav links
- **Security** — asset tokens length-capped before decoding (#423),
journal author markdown escaped rather than filtered, journal file paths
contained, admin session key derived with scrypt (#432), Next.js 16.3.0
for CVE-2025-13465
- **Fixed** — client proofing honours its own configuration again
(#454); journal photo rendering (#432)
Full detail in [CHANGELOG.md](CHANGELOG.md#0110--2026-08-15).
## Verified
`npx tsc --noEmit` clean · `npx vitest run` 435 tests pass · `npm run
build` succeeds · lint 0 errors · `prettier --check` clean · local
`docker build` of the release tree.
## After merge
Tag `v0.11.0` on `main` and publish the release — that triggers
`docker-publish.yml`, which pushes the image and moves `latest`.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
---------
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
2026-08-15 09:09:18 +02:00
|
|
|
|
{(
|
|
|
|
|
|
[
|
|
|
|
|
|
{
|
|
|
|
|
|
key: 'published',
|
|
|
|
|
|
active: sp.enabled !== false && sp.hidden !== true,
|
|
|
|
|
|
icon: <IconGlobe size={15} />,
|
|
|
|
|
|
iconColor: '#4ade80',
|
|
|
|
|
|
title: 'Published',
|
|
|
|
|
|
desc: 'Shown in the header menu and homepage lists, reachable via URL',
|
|
|
|
|
|
patch: { enabled: true, hidden: false },
|
|
|
|
|
|
},
|
|
|
|
|
|
{
|
|
|
|
|
|
key: 'unlisted',
|
|
|
|
|
|
active: sp.enabled !== false && sp.hidden === true,
|
|
|
|
|
|
icon: <IconEyeOff size={15} />,
|
|
|
|
|
|
iconColor: '#fbbf24',
|
|
|
|
|
|
title: 'Unlisted (Experimental)',
|
|
|
|
|
|
desc: 'Not shown in menus or on the homepage, but reachable via direct link',
|
|
|
|
|
|
patch: { enabled: true, hidden: true },
|
|
|
|
|
|
},
|
|
|
|
|
|
{
|
|
|
|
|
|
key: 'disabled',
|
|
|
|
|
|
active: sp.enabled === false,
|
|
|
|
|
|
icon: <IconBan size={15} />,
|
|
|
|
|
|
iconColor: '#f87171',
|
|
|
|
|
|
title: 'Disabled',
|
|
|
|
|
|
desc: 'Completely offline — returns 404 even when accessed directly',
|
|
|
|
|
|
patch: { enabled: false, hidden: false },
|
|
|
|
|
|
},
|
|
|
|
|
|
] as const
|
|
|
|
|
|
).map((opt) => (
|
|
|
|
|
|
<button
|
|
|
|
|
|
key={opt.key}
|
|
|
|
|
|
type="button"
|
|
|
|
|
|
className={`admin-toggle-card ${opt.active ? 'active' : ''}`}
|
|
|
|
|
|
onClick={() => updateSubpage(spIndex, opt.patch)}
|
|
|
|
|
|
aria-pressed={opt.active}
|
|
|
|
|
|
style={{
|
|
|
|
|
|
padding: '10px 14px',
|
|
|
|
|
|
width: '100%',
|
|
|
|
|
|
display: 'flex',
|
|
|
|
|
|
alignItems: 'center',
|
|
|
|
|
|
justifyContent: 'space-between',
|
|
|
|
|
|
borderRadius: '8px',
|
|
|
|
|
|
cursor: 'pointer',
|
|
|
|
|
|
marginBottom: '6px',
|
|
|
|
|
|
}}
|
|
|
|
|
|
>
|
|
|
|
|
|
<div className="toggle-card-info" style={{ textAlign: 'left' }}>
|
|
|
|
|
|
<span
|
|
|
|
|
|
className="toggle-card-title"
|
|
|
|
|
|
style={{
|
|
|
|
|
|
fontWeight: 600,
|
|
|
|
|
|
display: 'inline-flex',
|
|
|
|
|
|
alignItems: 'center',
|
|
|
|
|
|
gap: '8px',
|
|
|
|
|
|
}}
|
|
|
|
|
|
>
|
|
|
|
|
|
<span
|
|
|
|
|
|
style={{ color: opt.iconColor, display: 'inline-flex' }}
|
|
|
|
|
|
aria-hidden="true"
|
|
|
|
|
|
>
|
|
|
|
|
|
{opt.icon}
|
|
|
|
|
|
</span>
|
|
|
|
|
|
{opt.title}
|
|
|
|
|
|
</span>
|
|
|
|
|
|
<span
|
|
|
|
|
|
className="toggle-card-desc"
|
|
|
|
|
|
style={{
|
|
|
|
|
|
fontSize: '0.8rem',
|
|
|
|
|
|
display: 'block',
|
|
|
|
|
|
opacity: 0.75,
|
|
|
|
|
|
}}
|
|
|
|
|
|
>
|
|
|
|
|
|
{opt.desc}
|
|
|
|
|
|
</span>
|
|
|
|
|
|
</div>
|
|
|
|
|
|
<div className={`switch-toggle ${opt.active ? 'on' : ''}`}>
|
|
|
|
|
|
<span className="switch-slider" />
|
|
|
|
|
|
</div>
|
|
|
|
|
|
</button>
|
|
|
|
|
|
))}
|
experimental: portfolio features (justified layout, unlisted pages, captions, per-album grid, focal point, nav links, cover hero) (#431)
## Was ist das?
Sieben neue Portfolio-Features, alle als **experimental** gekennzeichnet
— in YAML-Kommentaren, Admin-Panel-Labels und Commit-Scopes, damit sie
einzeln nachvollziehbar und revertierbar bleiben.
## Features (je ein Commit)
| Commit | Feature |
| --- | --- |
| `justified rows gallery layout` | Neues Grid-Layout `justified`:
zeilenbasiert, gleiche Höhen, volle Breite — Flexbox ohne JS-Messung,
letzte Zeile bleibt natürlich klein |
| `hide subpages from navigation` | `hidden: true`: Seite aus
Nav/Homepage raus, per Direktlink erreichbar — im Gegensatz zu `enabled:
false` (404) |
| `lightbox captions` | Immich-Asset-Description als Bildunterschrift im
Info-Panel; EXIF-Route liefert bei `exifOnHover: false` jetzt nur noch
die Caption statt 403 |
| `per-album grid overrides` | `grid:` pro Album-Eintrag, Präzedenz
global < Subpage < Album |
| `per-album cover focal point` | `coverPosition:` → `object-position`
auf Cover-Karten, strikt validiert |
| `external links in header navigation` | `navLinks:` in settings.yaml,
nur http(s), sanitisiert |
| `cover splash hero style` | `heroStyle: cover`: Fullscreen-Splash mit
Enter-Link ins Portfolio |
Alle Optionen sind im Admin-Panel editierbar (PageBuilder /
SettingsEditor).
## Tests
- 356 Unit-Tests grün (13 neue: deriveGallery hidden/grid/coverPosition,
sanitizeNavLinks, EXIF-Route-Captions, justified-Layout-Validierung)
- `npx tsc --noEmit`: 0 Fehler
- `npm run build`: sauber
- Justified-Zeilenmathematik und Cover-Splash per Browser-Harness
visuell/numerisch verifiziert (volle Zeilen enden exakt an der
Containerkante, letzte Zeile bleibt natürlich)
---------
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
2026-08-14 17:56:22 +02:00
|
|
|
|
|
release: v0.11.0 (#459)
Ships `dev` as **v0.11.0**. `main` contains nothing that `dev` does not,
so this is a clean sync.
## Headline changes since v0.10.0
- **Journal & Journal Studio** — photo essays at `/journal`,
split-screen block editor with live preview, drafts, per-entry
passwords, cover images
- **First-run setup wizard at `/install`** — configure a fresh
deployment from the browser; credentials are verified against Immich
before anything is written, and the wizard is gated by a one-time token
- **About page editor and toggle** in the admin panel
- **Per-album photo order** independent of Immich, with a drag & drop
editor
- **Custom favicon upload**
- **Experimental portfolio features** — justified grid, `cover` hero,
unlisted subpages, per-album grid overrides, cover focal points,
external nav links
- **Security** — asset tokens length-capped before decoding (#423),
journal author markdown escaped rather than filtered, journal file paths
contained, admin session key derived with scrypt (#432), Next.js 16.3.0
for CVE-2025-13465
- **Fixed** — client proofing honours its own configuration again
(#454); journal photo rendering (#432)
Full detail in [CHANGELOG.md](CHANGELOG.md#0110--2026-08-15).
## Verified
`npx tsc --noEmit` clean · `npx vitest run` 435 tests pass · `npm run
build` succeeds · lint 0 errors · `prettier --check` clean · local
`docker build` of the release tree.
## After merge
Tag `v0.11.0` on `main` and publish the release — that triggers
`docker-publish.yml`, which pushes the image and moves `latest`.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
---------
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
2026-08-15 09:09:18 +02:00
|
|
|
|
{/* Password lives in the same group: it is the access half
|
experimental: portfolio features (justified layout, unlisted pages, captions, per-album grid, focal point, nav links, cover hero) (#431)
## Was ist das?
Sieben neue Portfolio-Features, alle als **experimental** gekennzeichnet
— in YAML-Kommentaren, Admin-Panel-Labels und Commit-Scopes, damit sie
einzeln nachvollziehbar und revertierbar bleiben.
## Features (je ein Commit)
| Commit | Feature |
| --- | --- |
| `justified rows gallery layout` | Neues Grid-Layout `justified`:
zeilenbasiert, gleiche Höhen, volle Breite — Flexbox ohne JS-Messung,
letzte Zeile bleibt natürlich klein |
| `hide subpages from navigation` | `hidden: true`: Seite aus
Nav/Homepage raus, per Direktlink erreichbar — im Gegensatz zu `enabled:
false` (404) |
| `lightbox captions` | Immich-Asset-Description als Bildunterschrift im
Info-Panel; EXIF-Route liefert bei `exifOnHover: false` jetzt nur noch
die Caption statt 403 |
| `per-album grid overrides` | `grid:` pro Album-Eintrag, Präzedenz
global < Subpage < Album |
| `per-album cover focal point` | `coverPosition:` → `object-position`
auf Cover-Karten, strikt validiert |
| `external links in header navigation` | `navLinks:` in settings.yaml,
nur http(s), sanitisiert |
| `cover splash hero style` | `heroStyle: cover`: Fullscreen-Splash mit
Enter-Link ins Portfolio |
Alle Optionen sind im Admin-Panel editierbar (PageBuilder /
SettingsEditor).
## Tests
- 356 Unit-Tests grün (13 neue: deriveGallery hidden/grid/coverPosition,
sanitizeNavLinks, EXIF-Route-Captions, justified-Layout-Validierung)
- `npx tsc --noEmit`: 0 Fehler
- `npm run build`: sauber
- Justified-Zeilenmathematik und Cover-Splash per Browser-Harness
visuell/numerisch verifiziert (volle Zeilen enden exakt an der
Containerkante, letzte Zeile bleibt natürlich)
---------
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
2026-08-14 17:56:22 +02:00
|
|
|
|
of "who gets to see this page". Applies to Published and
|
|
|
|
|
|
Unlisted; a Disabled page 404s before the gate. */}
|
release: v0.11.0 (#459)
Ships `dev` as **v0.11.0**. `main` contains nothing that `dev` does not,
so this is a clean sync.
## Headline changes since v0.10.0
- **Journal & Journal Studio** — photo essays at `/journal`,
split-screen block editor with live preview, drafts, per-entry
passwords, cover images
- **First-run setup wizard at `/install`** — configure a fresh
deployment from the browser; credentials are verified against Immich
before anything is written, and the wizard is gated by a one-time token
- **About page editor and toggle** in the admin panel
- **Per-album photo order** independent of Immich, with a drag & drop
editor
- **Custom favicon upload**
- **Experimental portfolio features** — justified grid, `cover` hero,
unlisted subpages, per-album grid overrides, cover focal points,
external nav links
- **Security** — asset tokens length-capped before decoding (#423),
journal author markdown escaped rather than filtered, journal file paths
contained, admin session key derived with scrypt (#432), Next.js 16.3.0
for CVE-2025-13465
- **Fixed** — client proofing honours its own configuration again
(#454); journal photo rendering (#432)
Full detail in [CHANGELOG.md](CHANGELOG.md#0110--2026-08-15).
## Verified
`npx tsc --noEmit` clean · `npx vitest run` 435 tests pass · `npm run
build` succeeds · lint 0 errors · `prettier --check` clean · local
`docker build` of the release tree.
## After merge
Tag `v0.11.0` on `main` and publish the release — that triggers
`docker-publish.yml`, which pushes the image and moves `latest`.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
---------
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
2026-08-15 09:09:18 +02:00
|
|
|
|
<div
|
|
|
|
|
|
className="password-input-wrapper"
|
|
|
|
|
|
style={{ marginTop: '6px' }}
|
|
|
|
|
|
>
|
|
|
|
|
|
<span className="password-icon">
|
|
|
|
|
|
<IconLock size={12} />
|
|
|
|
|
|
</span>
|
|
|
|
|
|
<input
|
|
|
|
|
|
type="password"
|
|
|
|
|
|
value={sp.password || ''}
|
|
|
|
|
|
onChange={(e) =>
|
|
|
|
|
|
updateSubpage(spIndex, {
|
|
|
|
|
|
password: e.target.value || undefined,
|
|
|
|
|
|
})
|
|
|
|
|
|
}
|
|
|
|
|
|
placeholder="Password protection (optional) — leave empty for public access"
|
|
|
|
|
|
disabled={sp.enabled === false}
|
|
|
|
|
|
/>
|
|
|
|
|
|
</div>
|
|
|
|
|
|
</div>
|
|
|
|
|
|
<div className="admin-field" style={{ marginTop: '1rem' }}>
|
|
|
|
|
|
<label>Page Layout Style</label>
|
|
|
|
|
|
<select
|
|
|
|
|
|
value={sp.grid?.layout || 'masonry'}
|
|
|
|
|
|
onChange={(e) => {
|
|
|
|
|
|
const newLayout = e.target.value;
|
|
|
|
|
|
updateSubpage(spIndex, {
|
|
|
|
|
|
grid: { ...(sp.grid || {}), layout: newLayout },
|
|
|
|
|
|
});
|
|
|
|
|
|
}}
|
|
|
|
|
|
style={{
|
|
|
|
|
|
padding: '8px 12px',
|
|
|
|
|
|
borderRadius: '6px',
|
|
|
|
|
|
width: '100%',
|
|
|
|
|
|
fontSize: '0.9rem',
|
|
|
|
|
|
}}
|
|
|
|
|
|
>
|
|
|
|
|
|
{/*
|
2026-08-14 11:10:42 +02:00
|
|
|
|
Plain text, no emoji: an <option> cannot contain markup, so the
|
|
|
|
|
|
SVG icon set is not available here — and a decorative emoji is
|
|
|
|
|
|
not a substitute for it.
|
|
|
|
|
|
*/}
|
release: v0.11.0 (#459)
Ships `dev` as **v0.11.0**. `main` contains nothing that `dev` does not,
so this is a clean sync.
## Headline changes since v0.10.0
- **Journal & Journal Studio** — photo essays at `/journal`,
split-screen block editor with live preview, drafts, per-entry
passwords, cover images
- **First-run setup wizard at `/install`** — configure a fresh
deployment from the browser; credentials are verified against Immich
before anything is written, and the wizard is gated by a one-time token
- **About page editor and toggle** in the admin panel
- **Per-album photo order** independent of Immich, with a drag & drop
editor
- **Custom favicon upload**
- **Experimental portfolio features** — justified grid, `cover` hero,
unlisted subpages, per-album grid overrides, cover focal points,
external nav links
- **Security** — asset tokens length-capped before decoding (#423),
journal author markdown escaped rather than filtered, journal file paths
contained, admin session key derived with scrypt (#432), Next.js 16.3.0
for CVE-2025-13465
- **Fixed** — client proofing honours its own configuration again
(#454); journal photo rendering (#432)
Full detail in [CHANGELOG.md](CHANGELOG.md#0110--2026-08-15).
## Verified
`npx tsc --noEmit` clean · `npx vitest run` 435 tests pass · `npm run
build` succeeds · lint 0 errors · `prettier --check` clean · local
`docker build` of the release tree.
## After merge
Tag `v0.11.0` on `main` and publish the release — that triggers
`docker-publish.yml`, which pushes the image and moves `latest`.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
---------
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
2026-08-15 09:09:18 +02:00
|
|
|
|
<option value="masonry">Masonry Grid (Dynamic Height)</option>
|
|
|
|
|
|
<option value="uniform">Uniform Grid (Square Tiles)</option>
|
|
|
|
|
|
<option value="showcase">Showcase (Featured First Asset)</option>
|
|
|
|
|
|
<option value="filmstrip">Filmstrip (Horizontal Scroll)</option>
|
|
|
|
|
|
<option value="editorial-flow">Editorial Flow</option>
|
|
|
|
|
|
<option value="essay">
|
|
|
|
|
|
Photo Essay Mode (Storytelling Editor)
|
|
|
|
|
|
</option>
|
|
|
|
|
|
</select>
|
security: add Trivy container scan to Docker publish workflow (#399)
* feat(admin): add backup manager UI with 1-click restore
* feat(admin): collapse older backup entries by default
* fix(theme): isolate admin layout, instant DOM theme updates, and add Light/Dark mode toggle
* feat(admin): replace text controls for Photo Frame and Hero Style with visual preview cards
* fix(admin): define missing CSS rules for button system (.btn, .preset-btn)
* feat(admin): redesign theme settings with segmented mode toggle, accent color swatches, and custom iOS-style toggle cards
* feat(admin): upgrade all settings tabs with visual grid previews, Google SEO snippet preview, and toggle cards
* feat(admin): overhaul Pages Builder UX with slide-over drawer, card hover badges, real-time search, and floating save bar
* fix(admin): remove leftover dangling syntax snippet in PageBuilder.tsx
* fix(admin): add position: relative to subpage-tile so hover overlay is contained inside the tile
* style(admin): replace all emojis with clean Leica-style vector SVG icons
* fix(types): extend IconProps with SVGProps to allow style prop on Leica SVG icons
* feat(admin): add subpage live-preview, privacy analytics, and asset protection settings
* fix(typecheck): fix AlbumEntry property access in subpage drawer preview mode
* fix(types): fix ImmichAlbumInfo property names thumbnailAssetId and albumName in PageBuilder.tsx
* fix(types): add protection and watermark optional properties to AppConfig interface
* feat(settings): add toggle for disabling analytics tracking (defaults to enabled)
* feat(ux): show status banner when analytics tracking is disabled + add live sync indicator
* feat(watermark): render customizable watermark overlay on Lightbox images + rename section to Portfolio Features & Modules
* fix(types): import type LightboxWatermark in PhotoGrid.tsx
* fix(types): destructure watermark prop in PhotoGrid function signature
* feat(seo): add configurable subpage title template and metadata descriptions
* feat(seo): add generateMetadata to about page for title template support
* feat(proofing): add client proofing, favorites selection, compact URL bitmasking, and export modal
* feat(essay): add Photo Essay storytelling mode with RSC markdown parser and fullbleed/pair layouts
* feat(subpages): add page enabled toggle to deactivate subpages without deleting them
* feat(admin): add visual essay block builder for photo essay storytelling pages
* security: add Trivy container scan to Docker publish workflow
Scans the built image for CRITICAL/HIGH CVEs on every release and
uploads results to the GitHub Security tab. Non-blocking for now
(exit-code 0) so releases aren't gated on findings. Also documents
the scan and existing Dependabot coverage in the README.
---------
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-08-07 11:08:04 +02:00
|
|
|
|
</div>
|
2026-08-23 23:18:14 +02:00
|
|
|
|
|
|
|
|
|
|
{/* Album cover grid — hidden in essay mode, which
|
|
|
|
|
|
renders a story instead of a cover grid. The
|
|
|
|
|
|
album count is deliberately not checked: it
|
|
|
|
|
|
changes in this very drawer, and a field that
|
|
|
|
|
|
vanishes while you edit is worse than one that
|
|
|
|
|
|
has no effect yet. */}
|
|
|
|
|
|
{sp.grid?.layout !== 'essay' && sp.essayText == null && (
|
|
|
|
|
|
<div className="admin-field" style={{ marginTop: '1rem' }}>
|
|
|
|
|
|
<label>Album Cover Grid</label>
|
|
|
|
|
|
<div style={{ display: 'flex', gap: '12px' }}>
|
|
|
|
|
|
<input
|
|
|
|
|
|
type="number"
|
|
|
|
|
|
min={COVER_GRID_COLUMNS_MIN}
|
|
|
|
|
|
max={COVER_GRID_COLUMNS_MAX}
|
|
|
|
|
|
value={sp.grid?.columns ?? ''}
|
|
|
|
|
|
placeholder="Columns (site default)"
|
|
|
|
|
|
onChange={(e) => {
|
|
|
|
|
|
const raw = e.target.value;
|
|
|
|
|
|
const columns = raw === '' ? undefined : Number(raw);
|
|
|
|
|
|
updateSubpage(spIndex, {
|
|
|
|
|
|
grid: normalizeSubpageGrid({
|
|
|
|
|
|
...(sp.grid || {}),
|
|
|
|
|
|
columns:
|
|
|
|
|
|
columns != null &&
|
|
|
|
|
|
columns >= COVER_GRID_COLUMNS_MIN &&
|
|
|
|
|
|
columns <= COVER_GRID_COLUMNS_MAX
|
|
|
|
|
|
? columns
|
|
|
|
|
|
: undefined,
|
|
|
|
|
|
}),
|
|
|
|
|
|
});
|
|
|
|
|
|
}}
|
|
|
|
|
|
style={{
|
|
|
|
|
|
padding: '8px 12px',
|
|
|
|
|
|
borderRadius: '6px',
|
|
|
|
|
|
flex: 1,
|
|
|
|
|
|
fontSize: '0.9rem',
|
|
|
|
|
|
}}
|
|
|
|
|
|
/>
|
|
|
|
|
|
<input
|
|
|
|
|
|
type="number"
|
|
|
|
|
|
min={0}
|
|
|
|
|
|
max={COVER_GRID_GAP_MAX}
|
|
|
|
|
|
value={sp.grid?.gap ?? ''}
|
|
|
|
|
|
placeholder="Gap in px (theme default)"
|
|
|
|
|
|
onChange={(e) => {
|
|
|
|
|
|
const raw = e.target.value;
|
|
|
|
|
|
const gap = raw === '' ? undefined : Number(raw);
|
|
|
|
|
|
updateSubpage(spIndex, {
|
|
|
|
|
|
grid: normalizeSubpageGrid({
|
|
|
|
|
|
...(sp.grid || {}),
|
|
|
|
|
|
gap:
|
|
|
|
|
|
gap != null && gap >= 0 && gap <= COVER_GRID_GAP_MAX
|
|
|
|
|
|
? gap
|
|
|
|
|
|
: undefined,
|
|
|
|
|
|
}),
|
|
|
|
|
|
});
|
|
|
|
|
|
}}
|
|
|
|
|
|
style={{
|
|
|
|
|
|
padding: '8px 12px',
|
|
|
|
|
|
borderRadius: '6px',
|
|
|
|
|
|
flex: 1,
|
|
|
|
|
|
fontSize: '0.9rem',
|
|
|
|
|
|
}}
|
|
|
|
|
|
/>
|
|
|
|
|
|
</div>
|
|
|
|
|
|
<p className="admin-field-hint">
|
|
|
|
|
|
Overrides how the album covers are tiled on this page. Leave the
|
|
|
|
|
|
column count empty to follow the site-wide grid setting, and the
|
|
|
|
|
|
gap empty to keep the theme's own spacing. Tablet widths
|
|
|
|
|
|
show at most two covers per row.
|
|
|
|
|
|
</p>
|
|
|
|
|
|
</div>
|
|
|
|
|
|
)}
|
release: v0.11.0 (#459)
Ships `dev` as **v0.11.0**. `main` contains nothing that `dev` does not,
so this is a clean sync.
## Headline changes since v0.10.0
- **Journal & Journal Studio** — photo essays at `/journal`,
split-screen block editor with live preview, drafts, per-entry
passwords, cover images
- **First-run setup wizard at `/install`** — configure a fresh
deployment from the browser; credentials are verified against Immich
before anything is written, and the wizard is gated by a one-time token
- **About page editor and toggle** in the admin panel
- **Per-album photo order** independent of Immich, with a drag & drop
editor
- **Custom favicon upload**
- **Experimental portfolio features** — justified grid, `cover` hero,
unlisted subpages, per-album grid overrides, cover focal points,
external nav links
- **Security** — asset tokens length-capped before decoding (#423),
journal author markdown escaped rather than filtered, journal file paths
contained, admin session key derived with scrypt (#432), Next.js 16.3.0
for CVE-2025-13465
- **Fixed** — client proofing honours its own configuration again
(#454); journal photo rendering (#432)
Full detail in [CHANGELOG.md](CHANGELOG.md#0110--2026-08-15).
## Verified
`npx tsc --noEmit` clean · `npx vitest run` 435 tests pass · `npm run
build` succeeds · lint 0 errors · `prettier --check` clean · local
`docker build` of the release tree.
## After merge
Tag `v0.11.0` on `main` and publish the release — that triggers
`docker-publish.yml`, which pushes the image and moves `latest`.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
---------
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
2026-08-15 09:09:18 +02:00
|
|
|
|
</div>
|
|
|
|
|
|
|
|
|
|
|
|
{/* Visual Photo Essay Builder (if layout === 'essay') */}
|
|
|
|
|
|
{(sp.grid?.layout === 'essay' || sp.essayText != null) && (
|
|
|
|
|
|
<div className="subpage-drawer-section">
|
|
|
|
|
|
<div className="drawer-section-heading">
|
|
|
|
|
|
<h4>
|
|
|
|
|
|
<IconBook size={16} /> Storytelling & Photo Essay Builder
|
|
|
|
|
|
</h4>
|
|
|
|
|
|
<p>Compose text, quotes, and fullbleed/wide photos visually.</p>
|
|
|
|
|
|
</div>
|
security: add Trivy container scan to Docker publish workflow (#399)
* feat(admin): add backup manager UI with 1-click restore
* feat(admin): collapse older backup entries by default
* fix(theme): isolate admin layout, instant DOM theme updates, and add Light/Dark mode toggle
* feat(admin): replace text controls for Photo Frame and Hero Style with visual preview cards
* fix(admin): define missing CSS rules for button system (.btn, .preset-btn)
* feat(admin): redesign theme settings with segmented mode toggle, accent color swatches, and custom iOS-style toggle cards
* feat(admin): upgrade all settings tabs with visual grid previews, Google SEO snippet preview, and toggle cards
* feat(admin): overhaul Pages Builder UX with slide-over drawer, card hover badges, real-time search, and floating save bar
* fix(admin): remove leftover dangling syntax snippet in PageBuilder.tsx
* fix(admin): add position: relative to subpage-tile so hover overlay is contained inside the tile
* style(admin): replace all emojis with clean Leica-style vector SVG icons
* fix(types): extend IconProps with SVGProps to allow style prop on Leica SVG icons
* feat(admin): add subpage live-preview, privacy analytics, and asset protection settings
* fix(typecheck): fix AlbumEntry property access in subpage drawer preview mode
* fix(types): fix ImmichAlbumInfo property names thumbnailAssetId and albumName in PageBuilder.tsx
* fix(types): add protection and watermark optional properties to AppConfig interface
* feat(settings): add toggle for disabling analytics tracking (defaults to enabled)
* feat(ux): show status banner when analytics tracking is disabled + add live sync indicator
* feat(watermark): render customizable watermark overlay on Lightbox images + rename section to Portfolio Features & Modules
* fix(types): import type LightboxWatermark in PhotoGrid.tsx
* fix(types): destructure watermark prop in PhotoGrid function signature
* feat(seo): add configurable subpage title template and metadata descriptions
* feat(seo): add generateMetadata to about page for title template support
* feat(proofing): add client proofing, favorites selection, compact URL bitmasking, and export modal
* feat(essay): add Photo Essay storytelling mode with RSC markdown parser and fullbleed/pair layouts
* feat(subpages): add page enabled toggle to deactivate subpages without deleting them
* feat(admin): add visual essay block builder for photo essay storytelling pages
* security: add Trivy container scan to Docker publish workflow
Scans the built image for CRITICAL/HIGH CVEs on every release and
uploads results to the GitHub Security tab. Non-blocking for now
(exit-code 0) so releases aren't gated on findings. Also documents
the scan and existing Dependabot coverage in the README.
---------
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-08-07 11:08:04 +02:00
|
|
|
|
|
release: v0.11.0 (#459)
Ships `dev` as **v0.11.0**. `main` contains nothing that `dev` does not,
so this is a clean sync.
## Headline changes since v0.10.0
- **Journal & Journal Studio** — photo essays at `/journal`,
split-screen block editor with live preview, drafts, per-entry
passwords, cover images
- **First-run setup wizard at `/install`** — configure a fresh
deployment from the browser; credentials are verified against Immich
before anything is written, and the wizard is gated by a one-time token
- **About page editor and toggle** in the admin panel
- **Per-album photo order** independent of Immich, with a drag & drop
editor
- **Custom favicon upload**
- **Experimental portfolio features** — justified grid, `cover` hero,
unlisted subpages, per-album grid overrides, cover focal points,
external nav links
- **Security** — asset tokens length-capped before decoding (#423),
journal author markdown escaped rather than filtered, journal file paths
contained, admin session key derived with scrypt (#432), Next.js 16.3.0
for CVE-2025-13465
- **Fixed** — client proofing honours its own configuration again
(#454); journal photo rendering (#432)
Full detail in [CHANGELOG.md](CHANGELOG.md#0110--2026-08-15).
## Verified
`npx tsc --noEmit` clean · `npx vitest run` 435 tests pass · `npm run
build` succeeds · lint 0 errors · `prettier --check` clean · local
`docker build` of the release tree.
## After merge
Tag `v0.11.0` on `main` and publish the release — that triggers
`docker-publish.yml`, which pushes the image and moves `latest`.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
---------
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
2026-08-15 09:09:18 +02:00
|
|
|
|
<EssayBlockEditor
|
|
|
|
|
|
markdown={sp.essayText || ''}
|
|
|
|
|
|
onChange={(newMarkdown) =>
|
|
|
|
|
|
updateSubpage(spIndex, { essayText: newMarkdown })
|
security: add Trivy container scan to Docker publish workflow (#399)
* feat(admin): add backup manager UI with 1-click restore
* feat(admin): collapse older backup entries by default
* fix(theme): isolate admin layout, instant DOM theme updates, and add Light/Dark mode toggle
* feat(admin): replace text controls for Photo Frame and Hero Style with visual preview cards
* fix(admin): define missing CSS rules for button system (.btn, .preset-btn)
* feat(admin): redesign theme settings with segmented mode toggle, accent color swatches, and custom iOS-style toggle cards
* feat(admin): upgrade all settings tabs with visual grid previews, Google SEO snippet preview, and toggle cards
* feat(admin): overhaul Pages Builder UX with slide-over drawer, card hover badges, real-time search, and floating save bar
* fix(admin): remove leftover dangling syntax snippet in PageBuilder.tsx
* fix(admin): add position: relative to subpage-tile so hover overlay is contained inside the tile
* style(admin): replace all emojis with clean Leica-style vector SVG icons
* fix(types): extend IconProps with SVGProps to allow style prop on Leica SVG icons
* feat(admin): add subpage live-preview, privacy analytics, and asset protection settings
* fix(typecheck): fix AlbumEntry property access in subpage drawer preview mode
* fix(types): fix ImmichAlbumInfo property names thumbnailAssetId and albumName in PageBuilder.tsx
* fix(types): add protection and watermark optional properties to AppConfig interface
* feat(settings): add toggle for disabling analytics tracking (defaults to enabled)
* feat(ux): show status banner when analytics tracking is disabled + add live sync indicator
* feat(watermark): render customizable watermark overlay on Lightbox images + rename section to Portfolio Features & Modules
* fix(types): import type LightboxWatermark in PhotoGrid.tsx
* fix(types): destructure watermark prop in PhotoGrid function signature
* feat(seo): add configurable subpage title template and metadata descriptions
* feat(seo): add generateMetadata to about page for title template support
* feat(proofing): add client proofing, favorites selection, compact URL bitmasking, and export modal
* feat(essay): add Photo Essay storytelling mode with RSC markdown parser and fullbleed/pair layouts
* feat(subpages): add page enabled toggle to deactivate subpages without deleting them
* feat(admin): add visual essay block builder for photo essay storytelling pages
* security: add Trivy container scan to Docker publish workflow
Scans the built image for CRITICAL/HIGH CVEs on every release and
uploads results to the GitHub Security tab. Non-blocking for now
(exit-code 0) so releases aren't gated on findings. Also documents
the scan and existing Dependabot coverage in the README.
---------
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-08-07 11:08:04 +02:00
|
|
|
|
}
|
release: v0.11.0 (#459)
Ships `dev` as **v0.11.0**. `main` contains nothing that `dev` does not,
so this is a clean sync.
## Headline changes since v0.10.0
- **Journal & Journal Studio** — photo essays at `/journal`,
split-screen block editor with live preview, drafts, per-entry
passwords, cover images
- **First-run setup wizard at `/install`** — configure a fresh
deployment from the browser; credentials are verified against Immich
before anything is written, and the wizard is gated by a one-time token
- **About page editor and toggle** in the admin panel
- **Per-album photo order** independent of Immich, with a drag & drop
editor
- **Custom favicon upload**
- **Experimental portfolio features** — justified grid, `cover` hero,
unlisted subpages, per-album grid overrides, cover focal points,
external nav links
- **Security** — asset tokens length-capped before decoding (#423),
journal author markdown escaped rather than filtered, journal file paths
contained, admin session key derived with scrypt (#432), Next.js 16.3.0
for CVE-2025-13465
- **Fixed** — client proofing honours its own configuration again
(#454); journal photo rendering (#432)
Full detail in [CHANGELOG.md](CHANGELOG.md#0110--2026-08-15).
## Verified
`npx tsc --noEmit` clean · `npx vitest run` 435 tests pass · `npm run
build` succeeds · lint 0 errors · `prettier --check` clean · local
`docker build` of the release tree.
## After merge
Tag `v0.11.0` on `main` and publish the release — that triggers
`docker-publish.yml`, which pushes the image and moves `latest`.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
---------
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
2026-08-15 09:09:18 +02:00
|
|
|
|
onSelectPhoto={(callback) => {
|
|
|
|
|
|
setHeroPickerTarget({
|
|
|
|
|
|
albumId: undefined,
|
|
|
|
|
|
title: 'Select Photo for Photo Essay',
|
|
|
|
|
|
onSelect: (assetId) => {
|
|
|
|
|
|
callback(assetId);
|
|
|
|
|
|
setHeroPickerTarget(null);
|
|
|
|
|
|
},
|
|
|
|
|
|
});
|
|
|
|
|
|
}}
|
security: add Trivy container scan to Docker publish workflow (#399)
* feat(admin): add backup manager UI with 1-click restore
* feat(admin): collapse older backup entries by default
* fix(theme): isolate admin layout, instant DOM theme updates, and add Light/Dark mode toggle
* feat(admin): replace text controls for Photo Frame and Hero Style with visual preview cards
* fix(admin): define missing CSS rules for button system (.btn, .preset-btn)
* feat(admin): redesign theme settings with segmented mode toggle, accent color swatches, and custom iOS-style toggle cards
* feat(admin): upgrade all settings tabs with visual grid previews, Google SEO snippet preview, and toggle cards
* feat(admin): overhaul Pages Builder UX with slide-over drawer, card hover badges, real-time search, and floating save bar
* fix(admin): remove leftover dangling syntax snippet in PageBuilder.tsx
* fix(admin): add position: relative to subpage-tile so hover overlay is contained inside the tile
* style(admin): replace all emojis with clean Leica-style vector SVG icons
* fix(types): extend IconProps with SVGProps to allow style prop on Leica SVG icons
* feat(admin): add subpage live-preview, privacy analytics, and asset protection settings
* fix(typecheck): fix AlbumEntry property access in subpage drawer preview mode
* fix(types): fix ImmichAlbumInfo property names thumbnailAssetId and albumName in PageBuilder.tsx
* fix(types): add protection and watermark optional properties to AppConfig interface
* feat(settings): add toggle for disabling analytics tracking (defaults to enabled)
* feat(ux): show status banner when analytics tracking is disabled + add live sync indicator
* feat(watermark): render customizable watermark overlay on Lightbox images + rename section to Portfolio Features & Modules
* fix(types): import type LightboxWatermark in PhotoGrid.tsx
* fix(types): destructure watermark prop in PhotoGrid function signature
* feat(seo): add configurable subpage title template and metadata descriptions
* feat(seo): add generateMetadata to about page for title template support
* feat(proofing): add client proofing, favorites selection, compact URL bitmasking, and export modal
* feat(essay): add Photo Essay storytelling mode with RSC markdown parser and fullbleed/pair layouts
* feat(subpages): add page enabled toggle to deactivate subpages without deleting them
* feat(admin): add visual essay block builder for photo essay storytelling pages
* security: add Trivy container scan to Docker publish workflow
Scans the built image for CRITICAL/HIGH CVEs on every release and
uploads results to the GitHub Security tab. Non-blocking for now
(exit-code 0) so releases aren't gated on findings. Also documents
the scan and existing Dependabot coverage in the README.
---------
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-08-07 11:08:04 +02:00
|
|
|
|
/>
|
|
|
|
|
|
</div>
|
release: v0.11.0 (#459)
Ships `dev` as **v0.11.0**. `main` contains nothing that `dev` does not,
so this is a clean sync.
## Headline changes since v0.10.0
- **Journal & Journal Studio** — photo essays at `/journal`,
split-screen block editor with live preview, drafts, per-entry
passwords, cover images
- **First-run setup wizard at `/install`** — configure a fresh
deployment from the browser; credentials are verified against Immich
before anything is written, and the wizard is gated by a one-time token
- **About page editor and toggle** in the admin panel
- **Per-album photo order** independent of Immich, with a drag & drop
editor
- **Custom favicon upload**
- **Experimental portfolio features** — justified grid, `cover` hero,
unlisted subpages, per-album grid overrides, cover focal points,
external nav links
- **Security** — asset tokens length-capped before decoding (#423),
journal author markdown escaped rather than filtered, journal file paths
contained, admin session key derived with scrypt (#432), Next.js 16.3.0
for CVE-2025-13465
- **Fixed** — client proofing honours its own configuration again
(#454); journal photo rendering (#432)
Full detail in [CHANGELOG.md](CHANGELOG.md#0110--2026-08-15).
## Verified
`npx tsc --noEmit` clean · `npx vitest run` 435 tests pass · `npm run
build` succeeds · lint 0 errors · `prettier --check` clean · local
`docker build` of the release tree.
## After merge
Tag `v0.11.0` on `main` and publish the release — that triggers
`docker-publish.yml`, which pushes the image and moves `latest`.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
---------
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
2026-08-15 09:09:18 +02:00
|
|
|
|
)}
|
|
|
|
|
|
</div>
|
|
|
|
|
|
|
|
|
|
|
|
<div className="admin-sheet-col admin-sheet-col--divided">
|
|
|
|
|
|
{/* Albums (if no sections) with DnD */}
|
|
|
|
|
|
{(!sp.sections || sp.sections.length === 0) && (
|
|
|
|
|
|
<div className="subpage-albums">
|
|
|
|
|
|
<div className="subpage-albums-header">
|
|
|
|
|
|
<span>Albums in this Page</span>
|
|
|
|
|
|
<button
|
|
|
|
|
|
className="admin-btn admin-btn-xs admin-btn-primary"
|
|
|
|
|
|
onClick={() =>
|
|
|
|
|
|
setPickerTarget({ type: 'subpage', subpageIndex: spIndex })
|
|
|
|
|
|
}
|
|
|
|
|
|
>
|
|
|
|
|
|
+ Add Album
|
|
|
|
|
|
</button>
|
|
|
|
|
|
</div>
|
|
|
|
|
|
<DndContext
|
|
|
|
|
|
sensors={sensors}
|
|
|
|
|
|
collisionDetection={closestCenter}
|
|
|
|
|
|
onDragEnd={handleSubpageAlbumDragEnd(spIndex)}
|
|
|
|
|
|
>
|
|
|
|
|
|
<SortableContext
|
|
|
|
|
|
items={sp.albums.map((a, i) => `album-${a.id}-${i}`)}
|
|
|
|
|
|
strategy={verticalListSortingStrategy}
|
|
|
|
|
|
>
|
|
|
|
|
|
<div className="album-list">
|
|
|
|
|
|
{sp.albums.length === 0 && (
|
|
|
|
|
|
<p className="empty-hint">
|
|
|
|
|
|
No albums added yet. Click + Add Album to pick from
|
|
|
|
|
|
Immich.
|
|
|
|
|
|
</p>
|
|
|
|
|
|
)}
|
|
|
|
|
|
{sp.albums.map((album, aIndex) => (
|
|
|
|
|
|
<SortableAlbumCard
|
|
|
|
|
|
key={`${album.id}-${aIndex}`}
|
|
|
|
|
|
album={album}
|
|
|
|
|
|
index={aIndex}
|
|
|
|
|
|
name={getAlbumName(album.id)}
|
|
|
|
|
|
count={getAlbumCount(album.id)}
|
|
|
|
|
|
thumbnailId={getAlbumThumbnailId(album.id)}
|
|
|
|
|
|
onRemove={() => removeSubpageAlbum(spIndex, aIndex)}
|
|
|
|
|
|
onEdit={() =>
|
|
|
|
|
|
setEditingAlbumAddress({
|
|
|
|
|
|
type: 'subpage',
|
|
|
|
|
|
subpageIndex: spIndex,
|
|
|
|
|
|
albumIndex: aIndex,
|
|
|
|
|
|
})
|
|
|
|
|
|
}
|
|
|
|
|
|
/>
|
|
|
|
|
|
))}
|
|
|
|
|
|
</div>
|
|
|
|
|
|
</SortableContext>
|
|
|
|
|
|
</DndContext>
|
security: add Trivy container scan to Docker publish workflow (#399)
* feat(admin): add backup manager UI with 1-click restore
* feat(admin): collapse older backup entries by default
* fix(theme): isolate admin layout, instant DOM theme updates, and add Light/Dark mode toggle
* feat(admin): replace text controls for Photo Frame and Hero Style with visual preview cards
* fix(admin): define missing CSS rules for button system (.btn, .preset-btn)
* feat(admin): redesign theme settings with segmented mode toggle, accent color swatches, and custom iOS-style toggle cards
* feat(admin): upgrade all settings tabs with visual grid previews, Google SEO snippet preview, and toggle cards
* feat(admin): overhaul Pages Builder UX with slide-over drawer, card hover badges, real-time search, and floating save bar
* fix(admin): remove leftover dangling syntax snippet in PageBuilder.tsx
* fix(admin): add position: relative to subpage-tile so hover overlay is contained inside the tile
* style(admin): replace all emojis with clean Leica-style vector SVG icons
* fix(types): extend IconProps with SVGProps to allow style prop on Leica SVG icons
* feat(admin): add subpage live-preview, privacy analytics, and asset protection settings
* fix(typecheck): fix AlbumEntry property access in subpage drawer preview mode
* fix(types): fix ImmichAlbumInfo property names thumbnailAssetId and albumName in PageBuilder.tsx
* fix(types): add protection and watermark optional properties to AppConfig interface
* feat(settings): add toggle for disabling analytics tracking (defaults to enabled)
* feat(ux): show status banner when analytics tracking is disabled + add live sync indicator
* feat(watermark): render customizable watermark overlay on Lightbox images + rename section to Portfolio Features & Modules
* fix(types): import type LightboxWatermark in PhotoGrid.tsx
* fix(types): destructure watermark prop in PhotoGrid function signature
* feat(seo): add configurable subpage title template and metadata descriptions
* feat(seo): add generateMetadata to about page for title template support
* feat(proofing): add client proofing, favorites selection, compact URL bitmasking, and export modal
* feat(essay): add Photo Essay storytelling mode with RSC markdown parser and fullbleed/pair layouts
* feat(subpages): add page enabled toggle to deactivate subpages without deleting them
* feat(admin): add visual essay block builder for photo essay storytelling pages
* security: add Trivy container scan to Docker publish workflow
Scans the built image for CRITICAL/HIGH CVEs on every release and
uploads results to the GitHub Security tab. Non-blocking for now
(exit-code 0) so releases aren't gated on findings. Also documents
the scan and existing Dependabot coverage in the README.
---------
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-08-07 11:08:04 +02:00
|
|
|
|
</div>
|
release: v0.11.0 (#459)
Ships `dev` as **v0.11.0**. `main` contains nothing that `dev` does not,
so this is a clean sync.
## Headline changes since v0.10.0
- **Journal & Journal Studio** — photo essays at `/journal`,
split-screen block editor with live preview, drafts, per-entry
passwords, cover images
- **First-run setup wizard at `/install`** — configure a fresh
deployment from the browser; credentials are verified against Immich
before anything is written, and the wizard is gated by a one-time token
- **About page editor and toggle** in the admin panel
- **Per-album photo order** independent of Immich, with a drag & drop
editor
- **Custom favicon upload**
- **Experimental portfolio features** — justified grid, `cover` hero,
unlisted subpages, per-album grid overrides, cover focal points,
external nav links
- **Security** — asset tokens length-capped before decoding (#423),
journal author markdown escaped rather than filtered, journal file paths
contained, admin session key derived with scrypt (#432), Next.js 16.3.0
for CVE-2025-13465
- **Fixed** — client proofing honours its own configuration again
(#454); journal photo rendering (#432)
Full detail in [CHANGELOG.md](CHANGELOG.md#0110--2026-08-15).
## Verified
`npx tsc --noEmit` clean · `npx vitest run` 435 tests pass · `npm run
build` succeeds · lint 0 errors · `prettier --check` clean · local
`docker build` of the release tree.
## After merge
Tag `v0.11.0` on `main` and publish the release — that triggers
`docker-publish.yml`, which pushes the image and moves `latest`.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
---------
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
2026-08-15 09:09:18 +02:00
|
|
|
|
)}
|
|
|
|
|
|
|
|
|
|
|
|
{/* Sections */}
|
|
|
|
|
|
{sp.sections && sp.sections.length > 0 && (
|
|
|
|
|
|
<div className="subpage-sections">
|
|
|
|
|
|
{sp.sections.map((sec, secIndex) => (
|
|
|
|
|
|
<div key={secIndex} className="section-card">
|
|
|
|
|
|
<div className="section-header">
|
|
|
|
|
|
<input
|
|
|
|
|
|
className="section-title-input"
|
|
|
|
|
|
value={sec.title}
|
|
|
|
|
|
onChange={(e) =>
|
|
|
|
|
|
updateSection(spIndex, secIndex, {
|
|
|
|
|
|
title: e.target.value,
|
|
|
|
|
|
})
|
|
|
|
|
|
}
|
|
|
|
|
|
placeholder="Section title"
|
|
|
|
|
|
/>
|
|
|
|
|
|
<button
|
|
|
|
|
|
className="admin-btn-icon"
|
|
|
|
|
|
onClick={() => removeSection(spIndex, secIndex)}
|
|
|
|
|
|
title="Remove section"
|
|
|
|
|
|
>
|
|
|
|
|
|
<IconX size={14} />
|
|
|
|
|
|
</button>
|
|
|
|
|
|
</div>
|
|
|
|
|
|
<div className="admin-field">
|
|
|
|
|
|
<input
|
|
|
|
|
|
value={sec.description || ''}
|
|
|
|
|
|
onChange={(e) =>
|
|
|
|
|
|
updateSection(spIndex, secIndex, {
|
|
|
|
|
|
description: e.target.value || undefined,
|
|
|
|
|
|
})
|
|
|
|
|
|
}
|
|
|
|
|
|
placeholder="Section description (optional)"
|
|
|
|
|
|
className="section-desc-input"
|
|
|
|
|
|
/>
|
|
|
|
|
|
</div>
|
|
|
|
|
|
<div className="album-list">
|
|
|
|
|
|
{sec.albums.map((album, aIndex) => (
|
|
|
|
|
|
<AlbumCard
|
|
|
|
|
|
key={`${album.id}-${aIndex}`}
|
|
|
|
|
|
album={album}
|
|
|
|
|
|
name={getAlbumName(album.id)}
|
|
|
|
|
|
count={getAlbumCount(album.id)}
|
|
|
|
|
|
thumbnailId={getAlbumThumbnailId(album.id)}
|
|
|
|
|
|
onRemove={() =>
|
|
|
|
|
|
removeSectionAlbum(spIndex, secIndex, aIndex)
|
|
|
|
|
|
}
|
|
|
|
|
|
onEdit={() =>
|
|
|
|
|
|
setEditingAlbumAddress({
|
|
|
|
|
|
type: 'section',
|
|
|
|
|
|
subpageIndex: spIndex,
|
|
|
|
|
|
sectionIndex: secIndex,
|
|
|
|
|
|
albumIndex: aIndex,
|
|
|
|
|
|
})
|
|
|
|
|
|
}
|
|
|
|
|
|
/>
|
|
|
|
|
|
))}
|
|
|
|
|
|
</div>
|
|
|
|
|
|
<button
|
|
|
|
|
|
className="admin-btn admin-btn-xs"
|
|
|
|
|
|
onClick={() =>
|
|
|
|
|
|
setPickerTarget({
|
|
|
|
|
|
type: 'section',
|
|
|
|
|
|
subpageIndex: spIndex,
|
|
|
|
|
|
sectionIndex: secIndex,
|
|
|
|
|
|
})
|
|
|
|
|
|
}
|
|
|
|
|
|
>
|
|
|
|
|
|
+ Add Album
|
|
|
|
|
|
</button>
|
|
|
|
|
|
</div>
|
security: add Trivy container scan to Docker publish workflow (#399)
* feat(admin): add backup manager UI with 1-click restore
* feat(admin): collapse older backup entries by default
* fix(theme): isolate admin layout, instant DOM theme updates, and add Light/Dark mode toggle
* feat(admin): replace text controls for Photo Frame and Hero Style with visual preview cards
* fix(admin): define missing CSS rules for button system (.btn, .preset-btn)
* feat(admin): redesign theme settings with segmented mode toggle, accent color swatches, and custom iOS-style toggle cards
* feat(admin): upgrade all settings tabs with visual grid previews, Google SEO snippet preview, and toggle cards
* feat(admin): overhaul Pages Builder UX with slide-over drawer, card hover badges, real-time search, and floating save bar
* fix(admin): remove leftover dangling syntax snippet in PageBuilder.tsx
* fix(admin): add position: relative to subpage-tile so hover overlay is contained inside the tile
* style(admin): replace all emojis with clean Leica-style vector SVG icons
* fix(types): extend IconProps with SVGProps to allow style prop on Leica SVG icons
* feat(admin): add subpage live-preview, privacy analytics, and asset protection settings
* fix(typecheck): fix AlbumEntry property access in subpage drawer preview mode
* fix(types): fix ImmichAlbumInfo property names thumbnailAssetId and albumName in PageBuilder.tsx
* fix(types): add protection and watermark optional properties to AppConfig interface
* feat(settings): add toggle for disabling analytics tracking (defaults to enabled)
* feat(ux): show status banner when analytics tracking is disabled + add live sync indicator
* feat(watermark): render customizable watermark overlay on Lightbox images + rename section to Portfolio Features & Modules
* fix(types): import type LightboxWatermark in PhotoGrid.tsx
* fix(types): destructure watermark prop in PhotoGrid function signature
* feat(seo): add configurable subpage title template and metadata descriptions
* feat(seo): add generateMetadata to about page for title template support
* feat(proofing): add client proofing, favorites selection, compact URL bitmasking, and export modal
* feat(essay): add Photo Essay storytelling mode with RSC markdown parser and fullbleed/pair layouts
* feat(subpages): add page enabled toggle to deactivate subpages without deleting them
* feat(admin): add visual essay block builder for photo essay storytelling pages
* security: add Trivy container scan to Docker publish workflow
Scans the built image for CRITICAL/HIGH CVEs on every release and
uploads results to the GitHub Security tab. Non-blocking for now
(exit-code 0) so releases aren't gated on findings. Also documents
the scan and existing Dependabot coverage in the README.
---------
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-08-07 11:08:04 +02:00
|
|
|
|
))}
|
|
|
|
|
|
</div>
|
release: v0.11.0 (#459)
Ships `dev` as **v0.11.0**. `main` contains nothing that `dev` does not,
so this is a clean sync.
## Headline changes since v0.10.0
- **Journal & Journal Studio** — photo essays at `/journal`,
split-screen block editor with live preview, drafts, per-entry
passwords, cover images
- **First-run setup wizard at `/install`** — configure a fresh
deployment from the browser; credentials are verified against Immich
before anything is written, and the wizard is gated by a one-time token
- **About page editor and toggle** in the admin panel
- **Per-album photo order** independent of Immich, with a drag & drop
editor
- **Custom favicon upload**
- **Experimental portfolio features** — justified grid, `cover` hero,
unlisted subpages, per-album grid overrides, cover focal points,
external nav links
- **Security** — asset tokens length-capped before decoding (#423),
journal author markdown escaped rather than filtered, journal file paths
contained, admin session key derived with scrypt (#432), Next.js 16.3.0
for CVE-2025-13465
- **Fixed** — client proofing honours its own configuration again
(#454); journal photo rendering (#432)
Full detail in [CHANGELOG.md](CHANGELOG.md#0110--2026-08-15).
## Verified
`npx tsc --noEmit` clean · `npx vitest run` 435 tests pass · `npm run
build` succeeds · lint 0 errors · `prettier --check` clean · local
`docker build` of the release tree.
## After merge
Tag `v0.11.0` on `main` and publish the release — that triggers
`docker-publish.yml`, which pushes the image and moves `latest`.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
---------
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
2026-08-15 09:09:18 +02:00
|
|
|
|
)}
|
|
|
|
|
|
|
|
|
|
|
|
<div className="subpage-actions" style={{ marginTop: '1rem' }}>
|
security: add Trivy container scan to Docker publish workflow (#399)
* feat(admin): add backup manager UI with 1-click restore
* feat(admin): collapse older backup entries by default
* fix(theme): isolate admin layout, instant DOM theme updates, and add Light/Dark mode toggle
* feat(admin): replace text controls for Photo Frame and Hero Style with visual preview cards
* fix(admin): define missing CSS rules for button system (.btn, .preset-btn)
* feat(admin): redesign theme settings with segmented mode toggle, accent color swatches, and custom iOS-style toggle cards
* feat(admin): upgrade all settings tabs with visual grid previews, Google SEO snippet preview, and toggle cards
* feat(admin): overhaul Pages Builder UX with slide-over drawer, card hover badges, real-time search, and floating save bar
* fix(admin): remove leftover dangling syntax snippet in PageBuilder.tsx
* fix(admin): add position: relative to subpage-tile so hover overlay is contained inside the tile
* style(admin): replace all emojis with clean Leica-style vector SVG icons
* fix(types): extend IconProps with SVGProps to allow style prop on Leica SVG icons
* feat(admin): add subpage live-preview, privacy analytics, and asset protection settings
* fix(typecheck): fix AlbumEntry property access in subpage drawer preview mode
* fix(types): fix ImmichAlbumInfo property names thumbnailAssetId and albumName in PageBuilder.tsx
* fix(types): add protection and watermark optional properties to AppConfig interface
* feat(settings): add toggle for disabling analytics tracking (defaults to enabled)
* feat(ux): show status banner when analytics tracking is disabled + add live sync indicator
* feat(watermark): render customizable watermark overlay on Lightbox images + rename section to Portfolio Features & Modules
* fix(types): import type LightboxWatermark in PhotoGrid.tsx
* fix(types): destructure watermark prop in PhotoGrid function signature
* feat(seo): add configurable subpage title template and metadata descriptions
* feat(seo): add generateMetadata to about page for title template support
* feat(proofing): add client proofing, favorites selection, compact URL bitmasking, and export modal
* feat(essay): add Photo Essay storytelling mode with RSC markdown parser and fullbleed/pair layouts
* feat(subpages): add page enabled toggle to deactivate subpages without deleting them
* feat(admin): add visual essay block builder for photo essay storytelling pages
* security: add Trivy container scan to Docker publish workflow
Scans the built image for CRITICAL/HIGH CVEs on every release and
uploads results to the GitHub Security tab. Non-blocking for now
(exit-code 0) so releases aren't gated on findings. Also documents
the scan and existing Dependabot coverage in the README.
---------
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-08-07 11:08:04 +02:00
|
|
|
|
<button
|
release: v0.11.0 (#459)
Ships `dev` as **v0.11.0**. `main` contains nothing that `dev` does not,
so this is a clean sync.
## Headline changes since v0.10.0
- **Journal & Journal Studio** — photo essays at `/journal`,
split-screen block editor with live preview, drafts, per-entry
passwords, cover images
- **First-run setup wizard at `/install`** — configure a fresh
deployment from the browser; credentials are verified against Immich
before anything is written, and the wizard is gated by a one-time token
- **About page editor and toggle** in the admin panel
- **Per-album photo order** independent of Immich, with a drag & drop
editor
- **Custom favicon upload**
- **Experimental portfolio features** — justified grid, `cover` hero,
unlisted subpages, per-album grid overrides, cover focal points,
external nav links
- **Security** — asset tokens length-capped before decoding (#423),
journal author markdown escaped rather than filtered, journal file paths
contained, admin session key derived with scrypt (#432), Next.js 16.3.0
for CVE-2025-13465
- **Fixed** — client proofing honours its own configuration again
(#454); journal photo rendering (#432)
Full detail in [CHANGELOG.md](CHANGELOG.md#0110--2026-08-15).
## Verified
`npx tsc --noEmit` clean · `npx vitest run` 435 tests pass · `npm run
build` succeeds · lint 0 errors · `prettier --check` clean · local
`docker build` of the release tree.
## After merge
Tag `v0.11.0` on `main` and publish the release — that triggers
`docker-publish.yml`, which pushes the image and moves `latest`.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
---------
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
2026-08-15 09:09:18 +02:00
|
|
|
|
className="admin-btn admin-btn-xs admin-btn-secondary"
|
|
|
|
|
|
onClick={() => addSection(spIndex)}
|
security: add Trivy container scan to Docker publish workflow (#399)
* feat(admin): add backup manager UI with 1-click restore
* feat(admin): collapse older backup entries by default
* fix(theme): isolate admin layout, instant DOM theme updates, and add Light/Dark mode toggle
* feat(admin): replace text controls for Photo Frame and Hero Style with visual preview cards
* fix(admin): define missing CSS rules for button system (.btn, .preset-btn)
* feat(admin): redesign theme settings with segmented mode toggle, accent color swatches, and custom iOS-style toggle cards
* feat(admin): upgrade all settings tabs with visual grid previews, Google SEO snippet preview, and toggle cards
* feat(admin): overhaul Pages Builder UX with slide-over drawer, card hover badges, real-time search, and floating save bar
* fix(admin): remove leftover dangling syntax snippet in PageBuilder.tsx
* fix(admin): add position: relative to subpage-tile so hover overlay is contained inside the tile
* style(admin): replace all emojis with clean Leica-style vector SVG icons
* fix(types): extend IconProps with SVGProps to allow style prop on Leica SVG icons
* feat(admin): add subpage live-preview, privacy analytics, and asset protection settings
* fix(typecheck): fix AlbumEntry property access in subpage drawer preview mode
* fix(types): fix ImmichAlbumInfo property names thumbnailAssetId and albumName in PageBuilder.tsx
* fix(types): add protection and watermark optional properties to AppConfig interface
* feat(settings): add toggle for disabling analytics tracking (defaults to enabled)
* feat(ux): show status banner when analytics tracking is disabled + add live sync indicator
* feat(watermark): render customizable watermark overlay on Lightbox images + rename section to Portfolio Features & Modules
* fix(types): import type LightboxWatermark in PhotoGrid.tsx
* fix(types): destructure watermark prop in PhotoGrid function signature
* feat(seo): add configurable subpage title template and metadata descriptions
* feat(seo): add generateMetadata to about page for title template support
* feat(proofing): add client proofing, favorites selection, compact URL bitmasking, and export modal
* feat(essay): add Photo Essay storytelling mode with RSC markdown parser and fullbleed/pair layouts
* feat(subpages): add page enabled toggle to deactivate subpages without deleting them
* feat(admin): add visual essay block builder for photo essay storytelling pages
* security: add Trivy container scan to Docker publish workflow
Scans the built image for CRITICAL/HIGH CVEs on every release and
uploads results to the GitHub Security tab. Non-blocking for now
(exit-code 0) so releases aren't gated on findings. Also documents
the scan and existing Dependabot coverage in the README.
---------
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-08-07 11:08:04 +02:00
|
|
|
|
>
|
release: v0.11.0 (#459)
Ships `dev` as **v0.11.0**. `main` contains nothing that `dev` does not,
so this is a clean sync.
## Headline changes since v0.10.0
- **Journal & Journal Studio** — photo essays at `/journal`,
split-screen block editor with live preview, drafts, per-entry
passwords, cover images
- **First-run setup wizard at `/install`** — configure a fresh
deployment from the browser; credentials are verified against Immich
before anything is written, and the wizard is gated by a one-time token
- **About page editor and toggle** in the admin panel
- **Per-album photo order** independent of Immich, with a drag & drop
editor
- **Custom favicon upload**
- **Experimental portfolio features** — justified grid, `cover` hero,
unlisted subpages, per-album grid overrides, cover focal points,
external nav links
- **Security** — asset tokens length-capped before decoding (#423),
journal author markdown escaped rather than filtered, journal file paths
contained, admin session key derived with scrypt (#432), Next.js 16.3.0
for CVE-2025-13465
- **Fixed** — client proofing honours its own configuration again
(#454); journal photo rendering (#432)
Full detail in [CHANGELOG.md](CHANGELOG.md#0110--2026-08-15).
## Verified
`npx tsc --noEmit` clean · `npx vitest run` 435 tests pass · `npm run
build` succeeds · lint 0 errors · `prettier --check` clean · local
`docker build` of the release tree.
## After merge
Tag `v0.11.0` on `main` and publish the release — that triggers
`docker-publish.yml`, which pushes the image and moves `latest`.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
---------
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
2026-08-15 09:09:18 +02:00
|
|
|
|
+ Add Section
|
security: add Trivy container scan to Docker publish workflow (#399)
* feat(admin): add backup manager UI with 1-click restore
* feat(admin): collapse older backup entries by default
* fix(theme): isolate admin layout, instant DOM theme updates, and add Light/Dark mode toggle
* feat(admin): replace text controls for Photo Frame and Hero Style with visual preview cards
* fix(admin): define missing CSS rules for button system (.btn, .preset-btn)
* feat(admin): redesign theme settings with segmented mode toggle, accent color swatches, and custom iOS-style toggle cards
* feat(admin): upgrade all settings tabs with visual grid previews, Google SEO snippet preview, and toggle cards
* feat(admin): overhaul Pages Builder UX with slide-over drawer, card hover badges, real-time search, and floating save bar
* fix(admin): remove leftover dangling syntax snippet in PageBuilder.tsx
* fix(admin): add position: relative to subpage-tile so hover overlay is contained inside the tile
* style(admin): replace all emojis with clean Leica-style vector SVG icons
* fix(types): extend IconProps with SVGProps to allow style prop on Leica SVG icons
* feat(admin): add subpage live-preview, privacy analytics, and asset protection settings
* fix(typecheck): fix AlbumEntry property access in subpage drawer preview mode
* fix(types): fix ImmichAlbumInfo property names thumbnailAssetId and albumName in PageBuilder.tsx
* fix(types): add protection and watermark optional properties to AppConfig interface
* feat(settings): add toggle for disabling analytics tracking (defaults to enabled)
* feat(ux): show status banner when analytics tracking is disabled + add live sync indicator
* feat(watermark): render customizable watermark overlay on Lightbox images + rename section to Portfolio Features & Modules
* fix(types): import type LightboxWatermark in PhotoGrid.tsx
* fix(types): destructure watermark prop in PhotoGrid function signature
* feat(seo): add configurable subpage title template and metadata descriptions
* feat(seo): add generateMetadata to about page for title template support
* feat(proofing): add client proofing, favorites selection, compact URL bitmasking, and export modal
* feat(essay): add Photo Essay storytelling mode with RSC markdown parser and fullbleed/pair layouts
* feat(subpages): add page enabled toggle to deactivate subpages without deleting them
* feat(admin): add visual essay block builder for photo essay storytelling pages
* security: add Trivy container scan to Docker publish workflow
Scans the built image for CRITICAL/HIGH CVEs on every release and
uploads results to the GitHub Security tab. Non-blocking for now
(exit-code 0) so releases aren't gated on findings. Also documents
the scan and existing Dependabot coverage in the README.
---------
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-08-07 11:08:04 +02:00
|
|
|
|
</button>
|
release: v0.11.0 (#459)
Ships `dev` as **v0.11.0**. `main` contains nothing that `dev` does not,
so this is a clean sync.
## Headline changes since v0.10.0
- **Journal & Journal Studio** — photo essays at `/journal`,
split-screen block editor with live preview, drafts, per-entry
passwords, cover images
- **First-run setup wizard at `/install`** — configure a fresh
deployment from the browser; credentials are verified against Immich
before anything is written, and the wizard is gated by a one-time token
- **About page editor and toggle** in the admin panel
- **Per-album photo order** independent of Immich, with a drag & drop
editor
- **Custom favicon upload**
- **Experimental portfolio features** — justified grid, `cover` hero,
unlisted subpages, per-album grid overrides, cover focal points,
external nav links
- **Security** — asset tokens length-capped before decoding (#423),
journal author markdown escaped rather than filtered, journal file paths
contained, admin session key derived with scrypt (#432), Next.js 16.3.0
for CVE-2025-13465
- **Fixed** — client proofing honours its own configuration again
(#454); journal photo rendering (#432)
Full detail in [CHANGELOG.md](CHANGELOG.md#0110--2026-08-15).
## Verified
`npx tsc --noEmit` clean · `npx vitest run` 435 tests pass · `npm run
build` succeeds · lint 0 errors · `prettier --check` clean · local
`docker build` of the release tree.
## After merge
Tag `v0.11.0` on `main` and publish the release — that triggers
`docker-publish.yml`, which pushes the image and moves `latest`.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
---------
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
2026-08-15 09:09:18 +02:00
|
|
|
|
{sp.sections && sp.sections.length > 0 && (
|
|
|
|
|
|
<button
|
|
|
|
|
|
className="admin-btn admin-btn-xs admin-btn-secondary"
|
|
|
|
|
|
onClick={() =>
|
|
|
|
|
|
setPickerTarget({ type: 'subpage', subpageIndex: spIndex })
|
|
|
|
|
|
}
|
|
|
|
|
|
>
|
|
|
|
|
|
+ Add Loose Album
|
|
|
|
|
|
</button>
|
|
|
|
|
|
)}
|
security: add Trivy container scan to Docker publish workflow (#399)
* feat(admin): add backup manager UI with 1-click restore
* feat(admin): collapse older backup entries by default
* fix(theme): isolate admin layout, instant DOM theme updates, and add Light/Dark mode toggle
* feat(admin): replace text controls for Photo Frame and Hero Style with visual preview cards
* fix(admin): define missing CSS rules for button system (.btn, .preset-btn)
* feat(admin): redesign theme settings with segmented mode toggle, accent color swatches, and custom iOS-style toggle cards
* feat(admin): upgrade all settings tabs with visual grid previews, Google SEO snippet preview, and toggle cards
* feat(admin): overhaul Pages Builder UX with slide-over drawer, card hover badges, real-time search, and floating save bar
* fix(admin): remove leftover dangling syntax snippet in PageBuilder.tsx
* fix(admin): add position: relative to subpage-tile so hover overlay is contained inside the tile
* style(admin): replace all emojis with clean Leica-style vector SVG icons
* fix(types): extend IconProps with SVGProps to allow style prop on Leica SVG icons
* feat(admin): add subpage live-preview, privacy analytics, and asset protection settings
* fix(typecheck): fix AlbumEntry property access in subpage drawer preview mode
* fix(types): fix ImmichAlbumInfo property names thumbnailAssetId and albumName in PageBuilder.tsx
* fix(types): add protection and watermark optional properties to AppConfig interface
* feat(settings): add toggle for disabling analytics tracking (defaults to enabled)
* feat(ux): show status banner when analytics tracking is disabled + add live sync indicator
* feat(watermark): render customizable watermark overlay on Lightbox images + rename section to Portfolio Features & Modules
* fix(types): import type LightboxWatermark in PhotoGrid.tsx
* fix(types): destructure watermark prop in PhotoGrid function signature
* feat(seo): add configurable subpage title template and metadata descriptions
* feat(seo): add generateMetadata to about page for title template support
* feat(proofing): add client proofing, favorites selection, compact URL bitmasking, and export modal
* feat(essay): add Photo Essay storytelling mode with RSC markdown parser and fullbleed/pair layouts
* feat(subpages): add page enabled toggle to deactivate subpages without deleting them
* feat(admin): add visual essay block builder for photo essay storytelling pages
* security: add Trivy container scan to Docker publish workflow
Scans the built image for CRITICAL/HIGH CVEs on every release and
uploads results to the GitHub Security tab. Non-blocking for now
(exit-code 0) so releases aren't gated on findings. Also documents
the scan and existing Dependabot coverage in the README.
---------
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-08-07 11:08:04 +02:00
|
|
|
|
</div>
|
release: v0.11.0 (#459)
Ships `dev` as **v0.11.0**. `main` contains nothing that `dev` does not,
so this is a clean sync.
## Headline changes since v0.10.0
- **Journal & Journal Studio** — photo essays at `/journal`,
split-screen block editor with live preview, drafts, per-entry
passwords, cover images
- **First-run setup wizard at `/install`** — configure a fresh
deployment from the browser; credentials are verified against Immich
before anything is written, and the wizard is gated by a one-time token
- **About page editor and toggle** in the admin panel
- **Per-album photo order** independent of Immich, with a drag & drop
editor
- **Custom favicon upload**
- **Experimental portfolio features** — justified grid, `cover` hero,
unlisted subpages, per-album grid overrides, cover focal points,
external nav links
- **Security** — asset tokens length-capped before decoding (#423),
journal author markdown escaped rather than filtered, journal file paths
contained, admin session key derived with scrypt (#432), Next.js 16.3.0
for CVE-2025-13465
- **Fixed** — client proofing honours its own configuration again
(#454); journal photo rendering (#432)
Full detail in [CHANGELOG.md](CHANGELOG.md#0110--2026-08-15).
## Verified
`npx tsc --noEmit` clean · `npx vitest run` 435 tests pass · `npm run
build` succeeds · lint 0 errors · `prettier --check` clean · local
`docker build` of the release tree.
## After merge
Tag `v0.11.0` on `main` and publish the release — that triggers
`docker-publish.yml`, which pushes the image and moves `latest`.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
---------
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
2026-08-15 09:09:18 +02:00
|
|
|
|
</div>
|
experimental: portfolio features (justified layout, unlisted pages, captions, per-album grid, focal point, nav links, cover hero) (#431)
## Was ist das?
Sieben neue Portfolio-Features, alle als **experimental** gekennzeichnet
— in YAML-Kommentaren, Admin-Panel-Labels und Commit-Scopes, damit sie
einzeln nachvollziehbar und revertierbar bleiben.
## Features (je ein Commit)
| Commit | Feature |
| --- | --- |
| `justified rows gallery layout` | Neues Grid-Layout `justified`:
zeilenbasiert, gleiche Höhen, volle Breite — Flexbox ohne JS-Messung,
letzte Zeile bleibt natürlich klein |
| `hide subpages from navigation` | `hidden: true`: Seite aus
Nav/Homepage raus, per Direktlink erreichbar — im Gegensatz zu `enabled:
false` (404) |
| `lightbox captions` | Immich-Asset-Description als Bildunterschrift im
Info-Panel; EXIF-Route liefert bei `exifOnHover: false` jetzt nur noch
die Caption statt 403 |
| `per-album grid overrides` | `grid:` pro Album-Eintrag, Präzedenz
global < Subpage < Album |
| `per-album cover focal point` | `coverPosition:` → `object-position`
auf Cover-Karten, strikt validiert |
| `external links in header navigation` | `navLinks:` in settings.yaml,
nur http(s), sanitisiert |
| `cover splash hero style` | `heroStyle: cover`: Fullscreen-Splash mit
Enter-Link ins Portfolio |
Alle Optionen sind im Admin-Panel editierbar (PageBuilder /
SettingsEditor).
## Tests
- 356 Unit-Tests grün (13 neue: deriveGallery hidden/grid/coverPosition,
sanitizeNavLinks, EXIF-Route-Captions, justified-Layout-Validierung)
- `npx tsc --noEmit`: 0 Fehler
- `npm run build`: sauber
- Justified-Zeilenmathematik und Cover-Splash per Browser-Harness
visuell/numerisch verifiziert (volle Zeilen enden exakt an der
Containerkante, letzte Zeile bleibt natürlich)
---------
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
2026-08-14 17:56:22 +02:00
|
|
|
|
</div>
|
security: add Trivy container scan to Docker publish workflow (#399)
* feat(admin): add backup manager UI with 1-click restore
* feat(admin): collapse older backup entries by default
* fix(theme): isolate admin layout, instant DOM theme updates, and add Light/Dark mode toggle
* feat(admin): replace text controls for Photo Frame and Hero Style with visual preview cards
* fix(admin): define missing CSS rules for button system (.btn, .preset-btn)
* feat(admin): redesign theme settings with segmented mode toggle, accent color swatches, and custom iOS-style toggle cards
* feat(admin): upgrade all settings tabs with visual grid previews, Google SEO snippet preview, and toggle cards
* feat(admin): overhaul Pages Builder UX with slide-over drawer, card hover badges, real-time search, and floating save bar
* fix(admin): remove leftover dangling syntax snippet in PageBuilder.tsx
* fix(admin): add position: relative to subpage-tile so hover overlay is contained inside the tile
* style(admin): replace all emojis with clean Leica-style vector SVG icons
* fix(types): extend IconProps with SVGProps to allow style prop on Leica SVG icons
* feat(admin): add subpage live-preview, privacy analytics, and asset protection settings
* fix(typecheck): fix AlbumEntry property access in subpage drawer preview mode
* fix(types): fix ImmichAlbumInfo property names thumbnailAssetId and albumName in PageBuilder.tsx
* fix(types): add protection and watermark optional properties to AppConfig interface
* feat(settings): add toggle for disabling analytics tracking (defaults to enabled)
* feat(ux): show status banner when analytics tracking is disabled + add live sync indicator
* feat(watermark): render customizable watermark overlay on Lightbox images + rename section to Portfolio Features & Modules
* fix(types): import type LightboxWatermark in PhotoGrid.tsx
* fix(types): destructure watermark prop in PhotoGrid function signature
* feat(seo): add configurable subpage title template and metadata descriptions
* feat(seo): add generateMetadata to about page for title template support
* feat(proofing): add client proofing, favorites selection, compact URL bitmasking, and export modal
* feat(essay): add Photo Essay storytelling mode with RSC markdown parser and fullbleed/pair layouts
* feat(subpages): add page enabled toggle to deactivate subpages without deleting them
* feat(admin): add visual essay block builder for photo essay storytelling pages
* security: add Trivy container scan to Docker publish workflow
Scans the built image for CRITICAL/HIGH CVEs on every release and
uploads results to the GitHub Security tab. Non-blocking for now
(exit-code 0) so releases aren't gated on findings. Also documents
the scan and existing Dependabot coverage in the README.
---------
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-08-07 11:08:04 +02:00
|
|
|
|
)}
|
feat: add visual admin panel with page builder and settings editor
- Add /admin route with password-protected visual page builder
- Page Builder: manage hero images, standalone albums, subpages, and sections
- Album Picker: browse all shared Immich albums with search and filtering
- Settings Editor: theme, grid, footer, legal, SEO configuration
- YAML service with atomic writes and automatic backups (content/.backups/)
- HMAC-signed admin sessions (24h expiry, HttpOnly cookies)
- API endpoints: /api/admin/{auth,gallery,settings,albums,reload}
- Enable with ADMIN_PASSWORD env var; disabled by default
- invalidateConfigCache() export for hot-reload after saves
2026-05-29 17:04:37 +02:00
|
|
|
|
</div>
|
2026-05-29 17:29:26 +02:00
|
|
|
|
|
security: add Trivy container scan to Docker publish workflow (#399)
* feat(admin): add backup manager UI with 1-click restore
* feat(admin): collapse older backup entries by default
* fix(theme): isolate admin layout, instant DOM theme updates, and add Light/Dark mode toggle
* feat(admin): replace text controls for Photo Frame and Hero Style with visual preview cards
* fix(admin): define missing CSS rules for button system (.btn, .preset-btn)
* feat(admin): redesign theme settings with segmented mode toggle, accent color swatches, and custom iOS-style toggle cards
* feat(admin): upgrade all settings tabs with visual grid previews, Google SEO snippet preview, and toggle cards
* feat(admin): overhaul Pages Builder UX with slide-over drawer, card hover badges, real-time search, and floating save bar
* fix(admin): remove leftover dangling syntax snippet in PageBuilder.tsx
* fix(admin): add position: relative to subpage-tile so hover overlay is contained inside the tile
* style(admin): replace all emojis with clean Leica-style vector SVG icons
* fix(types): extend IconProps with SVGProps to allow style prop on Leica SVG icons
* feat(admin): add subpage live-preview, privacy analytics, and asset protection settings
* fix(typecheck): fix AlbumEntry property access in subpage drawer preview mode
* fix(types): fix ImmichAlbumInfo property names thumbnailAssetId and albumName in PageBuilder.tsx
* fix(types): add protection and watermark optional properties to AppConfig interface
* feat(settings): add toggle for disabling analytics tracking (defaults to enabled)
* feat(ux): show status banner when analytics tracking is disabled + add live sync indicator
* feat(watermark): render customizable watermark overlay on Lightbox images + rename section to Portfolio Features & Modules
* fix(types): import type LightboxWatermark in PhotoGrid.tsx
* fix(types): destructure watermark prop in PhotoGrid function signature
* feat(seo): add configurable subpage title template and metadata descriptions
* feat(seo): add generateMetadata to about page for title template support
* feat(proofing): add client proofing, favorites selection, compact URL bitmasking, and export modal
* feat(essay): add Photo Essay storytelling mode with RSC markdown parser and fullbleed/pair layouts
* feat(subpages): add page enabled toggle to deactivate subpages without deleting them
* feat(admin): add visual essay block builder for photo essay storytelling pages
* security: add Trivy container scan to Docker publish workflow
Scans the built image for CRITICAL/HIGH CVEs on every release and
uploads results to the GitHub Security tab. Non-blocking for now
(exit-code 0) so releases aren't gated on findings. Also documents
the scan and existing Dependabot coverage in the README.
---------
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-08-07 11:08:04 +02:00
|
|
|
|
<div className="subpage-drawer-footer">
|
2026-05-29 17:29:26 +02:00
|
|
|
|
<button
|
security: add Trivy container scan to Docker publish workflow (#399)
* feat(admin): add backup manager UI with 1-click restore
* feat(admin): collapse older backup entries by default
* fix(theme): isolate admin layout, instant DOM theme updates, and add Light/Dark mode toggle
* feat(admin): replace text controls for Photo Frame and Hero Style with visual preview cards
* fix(admin): define missing CSS rules for button system (.btn, .preset-btn)
* feat(admin): redesign theme settings with segmented mode toggle, accent color swatches, and custom iOS-style toggle cards
* feat(admin): upgrade all settings tabs with visual grid previews, Google SEO snippet preview, and toggle cards
* feat(admin): overhaul Pages Builder UX with slide-over drawer, card hover badges, real-time search, and floating save bar
* fix(admin): remove leftover dangling syntax snippet in PageBuilder.tsx
* fix(admin): add position: relative to subpage-tile so hover overlay is contained inside the tile
* style(admin): replace all emojis with clean Leica-style vector SVG icons
* fix(types): extend IconProps with SVGProps to allow style prop on Leica SVG icons
* feat(admin): add subpage live-preview, privacy analytics, and asset protection settings
* fix(typecheck): fix AlbumEntry property access in subpage drawer preview mode
* fix(types): fix ImmichAlbumInfo property names thumbnailAssetId and albumName in PageBuilder.tsx
* fix(types): add protection and watermark optional properties to AppConfig interface
* feat(settings): add toggle for disabling analytics tracking (defaults to enabled)
* feat(ux): show status banner when analytics tracking is disabled + add live sync indicator
* feat(watermark): render customizable watermark overlay on Lightbox images + rename section to Portfolio Features & Modules
* fix(types): import type LightboxWatermark in PhotoGrid.tsx
* fix(types): destructure watermark prop in PhotoGrid function signature
* feat(seo): add configurable subpage title template and metadata descriptions
* feat(seo): add generateMetadata to about page for title template support
* feat(proofing): add client proofing, favorites selection, compact URL bitmasking, and export modal
* feat(essay): add Photo Essay storytelling mode with RSC markdown parser and fullbleed/pair layouts
* feat(subpages): add page enabled toggle to deactivate subpages without deleting them
* feat(admin): add visual essay block builder for photo essay storytelling pages
* security: add Trivy container scan to Docker publish workflow
Scans the built image for CRITICAL/HIGH CVEs on every release and
uploads results to the GitHub Security tab. Non-blocking for now
(exit-code 0) so releases aren't gated on findings. Also documents
the scan and existing Dependabot coverage in the README.
---------
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-08-07 11:08:04 +02:00
|
|
|
|
className="admin-btn admin-btn-danger admin-btn-sm"
|
|
|
|
|
|
onClick={() => {
|
|
|
|
|
|
removeSubpage(spIndex);
|
|
|
|
|
|
setExpandedSubpage(null);
|
|
|
|
|
|
}}
|
2026-05-29 17:29:26 +02:00
|
|
|
|
>
|
2026-08-14 11:10:42 +02:00
|
|
|
|
<IconTrash size={14} /> Delete Subpage
|
2026-05-29 17:29:26 +02:00
|
|
|
|
</button>
|
security: add Trivy container scan to Docker publish workflow (#399)
* feat(admin): add backup manager UI with 1-click restore
* feat(admin): collapse older backup entries by default
* fix(theme): isolate admin layout, instant DOM theme updates, and add Light/Dark mode toggle
* feat(admin): replace text controls for Photo Frame and Hero Style with visual preview cards
* fix(admin): define missing CSS rules for button system (.btn, .preset-btn)
* feat(admin): redesign theme settings with segmented mode toggle, accent color swatches, and custom iOS-style toggle cards
* feat(admin): upgrade all settings tabs with visual grid previews, Google SEO snippet preview, and toggle cards
* feat(admin): overhaul Pages Builder UX with slide-over drawer, card hover badges, real-time search, and floating save bar
* fix(admin): remove leftover dangling syntax snippet in PageBuilder.tsx
* fix(admin): add position: relative to subpage-tile so hover overlay is contained inside the tile
* style(admin): replace all emojis with clean Leica-style vector SVG icons
* fix(types): extend IconProps with SVGProps to allow style prop on Leica SVG icons
* feat(admin): add subpage live-preview, privacy analytics, and asset protection settings
* fix(typecheck): fix AlbumEntry property access in subpage drawer preview mode
* fix(types): fix ImmichAlbumInfo property names thumbnailAssetId and albumName in PageBuilder.tsx
* fix(types): add protection and watermark optional properties to AppConfig interface
* feat(settings): add toggle for disabling analytics tracking (defaults to enabled)
* feat(ux): show status banner when analytics tracking is disabled + add live sync indicator
* feat(watermark): render customizable watermark overlay on Lightbox images + rename section to Portfolio Features & Modules
* fix(types): import type LightboxWatermark in PhotoGrid.tsx
* fix(types): destructure watermark prop in PhotoGrid function signature
* feat(seo): add configurable subpage title template and metadata descriptions
* feat(seo): add generateMetadata to about page for title template support
* feat(proofing): add client proofing, favorites selection, compact URL bitmasking, and export modal
* feat(essay): add Photo Essay storytelling mode with RSC markdown parser and fullbleed/pair layouts
* feat(subpages): add page enabled toggle to deactivate subpages without deleting them
* feat(admin): add visual essay block builder for photo essay storytelling pages
* security: add Trivy container scan to Docker publish workflow
Scans the built image for CRITICAL/HIGH CVEs on every release and
uploads results to the GitHub Security tab. Non-blocking for now
(exit-code 0) so releases aren't gated on findings. Also documents
the scan and existing Dependabot coverage in the README.
---------
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-08-07 11:08:04 +02:00
|
|
|
|
<button
|
|
|
|
|
|
className="admin-btn admin-btn-primary admin-btn-sm"
|
|
|
|
|
|
onClick={() => setExpandedSubpage(null)}
|
|
|
|
|
|
>
|
|
|
|
|
|
Done
|
|
|
|
|
|
</button>
|
|
|
|
|
|
</div>
|
|
|
|
|
|
</>
|
|
|
|
|
|
);
|
|
|
|
|
|
})()}
|
|
|
|
|
|
</div>
|
feat: add visual admin panel with page builder and settings editor
- Add /admin route with password-protected visual page builder
- Page Builder: manage hero images, standalone albums, subpages, and sections
- Album Picker: browse all shared Immich albums with search and filtering
- Settings Editor: theme, grid, footer, legal, SEO configuration
- YAML service with atomic writes and automatic backups (content/.backups/)
- HMAC-signed admin sessions (24h expiry, HttpOnly cookies)
- API endpoints: /api/admin/{auth,gallery,settings,albums,reload}
- Enable with ADMIN_PASSWORD env var; disabled by default
- invalidateConfigCache() export for hot-reload after saves
2026-05-29 17:04:37 +02:00
|
|
|
|
</div>
|
2026-05-29 17:29:26 +02:00
|
|
|
|
)}
|
feat: add visual admin panel with page builder and settings editor
- Add /admin route with password-protected visual page builder
- Page Builder: manage hero images, standalone albums, subpages, and sections
- Album Picker: browse all shared Immich albums with search and filtering
- Settings Editor: theme, grid, footer, legal, SEO configuration
- YAML service with atomic writes and automatic backups (content/.backups/)
- HMAC-signed admin sessions (24h expiry, HttpOnly cookies)
- API endpoints: /api/admin/{auth,gallery,settings,albums,reload}
- Enable with ADMIN_PASSWORD env var; disabled by default
- invalidateConfigCache() export for hot-reload after saves
2026-05-29 17:04:37 +02:00
|
|
|
|
</section>
|
|
|
|
|
|
|
|
|
|
|
|
{/* Album Picker Modal */}
|
|
|
|
|
|
{pickerTarget && (
|
|
|
|
|
|
<AlbumPicker
|
|
|
|
|
|
albums={immichAlbums}
|
|
|
|
|
|
onSelect={handlePickAlbum}
|
|
|
|
|
|
onClose={() => setPickerTarget(null)}
|
|
|
|
|
|
usedAlbumIds={getAllUsedAlbumIds()}
|
|
|
|
|
|
/>
|
|
|
|
|
|
)}
|
2026-05-29 17:59:25 +02:00
|
|
|
|
|
2026-05-31 21:30:00 +02:00
|
|
|
|
{/* Slide-over Drawer for Album Details (Centered 2-Column Modal) */}
|
2026-05-31 21:27:13 +02:00
|
|
|
|
{(() => {
|
|
|
|
|
|
if (!editingAlbumAddress) return null;
|
|
|
|
|
|
const info = getEditingAlbumInfo(editingAlbumAddress);
|
|
|
|
|
|
if (!info) return null;
|
|
|
|
|
|
const { album, name, count, thumbnailId, onUpdate, onRemove } = info;
|
|
|
|
|
|
const heroThumb = album.heroImage || thumbnailId;
|
|
|
|
|
|
|
|
|
|
|
|
return (
|
|
|
|
|
|
<div className="album-drawer-overlay open" onClick={() => setEditingAlbumAddress(null)}>
|
|
|
|
|
|
<div className="album-drawer" onClick={(e) => e.stopPropagation()}>
|
|
|
|
|
|
<div className="album-drawer-header">
|
|
|
|
|
|
<h3>
|
2026-08-14 11:10:42 +02:00
|
|
|
|
<IconCamera /> Edit Album Details
|
2026-05-31 21:27:13 +02:00
|
|
|
|
</h3>
|
|
|
|
|
|
<button
|
|
|
|
|
|
className="admin-btn-icon"
|
|
|
|
|
|
onClick={() => setEditingAlbumAddress(null)}
|
|
|
|
|
|
title="Close details"
|
|
|
|
|
|
>
|
2026-08-14 11:10:42 +02:00
|
|
|
|
<IconX size={14} />
|
2026-05-31 21:27:13 +02:00
|
|
|
|
</button>
|
|
|
|
|
|
</div>
|
release: v0.11.0 — journal fixes, admin URLs, design system cleanup (#432)
* fix(screenshots): sharp-Typen fuer 0.34 und 0.35 gleichzeitig (#410)
sharp 0.35 ist von `export =` auf ESM umgestellt: der Modul-Namespace
ist nicht mehr aufrufbar, die Factory sitzt unter .default. Der
Type-Check brach damit in scripts/screenshots.ts weg, sobald der
Next-Bump (#402) sharp von 0.34.5 auf 0.35.3 mitzieht -- sharp ist hier
keine deklarierte Dependency, sondern kommt ueber Next mit.
Die Form wird jetzt aus dem installierten Paket abgeleitet statt
festgeschrieben, zur Laufzeit wie im Typ. Geprueft mit beiden
Versionen: tsc laeuft mit 0.34.5 und mit 0.35.3 fehlerfrei durch.
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
* chore(deps): bump the nextjs group across 1 directory with 2 updates (#402)
Bumps the nextjs group with 2 updates in the / directory: [next](https://github.com/vercel/next.js) and [eslint-config-next](https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next).
Updates `next` from 16.2.12 to 16.3.0
- [Release notes](https://github.com/vercel/next.js/releases)
- [Commits](https://github.com/vercel/next.js/compare/v16.2.12...v16.3.0)
Updates `eslint-config-next` from 16.2.12 to 16.3.0
- [Release notes](https://github.com/vercel/next.js/releases)
- [Commits](https://github.com/vercel/next.js/commits/v16.3.0/packages/eslint-config-next)
---
updated-dependencies:
- dependency-name: eslint-config-next
dependency-version: 16.3.0
dependency-type: direct:development
update-type: version-update:semver-minor
dependency-group: nextjs
- dependency-name: next
dependency-version: 16.3.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: nextjs
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* chore(deps-dev): bump prettier from 3.8.3 to 3.9.6 (#405)
Bumps [prettier](https://github.com/prettier/prettier) from 3.8.3 to 3.9.6.
- [Release notes](https://github.com/prettier/prettier/releases)
- [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md)
- [Commits](https://github.com/prettier/prettier/compare/3.8.3...3.9.6)
---
updated-dependencies:
- dependency-name: prettier
dependency-version: 3.9.6
dependency-type: direct:development
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* docs(changelog): Unreleased-Sektion fuer die Bumps nach v0.10.0 (#413)
Die Dependency-PRs sind nach dem Release auf dev gelandet, teils auch
auf main. Ohne Eintrag waeren sie beim naechsten Release unsichtbar --
inklusive Next 16.3.0, das CVE-2025-13465 mitbringt.
Ausserdem im 0.10.0-Abschnitt nachgetragen, dass der Trivy-Scan bis
#409 nie gelaufen ist. Der Fix steckt im Tag v0.10.0, fehlte aber in der
Aufzaehlung -- und "Images werden bei jedem Publish gescannt" stand im
Changelog, waehrend der Job im Action-Setup abbrach.
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
* feat(gallery): per-album sort order, independent of Immich (#408) (#414)
Album order was dictated entirely by Immich: getAlbum() sorted by the
album's own asc/desc flag, so a Folio album always mirrored the archive.
A curated series has a narrative order that has nothing to do with
capture time, and changing the Immich album's sort to fit the website
changes it for the archive too.
Adds an optional per-album `sort` in gallery.yaml, editable in /admin,
defaulting to today's behaviour so every existing config is unchanged:
immich (default) | newest | oldest | filename | manual
`manual` is a pinned *prefix*: `assetOrder` lists only the photos placed
by hand, everything else follows in the album's Immich order. A full
permutation of a 2,000-photo album would be ~80 KB of UUIDs in a file
that is rewritten and copied to content/.backups/ on every admin save.
It also makes drift fall out for free — photos removed in Immich never
match, new ones land in the tail rather than being hidden.
Sorting is applied after the cache read, not before the cache write, so
the LRU keeps one canonical Immich-ordered copy per album. That avoids
putting the mode in the cache key, lets a config change take effect
without depending on invalidation, and keeps the stale-serving path
correct. cache.get() returns the stored object by reference, so
withSort() returns a shallow clone with a new array — sorting in place
would reorder the shared entry, and under request coalescing every
concurrent caller would be sorting the same array.
Also fixes a prerequisite bug: /api/admin/albums/[albumId]/assets read
album.assets from GET /albums/:id, which Immich 3.x no longer populates
(lib/immich.ts:507). The hero picker's "This Album" tab returned nothing
and threw outright when the key was absent. It now goes through the
client's paginated metadata search, with ?types=all to opt videos in for
the reorder editor.
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
* refactor(admin): drop decorative emoji from the sort select labels (#415)
An <option> cannot contain markup, so the SVG set in Icons is not
reachable there — but a decorative emoji is not a substitute for it.
Plain text instead; the album card badge already uses a real icon.
The remaining emoji in the admin panel (asset picker tabs, section
headings, layout picker options) predate this branch and are left for a
separate cleanup.
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
* refactor(admin): replace emoji icons with the shared SVG icon set (#416)
The admin panel mixed two icon conventions: inline SVGs from
`Icons.tsx` in most components, and decorative emoji in the asset
picker and a few PageBuilder labels. Emoji render inconsistently
across platforms, ignore the accent colour, and cannot inherit the
`.svg-icon` sizing rules.
- Icons.tsx: add `IconStar` (filled — it marks a state, not an
action) and `IconImage`.
- AssetPicker: the three tab labels and the favourite tile badge now
use IconFolder / IconStar / IconImage.
- PageBuilder: the "Standalone Albums" and "Subpages" headings use
the icon set instead of an emoji.
- PageBuilder: the layout picker drops its emoji for plain text. An
<option> cannot contain markup, so an SVG is impossible there and a
decorative glyph is not a substitute.
- admin.css: align icon and label in the picker tabs, and swap the
favourite badge's text-shadow for drop-shadow, which is what
applies to an inline SVG.
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
* refactor(admin): fold PageBuilder's local icons into the shared Icons module (#418)
* refactor(admin): fold PageBuilder's local icons into the shared module
PageBuilder.tsx carried its own `Icons` object duplicating most of the
glyphs already exported by Icons.tsx, with hardcoded sizes and slightly
divergent paths. Migrate all 32 call sites to the shared module and
delete the local object.
Five glyphs had no counterpart and are added to Icons.tsx as 1:1 ports
of the local paths: IconX, IconPlus, IconHome, IconCopy, IconImage.
The local ExternalLink and Check are dropped rather than ported — both
had zero call sites.
Two glyphs change shape slightly, which is the point of consolidating:
the shared IconCamera includes the viewfinder bump the local copy
omitted, and drag handles now use IconGripVertical.
IconGripVertical uses the module's square 24x24 viewBox, so `.svg-drag`
goes from 12x18 to 18x18 — the old non-square box would letterbox the
glyph down to 12x12 and shrink the handle.
* fix(admin): resolve icon-module integration after #416
Merging dev brought in #416, which added a second IconImage to Icons.tsx
and two <Icons.Camera>/<Icons.Folder> section headers that reference the
local Icons object this PR removes. Git merged both cleanly but the result
did not type-check.
- drop the duplicate IconImage (both copies were byte-identical)
- point the two section headers at the imported IconCamera/IconFolder
- refresh the SORT_LABELS comment: the icon set is imported now, not
declared below
---------
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
* fix(config): allow an empty gallery, guard against a double /api suffix (#421)
An empty gallery is now a valid, rendered state instead of a throw: deriveGallery() no longer requires at least one album or subpage, so a deployment with no albums yet renders a bare homepage the owner can fill in via /admin.
getConfig() also stops appending /api to an Immich URL that already ends in it, which previously produced .../api/api and broke every upstream request.
Includes a restore of the per-album sort test cases, which the branch had lost by being cut before #408/#414.
* feat(admin): favicon upload, served from the content volume (#422)
Adds a bundled default favicon, an upload widget in admin Settings > General, and a route that serves the icon from the writable content/ volume with a fallback to the bundled default. Raster uploads (PNG/ICO/JPEG) are wrapped in an SVG container; the response carries its own CSP so an uploaded SVG cannot execute script on the origin.
The GET route revalidates with an ETag instead of caching immutably, so a newly uploaded icon shows up immediately. Uploads are written via temp file + rename, and a Reset button restores the bundled default.
* ci: flag unformatted files in a PR, without blocking it (#424)
Prettier is configured as an error rule in eslint.config.mjs but has never run in CI, so part of the tree predates it. A final CI step now diffs against the PR base, runs prettier --list-different over the changed files, and emits a warning annotation per offender plus a job summary.
Advisory by design: it never fails the job. Blocking would turn a PR red for merely touching a file that was already unformatted, and normalising the tree in one commit would wreck git blame and conflict with the PRs in flight.
Requires fetch-depth: 0, since diffing against the base needs its history.
* feat(install): first-run wizard gated by a one-time setup token (#419)
Adds /install, a four-step first-run wizard: connect to Immich, optionally pick albums, name the site, finish. It verifies the credentials against the Immich server before writing anything, then writes gallery.yaml, settings.yaml and a content/install.json carrying the Immich credentials and a generated site secret.
install.json exists because a running process cannot pick up new env vars — the wizard has to write configuration that takes effect without a restart. getInstallCredentials() merges it under the real environment, so env vars always win and rotation stays a matter of setting one.
Both the page and the API routes are gated by a one-time setup token printed to the server log, so a deployment that is reachable before gallery.yaml exists cannot be configured by whoever finds it first. The token is stored in content/.setup-token (0600) rather than a module variable: Next.js bundles the page and each route handler separately, so a module-level token left the page and the API disagreeing inside one process and the wizard stuck on step 1. It is removed once the install completes.
The admin password is stored as an scrypt hash using the scheme lib/auth.ts already applies to album passwords; a plaintext ADMIN_PASSWORD env var keeps working.
* docs: document the setup wizard, fix the read-only content mount (#425)
Quick Start now leads with the /install wizard, with the hand-written YAML route kept alongside it, and a First-Run Setup section covers the setup token, the files the wizard writes, and env-var precedence.
Two corrections: both Docker examples mounted content/ as :ro, which silently breaks the wizard, the admin panel and the backup rotation alike — docs/admin-panel.md already said so and the README contradicted it. And nothing documented that content/install.json holds the Immich API key, so a backup of content/ is a backup of credentials.
Also adds a Contributors section crediting the people whose work is in the project.
* feat(admin): floating save bar pinned to the bottom of the viewport (#426)
The save bar was the first, static element inside .admin-main. Since the
document itself scrolls, it left the viewport as soon as you scrolled down
— editing a subpage section or a settings block far below gave no visible
dirty hint and no reachable save button.
Replace it with a bottom-pinned floating bar shared by both editors. It
only mounts while there is something to act on (unsaved changes, an
in-flight save, or a result message), so it never covers content while
idle. The success message clears after 5s, which hides the bar again.
- new SaveBar component, replacing the duplicated markup in PageBuilder
and SettingsEditor
- adopt the previously unused .floating-save-bar CSS: slide-in keyframes
(carrying translateX(-50%)), dirty border, wrap/gap, mobile variant and
a prefers-reduced-motion opt-out; z-index 900 keeps it below modals
- .admin-main gains bottom padding so the bar never covers page content
- drop the now-unreachable idle hints: the ⌘S hint becomes a button title,
the Live Sync note becomes a static line above the settings layout
- header "Site" link now bypasses the cache (/?fresh=1), so the preview
stays reachable when the bar is hidden
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
* feat(admin): themed listbox for the album sort control (#427)
The per-album "Photo order" control was a native <select>. Because an
<option> cannot contain markup, its choices could not use the admin
panel's currentColor SVG set — the reason #415 had to fall back to plain
text after dropping the emoji labels.
Adds a Listbox component implementing the ARIA combobox/listbox pattern,
so options can render a glyph beside their label:
- DOM focus stays on the trigger button; the active option is announced
through aria-activedescendant, keeping focus management to one element
- Keyboard: arrows (clamped at the ends, like a native select),
Home/End, Enter/Space to commit, Escape to cancel, Tab commits and
moves on, and prefix type-ahead with a repeat-key cycle
- Outside dismissal on pointerdown, so a press starting outside closes
the popup before the click retargets
The sort options now carry an icon each: calendar, arrow-down, arrow-up,
an A→Z marker, and the drag glyph for manual — matching the badge the
album card already shows. SORT_LABELS stays plain text because the badge
feeds it to a title attribute.
Closes #417
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
* chore(git): ignore generated design handoff folders
* fix(admin): stop the album sort dropdown clipping, and simplify the panel (#428)
* fix(admin): render listbox popup in a portal so it escapes modal clipping
The sort control's popup was position:absolute inside three clipping ancestors
(.album-drawer overflow:hidden > .album-drawer-body overflow-y:auto >
.modal-right-column overflow-y:auto), so it was cut off at the bottom of the
Edit Album Details modal. z-index could not help: clipping happens before
stacking. It also always hung below the trigger, with no flip.
Portal the popup to document.body and position it from the trigger's viewport
rect, flipping above when there is more room there and capping max-height to the
space available so it scrolls internally rather than overflowing. It is
dismissed on scroll and resize, since the anchor is only measured on open.
The outside-pointerdown handler now also treats the popup as inside; without
that the portalled list counts as outside, and a click on an option would close
it before the selection commits.
* refactor(admin): single-column album details panel
The left column spent 1.2fr on a cover thumbnail and three stat rows, two of
which (Status, Custom Hero) only restated the form fields opposite them, while
the form itself was squeezed into 1.8fr behind a second nested scroller.
Stack the drawer in one column instead: cover as a banner, then the form at full
width, with the UUID moved into the footer. The body is now the only scroll
container, which also removes one of the ancestors that was clipping the sort
popup.
---------
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
* fix(admin): give the portalled listbox its theme back, lock the page behind modals (#429)
Two defects in the album editor.
The sort listbox popup painted transparent. Every --admin-* variable is
scoped to .admin-layout, and since the popup moved into document.body it
sits outside that subtree, so background/border/text all resolved to
nothing. It now carries its own copy of the palette in both colour
schemes, plus the font it no longer inherits.
Scrolling inside a modal also moved the page behind it. No admin modal
ever locked body scroll: the overlay covers the page but does not absorb
wheel events, so a scroll starting on the backdrop — or continuing past
the end of the modal's own scroller — reaches the document.
overscroll-behavior cannot cover that case on its own, because it only
applies to scroll containers and the backdrop is not one.
useScrollLock freezes body while a modal is open and compensates for the
width the scrollbar gives up, so nothing shifts underneath. Each lock
restores the inline value it found, which makes nesting work without a
counter — a picker opened from the drawer restores the drawer's hidden
state instead of clearing it. Applied to both drawers and all four
picker modals, which share the defect. overscroll-behavior: contain on
the scrollers stops the chaining they can handle themselves.
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
* fix(security): allow unsafe-eval in CSP script-src during dev mode
* feat(journal): add Journal Studio with split-screen editor, live preview and dedicated routes
* fix(build): separate client parser from server journal-service and fix build type errors
* fix(journal): Fotos rendern, Layout und Lightbox-Steuerung korrigieren
Fünf unabhängige Fehler in der öffentlichen Journal- und Essay-Ansicht:
* Foto-Blöcke wurden nie angezeigt. EssayView löst ein Foto über
PhotoItem.id auf, und das sind verschlüsselte Tokens — die Blöcke aus
dem Markdown tragen aber rohe Asset-UUIDs. Jede Zuordnung lief ins
Leere, und nicht auflösbare Blöcke werden still verworfen. Die IDs
werden jetzt serverseitig übersetzt; damit verschwinden nebenbei die
rohen UUIDs aus dem Client-Payload, die dort laut Projektregel nie
auftauchen dürfen. Nicht auflösbare Referenzen werden geloggt.
* Überschriften standen weiter links als der Fließtext. Jeder Block
hatte einzeln `max-width: 68ch`, und `ch` ist relativ zur Schrift des
Elements — die Serif-Überschrift ergab eine breitere Spalte. Ersetzt
durch eine gemeinsame, font-unabhängige `--essay-measure`.
* Fullbleed-Fotos bluteten nur nach links aus: `.essay-figure` ist
`width: 100%`, wodurch die Box überbestimmt ist und der negative
rechte Margin verworfen wird.
* Foto-Paare stellten beide Bilder gleich breit dar, wodurch ein
Hochformat neben einem Querformat doppelt so hoch wurde. Jetzt eine
Justified-Reihe: Breite proportional zum Seitenverhältnis, dadurch
exakt gleiche Höhen ohne Beschnitt.
* Die Lightbox hatte im Journal keine Tastatursteuerung und keine
Scroll-Sperre — beides lag in PhotoGrid, also nur im Album-Raster.
Verlagert in die Lightbox selbst, der doppelte Handler in PhotoGrid
entfernt (sonst wäre pro Pfeildruck zwei Bilder weitergesprungen).
Zusätzlich sind Proofing-Herzen und das EXIF-Panel im redaktionellen
Modus abschaltbar und im Journal aus: Client-Proofing ist ein
Übergabe-Workflow für Alben, keine Funktion einer Reportage. Auf der
Übersicht wurde der Untertitel doppelt gerendert, weil extractExcerpt()
auf ihn zurückfällt.
* feat(admin): eigene URLs für alle Bereiche und überarbeiteter Journal Studio
Das Panel war eine einzige Client-Komponente, die ihre Tabs über
useState umschaltet: keine Route pro Bereich, kein Deep-Link, kein
Zurück-Button, und nach jedem Reload landete man wieder auf "Pages".
Auch der Journal-Editor hatte keine eigene URL.
Jetzt sieben echte Routen (/admin, /admin/pages, /admin/journal,
/admin/journal/<slug>, /admin/settings, /admin/settings/<section>,
/admin/analytics). Die Shell mit Auth-Prüfung und Kopfzeile sitzt im
Layout und umschließt children — so bleibt die Session-Prüfung über
Routenwechsel montiert, statt bei jedem Tab-Wechsel neu zu laufen und
den Spinner aufblitzen zu lassen. Unbekannte Settings-Sections fallen
auf General zurück.
Im selben Zug der Journal Studio, der die Routing-Änderung ohnehin
berührt:
* Alle Eingabefelder nutzten die Klasse `admin-input`, die in keinem
CSS definiert war — sie fielen auf Browser-Defaults zurück. Jetzt
gestylt, gescoped, damit der generische Name nicht ins übrige Panel
leckt.
* Der Split View ist per Divider verschiebbar (Maus, Tastatur,
Doppelklick zum Zurücksetzen), Breite in localStorage.
* Das Studio bricht aus der 1120px-Spalte aus, die Preview hat Platz.
* Die Preview zeigte für jedes Foto fest 3:2 und log damit über das
Layout der veröffentlichten Seite; die echten Verhältnisse werden
jetzt an den Thumbnails gemessen.
* Blöcke mit alten positionsbasierten Foto-Referenzen werden markiert —
die lassen sich auf einer eigenständigen Journal-Seite nicht auflösen
und verschwanden bisher stillschweigend.
* Blocktyp-Chips als gemeinsame Komponente, monochrom und per Icon
unterschieden statt in einer eigenen Blau/Lila/Orange-Palette, die
sonst nirgends im Panel vorkommt.
* Emojis raus, SVG-Icons rein.
* fix(admin): Designsystem-Lücken im Panel schließen
Eine systematische Suche nach Klassen, die im TSX benutzt, aber in
keinem CSS definiert sind, hat vier Stellen mit demselben Muster
gefunden:
* `admin-btn-secondary` und `admin-btn-danger` existierten nicht.
Sämtliche Löschen-Buttons sahen aus wie normale Buttons — keine
Warnwirkung. Als `.admin-btn.admin-btn-danger` geschrieben, weil die
Varianten mit den Größenklassen kombiniert werden, die weiter unten
ihren eigenen Hintergrund setzen.
* `page-progress-fill` fehlte: die Balken im Analytics-Panel waren
leere Rinnen, der Wert unsichtbar. Ebenso `analytics-empty` und
`admin-loading-container`.
* `subpage-drawer-section`, `subpage-drawer-title-group` und
`input-with-icon` im PageBuilder waren wirkungslos und teils mit
Inline-Styles notdürftig kompensiert.
* `grid-card-preview` fehlte, wodurch alle Layout-Vorschauen auf Höhe
null kollabierten. Nur "Showcase" war sichtbar — und das aus Versehen,
weil sein Tile `hero-tile` hieß und damit die `aspect-ratio` einer
fremden PageBuilder-Klasse erbte. Umbenannt.
Dazu die Theme-Vorschauen, die praktisch identisch aussahen: alle
sieben zeigten dieselben drei quadratischen Kacheln, einziger
Unterschied war die Hintergrundfarbe. Sie spiegeln jetzt die echten
Preset-Daten aus lib/config/theme.ts — Schriftcharakter, Eckradius,
Rasterdichte, Passepartout bzw. Schatten.
Die Kopfzeile richtet sich an einer gemeinsamen Steuerhöhe aus. Der
"Site"-Link war höher als die Buttons daneben: `.admin-btn` hatte keine
explizite line-height, und <button> bekommt box-sizing: border-box vom
Browser, <a> nicht. Die Statusanzeige setzte weder Schriftfamilie noch
-größe und fiel auf den Browser-Default zurück — sie war nie Teil des
Designsystems. Jetzt gleiche Höhe und Typografie, Pillenform als
Zustandsanzeige, Trenner zur Aktionsgruppe. Das dauerhafte Pulsieren
des grünen Punkts entfällt; Animation bleibt den Zuständen vorbehalten,
die Aufmerksamkeit brauchen.
Restliche Emojis durch SVG-Icons ersetzt.
* feat(admin): add scroll-to-top toggle and SVG arrow
The back-to-top button was always on and drew its arrow with the ↑ text
character. Add a `scrollToTop` setting (General section in the admin
panel, defaults to on so existing sites are unaffected) and replace the
glyph with a stroked SVG that inherits currentColor across all presets.
Scroll handling is now rAF-throttled, and prefers-reduced-motion turns
off both the hover lift and the smooth scroll.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
* security(journal): escape author HTML instead of filtering it
CodeQL flags 26 high-severity alerts on the release PR; the bulk of them
point at sanitizeHtml(), a denylist of three regexes whose output goes
into dangerouslySetInnerHTML. I reproduced the bypasses before changing
anything — all four pass the old filter:
<img src=x onerror=alert(1)> unquoted handler, regex wants quotes
<img src=x onerror='alert(1)'> single quotes, same reason
<svg onload=alert(1)> not a <script> tag
javasjavascript:cript:alert(1) one-pass replace, the rest recombines
Plus an attribute breakout in the link renderer, which interpolated the
URL into href="${url}" unescaped:
[x](" onmouseover=alert(1) x=") -> <a href="" onmouseover=alert(1" ...>
Replaced with escaping. Every `&<>"'` in author text becomes an entity
before any markdown rule runs, so the only tags in the output are the
ones renderInlineMarkdown builds itself and a URL cannot leave its
attribute. Link schemes are now an allowlist (http, https, mailto, tel,
relative, anchor); anything else renders as plain text.
The serializer needed decodeHtmlEntities to match: without it a save
would write `<` into the Markdown file and the next parse would
escape the `&` again, corrupting the text further on every round trip.
A test covers parse -> serialize -> parse stability.
Two existing tests asserted the old behaviour and were rewritten rather
than deleted: one expected the script tag to be *removed* from the
output, the other expected the substring "onerror" to be absent. Both
now assert the property that matters — that no tag can form — because
`onerror` surviving as inert text is fine.
Exploitation required admin access either way: journal and essay text
comes from the studio or from content/*.md. This removes the weakness,
it does not close an open door.
* fix(journal): contain file paths, fix frontmatter escaping, defuse two regexes
Follow-up to the CodeQL findings on release PR #432. I went through all 23
alerts individually; this addresses the ones that are worth addressing and
documents the ones that are not.
Path containment (12 alerts, all false positives). Every path built from a
slug goes through isValidSlug(), a strict `/^[a-zA-Z0-9_-]+$/` allowlist —
verified against `../../etc/passwd`, `foo/../../bar`, `a/b`, `..` and
friends, all rejected. CodeQL cannot see it because the check lives in
another module. Added a containedPath() helper that resolves the path and
refuses anything landing outside the content directory: a second lock on a
door that was already locked, and a barrier the analysis can follow. Also
removed the dead `slug.endsWith('.md')` branches — isValidSlug rejects
dots, so they could never be taken.
Frontmatter escaping (1 alert, a real bug). The serializer escaped `"` but
not `\`, and the parser never unescaped anything. A title containing either
character gained a backslash on every save/load cycle:
Path C:\Users "quoted" -> Path C:\\Users \"quoted\" -> ...
Escaping now covers the backslash first and the parser undoes both. A round
trip test covers quotes, backslashes, colons and apostrophes.
Two of three ReDoS regexes (2 alerts). The heading pattern had `\s+` next to
`(.+)`, which overlap, so the engine tried every split of the whitespace run
before failing; it is `[ \t]+` and `(\S.*)` now. The quote author pattern
wrapped a lazy group around an optional group — the quadratic case — and is
an index split on the first separator now.
The third regex, the bold/italic pass, is deliberately left alone. Rewriting
it with a negated class removes the backtracking but breaks nesting:
`**bold *and italic* here**` renders as `*<em>bold </em>and italic<em> here</em>*`.
The input is Markdown from an authenticated admin, never a visitor, so the
worst case is an author slowing down their own page. The comment in the code
says so.
Not addressed: 5 js/insufficient-password-hash alerts. They ask for a slow
KDF where the code uses SHA-256/HMAC — correct in general, but the admin
password comes from an environment variable and is never stored, so a
stronger KDF protects nothing that is not already in plaintext in the
environment.
399 unit tests pass (18 new), build and tsc clean.
* fix(journal): split the quote author by scanning, not by pattern
Cleaning up after myself. #439 replaced the quote author regex
`/^(.*?)(?:\s+--\s+(.+))?$/` — a lazy group around an optional one, the
quadratic case — with `/\s+--\s+/`, and CodeQL promptly flagged the
replacement for the same reason. One reported pattern traded for another.
splitQuoteAuthor() scans for the first `--` that has whitespace on both
sides. Linear, and it needs no reasoning about the regex engine at all.
Behaviour is identical to the original regex, checked case by case
against it: separator, no separator, several separators, tabs, wide gaps,
`a--b` without spaces, leading and trailing separators, empty string. All
nine are covered by tests, plus one asserting it stays fast on a 50k
whitespace run.
* security(admin): derive the session signing key with scrypt
getSigningKey() ran the admin password through a single SHA-256 digest.
It is key derivation rather than password storage, so it was never a
stored-hash problem — but if the derived key ever leaked, one fast hash
makes recovering the password by brute force cheap. CodeQL flags it as
js/insufficient-password-hash and, for this particular alert, has a
point.
scrypt now. Two details that matter:
The salt has to be stable. A random salt would produce a different key on
every call and invalidate every session; it is derived from AUTH_SECRET,
which is deployment-specific. Verified across separate processes: same
inputs produce a verifying token, so a restart or redeploy does not log
everyone out.
The result is cached for the process lifetime. scrypt is deliberately
slow and getSigningKey() runs on every admin request — deriving per call
would add ~24ms to each one. The cache key is a digest of secret plus
password, so a rotation misses the cache and derives again, and no extra
plaintext copy of the password is kept around.
Measured: first derivation 24ms, subsequent calls 0.12ms. Password
change and secret change both invalidate an existing token, checked in
separate processes.
Note the one-time effect: existing admin sessions are invalidated by the
change in derivation, so everyone logs in once more.
* security(admin): key the signing-key cache on its inputs, not a digest
#441 removed the SHA-256 digest of the admin password from the key
derivation and introduced a new one three lines above it, as the cache
key. Same rule, same file: CodeQL reported it immediately.
The comment justifying it was wrong too. It claimed no second plaintext
copy of the password was retained, while building the digest input
allocates exactly that in order to hash it.
The cache now holds the two input strings and compares them directly.
They are the same objects the env and install caches already hold, so
nothing extra is retained, and no fast hash of the password exists in
memory for the life of the process.
Re-verified after the change, in separate processes: a token from one
process verifies in another with the same inputs, a changed password or
secret rejects it, first derivation 24ms, cached calls 0.001ms.
That leaves scrypt as the only place the password is hashed here. The
two HMACs further down operate on the derived key and on token data, not
on the password; the constant-time comparison in verifyAdminPassword is
the previously dismissed one.
---------
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
2026-08-14 16:55:07 +02:00
|
|
|
|
{/* One scrolling column: cover banner, then the form. Anything the
|
|
|
|
|
|
form already shows (password state, custom hero) is not
|
|
|
|
|
|
repeated as a read-only stat. */}
|
2026-05-31 21:27:13 +02:00
|
|
|
|
<div className="album-drawer-body">
|
experimental: portfolio features (justified layout, unlisted pages, captions, per-album grid, focal point, nav links, cover hero) (#431)
## Was ist das?
Sieben neue Portfolio-Features, alle als **experimental** gekennzeichnet
— in YAML-Kommentaren, Admin-Panel-Labels und Commit-Scopes, damit sie
einzeln nachvollziehbar und revertierbar bleiben.
## Features (je ein Commit)
| Commit | Feature |
| --- | --- |
| `justified rows gallery layout` | Neues Grid-Layout `justified`:
zeilenbasiert, gleiche Höhen, volle Breite — Flexbox ohne JS-Messung,
letzte Zeile bleibt natürlich klein |
| `hide subpages from navigation` | `hidden: true`: Seite aus
Nav/Homepage raus, per Direktlink erreichbar — im Gegensatz zu `enabled:
false` (404) |
| `lightbox captions` | Immich-Asset-Description als Bildunterschrift im
Info-Panel; EXIF-Route liefert bei `exifOnHover: false` jetzt nur noch
die Caption statt 403 |
| `per-album grid overrides` | `grid:` pro Album-Eintrag, Präzedenz
global < Subpage < Album |
| `per-album cover focal point` | `coverPosition:` → `object-position`
auf Cover-Karten, strikt validiert |
| `external links in header navigation` | `navLinks:` in settings.yaml,
nur http(s), sanitisiert |
| `cover splash hero style` | `heroStyle: cover`: Fullscreen-Splash mit
Enter-Link ins Portfolio |
Alle Optionen sind im Admin-Panel editierbar (PageBuilder /
SettingsEditor).
## Tests
- 356 Unit-Tests grün (13 neue: deriveGallery hidden/grid/coverPosition,
sanitizeNavLinks, EXIF-Route-Captions, justified-Layout-Validierung)
- `npx tsc --noEmit`: 0 Fehler
- `npm run build`: sauber
- Justified-Zeilenmathematik und Cover-Splash per Browser-Harness
visuell/numerisch verifiziert (volle Zeilen enden exakt an der
Containerkante, letzte Zeile bleibt natürlich)
---------
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
2026-08-14 17:56:22 +02:00
|
|
|
|
<div className="admin-sheet-columns">
|
release: v0.11.0 (#459)
Ships `dev` as **v0.11.0**. `main` contains nothing that `dev` does not,
so this is a clean sync.
## Headline changes since v0.10.0
- **Journal & Journal Studio** — photo essays at `/journal`,
split-screen block editor with live preview, drafts, per-entry
passwords, cover images
- **First-run setup wizard at `/install`** — configure a fresh
deployment from the browser; credentials are verified against Immich
before anything is written, and the wizard is gated by a one-time token
- **About page editor and toggle** in the admin panel
- **Per-album photo order** independent of Immich, with a drag & drop
editor
- **Custom favicon upload**
- **Experimental portfolio features** — justified grid, `cover` hero,
unlisted subpages, per-album grid overrides, cover focal points,
external nav links
- **Security** — asset tokens length-capped before decoding (#423),
journal author markdown escaped rather than filtered, journal file paths
contained, admin session key derived with scrypt (#432), Next.js 16.3.0
for CVE-2025-13465
- **Fixed** — client proofing honours its own configuration again
(#454); journal photo rendering (#432)
Full detail in [CHANGELOG.md](CHANGELOG.md#0110--2026-08-15).
## Verified
`npx tsc --noEmit` clean · `npx vitest run` 435 tests pass · `npm run
build` succeeds · lint 0 errors · `prettier --check` clean · local
`docker build` of the release tree.
## After merge
Tag `v0.11.0` on `main` and publish the release — that triggers
`docker-publish.yml`, which pushes the image and moves `latest`.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
---------
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
2026-08-15 09:09:18 +02:00
|
|
|
|
<div className="admin-sheet-col">
|
|
|
|
|
|
<div className="modal-cover-container">
|
|
|
|
|
|
{heroThumb ? (
|
|
|
|
|
|
<img src={`/api/admin/thumbnail/${heroThumb}`} alt="" loading="lazy" />
|
|
|
|
|
|
) : (
|
|
|
|
|
|
<div className="modal-cover-placeholder">
|
|
|
|
|
|
<IconCamera />
|
|
|
|
|
|
</div>
|
|
|
|
|
|
)}
|
|
|
|
|
|
</div>
|
|
|
|
|
|
<div className="modal-meta-box">
|
|
|
|
|
|
<span className="modal-album-title">{album.title || name}</span>
|
|
|
|
|
|
<span className="modal-album-subtitle">
|
|
|
|
|
|
{count} {count === 1 ? 'photo' : 'photos'}
|
|
|
|
|
|
{album.title ? ` · Original: ${name}` : ''}
|
|
|
|
|
|
</span>
|
2026-05-31 21:30:00 +02:00
|
|
|
|
</div>
|
2026-05-31 21:27:13 +02:00
|
|
|
|
|
release: v0.11.0 (#459)
Ships `dev` as **v0.11.0**. `main` contains nothing that `dev` does not,
so this is a clean sync.
## Headline changes since v0.10.0
- **Journal & Journal Studio** — photo essays at `/journal`,
split-screen block editor with live preview, drafts, per-entry
passwords, cover images
- **First-run setup wizard at `/install`** — configure a fresh
deployment from the browser; credentials are verified against Immich
before anything is written, and the wizard is gated by a one-time token
- **About page editor and toggle** in the admin panel
- **Per-album photo order** independent of Immich, with a drag & drop
editor
- **Custom favicon upload**
- **Experimental portfolio features** — justified grid, `cover` hero,
unlisted subpages, per-album grid overrides, cover focal points,
external nav links
- **Security** — asset tokens length-capped before decoding (#423),
journal author markdown escaped rather than filtered, journal file paths
contained, admin session key derived with scrypt (#432), Next.js 16.3.0
for CVE-2025-13465
- **Fixed** — client proofing honours its own configuration again
(#454); journal photo rendering (#432)
Full detail in [CHANGELOG.md](CHANGELOG.md#0110--2026-08-15).
## Verified
`npx tsc --noEmit` clean · `npx vitest run` 435 tests pass · `npm run
build` succeeds · lint 0 errors · `prettier --check` clean · local
`docker build` of the release tree.
## After merge
Tag `v0.11.0` on `main` and publish the release — that triggers
`docker-publish.yml`, which pushes the image and moves `latest`.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
---------
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
2026-08-15 09:09:18 +02:00
|
|
|
|
<div className="admin-field">
|
|
|
|
|
|
<label>Title override</label>
|
|
|
|
|
|
<input
|
|
|
|
|
|
value={album.title || ''}
|
|
|
|
|
|
onChange={(e) => onUpdate({ title: e.target.value || undefined })}
|
|
|
|
|
|
placeholder={name}
|
|
|
|
|
|
/>
|
|
|
|
|
|
</div>
|
2026-05-31 21:27:13 +02:00
|
|
|
|
|
release: v0.11.0 (#459)
Ships `dev` as **v0.11.0**. `main` contains nothing that `dev` does not,
so this is a clean sync.
## Headline changes since v0.10.0
- **Journal & Journal Studio** — photo essays at `/journal`,
split-screen block editor with live preview, drafts, per-entry
passwords, cover images
- **First-run setup wizard at `/install`** — configure a fresh
deployment from the browser; credentials are verified against Immich
before anything is written, and the wizard is gated by a one-time token
- **About page editor and toggle** in the admin panel
- **Per-album photo order** independent of Immich, with a drag & drop
editor
- **Custom favicon upload**
- **Experimental portfolio features** — justified grid, `cover` hero,
unlisted subpages, per-album grid overrides, cover focal points,
external nav links
- **Security** — asset tokens length-capped before decoding (#423),
journal author markdown escaped rather than filtered, journal file paths
contained, admin session key derived with scrypt (#432), Next.js 16.3.0
for CVE-2025-13465
- **Fixed** — client proofing honours its own configuration again
(#454); journal photo rendering (#432)
Full detail in [CHANGELOG.md](CHANGELOG.md#0110--2026-08-15).
## Verified
`npx tsc --noEmit` clean · `npx vitest run` 435 tests pass · `npm run
build` succeeds · lint 0 errors · `prettier --check` clean · local
`docker build` of the release tree.
## After merge
Tag `v0.11.0` on `main` and publish the release — that triggers
`docker-publish.yml`, which pushes the image and moves `latest`.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
---------
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
2026-08-15 09:09:18 +02:00
|
|
|
|
<div className="admin-field">
|
|
|
|
|
|
<label>Description</label>
|
|
|
|
|
|
<textarea
|
|
|
|
|
|
value={album.description || ''}
|
|
|
|
|
|
onChange={(e) => onUpdate({ description: e.target.value || undefined })}
|
|
|
|
|
|
placeholder="Optional description for visitors"
|
|
|
|
|
|
rows={4}
|
|
|
|
|
|
/>
|
|
|
|
|
|
</div>
|
2026-05-31 21:27:13 +02:00
|
|
|
|
|
release: v0.11.0 (#459)
Ships `dev` as **v0.11.0**. `main` contains nothing that `dev` does not,
so this is a clean sync.
## Headline changes since v0.10.0
- **Journal & Journal Studio** — photo essays at `/journal`,
split-screen block editor with live preview, drafts, per-entry
passwords, cover images
- **First-run setup wizard at `/install`** — configure a fresh
deployment from the browser; credentials are verified against Immich
before anything is written, and the wizard is gated by a one-time token
- **About page editor and toggle** in the admin panel
- **Per-album photo order** independent of Immich, with a drag & drop
editor
- **Custom favicon upload**
- **Experimental portfolio features** — justified grid, `cover` hero,
unlisted subpages, per-album grid overrides, cover focal points,
external nav links
- **Security** — asset tokens length-capped before decoding (#423),
journal author markdown escaped rather than filtered, journal file paths
contained, admin session key derived with scrypt (#432), Next.js 16.3.0
for CVE-2025-13465
- **Fixed** — client proofing honours its own configuration again
(#454); journal photo rendering (#432)
Full detail in [CHANGELOG.md](CHANGELOG.md#0110--2026-08-15).
## Verified
`npx tsc --noEmit` clean · `npx vitest run` 435 tests pass · `npm run
build` succeeds · lint 0 errors · `prettier --check` clean · local
`docker build` of the release tree.
## After merge
Tag `v0.11.0` on `main` and publish the release — that triggers
`docker-publish.yml`, which pushes the image and moves `latest`.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
---------
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
2026-08-15 09:09:18 +02:00
|
|
|
|
<div className="admin-field">
|
|
|
|
|
|
<label>Password protection</label>
|
|
|
|
|
|
<div className="input-with-icon">
|
|
|
|
|
|
<input
|
|
|
|
|
|
type="password"
|
|
|
|
|
|
value={album.password || ''}
|
|
|
|
|
|
onChange={(e) => onUpdate({ password: e.target.value || undefined })}
|
|
|
|
|
|
placeholder="Leave empty for public access"
|
|
|
|
|
|
/>
|
|
|
|
|
|
</div>
|
|
|
|
|
|
</div>
|
2026-05-31 21:27:13 +02:00
|
|
|
|
</div>
|
experimental: portfolio features (justified layout, unlisted pages, captions, per-album grid, focal point, nav links, cover hero) (#431)
## Was ist das?
Sieben neue Portfolio-Features, alle als **experimental** gekennzeichnet
— in YAML-Kommentaren, Admin-Panel-Labels und Commit-Scopes, damit sie
einzeln nachvollziehbar und revertierbar bleiben.
## Features (je ein Commit)
| Commit | Feature |
| --- | --- |
| `justified rows gallery layout` | Neues Grid-Layout `justified`:
zeilenbasiert, gleiche Höhen, volle Breite — Flexbox ohne JS-Messung,
letzte Zeile bleibt natürlich klein |
| `hide subpages from navigation` | `hidden: true`: Seite aus
Nav/Homepage raus, per Direktlink erreichbar — im Gegensatz zu `enabled:
false` (404) |
| `lightbox captions` | Immich-Asset-Description als Bildunterschrift im
Info-Panel; EXIF-Route liefert bei `exifOnHover: false` jetzt nur noch
die Caption statt 403 |
| `per-album grid overrides` | `grid:` pro Album-Eintrag, Präzedenz
global < Subpage < Album |
| `per-album cover focal point` | `coverPosition:` → `object-position`
auf Cover-Karten, strikt validiert |
| `external links in header navigation` | `navLinks:` in settings.yaml,
nur http(s), sanitisiert |
| `cover splash hero style` | `heroStyle: cover`: Fullscreen-Splash mit
Enter-Link ins Portfolio |
Alle Optionen sind im Admin-Panel editierbar (PageBuilder /
SettingsEditor).
## Tests
- 356 Unit-Tests grün (13 neue: deriveGallery hidden/grid/coverPosition,
sanitizeNavLinks, EXIF-Route-Captions, justified-Layout-Validierung)
- `npx tsc --noEmit`: 0 Fehler
- `npm run build`: sauber
- Justified-Zeilenmathematik und Cover-Splash per Browser-Harness
visuell/numerisch verifiziert (volle Zeilen enden exakt an der
Containerkante, letzte Zeile bleibt natürlich)
---------
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
2026-08-14 17:56:22 +02:00
|
|
|
|
|
release: v0.11.0 (#459)
Ships `dev` as **v0.11.0**. `main` contains nothing that `dev` does not,
so this is a clean sync.
## Headline changes since v0.10.0
- **Journal & Journal Studio** — photo essays at `/journal`,
split-screen block editor with live preview, drafts, per-entry
passwords, cover images
- **First-run setup wizard at `/install`** — configure a fresh
deployment from the browser; credentials are verified against Immich
before anything is written, and the wizard is gated by a one-time token
- **About page editor and toggle** in the admin panel
- **Per-album photo order** independent of Immich, with a drag & drop
editor
- **Custom favicon upload**
- **Experimental portfolio features** — justified grid, `cover` hero,
unlisted subpages, per-album grid overrides, cover focal points,
external nav links
- **Security** — asset tokens length-capped before decoding (#423),
journal author markdown escaped rather than filtered, journal file paths
contained, admin session key derived with scrypt (#432), Next.js 16.3.0
for CVE-2025-13465
- **Fixed** — client proofing honours its own configuration again
(#454); journal photo rendering (#432)
Full detail in [CHANGELOG.md](CHANGELOG.md#0110--2026-08-15).
## Verified
`npx tsc --noEmit` clean · `npx vitest run` 435 tests pass · `npm run
build` succeeds · lint 0 errors · `prettier --check` clean · local
`docker build` of the release tree.
## After merge
Tag `v0.11.0` on `main` and publish the release — that triggers
`docker-publish.yml`, which pushes the image and moves `latest`.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
---------
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
2026-08-15 09:09:18 +02:00
|
|
|
|
<div className="admin-sheet-col admin-sheet-col--divided">
|
|
|
|
|
|
<div className="admin-field">
|
|
|
|
|
|
<label>Layout override (Experimental)</label>
|
|
|
|
|
|
<select
|
|
|
|
|
|
value={album.grid?.layout || ''}
|
|
|
|
|
|
onChange={(e) => {
|
|
|
|
|
|
const layout = e.target.value || undefined;
|
|
|
|
|
|
// Only the layout is exposed here; drop the grid object
|
|
|
|
|
|
// entirely when it goes back to "inherit" so the YAML
|
|
|
|
|
|
// stays clean.
|
|
|
|
|
|
onUpdate({
|
|
|
|
|
|
grid: layout ? { ...(album.grid || {}), layout } : undefined,
|
|
|
|
|
|
});
|
|
|
|
|
|
}}
|
|
|
|
|
|
>
|
|
|
|
|
|
<option value="">Inherit from page / global settings</option>
|
|
|
|
|
|
<option value="masonry">Masonry</option>
|
|
|
|
|
|
<option value="uniform">Uniform Grid</option>
|
|
|
|
|
|
<option value="showcase">Showcase</option>
|
|
|
|
|
|
<option value="filmstrip">Filmstrip</option>
|
|
|
|
|
|
<option value="editorial-flow">Editorial Flow</option>
|
|
|
|
|
|
<option value="justified">Justified (Experimental)</option>
|
|
|
|
|
|
</select>
|
|
|
|
|
|
</div>
|
experimental: portfolio features (justified layout, unlisted pages, captions, per-album grid, focal point, nav links, cover hero) (#431)
## Was ist das?
Sieben neue Portfolio-Features, alle als **experimental** gekennzeichnet
— in YAML-Kommentaren, Admin-Panel-Labels und Commit-Scopes, damit sie
einzeln nachvollziehbar und revertierbar bleiben.
## Features (je ein Commit)
| Commit | Feature |
| --- | --- |
| `justified rows gallery layout` | Neues Grid-Layout `justified`:
zeilenbasiert, gleiche Höhen, volle Breite — Flexbox ohne JS-Messung,
letzte Zeile bleibt natürlich klein |
| `hide subpages from navigation` | `hidden: true`: Seite aus
Nav/Homepage raus, per Direktlink erreichbar — im Gegensatz zu `enabled:
false` (404) |
| `lightbox captions` | Immich-Asset-Description als Bildunterschrift im
Info-Panel; EXIF-Route liefert bei `exifOnHover: false` jetzt nur noch
die Caption statt 403 |
| `per-album grid overrides` | `grid:` pro Album-Eintrag, Präzedenz
global < Subpage < Album |
| `per-album cover focal point` | `coverPosition:` → `object-position`
auf Cover-Karten, strikt validiert |
| `external links in header navigation` | `navLinks:` in settings.yaml,
nur http(s), sanitisiert |
| `cover splash hero style` | `heroStyle: cover`: Fullscreen-Splash mit
Enter-Link ins Portfolio |
Alle Optionen sind im Admin-Panel editierbar (PageBuilder /
SettingsEditor).
## Tests
- 356 Unit-Tests grün (13 neue: deriveGallery hidden/grid/coverPosition,
sanitizeNavLinks, EXIF-Route-Captions, justified-Layout-Validierung)
- `npx tsc --noEmit`: 0 Fehler
- `npm run build`: sauber
- Justified-Zeilenmathematik und Cover-Splash per Browser-Harness
visuell/numerisch verifiziert (volle Zeilen enden exakt an der
Containerkante, letzte Zeile bleibt natürlich)
---------
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
2026-08-14 17:56:22 +02:00
|
|
|
|
|
release: v0.11.0 (#459)
Ships `dev` as **v0.11.0**. `main` contains nothing that `dev` does not,
so this is a clean sync.
## Headline changes since v0.10.0
- **Journal & Journal Studio** — photo essays at `/journal`,
split-screen block editor with live preview, drafts, per-entry
passwords, cover images
- **First-run setup wizard at `/install`** — configure a fresh
deployment from the browser; credentials are verified against Immich
before anything is written, and the wizard is gated by a one-time token
- **About page editor and toggle** in the admin panel
- **Per-album photo order** independent of Immich, with a drag & drop
editor
- **Custom favicon upload**
- **Experimental portfolio features** — justified grid, `cover` hero,
unlisted subpages, per-album grid overrides, cover focal points,
external nav links
- **Security** — asset tokens length-capped before decoding (#423),
journal author markdown escaped rather than filtered, journal file paths
contained, admin session key derived with scrypt (#432), Next.js 16.3.0
for CVE-2025-13465
- **Fixed** — client proofing honours its own configuration again
(#454); journal photo rendering (#432)
Full detail in [CHANGELOG.md](CHANGELOG.md#0110--2026-08-15).
## Verified
`npx tsc --noEmit` clean · `npx vitest run` 435 tests pass · `npm run
build` succeeds · lint 0 errors · `prettier --check` clean · local
`docker build` of the release tree.
## After merge
Tag `v0.11.0` on `main` and publish the release — that triggers
`docker-publish.yml`, which pushes the image and moves `latest`.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
---------
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
2026-08-15 09:09:18 +02:00
|
|
|
|
<div className="admin-field">
|
|
|
|
|
|
<label>Cover focal point (Experimental)</label>
|
|
|
|
|
|
<input
|
|
|
|
|
|
value={album.coverPosition || ''}
|
|
|
|
|
|
onChange={(e) => onUpdate({ coverPosition: e.target.value || undefined })}
|
|
|
|
|
|
placeholder={'e.g. "50% 25%" or "top" — where the cover crop should anchor'}
|
|
|
|
|
|
/>
|
|
|
|
|
|
</div>
|
experimental: portfolio features (justified layout, unlisted pages, captions, per-album grid, focal point, nav links, cover hero) (#431)
## Was ist das?
Sieben neue Portfolio-Features, alle als **experimental** gekennzeichnet
— in YAML-Kommentaren, Admin-Panel-Labels und Commit-Scopes, damit sie
einzeln nachvollziehbar und revertierbar bleiben.
## Features (je ein Commit)
| Commit | Feature |
| --- | --- |
| `justified rows gallery layout` | Neues Grid-Layout `justified`:
zeilenbasiert, gleiche Höhen, volle Breite — Flexbox ohne JS-Messung,
letzte Zeile bleibt natürlich klein |
| `hide subpages from navigation` | `hidden: true`: Seite aus
Nav/Homepage raus, per Direktlink erreichbar — im Gegensatz zu `enabled:
false` (404) |
| `lightbox captions` | Immich-Asset-Description als Bildunterschrift im
Info-Panel; EXIF-Route liefert bei `exifOnHover: false` jetzt nur noch
die Caption statt 403 |
| `per-album grid overrides` | `grid:` pro Album-Eintrag, Präzedenz
global < Subpage < Album |
| `per-album cover focal point` | `coverPosition:` → `object-position`
auf Cover-Karten, strikt validiert |
| `external links in header navigation` | `navLinks:` in settings.yaml,
nur http(s), sanitisiert |
| `cover splash hero style` | `heroStyle: cover`: Fullscreen-Splash mit
Enter-Link ins Portfolio |
Alle Optionen sind im Admin-Panel editierbar (PageBuilder /
SettingsEditor).
## Tests
- 356 Unit-Tests grün (13 neue: deriveGallery hidden/grid/coverPosition,
sanitizeNavLinks, EXIF-Route-Captions, justified-Layout-Validierung)
- `npx tsc --noEmit`: 0 Fehler
- `npm run build`: sauber
- Justified-Zeilenmathematik und Cover-Splash per Browser-Harness
visuell/numerisch verifiziert (volle Zeilen enden exakt an der
Containerkante, letzte Zeile bleibt natürlich)
---------
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
2026-08-14 17:56:22 +02:00
|
|
|
|
|
release: v0.11.0 (#459)
Ships `dev` as **v0.11.0**. `main` contains nothing that `dev` does not,
so this is a clean sync.
## Headline changes since v0.10.0
- **Journal & Journal Studio** — photo essays at `/journal`,
split-screen block editor with live preview, drafts, per-entry
passwords, cover images
- **First-run setup wizard at `/install`** — configure a fresh
deployment from the browser; credentials are verified against Immich
before anything is written, and the wizard is gated by a one-time token
- **About page editor and toggle** in the admin panel
- **Per-album photo order** independent of Immich, with a drag & drop
editor
- **Custom favicon upload**
- **Experimental portfolio features** — justified grid, `cover` hero,
unlisted subpages, per-album grid overrides, cover focal points,
external nav links
- **Security** — asset tokens length-capped before decoding (#423),
journal author markdown escaped rather than filtered, journal file paths
contained, admin session key derived with scrypt (#432), Next.js 16.3.0
for CVE-2025-13465
- **Fixed** — client proofing honours its own configuration again
(#454); journal photo rendering (#432)
Full detail in [CHANGELOG.md](CHANGELOG.md#0110--2026-08-15).
## Verified
`npx tsc --noEmit` clean · `npx vitest run` 435 tests pass · `npm run
build` succeeds · lint 0 errors · `prettier --check` clean · local
`docker build` of the release tree.
## After merge
Tag `v0.11.0` on `main` and publish the release — that triggers
`docker-publish.yml`, which pushes the image and moves `latest`.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
---------
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
2026-08-15 09:09:18 +02:00
|
|
|
|
{/* Hero Image Selection */}
|
|
|
|
|
|
<div className="admin-field">
|
|
|
|
|
|
<label>Custom Hero Image</label>
|
|
|
|
|
|
<div className="album-hero-field">
|
|
|
|
|
|
{album.heroImage ? (
|
|
|
|
|
|
<div className="album-hero-preview">
|
|
|
|
|
|
<img src={`/api/admin/thumbnail/${album.heroImage}`} alt="Hero" />
|
|
|
|
|
|
<button
|
|
|
|
|
|
className="album-hero-remove"
|
|
|
|
|
|
onClick={() => onUpdate({ heroImage: undefined })}
|
|
|
|
|
|
title="Remove custom hero image"
|
|
|
|
|
|
>
|
|
|
|
|
|
<IconX size={14} />
|
|
|
|
|
|
</button>
|
|
|
|
|
|
</div>
|
|
|
|
|
|
) : (
|
|
|
|
|
|
<span className="album-hero-empty">Using default album cover</span>
|
|
|
|
|
|
)}
|
release: v0.11.0 — journal fixes, admin URLs, design system cleanup (#432)
* fix(screenshots): sharp-Typen fuer 0.34 und 0.35 gleichzeitig (#410)
sharp 0.35 ist von `export =` auf ESM umgestellt: der Modul-Namespace
ist nicht mehr aufrufbar, die Factory sitzt unter .default. Der
Type-Check brach damit in scripts/screenshots.ts weg, sobald der
Next-Bump (#402) sharp von 0.34.5 auf 0.35.3 mitzieht -- sharp ist hier
keine deklarierte Dependency, sondern kommt ueber Next mit.
Die Form wird jetzt aus dem installierten Paket abgeleitet statt
festgeschrieben, zur Laufzeit wie im Typ. Geprueft mit beiden
Versionen: tsc laeuft mit 0.34.5 und mit 0.35.3 fehlerfrei durch.
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
* chore(deps): bump the nextjs group across 1 directory with 2 updates (#402)
Bumps the nextjs group with 2 updates in the / directory: [next](https://github.com/vercel/next.js) and [eslint-config-next](https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next).
Updates `next` from 16.2.12 to 16.3.0
- [Release notes](https://github.com/vercel/next.js/releases)
- [Commits](https://github.com/vercel/next.js/compare/v16.2.12...v16.3.0)
Updates `eslint-config-next` from 16.2.12 to 16.3.0
- [Release notes](https://github.com/vercel/next.js/releases)
- [Commits](https://github.com/vercel/next.js/commits/v16.3.0/packages/eslint-config-next)
---
updated-dependencies:
- dependency-name: eslint-config-next
dependency-version: 16.3.0
dependency-type: direct:development
update-type: version-update:semver-minor
dependency-group: nextjs
- dependency-name: next
dependency-version: 16.3.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: nextjs
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* chore(deps-dev): bump prettier from 3.8.3 to 3.9.6 (#405)
Bumps [prettier](https://github.com/prettier/prettier) from 3.8.3 to 3.9.6.
- [Release notes](https://github.com/prettier/prettier/releases)
- [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md)
- [Commits](https://github.com/prettier/prettier/compare/3.8.3...3.9.6)
---
updated-dependencies:
- dependency-name: prettier
dependency-version: 3.9.6
dependency-type: direct:development
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* docs(changelog): Unreleased-Sektion fuer die Bumps nach v0.10.0 (#413)
Die Dependency-PRs sind nach dem Release auf dev gelandet, teils auch
auf main. Ohne Eintrag waeren sie beim naechsten Release unsichtbar --
inklusive Next 16.3.0, das CVE-2025-13465 mitbringt.
Ausserdem im 0.10.0-Abschnitt nachgetragen, dass der Trivy-Scan bis
#409 nie gelaufen ist. Der Fix steckt im Tag v0.10.0, fehlte aber in der
Aufzaehlung -- und "Images werden bei jedem Publish gescannt" stand im
Changelog, waehrend der Job im Action-Setup abbrach.
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
* feat(gallery): per-album sort order, independent of Immich (#408) (#414)
Album order was dictated entirely by Immich: getAlbum() sorted by the
album's own asc/desc flag, so a Folio album always mirrored the archive.
A curated series has a narrative order that has nothing to do with
capture time, and changing the Immich album's sort to fit the website
changes it for the archive too.
Adds an optional per-album `sort` in gallery.yaml, editable in /admin,
defaulting to today's behaviour so every existing config is unchanged:
immich (default) | newest | oldest | filename | manual
`manual` is a pinned *prefix*: `assetOrder` lists only the photos placed
by hand, everything else follows in the album's Immich order. A full
permutation of a 2,000-photo album would be ~80 KB of UUIDs in a file
that is rewritten and copied to content/.backups/ on every admin save.
It also makes drift fall out for free — photos removed in Immich never
match, new ones land in the tail rather than being hidden.
Sorting is applied after the cache read, not before the cache write, so
the LRU keeps one canonical Immich-ordered copy per album. That avoids
putting the mode in the cache key, lets a config change take effect
without depending on invalidation, and keeps the stale-serving path
correct. cache.get() returns the stored object by reference, so
withSort() returns a shallow clone with a new array — sorting in place
would reorder the shared entry, and under request coalescing every
concurrent caller would be sorting the same array.
Also fixes a prerequisite bug: /api/admin/albums/[albumId]/assets read
album.assets from GET /albums/:id, which Immich 3.x no longer populates
(lib/immich.ts:507). The hero picker's "This Album" tab returned nothing
and threw outright when the key was absent. It now goes through the
client's paginated metadata search, with ?types=all to opt videos in for
the reorder editor.
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
* refactor(admin): drop decorative emoji from the sort select labels (#415)
An <option> cannot contain markup, so the SVG set in Icons is not
reachable there — but a decorative emoji is not a substitute for it.
Plain text instead; the album card badge already uses a real icon.
The remaining emoji in the admin panel (asset picker tabs, section
headings, layout picker options) predate this branch and are left for a
separate cleanup.
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
* refactor(admin): replace emoji icons with the shared SVG icon set (#416)
The admin panel mixed two icon conventions: inline SVGs from
`Icons.tsx` in most components, and decorative emoji in the asset
picker and a few PageBuilder labels. Emoji render inconsistently
across platforms, ignore the accent colour, and cannot inherit the
`.svg-icon` sizing rules.
- Icons.tsx: add `IconStar` (filled — it marks a state, not an
action) and `IconImage`.
- AssetPicker: the three tab labels and the favourite tile badge now
use IconFolder / IconStar / IconImage.
- PageBuilder: the "Standalone Albums" and "Subpages" headings use
the icon set instead of an emoji.
- PageBuilder: the layout picker drops its emoji for plain text. An
<option> cannot contain markup, so an SVG is impossible there and a
decorative glyph is not a substitute.
- admin.css: align icon and label in the picker tabs, and swap the
favourite badge's text-shadow for drop-shadow, which is what
applies to an inline SVG.
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
* refactor(admin): fold PageBuilder's local icons into the shared Icons module (#418)
* refactor(admin): fold PageBuilder's local icons into the shared module
PageBuilder.tsx carried its own `Icons` object duplicating most of the
glyphs already exported by Icons.tsx, with hardcoded sizes and slightly
divergent paths. Migrate all 32 call sites to the shared module and
delete the local object.
Five glyphs had no counterpart and are added to Icons.tsx as 1:1 ports
of the local paths: IconX, IconPlus, IconHome, IconCopy, IconImage.
The local ExternalLink and Check are dropped rather than ported — both
had zero call sites.
Two glyphs change shape slightly, which is the point of consolidating:
the shared IconCamera includes the viewfinder bump the local copy
omitted, and drag handles now use IconGripVertical.
IconGripVertical uses the module's square 24x24 viewBox, so `.svg-drag`
goes from 12x18 to 18x18 — the old non-square box would letterbox the
glyph down to 12x12 and shrink the handle.
* fix(admin): resolve icon-module integration after #416
Merging dev brought in #416, which added a second IconImage to Icons.tsx
and two <Icons.Camera>/<Icons.Folder> section headers that reference the
local Icons object this PR removes. Git merged both cleanly but the result
did not type-check.
- drop the duplicate IconImage (both copies were byte-identical)
- point the two section headers at the imported IconCamera/IconFolder
- refresh the SORT_LABELS comment: the icon set is imported now, not
declared below
---------
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
* fix(config): allow an empty gallery, guard against a double /api suffix (#421)
An empty gallery is now a valid, rendered state instead of a throw: deriveGallery() no longer requires at least one album or subpage, so a deployment with no albums yet renders a bare homepage the owner can fill in via /admin.
getConfig() also stops appending /api to an Immich URL that already ends in it, which previously produced .../api/api and broke every upstream request.
Includes a restore of the per-album sort test cases, which the branch had lost by being cut before #408/#414.
* feat(admin): favicon upload, served from the content volume (#422)
Adds a bundled default favicon, an upload widget in admin Settings > General, and a route that serves the icon from the writable content/ volume with a fallback to the bundled default. Raster uploads (PNG/ICO/JPEG) are wrapped in an SVG container; the response carries its own CSP so an uploaded SVG cannot execute script on the origin.
The GET route revalidates with an ETag instead of caching immutably, so a newly uploaded icon shows up immediately. Uploads are written via temp file + rename, and a Reset button restores the bundled default.
* ci: flag unformatted files in a PR, without blocking it (#424)
Prettier is configured as an error rule in eslint.config.mjs but has never run in CI, so part of the tree predates it. A final CI step now diffs against the PR base, runs prettier --list-different over the changed files, and emits a warning annotation per offender plus a job summary.
Advisory by design: it never fails the job. Blocking would turn a PR red for merely touching a file that was already unformatted, and normalising the tree in one commit would wreck git blame and conflict with the PRs in flight.
Requires fetch-depth: 0, since diffing against the base needs its history.
* feat(install): first-run wizard gated by a one-time setup token (#419)
Adds /install, a four-step first-run wizard: connect to Immich, optionally pick albums, name the site, finish. It verifies the credentials against the Immich server before writing anything, then writes gallery.yaml, settings.yaml and a content/install.json carrying the Immich credentials and a generated site secret.
install.json exists because a running process cannot pick up new env vars — the wizard has to write configuration that takes effect without a restart. getInstallCredentials() merges it under the real environment, so env vars always win and rotation stays a matter of setting one.
Both the page and the API routes are gated by a one-time setup token printed to the server log, so a deployment that is reachable before gallery.yaml exists cannot be configured by whoever finds it first. The token is stored in content/.setup-token (0600) rather than a module variable: Next.js bundles the page and each route handler separately, so a module-level token left the page and the API disagreeing inside one process and the wizard stuck on step 1. It is removed once the install completes.
The admin password is stored as an scrypt hash using the scheme lib/auth.ts already applies to album passwords; a plaintext ADMIN_PASSWORD env var keeps working.
* docs: document the setup wizard, fix the read-only content mount (#425)
Quick Start now leads with the /install wizard, with the hand-written YAML route kept alongside it, and a First-Run Setup section covers the setup token, the files the wizard writes, and env-var precedence.
Two corrections: both Docker examples mounted content/ as :ro, which silently breaks the wizard, the admin panel and the backup rotation alike — docs/admin-panel.md already said so and the README contradicted it. And nothing documented that content/install.json holds the Immich API key, so a backup of content/ is a backup of credentials.
Also adds a Contributors section crediting the people whose work is in the project.
* feat(admin): floating save bar pinned to the bottom of the viewport (#426)
The save bar was the first, static element inside .admin-main. Since the
document itself scrolls, it left the viewport as soon as you scrolled down
— editing a subpage section or a settings block far below gave no visible
dirty hint and no reachable save button.
Replace it with a bottom-pinned floating bar shared by both editors. It
only mounts while there is something to act on (unsaved changes, an
in-flight save, or a result message), so it never covers content while
idle. The success message clears after 5s, which hides the bar again.
- new SaveBar component, replacing the duplicated markup in PageBuilder
and SettingsEditor
- adopt the previously unused .floating-save-bar CSS: slide-in keyframes
(carrying translateX(-50%)), dirty border, wrap/gap, mobile variant and
a prefers-reduced-motion opt-out; z-index 900 keeps it below modals
- .admin-main gains bottom padding so the bar never covers page content
- drop the now-unreachable idle hints: the ⌘S hint becomes a button title,
the Live Sync note becomes a static line above the settings layout
- header "Site" link now bypasses the cache (/?fresh=1), so the preview
stays reachable when the bar is hidden
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
* feat(admin): themed listbox for the album sort control (#427)
The per-album "Photo order" control was a native <select>. Because an
<option> cannot contain markup, its choices could not use the admin
panel's currentColor SVG set — the reason #415 had to fall back to plain
text after dropping the emoji labels.
Adds a Listbox component implementing the ARIA combobox/listbox pattern,
so options can render a glyph beside their label:
- DOM focus stays on the trigger button; the active option is announced
through aria-activedescendant, keeping focus management to one element
- Keyboard: arrows (clamped at the ends, like a native select),
Home/End, Enter/Space to commit, Escape to cancel, Tab commits and
moves on, and prefix type-ahead with a repeat-key cycle
- Outside dismissal on pointerdown, so a press starting outside closes
the popup before the click retargets
The sort options now carry an icon each: calendar, arrow-down, arrow-up,
an A→Z marker, and the drag glyph for manual — matching the badge the
album card already shows. SORT_LABELS stays plain text because the badge
feeds it to a title attribute.
Closes #417
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
* chore(git): ignore generated design handoff folders
* fix(admin): stop the album sort dropdown clipping, and simplify the panel (#428)
* fix(admin): render listbox popup in a portal so it escapes modal clipping
The sort control's popup was position:absolute inside three clipping ancestors
(.album-drawer overflow:hidden > .album-drawer-body overflow-y:auto >
.modal-right-column overflow-y:auto), so it was cut off at the bottom of the
Edit Album Details modal. z-index could not help: clipping happens before
stacking. It also always hung below the trigger, with no flip.
Portal the popup to document.body and position it from the trigger's viewport
rect, flipping above when there is more room there and capping max-height to the
space available so it scrolls internally rather than overflowing. It is
dismissed on scroll and resize, since the anchor is only measured on open.
The outside-pointerdown handler now also treats the popup as inside; without
that the portalled list counts as outside, and a click on an option would close
it before the selection commits.
* refactor(admin): single-column album details panel
The left column spent 1.2fr on a cover thumbnail and three stat rows, two of
which (Status, Custom Hero) only restated the form fields opposite them, while
the form itself was squeezed into 1.8fr behind a second nested scroller.
Stack the drawer in one column instead: cover as a banner, then the form at full
width, with the UUID moved into the footer. The body is now the only scroll
container, which also removes one of the ancestors that was clipping the sort
popup.
---------
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
* fix(admin): give the portalled listbox its theme back, lock the page behind modals (#429)
Two defects in the album editor.
The sort listbox popup painted transparent. Every --admin-* variable is
scoped to .admin-layout, and since the popup moved into document.body it
sits outside that subtree, so background/border/text all resolved to
nothing. It now carries its own copy of the palette in both colour
schemes, plus the font it no longer inherits.
Scrolling inside a modal also moved the page behind it. No admin modal
ever locked body scroll: the overlay covers the page but does not absorb
wheel events, so a scroll starting on the backdrop — or continuing past
the end of the modal's own scroller — reaches the document.
overscroll-behavior cannot cover that case on its own, because it only
applies to scroll containers and the backdrop is not one.
useScrollLock freezes body while a modal is open and compensates for the
width the scrollbar gives up, so nothing shifts underneath. Each lock
restores the inline value it found, which makes nesting work without a
counter — a picker opened from the drawer restores the drawer's hidden
state instead of clearing it. Applied to both drawers and all four
picker modals, which share the defect. overscroll-behavior: contain on
the scrollers stops the chaining they can handle themselves.
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
* fix(security): allow unsafe-eval in CSP script-src during dev mode
* feat(journal): add Journal Studio with split-screen editor, live preview and dedicated routes
* fix(build): separate client parser from server journal-service and fix build type errors
* fix(journal): Fotos rendern, Layout und Lightbox-Steuerung korrigieren
Fünf unabhängige Fehler in der öffentlichen Journal- und Essay-Ansicht:
* Foto-Blöcke wurden nie angezeigt. EssayView löst ein Foto über
PhotoItem.id auf, und das sind verschlüsselte Tokens — die Blöcke aus
dem Markdown tragen aber rohe Asset-UUIDs. Jede Zuordnung lief ins
Leere, und nicht auflösbare Blöcke werden still verworfen. Die IDs
werden jetzt serverseitig übersetzt; damit verschwinden nebenbei die
rohen UUIDs aus dem Client-Payload, die dort laut Projektregel nie
auftauchen dürfen. Nicht auflösbare Referenzen werden geloggt.
* Überschriften standen weiter links als der Fließtext. Jeder Block
hatte einzeln `max-width: 68ch`, und `ch` ist relativ zur Schrift des
Elements — die Serif-Überschrift ergab eine breitere Spalte. Ersetzt
durch eine gemeinsame, font-unabhängige `--essay-measure`.
* Fullbleed-Fotos bluteten nur nach links aus: `.essay-figure` ist
`width: 100%`, wodurch die Box überbestimmt ist und der negative
rechte Margin verworfen wird.
* Foto-Paare stellten beide Bilder gleich breit dar, wodurch ein
Hochformat neben einem Querformat doppelt so hoch wurde. Jetzt eine
Justified-Reihe: Breite proportional zum Seitenverhältnis, dadurch
exakt gleiche Höhen ohne Beschnitt.
* Die Lightbox hatte im Journal keine Tastatursteuerung und keine
Scroll-Sperre — beides lag in PhotoGrid, also nur im Album-Raster.
Verlagert in die Lightbox selbst, der doppelte Handler in PhotoGrid
entfernt (sonst wäre pro Pfeildruck zwei Bilder weitergesprungen).
Zusätzlich sind Proofing-Herzen und das EXIF-Panel im redaktionellen
Modus abschaltbar und im Journal aus: Client-Proofing ist ein
Übergabe-Workflow für Alben, keine Funktion einer Reportage. Auf der
Übersicht wurde der Untertitel doppelt gerendert, weil extractExcerpt()
auf ihn zurückfällt.
* feat(admin): eigene URLs für alle Bereiche und überarbeiteter Journal Studio
Das Panel war eine einzige Client-Komponente, die ihre Tabs über
useState umschaltet: keine Route pro Bereich, kein Deep-Link, kein
Zurück-Button, und nach jedem Reload landete man wieder auf "Pages".
Auch der Journal-Editor hatte keine eigene URL.
Jetzt sieben echte Routen (/admin, /admin/pages, /admin/journal,
/admin/journal/<slug>, /admin/settings, /admin/settings/<section>,
/admin/analytics). Die Shell mit Auth-Prüfung und Kopfzeile sitzt im
Layout und umschließt children — so bleibt die Session-Prüfung über
Routenwechsel montiert, statt bei jedem Tab-Wechsel neu zu laufen und
den Spinner aufblitzen zu lassen. Unbekannte Settings-Sections fallen
auf General zurück.
Im selben Zug der Journal Studio, der die Routing-Änderung ohnehin
berührt:
* Alle Eingabefelder nutzten die Klasse `admin-input`, die in keinem
CSS definiert war — sie fielen auf Browser-Defaults zurück. Jetzt
gestylt, gescoped, damit der generische Name nicht ins übrige Panel
leckt.
* Der Split View ist per Divider verschiebbar (Maus, Tastatur,
Doppelklick zum Zurücksetzen), Breite in localStorage.
* Das Studio bricht aus der 1120px-Spalte aus, die Preview hat Platz.
* Die Preview zeigte für jedes Foto fest 3:2 und log damit über das
Layout der veröffentlichten Seite; die echten Verhältnisse werden
jetzt an den Thumbnails gemessen.
* Blöcke mit alten positionsbasierten Foto-Referenzen werden markiert —
die lassen sich auf einer eigenständigen Journal-Seite nicht auflösen
und verschwanden bisher stillschweigend.
* Blocktyp-Chips als gemeinsame Komponente, monochrom und per Icon
unterschieden statt in einer eigenen Blau/Lila/Orange-Palette, die
sonst nirgends im Panel vorkommt.
* Emojis raus, SVG-Icons rein.
* fix(admin): Designsystem-Lücken im Panel schließen
Eine systematische Suche nach Klassen, die im TSX benutzt, aber in
keinem CSS definiert sind, hat vier Stellen mit demselben Muster
gefunden:
* `admin-btn-secondary` und `admin-btn-danger` existierten nicht.
Sämtliche Löschen-Buttons sahen aus wie normale Buttons — keine
Warnwirkung. Als `.admin-btn.admin-btn-danger` geschrieben, weil die
Varianten mit den Größenklassen kombiniert werden, die weiter unten
ihren eigenen Hintergrund setzen.
* `page-progress-fill` fehlte: die Balken im Analytics-Panel waren
leere Rinnen, der Wert unsichtbar. Ebenso `analytics-empty` und
`admin-loading-container`.
* `subpage-drawer-section`, `subpage-drawer-title-group` und
`input-with-icon` im PageBuilder waren wirkungslos und teils mit
Inline-Styles notdürftig kompensiert.
* `grid-card-preview` fehlte, wodurch alle Layout-Vorschauen auf Höhe
null kollabierten. Nur "Showcase" war sichtbar — und das aus Versehen,
weil sein Tile `hero-tile` hieß und damit die `aspect-ratio` einer
fremden PageBuilder-Klasse erbte. Umbenannt.
Dazu die Theme-Vorschauen, die praktisch identisch aussahen: alle
sieben zeigten dieselben drei quadratischen Kacheln, einziger
Unterschied war die Hintergrundfarbe. Sie spiegeln jetzt die echten
Preset-Daten aus lib/config/theme.ts — Schriftcharakter, Eckradius,
Rasterdichte, Passepartout bzw. Schatten.
Die Kopfzeile richtet sich an einer gemeinsamen Steuerhöhe aus. Der
"Site"-Link war höher als die Buttons daneben: `.admin-btn` hatte keine
explizite line-height, und <button> bekommt box-sizing: border-box vom
Browser, <a> nicht. Die Statusanzeige setzte weder Schriftfamilie noch
-größe und fiel auf den Browser-Default zurück — sie war nie Teil des
Designsystems. Jetzt gleiche Höhe und Typografie, Pillenform als
Zustandsanzeige, Trenner zur Aktionsgruppe. Das dauerhafte Pulsieren
des grünen Punkts entfällt; Animation bleibt den Zuständen vorbehalten,
die Aufmerksamkeit brauchen.
Restliche Emojis durch SVG-Icons ersetzt.
* feat(admin): add scroll-to-top toggle and SVG arrow
The back-to-top button was always on and drew its arrow with the ↑ text
character. Add a `scrollToTop` setting (General section in the admin
panel, defaults to on so existing sites are unaffected) and replace the
glyph with a stroked SVG that inherits currentColor across all presets.
Scroll handling is now rAF-throttled, and prefers-reduced-motion turns
off both the hover lift and the smooth scroll.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
* security(journal): escape author HTML instead of filtering it
CodeQL flags 26 high-severity alerts on the release PR; the bulk of them
point at sanitizeHtml(), a denylist of three regexes whose output goes
into dangerouslySetInnerHTML. I reproduced the bypasses before changing
anything — all four pass the old filter:
<img src=x onerror=alert(1)> unquoted handler, regex wants quotes
<img src=x onerror='alert(1)'> single quotes, same reason
<svg onload=alert(1)> not a <script> tag
javasjavascript:cript:alert(1) one-pass replace, the rest recombines
Plus an attribute breakout in the link renderer, which interpolated the
URL into href="${url}" unescaped:
[x](" onmouseover=alert(1) x=") -> <a href="" onmouseover=alert(1" ...>
Replaced with escaping. Every `&<>"'` in author text becomes an entity
before any markdown rule runs, so the only tags in the output are the
ones renderInlineMarkdown builds itself and a URL cannot leave its
attribute. Link schemes are now an allowlist (http, https, mailto, tel,
relative, anchor); anything else renders as plain text.
The serializer needed decodeHtmlEntities to match: without it a save
would write `<` into the Markdown file and the next parse would
escape the `&` again, corrupting the text further on every round trip.
A test covers parse -> serialize -> parse stability.
Two existing tests asserted the old behaviour and were rewritten rather
than deleted: one expected the script tag to be *removed* from the
output, the other expected the substring "onerror" to be absent. Both
now assert the property that matters — that no tag can form — because
`onerror` surviving as inert text is fine.
Exploitation required admin access either way: journal and essay text
comes from the studio or from content/*.md. This removes the weakness,
it does not close an open door.
* fix(journal): contain file paths, fix frontmatter escaping, defuse two regexes
Follow-up to the CodeQL findings on release PR #432. I went through all 23
alerts individually; this addresses the ones that are worth addressing and
documents the ones that are not.
Path containment (12 alerts, all false positives). Every path built from a
slug goes through isValidSlug(), a strict `/^[a-zA-Z0-9_-]+$/` allowlist —
verified against `../../etc/passwd`, `foo/../../bar`, `a/b`, `..` and
friends, all rejected. CodeQL cannot see it because the check lives in
another module. Added a containedPath() helper that resolves the path and
refuses anything landing outside the content directory: a second lock on a
door that was already locked, and a barrier the analysis can follow. Also
removed the dead `slug.endsWith('.md')` branches — isValidSlug rejects
dots, so they could never be taken.
Frontmatter escaping (1 alert, a real bug). The serializer escaped `"` but
not `\`, and the parser never unescaped anything. A title containing either
character gained a backslash on every save/load cycle:
Path C:\Users "quoted" -> Path C:\\Users \"quoted\" -> ...
Escaping now covers the backslash first and the parser undoes both. A round
trip test covers quotes, backslashes, colons and apostrophes.
Two of three ReDoS regexes (2 alerts). The heading pattern had `\s+` next to
`(.+)`, which overlap, so the engine tried every split of the whitespace run
before failing; it is `[ \t]+` and `(\S.*)` now. The quote author pattern
wrapped a lazy group around an optional group — the quadratic case — and is
an index split on the first separator now.
The third regex, the bold/italic pass, is deliberately left alone. Rewriting
it with a negated class removes the backtracking but breaks nesting:
`**bold *and italic* here**` renders as `*<em>bold </em>and italic<em> here</em>*`.
The input is Markdown from an authenticated admin, never a visitor, so the
worst case is an author slowing down their own page. The comment in the code
says so.
Not addressed: 5 js/insufficient-password-hash alerts. They ask for a slow
KDF where the code uses SHA-256/HMAC — correct in general, but the admin
password comes from an environment variable and is never stored, so a
stronger KDF protects nothing that is not already in plaintext in the
environment.
399 unit tests pass (18 new), build and tsc clean.
* fix(journal): split the quote author by scanning, not by pattern
Cleaning up after myself. #439 replaced the quote author regex
`/^(.*?)(?:\s+--\s+(.+))?$/` — a lazy group around an optional one, the
quadratic case — with `/\s+--\s+/`, and CodeQL promptly flagged the
replacement for the same reason. One reported pattern traded for another.
splitQuoteAuthor() scans for the first `--` that has whitespace on both
sides. Linear, and it needs no reasoning about the regex engine at all.
Behaviour is identical to the original regex, checked case by case
against it: separator, no separator, several separators, tabs, wide gaps,
`a--b` without spaces, leading and trailing separators, empty string. All
nine are covered by tests, plus one asserting it stays fast on a 50k
whitespace run.
* security(admin): derive the session signing key with scrypt
getSigningKey() ran the admin password through a single SHA-256 digest.
It is key derivation rather than password storage, so it was never a
stored-hash problem — but if the derived key ever leaked, one fast hash
makes recovering the password by brute force cheap. CodeQL flags it as
js/insufficient-password-hash and, for this particular alert, has a
point.
scrypt now. Two details that matter:
The salt has to be stable. A random salt would produce a different key on
every call and invalidate every session; it is derived from AUTH_SECRET,
which is deployment-specific. Verified across separate processes: same
inputs produce a verifying token, so a restart or redeploy does not log
everyone out.
The result is cached for the process lifetime. scrypt is deliberately
slow and getSigningKey() runs on every admin request — deriving per call
would add ~24ms to each one. The cache key is a digest of secret plus
password, so a rotation misses the cache and derives again, and no extra
plaintext copy of the password is kept around.
Measured: first derivation 24ms, subsequent calls 0.12ms. Password
change and secret change both invalidate an existing token, checked in
separate processes.
Note the one-time effect: existing admin sessions are invalidated by the
change in derivation, so everyone logs in once more.
* security(admin): key the signing-key cache on its inputs, not a digest
#441 removed the SHA-256 digest of the admin password from the key
derivation and introduced a new one three lines above it, as the cache
key. Same rule, same file: CodeQL reported it immediately.
The comment justifying it was wrong too. It claimed no second plaintext
copy of the password was retained, while building the digest input
allocates exactly that in order to hash it.
The cache now holds the two input strings and compares them directly.
They are the same objects the env and install caches already hold, so
nothing extra is retained, and no fast hash of the password exists in
memory for the life of the process.
Re-verified after the change, in separate processes: a token from one
process verifies in another with the same inputs, a changed password or
secret rejects it, first derivation 24ms, cached calls 0.001ms.
That leaves scrypt as the only place the password is hashed here. The
two HMACs further down operate on the derived key and on token data, not
on the password; the constant-time comparison in verifyAdminPassword is
the previously dismissed one.
---------
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
2026-08-14 16:55:07 +02:00
|
|
|
|
<button
|
release: v0.11.0 (#459)
Ships `dev` as **v0.11.0**. `main` contains nothing that `dev` does not,
so this is a clean sync.
## Headline changes since v0.10.0
- **Journal & Journal Studio** — photo essays at `/journal`,
split-screen block editor with live preview, drafts, per-entry
passwords, cover images
- **First-run setup wizard at `/install`** — configure a fresh
deployment from the browser; credentials are verified against Immich
before anything is written, and the wizard is gated by a one-time token
- **About page editor and toggle** in the admin panel
- **Per-album photo order** independent of Immich, with a drag & drop
editor
- **Custom favicon upload**
- **Experimental portfolio features** — justified grid, `cover` hero,
unlisted subpages, per-album grid overrides, cover focal points,
external nav links
- **Security** — asset tokens length-capped before decoding (#423),
journal author markdown escaped rather than filtered, journal file paths
contained, admin session key derived with scrypt (#432), Next.js 16.3.0
for CVE-2025-13465
- **Fixed** — client proofing honours its own configuration again
(#454); journal photo rendering (#432)
Full detail in [CHANGELOG.md](CHANGELOG.md#0110--2026-08-15).
## Verified
`npx tsc --noEmit` clean · `npx vitest run` 435 tests pass · `npm run
build` succeeds · lint 0 errors · `prettier --check` clean · local
`docker build` of the release tree.
## After merge
Tag `v0.11.0` on `main` and publish the release — that triggers
`docker-publish.yml`, which pushes the image and moves `latest`.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
---------
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
2026-08-15 09:09:18 +02:00
|
|
|
|
className="admin-btn admin-btn-sm"
|
|
|
|
|
|
onClick={() =>
|
|
|
|
|
|
setHeroPickerTarget({
|
|
|
|
|
|
albumId: album.id,
|
|
|
|
|
|
onSelect: (assetId) => {
|
|
|
|
|
|
onUpdate({ heroImage: assetId });
|
|
|
|
|
|
setHeroPickerTarget(null);
|
|
|
|
|
|
},
|
|
|
|
|
|
currentAssetIds: album.heroImage ? [album.heroImage] : [],
|
|
|
|
|
|
title: `Pick Hero Image for ${name}`,
|
|
|
|
|
|
})
|
|
|
|
|
|
}
|
release: v0.11.0 — journal fixes, admin URLs, design system cleanup (#432)
* fix(screenshots): sharp-Typen fuer 0.34 und 0.35 gleichzeitig (#410)
sharp 0.35 ist von `export =` auf ESM umgestellt: der Modul-Namespace
ist nicht mehr aufrufbar, die Factory sitzt unter .default. Der
Type-Check brach damit in scripts/screenshots.ts weg, sobald der
Next-Bump (#402) sharp von 0.34.5 auf 0.35.3 mitzieht -- sharp ist hier
keine deklarierte Dependency, sondern kommt ueber Next mit.
Die Form wird jetzt aus dem installierten Paket abgeleitet statt
festgeschrieben, zur Laufzeit wie im Typ. Geprueft mit beiden
Versionen: tsc laeuft mit 0.34.5 und mit 0.35.3 fehlerfrei durch.
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
* chore(deps): bump the nextjs group across 1 directory with 2 updates (#402)
Bumps the nextjs group with 2 updates in the / directory: [next](https://github.com/vercel/next.js) and [eslint-config-next](https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next).
Updates `next` from 16.2.12 to 16.3.0
- [Release notes](https://github.com/vercel/next.js/releases)
- [Commits](https://github.com/vercel/next.js/compare/v16.2.12...v16.3.0)
Updates `eslint-config-next` from 16.2.12 to 16.3.0
- [Release notes](https://github.com/vercel/next.js/releases)
- [Commits](https://github.com/vercel/next.js/commits/v16.3.0/packages/eslint-config-next)
---
updated-dependencies:
- dependency-name: eslint-config-next
dependency-version: 16.3.0
dependency-type: direct:development
update-type: version-update:semver-minor
dependency-group: nextjs
- dependency-name: next
dependency-version: 16.3.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: nextjs
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* chore(deps-dev): bump prettier from 3.8.3 to 3.9.6 (#405)
Bumps [prettier](https://github.com/prettier/prettier) from 3.8.3 to 3.9.6.
- [Release notes](https://github.com/prettier/prettier/releases)
- [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md)
- [Commits](https://github.com/prettier/prettier/compare/3.8.3...3.9.6)
---
updated-dependencies:
- dependency-name: prettier
dependency-version: 3.9.6
dependency-type: direct:development
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* docs(changelog): Unreleased-Sektion fuer die Bumps nach v0.10.0 (#413)
Die Dependency-PRs sind nach dem Release auf dev gelandet, teils auch
auf main. Ohne Eintrag waeren sie beim naechsten Release unsichtbar --
inklusive Next 16.3.0, das CVE-2025-13465 mitbringt.
Ausserdem im 0.10.0-Abschnitt nachgetragen, dass der Trivy-Scan bis
#409 nie gelaufen ist. Der Fix steckt im Tag v0.10.0, fehlte aber in der
Aufzaehlung -- und "Images werden bei jedem Publish gescannt" stand im
Changelog, waehrend der Job im Action-Setup abbrach.
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
* feat(gallery): per-album sort order, independent of Immich (#408) (#414)
Album order was dictated entirely by Immich: getAlbum() sorted by the
album's own asc/desc flag, so a Folio album always mirrored the archive.
A curated series has a narrative order that has nothing to do with
capture time, and changing the Immich album's sort to fit the website
changes it for the archive too.
Adds an optional per-album `sort` in gallery.yaml, editable in /admin,
defaulting to today's behaviour so every existing config is unchanged:
immich (default) | newest | oldest | filename | manual
`manual` is a pinned *prefix*: `assetOrder` lists only the photos placed
by hand, everything else follows in the album's Immich order. A full
permutation of a 2,000-photo album would be ~80 KB of UUIDs in a file
that is rewritten and copied to content/.backups/ on every admin save.
It also makes drift fall out for free — photos removed in Immich never
match, new ones land in the tail rather than being hidden.
Sorting is applied after the cache read, not before the cache write, so
the LRU keeps one canonical Immich-ordered copy per album. That avoids
putting the mode in the cache key, lets a config change take effect
without depending on invalidation, and keeps the stale-serving path
correct. cache.get() returns the stored object by reference, so
withSort() returns a shallow clone with a new array — sorting in place
would reorder the shared entry, and under request coalescing every
concurrent caller would be sorting the same array.
Also fixes a prerequisite bug: /api/admin/albums/[albumId]/assets read
album.assets from GET /albums/:id, which Immich 3.x no longer populates
(lib/immich.ts:507). The hero picker's "This Album" tab returned nothing
and threw outright when the key was absent. It now goes through the
client's paginated metadata search, with ?types=all to opt videos in for
the reorder editor.
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
* refactor(admin): drop decorative emoji from the sort select labels (#415)
An <option> cannot contain markup, so the SVG set in Icons is not
reachable there — but a decorative emoji is not a substitute for it.
Plain text instead; the album card badge already uses a real icon.
The remaining emoji in the admin panel (asset picker tabs, section
headings, layout picker options) predate this branch and are left for a
separate cleanup.
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
* refactor(admin): replace emoji icons with the shared SVG icon set (#416)
The admin panel mixed two icon conventions: inline SVGs from
`Icons.tsx` in most components, and decorative emoji in the asset
picker and a few PageBuilder labels. Emoji render inconsistently
across platforms, ignore the accent colour, and cannot inherit the
`.svg-icon` sizing rules.
- Icons.tsx: add `IconStar` (filled — it marks a state, not an
action) and `IconImage`.
- AssetPicker: the three tab labels and the favourite tile badge now
use IconFolder / IconStar / IconImage.
- PageBuilder: the "Standalone Albums" and "Subpages" headings use
the icon set instead of an emoji.
- PageBuilder: the layout picker drops its emoji for plain text. An
<option> cannot contain markup, so an SVG is impossible there and a
decorative glyph is not a substitute.
- admin.css: align icon and label in the picker tabs, and swap the
favourite badge's text-shadow for drop-shadow, which is what
applies to an inline SVG.
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
* refactor(admin): fold PageBuilder's local icons into the shared Icons module (#418)
* refactor(admin): fold PageBuilder's local icons into the shared module
PageBuilder.tsx carried its own `Icons` object duplicating most of the
glyphs already exported by Icons.tsx, with hardcoded sizes and slightly
divergent paths. Migrate all 32 call sites to the shared module and
delete the local object.
Five glyphs had no counterpart and are added to Icons.tsx as 1:1 ports
of the local paths: IconX, IconPlus, IconHome, IconCopy, IconImage.
The local ExternalLink and Check are dropped rather than ported — both
had zero call sites.
Two glyphs change shape slightly, which is the point of consolidating:
the shared IconCamera includes the viewfinder bump the local copy
omitted, and drag handles now use IconGripVertical.
IconGripVertical uses the module's square 24x24 viewBox, so `.svg-drag`
goes from 12x18 to 18x18 — the old non-square box would letterbox the
glyph down to 12x12 and shrink the handle.
* fix(admin): resolve icon-module integration after #416
Merging dev brought in #416, which added a second IconImage to Icons.tsx
and two <Icons.Camera>/<Icons.Folder> section headers that reference the
local Icons object this PR removes. Git merged both cleanly but the result
did not type-check.
- drop the duplicate IconImage (both copies were byte-identical)
- point the two section headers at the imported IconCamera/IconFolder
- refresh the SORT_LABELS comment: the icon set is imported now, not
declared below
---------
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
* fix(config): allow an empty gallery, guard against a double /api suffix (#421)
An empty gallery is now a valid, rendered state instead of a throw: deriveGallery() no longer requires at least one album or subpage, so a deployment with no albums yet renders a bare homepage the owner can fill in via /admin.
getConfig() also stops appending /api to an Immich URL that already ends in it, which previously produced .../api/api and broke every upstream request.
Includes a restore of the per-album sort test cases, which the branch had lost by being cut before #408/#414.
* feat(admin): favicon upload, served from the content volume (#422)
Adds a bundled default favicon, an upload widget in admin Settings > General, and a route that serves the icon from the writable content/ volume with a fallback to the bundled default. Raster uploads (PNG/ICO/JPEG) are wrapped in an SVG container; the response carries its own CSP so an uploaded SVG cannot execute script on the origin.
The GET route revalidates with an ETag instead of caching immutably, so a newly uploaded icon shows up immediately. Uploads are written via temp file + rename, and a Reset button restores the bundled default.
* ci: flag unformatted files in a PR, without blocking it (#424)
Prettier is configured as an error rule in eslint.config.mjs but has never run in CI, so part of the tree predates it. A final CI step now diffs against the PR base, runs prettier --list-different over the changed files, and emits a warning annotation per offender plus a job summary.
Advisory by design: it never fails the job. Blocking would turn a PR red for merely touching a file that was already unformatted, and normalising the tree in one commit would wreck git blame and conflict with the PRs in flight.
Requires fetch-depth: 0, since diffing against the base needs its history.
* feat(install): first-run wizard gated by a one-time setup token (#419)
Adds /install, a four-step first-run wizard: connect to Immich, optionally pick albums, name the site, finish. It verifies the credentials against the Immich server before writing anything, then writes gallery.yaml, settings.yaml and a content/install.json carrying the Immich credentials and a generated site secret.
install.json exists because a running process cannot pick up new env vars — the wizard has to write configuration that takes effect without a restart. getInstallCredentials() merges it under the real environment, so env vars always win and rotation stays a matter of setting one.
Both the page and the API routes are gated by a one-time setup token printed to the server log, so a deployment that is reachable before gallery.yaml exists cannot be configured by whoever finds it first. The token is stored in content/.setup-token (0600) rather than a module variable: Next.js bundles the page and each route handler separately, so a module-level token left the page and the API disagreeing inside one process and the wizard stuck on step 1. It is removed once the install completes.
The admin password is stored as an scrypt hash using the scheme lib/auth.ts already applies to album passwords; a plaintext ADMIN_PASSWORD env var keeps working.
* docs: document the setup wizard, fix the read-only content mount (#425)
Quick Start now leads with the /install wizard, with the hand-written YAML route kept alongside it, and a First-Run Setup section covers the setup token, the files the wizard writes, and env-var precedence.
Two corrections: both Docker examples mounted content/ as :ro, which silently breaks the wizard, the admin panel and the backup rotation alike — docs/admin-panel.md already said so and the README contradicted it. And nothing documented that content/install.json holds the Immich API key, so a backup of content/ is a backup of credentials.
Also adds a Contributors section crediting the people whose work is in the project.
* feat(admin): floating save bar pinned to the bottom of the viewport (#426)
The save bar was the first, static element inside .admin-main. Since the
document itself scrolls, it left the viewport as soon as you scrolled down
— editing a subpage section or a settings block far below gave no visible
dirty hint and no reachable save button.
Replace it with a bottom-pinned floating bar shared by both editors. It
only mounts while there is something to act on (unsaved changes, an
in-flight save, or a result message), so it never covers content while
idle. The success message clears after 5s, which hides the bar again.
- new SaveBar component, replacing the duplicated markup in PageBuilder
and SettingsEditor
- adopt the previously unused .floating-save-bar CSS: slide-in keyframes
(carrying translateX(-50%)), dirty border, wrap/gap, mobile variant and
a prefers-reduced-motion opt-out; z-index 900 keeps it below modals
- .admin-main gains bottom padding so the bar never covers page content
- drop the now-unreachable idle hints: the ⌘S hint becomes a button title,
the Live Sync note becomes a static line above the settings layout
- header "Site" link now bypasses the cache (/?fresh=1), so the preview
stays reachable when the bar is hidden
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
* feat(admin): themed listbox for the album sort control (#427)
The per-album "Photo order" control was a native <select>. Because an
<option> cannot contain markup, its choices could not use the admin
panel's currentColor SVG set — the reason #415 had to fall back to plain
text after dropping the emoji labels.
Adds a Listbox component implementing the ARIA combobox/listbox pattern,
so options can render a glyph beside their label:
- DOM focus stays on the trigger button; the active option is announced
through aria-activedescendant, keeping focus management to one element
- Keyboard: arrows (clamped at the ends, like a native select),
Home/End, Enter/Space to commit, Escape to cancel, Tab commits and
moves on, and prefix type-ahead with a repeat-key cycle
- Outside dismissal on pointerdown, so a press starting outside closes
the popup before the click retargets
The sort options now carry an icon each: calendar, arrow-down, arrow-up,
an A→Z marker, and the drag glyph for manual — matching the badge the
album card already shows. SORT_LABELS stays plain text because the badge
feeds it to a title attribute.
Closes #417
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
* chore(git): ignore generated design handoff folders
* fix(admin): stop the album sort dropdown clipping, and simplify the panel (#428)
* fix(admin): render listbox popup in a portal so it escapes modal clipping
The sort control's popup was position:absolute inside three clipping ancestors
(.album-drawer overflow:hidden > .album-drawer-body overflow-y:auto >
.modal-right-column overflow-y:auto), so it was cut off at the bottom of the
Edit Album Details modal. z-index could not help: clipping happens before
stacking. It also always hung below the trigger, with no flip.
Portal the popup to document.body and position it from the trigger's viewport
rect, flipping above when there is more room there and capping max-height to the
space available so it scrolls internally rather than overflowing. It is
dismissed on scroll and resize, since the anchor is only measured on open.
The outside-pointerdown handler now also treats the popup as inside; without
that the portalled list counts as outside, and a click on an option would close
it before the selection commits.
* refactor(admin): single-column album details panel
The left column spent 1.2fr on a cover thumbnail and three stat rows, two of
which (Status, Custom Hero) only restated the form fields opposite them, while
the form itself was squeezed into 1.8fr behind a second nested scroller.
Stack the drawer in one column instead: cover as a banner, then the form at full
width, with the UUID moved into the footer. The body is now the only scroll
container, which also removes one of the ancestors that was clipping the sort
popup.
---------
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
* fix(admin): give the portalled listbox its theme back, lock the page behind modals (#429)
Two defects in the album editor.
The sort listbox popup painted transparent. Every --admin-* variable is
scoped to .admin-layout, and since the popup moved into document.body it
sits outside that subtree, so background/border/text all resolved to
nothing. It now carries its own copy of the palette in both colour
schemes, plus the font it no longer inherits.
Scrolling inside a modal also moved the page behind it. No admin modal
ever locked body scroll: the overlay covers the page but does not absorb
wheel events, so a scroll starting on the backdrop — or continuing past
the end of the modal's own scroller — reaches the document.
overscroll-behavior cannot cover that case on its own, because it only
applies to scroll containers and the backdrop is not one.
useScrollLock freezes body while a modal is open and compensates for the
width the scrollbar gives up, so nothing shifts underneath. Each lock
restores the inline value it found, which makes nesting work without a
counter — a picker opened from the drawer restores the drawer's hidden
state instead of clearing it. Applied to both drawers and all four
picker modals, which share the defect. overscroll-behavior: contain on
the scrollers stops the chaining they can handle themselves.
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
* fix(security): allow unsafe-eval in CSP script-src during dev mode
* feat(journal): add Journal Studio with split-screen editor, live preview and dedicated routes
* fix(build): separate client parser from server journal-service and fix build type errors
* fix(journal): Fotos rendern, Layout und Lightbox-Steuerung korrigieren
Fünf unabhängige Fehler in der öffentlichen Journal- und Essay-Ansicht:
* Foto-Blöcke wurden nie angezeigt. EssayView löst ein Foto über
PhotoItem.id auf, und das sind verschlüsselte Tokens — die Blöcke aus
dem Markdown tragen aber rohe Asset-UUIDs. Jede Zuordnung lief ins
Leere, und nicht auflösbare Blöcke werden still verworfen. Die IDs
werden jetzt serverseitig übersetzt; damit verschwinden nebenbei die
rohen UUIDs aus dem Client-Payload, die dort laut Projektregel nie
auftauchen dürfen. Nicht auflösbare Referenzen werden geloggt.
* Überschriften standen weiter links als der Fließtext. Jeder Block
hatte einzeln `max-width: 68ch`, und `ch` ist relativ zur Schrift des
Elements — die Serif-Überschrift ergab eine breitere Spalte. Ersetzt
durch eine gemeinsame, font-unabhängige `--essay-measure`.
* Fullbleed-Fotos bluteten nur nach links aus: `.essay-figure` ist
`width: 100%`, wodurch die Box überbestimmt ist und der negative
rechte Margin verworfen wird.
* Foto-Paare stellten beide Bilder gleich breit dar, wodurch ein
Hochformat neben einem Querformat doppelt so hoch wurde. Jetzt eine
Justified-Reihe: Breite proportional zum Seitenverhältnis, dadurch
exakt gleiche Höhen ohne Beschnitt.
* Die Lightbox hatte im Journal keine Tastatursteuerung und keine
Scroll-Sperre — beides lag in PhotoGrid, also nur im Album-Raster.
Verlagert in die Lightbox selbst, der doppelte Handler in PhotoGrid
entfernt (sonst wäre pro Pfeildruck zwei Bilder weitergesprungen).
Zusätzlich sind Proofing-Herzen und das EXIF-Panel im redaktionellen
Modus abschaltbar und im Journal aus: Client-Proofing ist ein
Übergabe-Workflow für Alben, keine Funktion einer Reportage. Auf der
Übersicht wurde der Untertitel doppelt gerendert, weil extractExcerpt()
auf ihn zurückfällt.
* feat(admin): eigene URLs für alle Bereiche und überarbeiteter Journal Studio
Das Panel war eine einzige Client-Komponente, die ihre Tabs über
useState umschaltet: keine Route pro Bereich, kein Deep-Link, kein
Zurück-Button, und nach jedem Reload landete man wieder auf "Pages".
Auch der Journal-Editor hatte keine eigene URL.
Jetzt sieben echte Routen (/admin, /admin/pages, /admin/journal,
/admin/journal/<slug>, /admin/settings, /admin/settings/<section>,
/admin/analytics). Die Shell mit Auth-Prüfung und Kopfzeile sitzt im
Layout und umschließt children — so bleibt die Session-Prüfung über
Routenwechsel montiert, statt bei jedem Tab-Wechsel neu zu laufen und
den Spinner aufblitzen zu lassen. Unbekannte Settings-Sections fallen
auf General zurück.
Im selben Zug der Journal Studio, der die Routing-Änderung ohnehin
berührt:
* Alle Eingabefelder nutzten die Klasse `admin-input`, die in keinem
CSS definiert war — sie fielen auf Browser-Defaults zurück. Jetzt
gestylt, gescoped, damit der generische Name nicht ins übrige Panel
leckt.
* Der Split View ist per Divider verschiebbar (Maus, Tastatur,
Doppelklick zum Zurücksetzen), Breite in localStorage.
* Das Studio bricht aus der 1120px-Spalte aus, die Preview hat Platz.
* Die Preview zeigte für jedes Foto fest 3:2 und log damit über das
Layout der veröffentlichten Seite; die echten Verhältnisse werden
jetzt an den Thumbnails gemessen.
* Blöcke mit alten positionsbasierten Foto-Referenzen werden markiert —
die lassen sich auf einer eigenständigen Journal-Seite nicht auflösen
und verschwanden bisher stillschweigend.
* Blocktyp-Chips als gemeinsame Komponente, monochrom und per Icon
unterschieden statt in einer eigenen Blau/Lila/Orange-Palette, die
sonst nirgends im Panel vorkommt.
* Emojis raus, SVG-Icons rein.
* fix(admin): Designsystem-Lücken im Panel schließen
Eine systematische Suche nach Klassen, die im TSX benutzt, aber in
keinem CSS definiert sind, hat vier Stellen mit demselben Muster
gefunden:
* `admin-btn-secondary` und `admin-btn-danger` existierten nicht.
Sämtliche Löschen-Buttons sahen aus wie normale Buttons — keine
Warnwirkung. Als `.admin-btn.admin-btn-danger` geschrieben, weil die
Varianten mit den Größenklassen kombiniert werden, die weiter unten
ihren eigenen Hintergrund setzen.
* `page-progress-fill` fehlte: die Balken im Analytics-Panel waren
leere Rinnen, der Wert unsichtbar. Ebenso `analytics-empty` und
`admin-loading-container`.
* `subpage-drawer-section`, `subpage-drawer-title-group` und
`input-with-icon` im PageBuilder waren wirkungslos und teils mit
Inline-Styles notdürftig kompensiert.
* `grid-card-preview` fehlte, wodurch alle Layout-Vorschauen auf Höhe
null kollabierten. Nur "Showcase" war sichtbar — und das aus Versehen,
weil sein Tile `hero-tile` hieß und damit die `aspect-ratio` einer
fremden PageBuilder-Klasse erbte. Umbenannt.
Dazu die Theme-Vorschauen, die praktisch identisch aussahen: alle
sieben zeigten dieselben drei quadratischen Kacheln, einziger
Unterschied war die Hintergrundfarbe. Sie spiegeln jetzt die echten
Preset-Daten aus lib/config/theme.ts — Schriftcharakter, Eckradius,
Rasterdichte, Passepartout bzw. Schatten.
Die Kopfzeile richtet sich an einer gemeinsamen Steuerhöhe aus. Der
"Site"-Link war höher als die Buttons daneben: `.admin-btn` hatte keine
explizite line-height, und <button> bekommt box-sizing: border-box vom
Browser, <a> nicht. Die Statusanzeige setzte weder Schriftfamilie noch
-größe und fiel auf den Browser-Default zurück — sie war nie Teil des
Designsystems. Jetzt gleiche Höhe und Typografie, Pillenform als
Zustandsanzeige, Trenner zur Aktionsgruppe. Das dauerhafte Pulsieren
des grünen Punkts entfällt; Animation bleibt den Zuständen vorbehalten,
die Aufmerksamkeit brauchen.
Restliche Emojis durch SVG-Icons ersetzt.
* feat(admin): add scroll-to-top toggle and SVG arrow
The back-to-top button was always on and drew its arrow with the ↑ text
character. Add a `scrollToTop` setting (General section in the admin
panel, defaults to on so existing sites are unaffected) and replace the
glyph with a stroked SVG that inherits currentColor across all presets.
Scroll handling is now rAF-throttled, and prefers-reduced-motion turns
off both the hover lift and the smooth scroll.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
* security(journal): escape author HTML instead of filtering it
CodeQL flags 26 high-severity alerts on the release PR; the bulk of them
point at sanitizeHtml(), a denylist of three regexes whose output goes
into dangerouslySetInnerHTML. I reproduced the bypasses before changing
anything — all four pass the old filter:
<img src=x onerror=alert(1)> unquoted handler, regex wants quotes
<img src=x onerror='alert(1)'> single quotes, same reason
<svg onload=alert(1)> not a <script> tag
javasjavascript:cript:alert(1) one-pass replace, the rest recombines
Plus an attribute breakout in the link renderer, which interpolated the
URL into href="${url}" unescaped:
[x](" onmouseover=alert(1) x=") -> <a href="" onmouseover=alert(1" ...>
Replaced with escaping. Every `&<>"'` in author text becomes an entity
before any markdown rule runs, so the only tags in the output are the
ones renderInlineMarkdown builds itself and a URL cannot leave its
attribute. Link schemes are now an allowlist (http, https, mailto, tel,
relative, anchor); anything else renders as plain text.
The serializer needed decodeHtmlEntities to match: without it a save
would write `<` into the Markdown file and the next parse would
escape the `&` again, corrupting the text further on every round trip.
A test covers parse -> serialize -> parse stability.
Two existing tests asserted the old behaviour and were rewritten rather
than deleted: one expected the script tag to be *removed* from the
output, the other expected the substring "onerror" to be absent. Both
now assert the property that matters — that no tag can form — because
`onerror` surviving as inert text is fine.
Exploitation required admin access either way: journal and essay text
comes from the studio or from content/*.md. This removes the weakness,
it does not close an open door.
* fix(journal): contain file paths, fix frontmatter escaping, defuse two regexes
Follow-up to the CodeQL findings on release PR #432. I went through all 23
alerts individually; this addresses the ones that are worth addressing and
documents the ones that are not.
Path containment (12 alerts, all false positives). Every path built from a
slug goes through isValidSlug(), a strict `/^[a-zA-Z0-9_-]+$/` allowlist —
verified against `../../etc/passwd`, `foo/../../bar`, `a/b`, `..` and
friends, all rejected. CodeQL cannot see it because the check lives in
another module. Added a containedPath() helper that resolves the path and
refuses anything landing outside the content directory: a second lock on a
door that was already locked, and a barrier the analysis can follow. Also
removed the dead `slug.endsWith('.md')` branches — isValidSlug rejects
dots, so they could never be taken.
Frontmatter escaping (1 alert, a real bug). The serializer escaped `"` but
not `\`, and the parser never unescaped anything. A title containing either
character gained a backslash on every save/load cycle:
Path C:\Users "quoted" -> Path C:\\Users \"quoted\" -> ...
Escaping now covers the backslash first and the parser undoes both. A round
trip test covers quotes, backslashes, colons and apostrophes.
Two of three ReDoS regexes (2 alerts). The heading pattern had `\s+` next to
`(.+)`, which overlap, so the engine tried every split of the whitespace run
before failing; it is `[ \t]+` and `(\S.*)` now. The quote author pattern
wrapped a lazy group around an optional group — the quadratic case — and is
an index split on the first separator now.
The third regex, the bold/italic pass, is deliberately left alone. Rewriting
it with a negated class removes the backtracking but breaks nesting:
`**bold *and italic* here**` renders as `*<em>bold </em>and italic<em> here</em>*`.
The input is Markdown from an authenticated admin, never a visitor, so the
worst case is an author slowing down their own page. The comment in the code
says so.
Not addressed: 5 js/insufficient-password-hash alerts. They ask for a slow
KDF where the code uses SHA-256/HMAC — correct in general, but the admin
password comes from an environment variable and is never stored, so a
stronger KDF protects nothing that is not already in plaintext in the
environment.
399 unit tests pass (18 new), build and tsc clean.
* fix(journal): split the quote author by scanning, not by pattern
Cleaning up after myself. #439 replaced the quote author regex
`/^(.*?)(?:\s+--\s+(.+))?$/` — a lazy group around an optional one, the
quadratic case — with `/\s+--\s+/`, and CodeQL promptly flagged the
replacement for the same reason. One reported pattern traded for another.
splitQuoteAuthor() scans for the first `--` that has whitespace on both
sides. Linear, and it needs no reasoning about the regex engine at all.
Behaviour is identical to the original regex, checked case by case
against it: separator, no separator, several separators, tabs, wide gaps,
`a--b` without spaces, leading and trailing separators, empty string. All
nine are covered by tests, plus one asserting it stays fast on a 50k
whitespace run.
* security(admin): derive the session signing key with scrypt
getSigningKey() ran the admin password through a single SHA-256 digest.
It is key derivation rather than password storage, so it was never a
stored-hash problem — but if the derived key ever leaked, one fast hash
makes recovering the password by brute force cheap. CodeQL flags it as
js/insufficient-password-hash and, for this particular alert, has a
point.
scrypt now. Two details that matter:
The salt has to be stable. A random salt would produce a different key on
every call and invalidate every session; it is derived from AUTH_SECRET,
which is deployment-specific. Verified across separate processes: same
inputs produce a verifying token, so a restart or redeploy does not log
everyone out.
The result is cached for the process lifetime. scrypt is deliberately
slow and getSigningKey() runs on every admin request — deriving per call
would add ~24ms to each one. The cache key is a digest of secret plus
password, so a rotation misses the cache and derives again, and no extra
plaintext copy of the password is kept around.
Measured: first derivation 24ms, subsequent calls 0.12ms. Password
change and secret change both invalidate an existing token, checked in
separate processes.
Note the one-time effect: existing admin sessions are invalidated by the
change in derivation, so everyone logs in once more.
* security(admin): key the signing-key cache on its inputs, not a digest
#441 removed the SHA-256 digest of the admin password from the key
derivation and introduced a new one three lines above it, as the cache
key. Same rule, same file: CodeQL reported it immediately.
The comment justifying it was wrong too. It claimed no second plaintext
copy of the password was retained, while building the digest input
allocates exactly that in order to hash it.
The cache now holds the two input strings and compares them directly.
They are the same objects the env and install caches already hold, so
nothing extra is retained, and no fast hash of the password exists in
memory for the life of the process.
Re-verified after the change, in separate processes: a token from one
process verifies in another with the same inputs, a changed password or
secret rejects it, first derivation 24ms, cached calls 0.001ms.
That leaves scrypt as the only place the password is hashed here. The
two HMACs further down operate on the derived key and on token data, not
on the password; the constant-time comparison in verifyAdminPassword is
the previously dismissed one.
---------
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
2026-08-14 16:55:07 +02:00
|
|
|
|
>
|
release: v0.11.0 (#459)
Ships `dev` as **v0.11.0**. `main` contains nothing that `dev` does not,
so this is a clean sync.
## Headline changes since v0.10.0
- **Journal & Journal Studio** — photo essays at `/journal`,
split-screen block editor with live preview, drafts, per-entry
passwords, cover images
- **First-run setup wizard at `/install`** — configure a fresh
deployment from the browser; credentials are verified against Immich
before anything is written, and the wizard is gated by a one-time token
- **About page editor and toggle** in the admin panel
- **Per-album photo order** independent of Immich, with a drag & drop
editor
- **Custom favicon upload**
- **Experimental portfolio features** — justified grid, `cover` hero,
unlisted subpages, per-album grid overrides, cover focal points,
external nav links
- **Security** — asset tokens length-capped before decoding (#423),
journal author markdown escaped rather than filtered, journal file paths
contained, admin session key derived with scrypt (#432), Next.js 16.3.0
for CVE-2025-13465
- **Fixed** — client proofing honours its own configuration again
(#454); journal photo rendering (#432)
Full detail in [CHANGELOG.md](CHANGELOG.md#0110--2026-08-15).
## Verified
`npx tsc --noEmit` clean · `npx vitest run` 435 tests pass · `npm run
build` succeeds · lint 0 errors · `prettier --check` clean · local
`docker build` of the release tree.
## After merge
Tag `v0.11.0` on `main` and publish the release — that triggers
`docker-publish.yml`, which pushes the image and moves `latest`.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
---------
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
2026-08-15 09:09:18 +02:00
|
|
|
|
<IconImage size={12} />{' '}
|
|
|
|
|
|
{album.heroImage ? 'Change Image' : 'Pick Hero Image'}
|
release: v0.11.0 — journal fixes, admin URLs, design system cleanup (#432)
* fix(screenshots): sharp-Typen fuer 0.34 und 0.35 gleichzeitig (#410)
sharp 0.35 ist von `export =` auf ESM umgestellt: der Modul-Namespace
ist nicht mehr aufrufbar, die Factory sitzt unter .default. Der
Type-Check brach damit in scripts/screenshots.ts weg, sobald der
Next-Bump (#402) sharp von 0.34.5 auf 0.35.3 mitzieht -- sharp ist hier
keine deklarierte Dependency, sondern kommt ueber Next mit.
Die Form wird jetzt aus dem installierten Paket abgeleitet statt
festgeschrieben, zur Laufzeit wie im Typ. Geprueft mit beiden
Versionen: tsc laeuft mit 0.34.5 und mit 0.35.3 fehlerfrei durch.
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
* chore(deps): bump the nextjs group across 1 directory with 2 updates (#402)
Bumps the nextjs group with 2 updates in the / directory: [next](https://github.com/vercel/next.js) and [eslint-config-next](https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next).
Updates `next` from 16.2.12 to 16.3.0
- [Release notes](https://github.com/vercel/next.js/releases)
- [Commits](https://github.com/vercel/next.js/compare/v16.2.12...v16.3.0)
Updates `eslint-config-next` from 16.2.12 to 16.3.0
- [Release notes](https://github.com/vercel/next.js/releases)
- [Commits](https://github.com/vercel/next.js/commits/v16.3.0/packages/eslint-config-next)
---
updated-dependencies:
- dependency-name: eslint-config-next
dependency-version: 16.3.0
dependency-type: direct:development
update-type: version-update:semver-minor
dependency-group: nextjs
- dependency-name: next
dependency-version: 16.3.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: nextjs
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* chore(deps-dev): bump prettier from 3.8.3 to 3.9.6 (#405)
Bumps [prettier](https://github.com/prettier/prettier) from 3.8.3 to 3.9.6.
- [Release notes](https://github.com/prettier/prettier/releases)
- [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md)
- [Commits](https://github.com/prettier/prettier/compare/3.8.3...3.9.6)
---
updated-dependencies:
- dependency-name: prettier
dependency-version: 3.9.6
dependency-type: direct:development
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* docs(changelog): Unreleased-Sektion fuer die Bumps nach v0.10.0 (#413)
Die Dependency-PRs sind nach dem Release auf dev gelandet, teils auch
auf main. Ohne Eintrag waeren sie beim naechsten Release unsichtbar --
inklusive Next 16.3.0, das CVE-2025-13465 mitbringt.
Ausserdem im 0.10.0-Abschnitt nachgetragen, dass der Trivy-Scan bis
#409 nie gelaufen ist. Der Fix steckt im Tag v0.10.0, fehlte aber in der
Aufzaehlung -- und "Images werden bei jedem Publish gescannt" stand im
Changelog, waehrend der Job im Action-Setup abbrach.
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
* feat(gallery): per-album sort order, independent of Immich (#408) (#414)
Album order was dictated entirely by Immich: getAlbum() sorted by the
album's own asc/desc flag, so a Folio album always mirrored the archive.
A curated series has a narrative order that has nothing to do with
capture time, and changing the Immich album's sort to fit the website
changes it for the archive too.
Adds an optional per-album `sort` in gallery.yaml, editable in /admin,
defaulting to today's behaviour so every existing config is unchanged:
immich (default) | newest | oldest | filename | manual
`manual` is a pinned *prefix*: `assetOrder` lists only the photos placed
by hand, everything else follows in the album's Immich order. A full
permutation of a 2,000-photo album would be ~80 KB of UUIDs in a file
that is rewritten and copied to content/.backups/ on every admin save.
It also makes drift fall out for free — photos removed in Immich never
match, new ones land in the tail rather than being hidden.
Sorting is applied after the cache read, not before the cache write, so
the LRU keeps one canonical Immich-ordered copy per album. That avoids
putting the mode in the cache key, lets a config change take effect
without depending on invalidation, and keeps the stale-serving path
correct. cache.get() returns the stored object by reference, so
withSort() returns a shallow clone with a new array — sorting in place
would reorder the shared entry, and under request coalescing every
concurrent caller would be sorting the same array.
Also fixes a prerequisite bug: /api/admin/albums/[albumId]/assets read
album.assets from GET /albums/:id, which Immich 3.x no longer populates
(lib/immich.ts:507). The hero picker's "This Album" tab returned nothing
and threw outright when the key was absent. It now goes through the
client's paginated metadata search, with ?types=all to opt videos in for
the reorder editor.
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
* refactor(admin): drop decorative emoji from the sort select labels (#415)
An <option> cannot contain markup, so the SVG set in Icons is not
reachable there — but a decorative emoji is not a substitute for it.
Plain text instead; the album card badge already uses a real icon.
The remaining emoji in the admin panel (asset picker tabs, section
headings, layout picker options) predate this branch and are left for a
separate cleanup.
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
* refactor(admin): replace emoji icons with the shared SVG icon set (#416)
The admin panel mixed two icon conventions: inline SVGs from
`Icons.tsx` in most components, and decorative emoji in the asset
picker and a few PageBuilder labels. Emoji render inconsistently
across platforms, ignore the accent colour, and cannot inherit the
`.svg-icon` sizing rules.
- Icons.tsx: add `IconStar` (filled — it marks a state, not an
action) and `IconImage`.
- AssetPicker: the three tab labels and the favourite tile badge now
use IconFolder / IconStar / IconImage.
- PageBuilder: the "Standalone Albums" and "Subpages" headings use
the icon set instead of an emoji.
- PageBuilder: the layout picker drops its emoji for plain text. An
<option> cannot contain markup, so an SVG is impossible there and a
decorative glyph is not a substitute.
- admin.css: align icon and label in the picker tabs, and swap the
favourite badge's text-shadow for drop-shadow, which is what
applies to an inline SVG.
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
* refactor(admin): fold PageBuilder's local icons into the shared Icons module (#418)
* refactor(admin): fold PageBuilder's local icons into the shared module
PageBuilder.tsx carried its own `Icons` object duplicating most of the
glyphs already exported by Icons.tsx, with hardcoded sizes and slightly
divergent paths. Migrate all 32 call sites to the shared module and
delete the local object.
Five glyphs had no counterpart and are added to Icons.tsx as 1:1 ports
of the local paths: IconX, IconPlus, IconHome, IconCopy, IconImage.
The local ExternalLink and Check are dropped rather than ported — both
had zero call sites.
Two glyphs change shape slightly, which is the point of consolidating:
the shared IconCamera includes the viewfinder bump the local copy
omitted, and drag handles now use IconGripVertical.
IconGripVertical uses the module's square 24x24 viewBox, so `.svg-drag`
goes from 12x18 to 18x18 — the old non-square box would letterbox the
glyph down to 12x12 and shrink the handle.
* fix(admin): resolve icon-module integration after #416
Merging dev brought in #416, which added a second IconImage to Icons.tsx
and two <Icons.Camera>/<Icons.Folder> section headers that reference the
local Icons object this PR removes. Git merged both cleanly but the result
did not type-check.
- drop the duplicate IconImage (both copies were byte-identical)
- point the two section headers at the imported IconCamera/IconFolder
- refresh the SORT_LABELS comment: the icon set is imported now, not
declared below
---------
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
* fix(config): allow an empty gallery, guard against a double /api suffix (#421)
An empty gallery is now a valid, rendered state instead of a throw: deriveGallery() no longer requires at least one album or subpage, so a deployment with no albums yet renders a bare homepage the owner can fill in via /admin.
getConfig() also stops appending /api to an Immich URL that already ends in it, which previously produced .../api/api and broke every upstream request.
Includes a restore of the per-album sort test cases, which the branch had lost by being cut before #408/#414.
* feat(admin): favicon upload, served from the content volume (#422)
Adds a bundled default favicon, an upload widget in admin Settings > General, and a route that serves the icon from the writable content/ volume with a fallback to the bundled default. Raster uploads (PNG/ICO/JPEG) are wrapped in an SVG container; the response carries its own CSP so an uploaded SVG cannot execute script on the origin.
The GET route revalidates with an ETag instead of caching immutably, so a newly uploaded icon shows up immediately. Uploads are written via temp file + rename, and a Reset button restores the bundled default.
* ci: flag unformatted files in a PR, without blocking it (#424)
Prettier is configured as an error rule in eslint.config.mjs but has never run in CI, so part of the tree predates it. A final CI step now diffs against the PR base, runs prettier --list-different over the changed files, and emits a warning annotation per offender plus a job summary.
Advisory by design: it never fails the job. Blocking would turn a PR red for merely touching a file that was already unformatted, and normalising the tree in one commit would wreck git blame and conflict with the PRs in flight.
Requires fetch-depth: 0, since diffing against the base needs its history.
* feat(install): first-run wizard gated by a one-time setup token (#419)
Adds /install, a four-step first-run wizard: connect to Immich, optionally pick albums, name the site, finish. It verifies the credentials against the Immich server before writing anything, then writes gallery.yaml, settings.yaml and a content/install.json carrying the Immich credentials and a generated site secret.
install.json exists because a running process cannot pick up new env vars — the wizard has to write configuration that takes effect without a restart. getInstallCredentials() merges it under the real environment, so env vars always win and rotation stays a matter of setting one.
Both the page and the API routes are gated by a one-time setup token printed to the server log, so a deployment that is reachable before gallery.yaml exists cannot be configured by whoever finds it first. The token is stored in content/.setup-token (0600) rather than a module variable: Next.js bundles the page and each route handler separately, so a module-level token left the page and the API disagreeing inside one process and the wizard stuck on step 1. It is removed once the install completes.
The admin password is stored as an scrypt hash using the scheme lib/auth.ts already applies to album passwords; a plaintext ADMIN_PASSWORD env var keeps working.
* docs: document the setup wizard, fix the read-only content mount (#425)
Quick Start now leads with the /install wizard, with the hand-written YAML route kept alongside it, and a First-Run Setup section covers the setup token, the files the wizard writes, and env-var precedence.
Two corrections: both Docker examples mounted content/ as :ro, which silently breaks the wizard, the admin panel and the backup rotation alike — docs/admin-panel.md already said so and the README contradicted it. And nothing documented that content/install.json holds the Immich API key, so a backup of content/ is a backup of credentials.
Also adds a Contributors section crediting the people whose work is in the project.
* feat(admin): floating save bar pinned to the bottom of the viewport (#426)
The save bar was the first, static element inside .admin-main. Since the
document itself scrolls, it left the viewport as soon as you scrolled down
— editing a subpage section or a settings block far below gave no visible
dirty hint and no reachable save button.
Replace it with a bottom-pinned floating bar shared by both editors. It
only mounts while there is something to act on (unsaved changes, an
in-flight save, or a result message), so it never covers content while
idle. The success message clears after 5s, which hides the bar again.
- new SaveBar component, replacing the duplicated markup in PageBuilder
and SettingsEditor
- adopt the previously unused .floating-save-bar CSS: slide-in keyframes
(carrying translateX(-50%)), dirty border, wrap/gap, mobile variant and
a prefers-reduced-motion opt-out; z-index 900 keeps it below modals
- .admin-main gains bottom padding so the bar never covers page content
- drop the now-unreachable idle hints: the ⌘S hint becomes a button title,
the Live Sync note becomes a static line above the settings layout
- header "Site" link now bypasses the cache (/?fresh=1), so the preview
stays reachable when the bar is hidden
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
* feat(admin): themed listbox for the album sort control (#427)
The per-album "Photo order" control was a native <select>. Because an
<option> cannot contain markup, its choices could not use the admin
panel's currentColor SVG set — the reason #415 had to fall back to plain
text after dropping the emoji labels.
Adds a Listbox component implementing the ARIA combobox/listbox pattern,
so options can render a glyph beside their label:
- DOM focus stays on the trigger button; the active option is announced
through aria-activedescendant, keeping focus management to one element
- Keyboard: arrows (clamped at the ends, like a native select),
Home/End, Enter/Space to commit, Escape to cancel, Tab commits and
moves on, and prefix type-ahead with a repeat-key cycle
- Outside dismissal on pointerdown, so a press starting outside closes
the popup before the click retargets
The sort options now carry an icon each: calendar, arrow-down, arrow-up,
an A→Z marker, and the drag glyph for manual — matching the badge the
album card already shows. SORT_LABELS stays plain text because the badge
feeds it to a title attribute.
Closes #417
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
* chore(git): ignore generated design handoff folders
* fix(admin): stop the album sort dropdown clipping, and simplify the panel (#428)
* fix(admin): render listbox popup in a portal so it escapes modal clipping
The sort control's popup was position:absolute inside three clipping ancestors
(.album-drawer overflow:hidden > .album-drawer-body overflow-y:auto >
.modal-right-column overflow-y:auto), so it was cut off at the bottom of the
Edit Album Details modal. z-index could not help: clipping happens before
stacking. It also always hung below the trigger, with no flip.
Portal the popup to document.body and position it from the trigger's viewport
rect, flipping above when there is more room there and capping max-height to the
space available so it scrolls internally rather than overflowing. It is
dismissed on scroll and resize, since the anchor is only measured on open.
The outside-pointerdown handler now also treats the popup as inside; without
that the portalled list counts as outside, and a click on an option would close
it before the selection commits.
* refactor(admin): single-column album details panel
The left column spent 1.2fr on a cover thumbnail and three stat rows, two of
which (Status, Custom Hero) only restated the form fields opposite them, while
the form itself was squeezed into 1.8fr behind a second nested scroller.
Stack the drawer in one column instead: cover as a banner, then the form at full
width, with the UUID moved into the footer. The body is now the only scroll
container, which also removes one of the ancestors that was clipping the sort
popup.
---------
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
* fix(admin): give the portalled listbox its theme back, lock the page behind modals (#429)
Two defects in the album editor.
The sort listbox popup painted transparent. Every --admin-* variable is
scoped to .admin-layout, and since the popup moved into document.body it
sits outside that subtree, so background/border/text all resolved to
nothing. It now carries its own copy of the palette in both colour
schemes, plus the font it no longer inherits.
Scrolling inside a modal also moved the page behind it. No admin modal
ever locked body scroll: the overlay covers the page but does not absorb
wheel events, so a scroll starting on the backdrop — or continuing past
the end of the modal's own scroller — reaches the document.
overscroll-behavior cannot cover that case on its own, because it only
applies to scroll containers and the backdrop is not one.
useScrollLock freezes body while a modal is open and compensates for the
width the scrollbar gives up, so nothing shifts underneath. Each lock
restores the inline value it found, which makes nesting work without a
counter — a picker opened from the drawer restores the drawer's hidden
state instead of clearing it. Applied to both drawers and all four
picker modals, which share the defect. overscroll-behavior: contain on
the scrollers stops the chaining they can handle themselves.
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
* fix(security): allow unsafe-eval in CSP script-src during dev mode
* feat(journal): add Journal Studio with split-screen editor, live preview and dedicated routes
* fix(build): separate client parser from server journal-service and fix build type errors
* fix(journal): Fotos rendern, Layout und Lightbox-Steuerung korrigieren
Fünf unabhängige Fehler in der öffentlichen Journal- und Essay-Ansicht:
* Foto-Blöcke wurden nie angezeigt. EssayView löst ein Foto über
PhotoItem.id auf, und das sind verschlüsselte Tokens — die Blöcke aus
dem Markdown tragen aber rohe Asset-UUIDs. Jede Zuordnung lief ins
Leere, und nicht auflösbare Blöcke werden still verworfen. Die IDs
werden jetzt serverseitig übersetzt; damit verschwinden nebenbei die
rohen UUIDs aus dem Client-Payload, die dort laut Projektregel nie
auftauchen dürfen. Nicht auflösbare Referenzen werden geloggt.
* Überschriften standen weiter links als der Fließtext. Jeder Block
hatte einzeln `max-width: 68ch`, und `ch` ist relativ zur Schrift des
Elements — die Serif-Überschrift ergab eine breitere Spalte. Ersetzt
durch eine gemeinsame, font-unabhängige `--essay-measure`.
* Fullbleed-Fotos bluteten nur nach links aus: `.essay-figure` ist
`width: 100%`, wodurch die Box überbestimmt ist und der negative
rechte Margin verworfen wird.
* Foto-Paare stellten beide Bilder gleich breit dar, wodurch ein
Hochformat neben einem Querformat doppelt so hoch wurde. Jetzt eine
Justified-Reihe: Breite proportional zum Seitenverhältnis, dadurch
exakt gleiche Höhen ohne Beschnitt.
* Die Lightbox hatte im Journal keine Tastatursteuerung und keine
Scroll-Sperre — beides lag in PhotoGrid, also nur im Album-Raster.
Verlagert in die Lightbox selbst, der doppelte Handler in PhotoGrid
entfernt (sonst wäre pro Pfeildruck zwei Bilder weitergesprungen).
Zusätzlich sind Proofing-Herzen und das EXIF-Panel im redaktionellen
Modus abschaltbar und im Journal aus: Client-Proofing ist ein
Übergabe-Workflow für Alben, keine Funktion einer Reportage. Auf der
Übersicht wurde der Untertitel doppelt gerendert, weil extractExcerpt()
auf ihn zurückfällt.
* feat(admin): eigene URLs für alle Bereiche und überarbeiteter Journal Studio
Das Panel war eine einzige Client-Komponente, die ihre Tabs über
useState umschaltet: keine Route pro Bereich, kein Deep-Link, kein
Zurück-Button, und nach jedem Reload landete man wieder auf "Pages".
Auch der Journal-Editor hatte keine eigene URL.
Jetzt sieben echte Routen (/admin, /admin/pages, /admin/journal,
/admin/journal/<slug>, /admin/settings, /admin/settings/<section>,
/admin/analytics). Die Shell mit Auth-Prüfung und Kopfzeile sitzt im
Layout und umschließt children — so bleibt die Session-Prüfung über
Routenwechsel montiert, statt bei jedem Tab-Wechsel neu zu laufen und
den Spinner aufblitzen zu lassen. Unbekannte Settings-Sections fallen
auf General zurück.
Im selben Zug der Journal Studio, der die Routing-Änderung ohnehin
berührt:
* Alle Eingabefelder nutzten die Klasse `admin-input`, die in keinem
CSS definiert war — sie fielen auf Browser-Defaults zurück. Jetzt
gestylt, gescoped, damit der generische Name nicht ins übrige Panel
leckt.
* Der Split View ist per Divider verschiebbar (Maus, Tastatur,
Doppelklick zum Zurücksetzen), Breite in localStorage.
* Das Studio bricht aus der 1120px-Spalte aus, die Preview hat Platz.
* Die Preview zeigte für jedes Foto fest 3:2 und log damit über das
Layout der veröffentlichten Seite; die echten Verhältnisse werden
jetzt an den Thumbnails gemessen.
* Blöcke mit alten positionsbasierten Foto-Referenzen werden markiert —
die lassen sich auf einer eigenständigen Journal-Seite nicht auflösen
und verschwanden bisher stillschweigend.
* Blocktyp-Chips als gemeinsame Komponente, monochrom und per Icon
unterschieden statt in einer eigenen Blau/Lila/Orange-Palette, die
sonst nirgends im Panel vorkommt.
* Emojis raus, SVG-Icons rein.
* fix(admin): Designsystem-Lücken im Panel schließen
Eine systematische Suche nach Klassen, die im TSX benutzt, aber in
keinem CSS definiert sind, hat vier Stellen mit demselben Muster
gefunden:
* `admin-btn-secondary` und `admin-btn-danger` existierten nicht.
Sämtliche Löschen-Buttons sahen aus wie normale Buttons — keine
Warnwirkung. Als `.admin-btn.admin-btn-danger` geschrieben, weil die
Varianten mit den Größenklassen kombiniert werden, die weiter unten
ihren eigenen Hintergrund setzen.
* `page-progress-fill` fehlte: die Balken im Analytics-Panel waren
leere Rinnen, der Wert unsichtbar. Ebenso `analytics-empty` und
`admin-loading-container`.
* `subpage-drawer-section`, `subpage-drawer-title-group` und
`input-with-icon` im PageBuilder waren wirkungslos und teils mit
Inline-Styles notdürftig kompensiert.
* `grid-card-preview` fehlte, wodurch alle Layout-Vorschauen auf Höhe
null kollabierten. Nur "Showcase" war sichtbar — und das aus Versehen,
weil sein Tile `hero-tile` hieß und damit die `aspect-ratio` einer
fremden PageBuilder-Klasse erbte. Umbenannt.
Dazu die Theme-Vorschauen, die praktisch identisch aussahen: alle
sieben zeigten dieselben drei quadratischen Kacheln, einziger
Unterschied war die Hintergrundfarbe. Sie spiegeln jetzt die echten
Preset-Daten aus lib/config/theme.ts — Schriftcharakter, Eckradius,
Rasterdichte, Passepartout bzw. Schatten.
Die Kopfzeile richtet sich an einer gemeinsamen Steuerhöhe aus. Der
"Site"-Link war höher als die Buttons daneben: `.admin-btn` hatte keine
explizite line-height, und <button> bekommt box-sizing: border-box vom
Browser, <a> nicht. Die Statusanzeige setzte weder Schriftfamilie noch
-größe und fiel auf den Browser-Default zurück — sie war nie Teil des
Designsystems. Jetzt gleiche Höhe und Typografie, Pillenform als
Zustandsanzeige, Trenner zur Aktionsgruppe. Das dauerhafte Pulsieren
des grünen Punkts entfällt; Animation bleibt den Zuständen vorbehalten,
die Aufmerksamkeit brauchen.
Restliche Emojis durch SVG-Icons ersetzt.
* feat(admin): add scroll-to-top toggle and SVG arrow
The back-to-top button was always on and drew its arrow with the ↑ text
character. Add a `scrollToTop` setting (General section in the admin
panel, defaults to on so existing sites are unaffected) and replace the
glyph with a stroked SVG that inherits currentColor across all presets.
Scroll handling is now rAF-throttled, and prefers-reduced-motion turns
off both the hover lift and the smooth scroll.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
* security(journal): escape author HTML instead of filtering it
CodeQL flags 26 high-severity alerts on the release PR; the bulk of them
point at sanitizeHtml(), a denylist of three regexes whose output goes
into dangerouslySetInnerHTML. I reproduced the bypasses before changing
anything — all four pass the old filter:
<img src=x onerror=alert(1)> unquoted handler, regex wants quotes
<img src=x onerror='alert(1)'> single quotes, same reason
<svg onload=alert(1)> not a <script> tag
javasjavascript:cript:alert(1) one-pass replace, the rest recombines
Plus an attribute breakout in the link renderer, which interpolated the
URL into href="${url}" unescaped:
[x](" onmouseover=alert(1) x=") -> <a href="" onmouseover=alert(1" ...>
Replaced with escaping. Every `&<>"'` in author text becomes an entity
before any markdown rule runs, so the only tags in the output are the
ones renderInlineMarkdown builds itself and a URL cannot leave its
attribute. Link schemes are now an allowlist (http, https, mailto, tel,
relative, anchor); anything else renders as plain text.
The serializer needed decodeHtmlEntities to match: without it a save
would write `<` into the Markdown file and the next parse would
escape the `&` again, corrupting the text further on every round trip.
A test covers parse -> serialize -> parse stability.
Two existing tests asserted the old behaviour and were rewritten rather
than deleted: one expected the script tag to be *removed* from the
output, the other expected the substring "onerror" to be absent. Both
now assert the property that matters — that no tag can form — because
`onerror` surviving as inert text is fine.
Exploitation required admin access either way: journal and essay text
comes from the studio or from content/*.md. This removes the weakness,
it does not close an open door.
* fix(journal): contain file paths, fix frontmatter escaping, defuse two regexes
Follow-up to the CodeQL findings on release PR #432. I went through all 23
alerts individually; this addresses the ones that are worth addressing and
documents the ones that are not.
Path containment (12 alerts, all false positives). Every path built from a
slug goes through isValidSlug(), a strict `/^[a-zA-Z0-9_-]+$/` allowlist —
verified against `../../etc/passwd`, `foo/../../bar`, `a/b`, `..` and
friends, all rejected. CodeQL cannot see it because the check lives in
another module. Added a containedPath() helper that resolves the path and
refuses anything landing outside the content directory: a second lock on a
door that was already locked, and a barrier the analysis can follow. Also
removed the dead `slug.endsWith('.md')` branches — isValidSlug rejects
dots, so they could never be taken.
Frontmatter escaping (1 alert, a real bug). The serializer escaped `"` but
not `\`, and the parser never unescaped anything. A title containing either
character gained a backslash on every save/load cycle:
Path C:\Users "quoted" -> Path C:\\Users \"quoted\" -> ...
Escaping now covers the backslash first and the parser undoes both. A round
trip test covers quotes, backslashes, colons and apostrophes.
Two of three ReDoS regexes (2 alerts). The heading pattern had `\s+` next to
`(.+)`, which overlap, so the engine tried every split of the whitespace run
before failing; it is `[ \t]+` and `(\S.*)` now. The quote author pattern
wrapped a lazy group around an optional group — the quadratic case — and is
an index split on the first separator now.
The third regex, the bold/italic pass, is deliberately left alone. Rewriting
it with a negated class removes the backtracking but breaks nesting:
`**bold *and italic* here**` renders as `*<em>bold </em>and italic<em> here</em>*`.
The input is Markdown from an authenticated admin, never a visitor, so the
worst case is an author slowing down their own page. The comment in the code
says so.
Not addressed: 5 js/insufficient-password-hash alerts. They ask for a slow
KDF where the code uses SHA-256/HMAC — correct in general, but the admin
password comes from an environment variable and is never stored, so a
stronger KDF protects nothing that is not already in plaintext in the
environment.
399 unit tests pass (18 new), build and tsc clean.
* fix(journal): split the quote author by scanning, not by pattern
Cleaning up after myself. #439 replaced the quote author regex
`/^(.*?)(?:\s+--\s+(.+))?$/` — a lazy group around an optional one, the
quadratic case — with `/\s+--\s+/`, and CodeQL promptly flagged the
replacement for the same reason. One reported pattern traded for another.
splitQuoteAuthor() scans for the first `--` that has whitespace on both
sides. Linear, and it needs no reasoning about the regex engine at all.
Behaviour is identical to the original regex, checked case by case
against it: separator, no separator, several separators, tabs, wide gaps,
`a--b` without spaces, leading and trailing separators, empty string. All
nine are covered by tests, plus one asserting it stays fast on a 50k
whitespace run.
* security(admin): derive the session signing key with scrypt
getSigningKey() ran the admin password through a single SHA-256 digest.
It is key derivation rather than password storage, so it was never a
stored-hash problem — but if the derived key ever leaked, one fast hash
makes recovering the password by brute force cheap. CodeQL flags it as
js/insufficient-password-hash and, for this particular alert, has a
point.
scrypt now. Two details that matter:
The salt has to be stable. A random salt would produce a different key on
every call and invalidate every session; it is derived from AUTH_SECRET,
which is deployment-specific. Verified across separate processes: same
inputs produce a verifying token, so a restart or redeploy does not log
everyone out.
The result is cached for the process lifetime. scrypt is deliberately
slow and getSigningKey() runs on every admin request — deriving per call
would add ~24ms to each one. The cache key is a digest of secret plus
password, so a rotation misses the cache and derives again, and no extra
plaintext copy of the password is kept around.
Measured: first derivation 24ms, subsequent calls 0.12ms. Password
change and secret change both invalidate an existing token, checked in
separate processes.
Note the one-time effect: existing admin sessions are invalidated by the
change in derivation, so everyone logs in once more.
* security(admin): key the signing-key cache on its inputs, not a digest
#441 removed the SHA-256 digest of the admin password from the key
derivation and introduced a new one three lines above it, as the cache
key. Same rule, same file: CodeQL reported it immediately.
The comment justifying it was wrong too. It claimed no second plaintext
copy of the password was retained, while building the digest input
allocates exactly that in order to hash it.
The cache now holds the two input strings and compares them directly.
They are the same objects the env and install caches already hold, so
nothing extra is retained, and no fast hash of the password exists in
memory for the life of the process.
Re-verified after the change, in separate processes: a token from one
process verifies in another with the same inputs, a changed password or
secret rejects it, first derivation 24ms, cached calls 0.001ms.
That leaves scrypt as the only place the password is hashed here. The
two HMACs further down operate on the derived key and on token data, not
on the password; the constant-time comparison in verifyAdminPassword is
the previously dismissed one.
---------
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
2026-08-14 16:55:07 +02:00
|
|
|
|
</button>
|
|
|
|
|
|
</div>
|
release: v0.11.0 (#459)
Ships `dev` as **v0.11.0**. `main` contains nothing that `dev` does not,
so this is a clean sync.
## Headline changes since v0.10.0
- **Journal & Journal Studio** — photo essays at `/journal`,
split-screen block editor with live preview, drafts, per-entry
passwords, cover images
- **First-run setup wizard at `/install`** — configure a fresh
deployment from the browser; credentials are verified against Immich
before anything is written, and the wizard is gated by a one-time token
- **About page editor and toggle** in the admin panel
- **Per-album photo order** independent of Immich, with a drag & drop
editor
- **Custom favicon upload**
- **Experimental portfolio features** — justified grid, `cover` hero,
unlisted subpages, per-album grid overrides, cover focal points,
external nav links
- **Security** — asset tokens length-capped before decoding (#423),
journal author markdown escaped rather than filtered, journal file paths
contained, admin session key derived with scrypt (#432), Next.js 16.3.0
for CVE-2025-13465
- **Fixed** — client proofing honours its own configuration again
(#454); journal photo rendering (#432)
Full detail in [CHANGELOG.md](CHANGELOG.md#0110--2026-08-15).
## Verified
`npx tsc --noEmit` clean · `npx vitest run` 435 tests pass · `npm run
build` succeeds · lint 0 errors · `prettier --check` clean · local
`docker build` of the release tree.
## After merge
Tag `v0.11.0` on `main` and publish the release — that triggers
`docker-publish.yml`, which pushes the image and moves `latest`.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
---------
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
2026-08-15 09:09:18 +02:00
|
|
|
|
</div>
|
2026-05-31 21:30:00 +02:00
|
|
|
|
|
release: v0.11.0 (#459)
Ships `dev` as **v0.11.0**. `main` contains nothing that `dev` does not,
so this is a clean sync.
## Headline changes since v0.10.0
- **Journal & Journal Studio** — photo essays at `/journal`,
split-screen block editor with live preview, drafts, per-entry
passwords, cover images
- **First-run setup wizard at `/install`** — configure a fresh
deployment from the browser; credentials are verified against Immich
before anything is written, and the wizard is gated by a one-time token
- **About page editor and toggle** in the admin panel
- **Per-album photo order** independent of Immich, with a drag & drop
editor
- **Custom favicon upload**
- **Experimental portfolio features** — justified grid, `cover` hero,
unlisted subpages, per-album grid overrides, cover focal points,
external nav links
- **Security** — asset tokens length-capped before decoding (#423),
journal author markdown escaped rather than filtered, journal file paths
contained, admin session key derived with scrypt (#432), Next.js 16.3.0
for CVE-2025-13465
- **Fixed** — client proofing honours its own configuration again
(#454); journal photo rendering (#432)
Full detail in [CHANGELOG.md](CHANGELOG.md#0110--2026-08-15).
## Verified
`npx tsc --noEmit` clean · `npx vitest run` 435 tests pass · `npm run
build` succeeds · lint 0 errors · `prettier --check` clean · local
`docker build` of the release tree.
## After merge
Tag `v0.11.0` on `main` and publish the release — that triggers
`docker-publish.yml`, which pushes the image and moves `latest`.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
---------
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
2026-08-15 09:09:18 +02:00
|
|
|
|
{/* Photo order */}
|
|
|
|
|
|
<div className="admin-field">
|
|
|
|
|
|
<label id="album-sort-label">Photo order</label>
|
|
|
|
|
|
<Listbox
|
|
|
|
|
|
labelledBy="album-sort-label"
|
|
|
|
|
|
value={album.sort || DEFAULT_ALBUM_SORT}
|
|
|
|
|
|
options={SORT_OPTIONS}
|
|
|
|
|
|
onChange={(mode) => onUpdate({ sort: mode })}
|
|
|
|
|
|
/>
|
|
|
|
|
|
<span className="admin-field-hint">
|
|
|
|
|
|
{album.sort === 'manual'
|
|
|
|
|
|
? 'Pinned photos come first, in the order you set. Everything else follows in the album’s Immich order.'
|
|
|
|
|
|
: 'Immich order follows the album’s own sort setting in Immich.'}
|
|
|
|
|
|
</span>
|
|
|
|
|
|
|
|
|
|
|
|
{album.sort === 'manual' && (
|
|
|
|
|
|
<div style={{ marginTop: '0.75rem' }}>
|
|
|
|
|
|
<button
|
|
|
|
|
|
className="admin-btn admin-btn-sm"
|
|
|
|
|
|
onClick={() =>
|
|
|
|
|
|
setOrderEditorTarget({
|
|
|
|
|
|
albumId: album.id,
|
|
|
|
|
|
albumName: album.title || name,
|
|
|
|
|
|
assetOrder: album.assetOrder || [],
|
|
|
|
|
|
onSave: (assetOrder) => {
|
|
|
|
|
|
onUpdate({ assetOrder });
|
|
|
|
|
|
setOrderEditorTarget(null);
|
|
|
|
|
|
},
|
|
|
|
|
|
})
|
|
|
|
|
|
}
|
|
|
|
|
|
>
|
|
|
|
|
|
<IconGripVertical size={18} className="svg-icon svg-drag" />{' '}
|
|
|
|
|
|
{album.assetOrder?.length
|
|
|
|
|
|
? `Reorder photos (${album.assetOrder.length} pinned)`
|
|
|
|
|
|
: 'Reorder photos'}
|
|
|
|
|
|
</button>
|
|
|
|
|
|
</div>
|
|
|
|
|
|
)}
|
2026-05-31 21:30:00 +02:00
|
|
|
|
</div>
|
release: v0.11.0 (#459)
Ships `dev` as **v0.11.0**. `main` contains nothing that `dev` does not,
so this is a clean sync.
## Headline changes since v0.10.0
- **Journal & Journal Studio** — photo essays at `/journal`,
split-screen block editor with live preview, drafts, per-entry
passwords, cover images
- **First-run setup wizard at `/install`** — configure a fresh
deployment from the browser; credentials are verified against Immich
before anything is written, and the wizard is gated by a one-time token
- **About page editor and toggle** in the admin panel
- **Per-album photo order** independent of Immich, with a drag & drop
editor
- **Custom favicon upload**
- **Experimental portfolio features** — justified grid, `cover` hero,
unlisted subpages, per-album grid overrides, cover focal points,
external nav links
- **Security** — asset tokens length-capped before decoding (#423),
journal author markdown escaped rather than filtered, journal file paths
contained, admin session key derived with scrypt (#432), Next.js 16.3.0
for CVE-2025-13465
- **Fixed** — client proofing honours its own configuration again
(#454); journal photo rendering (#432)
Full detail in [CHANGELOG.md](CHANGELOG.md#0110--2026-08-15).
## Verified
`npx tsc --noEmit` clean · `npx vitest run` 435 tests pass · `npm run
build` succeeds · lint 0 errors · `prettier --check` clean · local
`docker build` of the release tree.
## After merge
Tag `v0.11.0` on `main` and publish the release — that triggers
`docker-publish.yml`, which pushes the image and moves `latest`.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
---------
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
2026-08-15 09:09:18 +02:00
|
|
|
|
</div>
|
experimental: portfolio features (justified layout, unlisted pages, captions, per-album grid, focal point, nav links, cover hero) (#431)
## Was ist das?
Sieben neue Portfolio-Features, alle als **experimental** gekennzeichnet
— in YAML-Kommentaren, Admin-Panel-Labels und Commit-Scopes, damit sie
einzeln nachvollziehbar und revertierbar bleiben.
## Features (je ein Commit)
| Commit | Feature |
| --- | --- |
| `justified rows gallery layout` | Neues Grid-Layout `justified`:
zeilenbasiert, gleiche Höhen, volle Breite — Flexbox ohne JS-Messung,
letzte Zeile bleibt natürlich klein |
| `hide subpages from navigation` | `hidden: true`: Seite aus
Nav/Homepage raus, per Direktlink erreichbar — im Gegensatz zu `enabled:
false` (404) |
| `lightbox captions` | Immich-Asset-Description als Bildunterschrift im
Info-Panel; EXIF-Route liefert bei `exifOnHover: false` jetzt nur noch
die Caption statt 403 |
| `per-album grid overrides` | `grid:` pro Album-Eintrag, Präzedenz
global < Subpage < Album |
| `per-album cover focal point` | `coverPosition:` → `object-position`
auf Cover-Karten, strikt validiert |
| `external links in header navigation` | `navLinks:` in settings.yaml,
nur http(s), sanitisiert |
| `cover splash hero style` | `heroStyle: cover`: Fullscreen-Splash mit
Enter-Link ins Portfolio |
Alle Optionen sind im Admin-Panel editierbar (PageBuilder /
SettingsEditor).
## Tests
- 356 Unit-Tests grün (13 neue: deriveGallery hidden/grid/coverPosition,
sanitizeNavLinks, EXIF-Route-Captions, justified-Layout-Validierung)
- `npx tsc --noEmit`: 0 Fehler
- `npm run build`: sauber
- Justified-Zeilenmathematik und Cover-Splash per Browser-Harness
visuell/numerisch verifiziert (volle Zeilen enden exakt an der
Containerkante, letzte Zeile bleibt natürlich)
---------
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
2026-08-14 17:56:22 +02:00
|
|
|
|
</div>
|
2026-05-31 21:27:13 +02:00
|
|
|
|
</div>
|
|
|
|
|
|
<div className="album-drawer-footer">
|
|
|
|
|
|
<button
|
|
|
|
|
|
className="admin-btn admin-btn-ghost admin-btn-danger"
|
|
|
|
|
|
onClick={onRemove}
|
2026-05-31 21:30:00 +02:00
|
|
|
|
style={{ maxWidth: '160px' }}
|
2026-05-31 21:27:13 +02:00
|
|
|
|
>
|
2026-08-14 11:10:42 +02:00
|
|
|
|
<IconTrash size={14} /> Remove Album
|
2026-05-31 21:27:13 +02:00
|
|
|
|
</button>
|
release: v0.11.0 — journal fixes, admin URLs, design system cleanup (#432)
* fix(screenshots): sharp-Typen fuer 0.34 und 0.35 gleichzeitig (#410)
sharp 0.35 ist von `export =` auf ESM umgestellt: der Modul-Namespace
ist nicht mehr aufrufbar, die Factory sitzt unter .default. Der
Type-Check brach damit in scripts/screenshots.ts weg, sobald der
Next-Bump (#402) sharp von 0.34.5 auf 0.35.3 mitzieht -- sharp ist hier
keine deklarierte Dependency, sondern kommt ueber Next mit.
Die Form wird jetzt aus dem installierten Paket abgeleitet statt
festgeschrieben, zur Laufzeit wie im Typ. Geprueft mit beiden
Versionen: tsc laeuft mit 0.34.5 und mit 0.35.3 fehlerfrei durch.
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
* chore(deps): bump the nextjs group across 1 directory with 2 updates (#402)
Bumps the nextjs group with 2 updates in the / directory: [next](https://github.com/vercel/next.js) and [eslint-config-next](https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next).
Updates `next` from 16.2.12 to 16.3.0
- [Release notes](https://github.com/vercel/next.js/releases)
- [Commits](https://github.com/vercel/next.js/compare/v16.2.12...v16.3.0)
Updates `eslint-config-next` from 16.2.12 to 16.3.0
- [Release notes](https://github.com/vercel/next.js/releases)
- [Commits](https://github.com/vercel/next.js/commits/v16.3.0/packages/eslint-config-next)
---
updated-dependencies:
- dependency-name: eslint-config-next
dependency-version: 16.3.0
dependency-type: direct:development
update-type: version-update:semver-minor
dependency-group: nextjs
- dependency-name: next
dependency-version: 16.3.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: nextjs
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* chore(deps-dev): bump prettier from 3.8.3 to 3.9.6 (#405)
Bumps [prettier](https://github.com/prettier/prettier) from 3.8.3 to 3.9.6.
- [Release notes](https://github.com/prettier/prettier/releases)
- [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md)
- [Commits](https://github.com/prettier/prettier/compare/3.8.3...3.9.6)
---
updated-dependencies:
- dependency-name: prettier
dependency-version: 3.9.6
dependency-type: direct:development
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* docs(changelog): Unreleased-Sektion fuer die Bumps nach v0.10.0 (#413)
Die Dependency-PRs sind nach dem Release auf dev gelandet, teils auch
auf main. Ohne Eintrag waeren sie beim naechsten Release unsichtbar --
inklusive Next 16.3.0, das CVE-2025-13465 mitbringt.
Ausserdem im 0.10.0-Abschnitt nachgetragen, dass der Trivy-Scan bis
#409 nie gelaufen ist. Der Fix steckt im Tag v0.10.0, fehlte aber in der
Aufzaehlung -- und "Images werden bei jedem Publish gescannt" stand im
Changelog, waehrend der Job im Action-Setup abbrach.
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
* feat(gallery): per-album sort order, independent of Immich (#408) (#414)
Album order was dictated entirely by Immich: getAlbum() sorted by the
album's own asc/desc flag, so a Folio album always mirrored the archive.
A curated series has a narrative order that has nothing to do with
capture time, and changing the Immich album's sort to fit the website
changes it for the archive too.
Adds an optional per-album `sort` in gallery.yaml, editable in /admin,
defaulting to today's behaviour so every existing config is unchanged:
immich (default) | newest | oldest | filename | manual
`manual` is a pinned *prefix*: `assetOrder` lists only the photos placed
by hand, everything else follows in the album's Immich order. A full
permutation of a 2,000-photo album would be ~80 KB of UUIDs in a file
that is rewritten and copied to content/.backups/ on every admin save.
It also makes drift fall out for free — photos removed in Immich never
match, new ones land in the tail rather than being hidden.
Sorting is applied after the cache read, not before the cache write, so
the LRU keeps one canonical Immich-ordered copy per album. That avoids
putting the mode in the cache key, lets a config change take effect
without depending on invalidation, and keeps the stale-serving path
correct. cache.get() returns the stored object by reference, so
withSort() returns a shallow clone with a new array — sorting in place
would reorder the shared entry, and under request coalescing every
concurrent caller would be sorting the same array.
Also fixes a prerequisite bug: /api/admin/albums/[albumId]/assets read
album.assets from GET /albums/:id, which Immich 3.x no longer populates
(lib/immich.ts:507). The hero picker's "This Album" tab returned nothing
and threw outright when the key was absent. It now goes through the
client's paginated metadata search, with ?types=all to opt videos in for
the reorder editor.
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
* refactor(admin): drop decorative emoji from the sort select labels (#415)
An <option> cannot contain markup, so the SVG set in Icons is not
reachable there — but a decorative emoji is not a substitute for it.
Plain text instead; the album card badge already uses a real icon.
The remaining emoji in the admin panel (asset picker tabs, section
headings, layout picker options) predate this branch and are left for a
separate cleanup.
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
* refactor(admin): replace emoji icons with the shared SVG icon set (#416)
The admin panel mixed two icon conventions: inline SVGs from
`Icons.tsx` in most components, and decorative emoji in the asset
picker and a few PageBuilder labels. Emoji render inconsistently
across platforms, ignore the accent colour, and cannot inherit the
`.svg-icon` sizing rules.
- Icons.tsx: add `IconStar` (filled — it marks a state, not an
action) and `IconImage`.
- AssetPicker: the three tab labels and the favourite tile badge now
use IconFolder / IconStar / IconImage.
- PageBuilder: the "Standalone Albums" and "Subpages" headings use
the icon set instead of an emoji.
- PageBuilder: the layout picker drops its emoji for plain text. An
<option> cannot contain markup, so an SVG is impossible there and a
decorative glyph is not a substitute.
- admin.css: align icon and label in the picker tabs, and swap the
favourite badge's text-shadow for drop-shadow, which is what
applies to an inline SVG.
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
* refactor(admin): fold PageBuilder's local icons into the shared Icons module (#418)
* refactor(admin): fold PageBuilder's local icons into the shared module
PageBuilder.tsx carried its own `Icons` object duplicating most of the
glyphs already exported by Icons.tsx, with hardcoded sizes and slightly
divergent paths. Migrate all 32 call sites to the shared module and
delete the local object.
Five glyphs had no counterpart and are added to Icons.tsx as 1:1 ports
of the local paths: IconX, IconPlus, IconHome, IconCopy, IconImage.
The local ExternalLink and Check are dropped rather than ported — both
had zero call sites.
Two glyphs change shape slightly, which is the point of consolidating:
the shared IconCamera includes the viewfinder bump the local copy
omitted, and drag handles now use IconGripVertical.
IconGripVertical uses the module's square 24x24 viewBox, so `.svg-drag`
goes from 12x18 to 18x18 — the old non-square box would letterbox the
glyph down to 12x12 and shrink the handle.
* fix(admin): resolve icon-module integration after #416
Merging dev brought in #416, which added a second IconImage to Icons.tsx
and two <Icons.Camera>/<Icons.Folder> section headers that reference the
local Icons object this PR removes. Git merged both cleanly but the result
did not type-check.
- drop the duplicate IconImage (both copies were byte-identical)
- point the two section headers at the imported IconCamera/IconFolder
- refresh the SORT_LABELS comment: the icon set is imported now, not
declared below
---------
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
* fix(config): allow an empty gallery, guard against a double /api suffix (#421)
An empty gallery is now a valid, rendered state instead of a throw: deriveGallery() no longer requires at least one album or subpage, so a deployment with no albums yet renders a bare homepage the owner can fill in via /admin.
getConfig() also stops appending /api to an Immich URL that already ends in it, which previously produced .../api/api and broke every upstream request.
Includes a restore of the per-album sort test cases, which the branch had lost by being cut before #408/#414.
* feat(admin): favicon upload, served from the content volume (#422)
Adds a bundled default favicon, an upload widget in admin Settings > General, and a route that serves the icon from the writable content/ volume with a fallback to the bundled default. Raster uploads (PNG/ICO/JPEG) are wrapped in an SVG container; the response carries its own CSP so an uploaded SVG cannot execute script on the origin.
The GET route revalidates with an ETag instead of caching immutably, so a newly uploaded icon shows up immediately. Uploads are written via temp file + rename, and a Reset button restores the bundled default.
* ci: flag unformatted files in a PR, without blocking it (#424)
Prettier is configured as an error rule in eslint.config.mjs but has never run in CI, so part of the tree predates it. A final CI step now diffs against the PR base, runs prettier --list-different over the changed files, and emits a warning annotation per offender plus a job summary.
Advisory by design: it never fails the job. Blocking would turn a PR red for merely touching a file that was already unformatted, and normalising the tree in one commit would wreck git blame and conflict with the PRs in flight.
Requires fetch-depth: 0, since diffing against the base needs its history.
* feat(install): first-run wizard gated by a one-time setup token (#419)
Adds /install, a four-step first-run wizard: connect to Immich, optionally pick albums, name the site, finish. It verifies the credentials against the Immich server before writing anything, then writes gallery.yaml, settings.yaml and a content/install.json carrying the Immich credentials and a generated site secret.
install.json exists because a running process cannot pick up new env vars — the wizard has to write configuration that takes effect without a restart. getInstallCredentials() merges it under the real environment, so env vars always win and rotation stays a matter of setting one.
Both the page and the API routes are gated by a one-time setup token printed to the server log, so a deployment that is reachable before gallery.yaml exists cannot be configured by whoever finds it first. The token is stored in content/.setup-token (0600) rather than a module variable: Next.js bundles the page and each route handler separately, so a module-level token left the page and the API disagreeing inside one process and the wizard stuck on step 1. It is removed once the install completes.
The admin password is stored as an scrypt hash using the scheme lib/auth.ts already applies to album passwords; a plaintext ADMIN_PASSWORD env var keeps working.
* docs: document the setup wizard, fix the read-only content mount (#425)
Quick Start now leads with the /install wizard, with the hand-written YAML route kept alongside it, and a First-Run Setup section covers the setup token, the files the wizard writes, and env-var precedence.
Two corrections: both Docker examples mounted content/ as :ro, which silently breaks the wizard, the admin panel and the backup rotation alike — docs/admin-panel.md already said so and the README contradicted it. And nothing documented that content/install.json holds the Immich API key, so a backup of content/ is a backup of credentials.
Also adds a Contributors section crediting the people whose work is in the project.
* feat(admin): floating save bar pinned to the bottom of the viewport (#426)
The save bar was the first, static element inside .admin-main. Since the
document itself scrolls, it left the viewport as soon as you scrolled down
— editing a subpage section or a settings block far below gave no visible
dirty hint and no reachable save button.
Replace it with a bottom-pinned floating bar shared by both editors. It
only mounts while there is something to act on (unsaved changes, an
in-flight save, or a result message), so it never covers content while
idle. The success message clears after 5s, which hides the bar again.
- new SaveBar component, replacing the duplicated markup in PageBuilder
and SettingsEditor
- adopt the previously unused .floating-save-bar CSS: slide-in keyframes
(carrying translateX(-50%)), dirty border, wrap/gap, mobile variant and
a prefers-reduced-motion opt-out; z-index 900 keeps it below modals
- .admin-main gains bottom padding so the bar never covers page content
- drop the now-unreachable idle hints: the ⌘S hint becomes a button title,
the Live Sync note becomes a static line above the settings layout
- header "Site" link now bypasses the cache (/?fresh=1), so the preview
stays reachable when the bar is hidden
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
* feat(admin): themed listbox for the album sort control (#427)
The per-album "Photo order" control was a native <select>. Because an
<option> cannot contain markup, its choices could not use the admin
panel's currentColor SVG set — the reason #415 had to fall back to plain
text after dropping the emoji labels.
Adds a Listbox component implementing the ARIA combobox/listbox pattern,
so options can render a glyph beside their label:
- DOM focus stays on the trigger button; the active option is announced
through aria-activedescendant, keeping focus management to one element
- Keyboard: arrows (clamped at the ends, like a native select),
Home/End, Enter/Space to commit, Escape to cancel, Tab commits and
moves on, and prefix type-ahead with a repeat-key cycle
- Outside dismissal on pointerdown, so a press starting outside closes
the popup before the click retargets
The sort options now carry an icon each: calendar, arrow-down, arrow-up,
an A→Z marker, and the drag glyph for manual — matching the badge the
album card already shows. SORT_LABELS stays plain text because the badge
feeds it to a title attribute.
Closes #417
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
* chore(git): ignore generated design handoff folders
* fix(admin): stop the album sort dropdown clipping, and simplify the panel (#428)
* fix(admin): render listbox popup in a portal so it escapes modal clipping
The sort control's popup was position:absolute inside three clipping ancestors
(.album-drawer overflow:hidden > .album-drawer-body overflow-y:auto >
.modal-right-column overflow-y:auto), so it was cut off at the bottom of the
Edit Album Details modal. z-index could not help: clipping happens before
stacking. It also always hung below the trigger, with no flip.
Portal the popup to document.body and position it from the trigger's viewport
rect, flipping above when there is more room there and capping max-height to the
space available so it scrolls internally rather than overflowing. It is
dismissed on scroll and resize, since the anchor is only measured on open.
The outside-pointerdown handler now also treats the popup as inside; without
that the portalled list counts as outside, and a click on an option would close
it before the selection commits.
* refactor(admin): single-column album details panel
The left column spent 1.2fr on a cover thumbnail and three stat rows, two of
which (Status, Custom Hero) only restated the form fields opposite them, while
the form itself was squeezed into 1.8fr behind a second nested scroller.
Stack the drawer in one column instead: cover as a banner, then the form at full
width, with the UUID moved into the footer. The body is now the only scroll
container, which also removes one of the ancestors that was clipping the sort
popup.
---------
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
* fix(admin): give the portalled listbox its theme back, lock the page behind modals (#429)
Two defects in the album editor.
The sort listbox popup painted transparent. Every --admin-* variable is
scoped to .admin-layout, and since the popup moved into document.body it
sits outside that subtree, so background/border/text all resolved to
nothing. It now carries its own copy of the palette in both colour
schemes, plus the font it no longer inherits.
Scrolling inside a modal also moved the page behind it. No admin modal
ever locked body scroll: the overlay covers the page but does not absorb
wheel events, so a scroll starting on the backdrop — or continuing past
the end of the modal's own scroller — reaches the document.
overscroll-behavior cannot cover that case on its own, because it only
applies to scroll containers and the backdrop is not one.
useScrollLock freezes body while a modal is open and compensates for the
width the scrollbar gives up, so nothing shifts underneath. Each lock
restores the inline value it found, which makes nesting work without a
counter — a picker opened from the drawer restores the drawer's hidden
state instead of clearing it. Applied to both drawers and all four
picker modals, which share the defect. overscroll-behavior: contain on
the scrollers stops the chaining they can handle themselves.
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
* fix(security): allow unsafe-eval in CSP script-src during dev mode
* feat(journal): add Journal Studio with split-screen editor, live preview and dedicated routes
* fix(build): separate client parser from server journal-service and fix build type errors
* fix(journal): Fotos rendern, Layout und Lightbox-Steuerung korrigieren
Fünf unabhängige Fehler in der öffentlichen Journal- und Essay-Ansicht:
* Foto-Blöcke wurden nie angezeigt. EssayView löst ein Foto über
PhotoItem.id auf, und das sind verschlüsselte Tokens — die Blöcke aus
dem Markdown tragen aber rohe Asset-UUIDs. Jede Zuordnung lief ins
Leere, und nicht auflösbare Blöcke werden still verworfen. Die IDs
werden jetzt serverseitig übersetzt; damit verschwinden nebenbei die
rohen UUIDs aus dem Client-Payload, die dort laut Projektregel nie
auftauchen dürfen. Nicht auflösbare Referenzen werden geloggt.
* Überschriften standen weiter links als der Fließtext. Jeder Block
hatte einzeln `max-width: 68ch`, und `ch` ist relativ zur Schrift des
Elements — die Serif-Überschrift ergab eine breitere Spalte. Ersetzt
durch eine gemeinsame, font-unabhängige `--essay-measure`.
* Fullbleed-Fotos bluteten nur nach links aus: `.essay-figure` ist
`width: 100%`, wodurch die Box überbestimmt ist und der negative
rechte Margin verworfen wird.
* Foto-Paare stellten beide Bilder gleich breit dar, wodurch ein
Hochformat neben einem Querformat doppelt so hoch wurde. Jetzt eine
Justified-Reihe: Breite proportional zum Seitenverhältnis, dadurch
exakt gleiche Höhen ohne Beschnitt.
* Die Lightbox hatte im Journal keine Tastatursteuerung und keine
Scroll-Sperre — beides lag in PhotoGrid, also nur im Album-Raster.
Verlagert in die Lightbox selbst, der doppelte Handler in PhotoGrid
entfernt (sonst wäre pro Pfeildruck zwei Bilder weitergesprungen).
Zusätzlich sind Proofing-Herzen und das EXIF-Panel im redaktionellen
Modus abschaltbar und im Journal aus: Client-Proofing ist ein
Übergabe-Workflow für Alben, keine Funktion einer Reportage. Auf der
Übersicht wurde der Untertitel doppelt gerendert, weil extractExcerpt()
auf ihn zurückfällt.
* feat(admin): eigene URLs für alle Bereiche und überarbeiteter Journal Studio
Das Panel war eine einzige Client-Komponente, die ihre Tabs über
useState umschaltet: keine Route pro Bereich, kein Deep-Link, kein
Zurück-Button, und nach jedem Reload landete man wieder auf "Pages".
Auch der Journal-Editor hatte keine eigene URL.
Jetzt sieben echte Routen (/admin, /admin/pages, /admin/journal,
/admin/journal/<slug>, /admin/settings, /admin/settings/<section>,
/admin/analytics). Die Shell mit Auth-Prüfung und Kopfzeile sitzt im
Layout und umschließt children — so bleibt die Session-Prüfung über
Routenwechsel montiert, statt bei jedem Tab-Wechsel neu zu laufen und
den Spinner aufblitzen zu lassen. Unbekannte Settings-Sections fallen
auf General zurück.
Im selben Zug der Journal Studio, der die Routing-Änderung ohnehin
berührt:
* Alle Eingabefelder nutzten die Klasse `admin-input`, die in keinem
CSS definiert war — sie fielen auf Browser-Defaults zurück. Jetzt
gestylt, gescoped, damit der generische Name nicht ins übrige Panel
leckt.
* Der Split View ist per Divider verschiebbar (Maus, Tastatur,
Doppelklick zum Zurücksetzen), Breite in localStorage.
* Das Studio bricht aus der 1120px-Spalte aus, die Preview hat Platz.
* Die Preview zeigte für jedes Foto fest 3:2 und log damit über das
Layout der veröffentlichten Seite; die echten Verhältnisse werden
jetzt an den Thumbnails gemessen.
* Blöcke mit alten positionsbasierten Foto-Referenzen werden markiert —
die lassen sich auf einer eigenständigen Journal-Seite nicht auflösen
und verschwanden bisher stillschweigend.
* Blocktyp-Chips als gemeinsame Komponente, monochrom und per Icon
unterschieden statt in einer eigenen Blau/Lila/Orange-Palette, die
sonst nirgends im Panel vorkommt.
* Emojis raus, SVG-Icons rein.
* fix(admin): Designsystem-Lücken im Panel schließen
Eine systematische Suche nach Klassen, die im TSX benutzt, aber in
keinem CSS definiert sind, hat vier Stellen mit demselben Muster
gefunden:
* `admin-btn-secondary` und `admin-btn-danger` existierten nicht.
Sämtliche Löschen-Buttons sahen aus wie normale Buttons — keine
Warnwirkung. Als `.admin-btn.admin-btn-danger` geschrieben, weil die
Varianten mit den Größenklassen kombiniert werden, die weiter unten
ihren eigenen Hintergrund setzen.
* `page-progress-fill` fehlte: die Balken im Analytics-Panel waren
leere Rinnen, der Wert unsichtbar. Ebenso `analytics-empty` und
`admin-loading-container`.
* `subpage-drawer-section`, `subpage-drawer-title-group` und
`input-with-icon` im PageBuilder waren wirkungslos und teils mit
Inline-Styles notdürftig kompensiert.
* `grid-card-preview` fehlte, wodurch alle Layout-Vorschauen auf Höhe
null kollabierten. Nur "Showcase" war sichtbar — und das aus Versehen,
weil sein Tile `hero-tile` hieß und damit die `aspect-ratio` einer
fremden PageBuilder-Klasse erbte. Umbenannt.
Dazu die Theme-Vorschauen, die praktisch identisch aussahen: alle
sieben zeigten dieselben drei quadratischen Kacheln, einziger
Unterschied war die Hintergrundfarbe. Sie spiegeln jetzt die echten
Preset-Daten aus lib/config/theme.ts — Schriftcharakter, Eckradius,
Rasterdichte, Passepartout bzw. Schatten.
Die Kopfzeile richtet sich an einer gemeinsamen Steuerhöhe aus. Der
"Site"-Link war höher als die Buttons daneben: `.admin-btn` hatte keine
explizite line-height, und <button> bekommt box-sizing: border-box vom
Browser, <a> nicht. Die Statusanzeige setzte weder Schriftfamilie noch
-größe und fiel auf den Browser-Default zurück — sie war nie Teil des
Designsystems. Jetzt gleiche Höhe und Typografie, Pillenform als
Zustandsanzeige, Trenner zur Aktionsgruppe. Das dauerhafte Pulsieren
des grünen Punkts entfällt; Animation bleibt den Zuständen vorbehalten,
die Aufmerksamkeit brauchen.
Restliche Emojis durch SVG-Icons ersetzt.
* feat(admin): add scroll-to-top toggle and SVG arrow
The back-to-top button was always on and drew its arrow with the ↑ text
character. Add a `scrollToTop` setting (General section in the admin
panel, defaults to on so existing sites are unaffected) and replace the
glyph with a stroked SVG that inherits currentColor across all presets.
Scroll handling is now rAF-throttled, and prefers-reduced-motion turns
off both the hover lift and the smooth scroll.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
* security(journal): escape author HTML instead of filtering it
CodeQL flags 26 high-severity alerts on the release PR; the bulk of them
point at sanitizeHtml(), a denylist of three regexes whose output goes
into dangerouslySetInnerHTML. I reproduced the bypasses before changing
anything — all four pass the old filter:
<img src=x onerror=alert(1)> unquoted handler, regex wants quotes
<img src=x onerror='alert(1)'> single quotes, same reason
<svg onload=alert(1)> not a <script> tag
javasjavascript:cript:alert(1) one-pass replace, the rest recombines
Plus an attribute breakout in the link renderer, which interpolated the
URL into href="${url}" unescaped:
[x](" onmouseover=alert(1) x=") -> <a href="" onmouseover=alert(1" ...>
Replaced with escaping. Every `&<>"'` in author text becomes an entity
before any markdown rule runs, so the only tags in the output are the
ones renderInlineMarkdown builds itself and a URL cannot leave its
attribute. Link schemes are now an allowlist (http, https, mailto, tel,
relative, anchor); anything else renders as plain text.
The serializer needed decodeHtmlEntities to match: without it a save
would write `<` into the Markdown file and the next parse would
escape the `&` again, corrupting the text further on every round trip.
A test covers parse -> serialize -> parse stability.
Two existing tests asserted the old behaviour and were rewritten rather
than deleted: one expected the script tag to be *removed* from the
output, the other expected the substring "onerror" to be absent. Both
now assert the property that matters — that no tag can form — because
`onerror` surviving as inert text is fine.
Exploitation required admin access either way: journal and essay text
comes from the studio or from content/*.md. This removes the weakness,
it does not close an open door.
* fix(journal): contain file paths, fix frontmatter escaping, defuse two regexes
Follow-up to the CodeQL findings on release PR #432. I went through all 23
alerts individually; this addresses the ones that are worth addressing and
documents the ones that are not.
Path containment (12 alerts, all false positives). Every path built from a
slug goes through isValidSlug(), a strict `/^[a-zA-Z0-9_-]+$/` allowlist —
verified against `../../etc/passwd`, `foo/../../bar`, `a/b`, `..` and
friends, all rejected. CodeQL cannot see it because the check lives in
another module. Added a containedPath() helper that resolves the path and
refuses anything landing outside the content directory: a second lock on a
door that was already locked, and a barrier the analysis can follow. Also
removed the dead `slug.endsWith('.md')` branches — isValidSlug rejects
dots, so they could never be taken.
Frontmatter escaping (1 alert, a real bug). The serializer escaped `"` but
not `\`, and the parser never unescaped anything. A title containing either
character gained a backslash on every save/load cycle:
Path C:\Users "quoted" -> Path C:\\Users \"quoted\" -> ...
Escaping now covers the backslash first and the parser undoes both. A round
trip test covers quotes, backslashes, colons and apostrophes.
Two of three ReDoS regexes (2 alerts). The heading pattern had `\s+` next to
`(.+)`, which overlap, so the engine tried every split of the whitespace run
before failing; it is `[ \t]+` and `(\S.*)` now. The quote author pattern
wrapped a lazy group around an optional group — the quadratic case — and is
an index split on the first separator now.
The third regex, the bold/italic pass, is deliberately left alone. Rewriting
it with a negated class removes the backtracking but breaks nesting:
`**bold *and italic* here**` renders as `*<em>bold </em>and italic<em> here</em>*`.
The input is Markdown from an authenticated admin, never a visitor, so the
worst case is an author slowing down their own page. The comment in the code
says so.
Not addressed: 5 js/insufficient-password-hash alerts. They ask for a slow
KDF where the code uses SHA-256/HMAC — correct in general, but the admin
password comes from an environment variable and is never stored, so a
stronger KDF protects nothing that is not already in plaintext in the
environment.
399 unit tests pass (18 new), build and tsc clean.
* fix(journal): split the quote author by scanning, not by pattern
Cleaning up after myself. #439 replaced the quote author regex
`/^(.*?)(?:\s+--\s+(.+))?$/` — a lazy group around an optional one, the
quadratic case — with `/\s+--\s+/`, and CodeQL promptly flagged the
replacement for the same reason. One reported pattern traded for another.
splitQuoteAuthor() scans for the first `--` that has whitespace on both
sides. Linear, and it needs no reasoning about the regex engine at all.
Behaviour is identical to the original regex, checked case by case
against it: separator, no separator, several separators, tabs, wide gaps,
`a--b` without spaces, leading and trailing separators, empty string. All
nine are covered by tests, plus one asserting it stays fast on a 50k
whitespace run.
* security(admin): derive the session signing key with scrypt
getSigningKey() ran the admin password through a single SHA-256 digest.
It is key derivation rather than password storage, so it was never a
stored-hash problem — but if the derived key ever leaked, one fast hash
makes recovering the password by brute force cheap. CodeQL flags it as
js/insufficient-password-hash and, for this particular alert, has a
point.
scrypt now. Two details that matter:
The salt has to be stable. A random salt would produce a different key on
every call and invalidate every session; it is derived from AUTH_SECRET,
which is deployment-specific. Verified across separate processes: same
inputs produce a verifying token, so a restart or redeploy does not log
everyone out.
The result is cached for the process lifetime. scrypt is deliberately
slow and getSigningKey() runs on every admin request — deriving per call
would add ~24ms to each one. The cache key is a digest of secret plus
password, so a rotation misses the cache and derives again, and no extra
plaintext copy of the password is kept around.
Measured: first derivation 24ms, subsequent calls 0.12ms. Password
change and secret change both invalidate an existing token, checked in
separate processes.
Note the one-time effect: existing admin sessions are invalidated by the
change in derivation, so everyone logs in once more.
* security(admin): key the signing-key cache on its inputs, not a digest
#441 removed the SHA-256 digest of the admin password from the key
derivation and introduced a new one three lines above it, as the cache
key. Same rule, same file: CodeQL reported it immediately.
The comment justifying it was wrong too. It claimed no second plaintext
copy of the password was retained, while building the digest input
allocates exactly that in order to hash it.
The cache now holds the two input strings and compares them directly.
They are the same objects the env and install caches already hold, so
nothing extra is retained, and no fast hash of the password exists in
memory for the life of the process.
Re-verified after the change, in separate processes: a token from one
process verifies in another with the same inputs, a changed password or
secret rejects it, first derivation 24ms, cached calls 0.001ms.
That leaves scrypt as the only place the password is hashed here. The
two HMACs further down operate on the derived key and on token data, not
on the password; the constant-time comparison in verifyAdminPassword is
the previously dismissed one.
---------
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
2026-08-14 16:55:07 +02:00
|
|
|
|
<div className="uuid-copy-box" title="Immich album UUID">
|
|
|
|
|
|
<code>{album.id}</code>
|
|
|
|
|
|
<button
|
|
|
|
|
|
className="uuid-copy-btn"
|
|
|
|
|
|
onClick={() => {
|
|
|
|
|
|
navigator.clipboard.writeText(album.id);
|
|
|
|
|
|
}}
|
|
|
|
|
|
title="Copy UUID"
|
|
|
|
|
|
aria-label="Copy Immich album UUID"
|
|
|
|
|
|
>
|
|
|
|
|
|
<IconCopy size={12} />
|
|
|
|
|
|
</button>
|
|
|
|
|
|
</div>
|
2026-05-31 21:30:00 +02:00
|
|
|
|
<button
|
|
|
|
|
|
className="admin-btn admin-btn-primary"
|
|
|
|
|
|
onClick={() => setEditingAlbumAddress(null)}
|
|
|
|
|
|
style={{ maxWidth: '140px' }}
|
|
|
|
|
|
>
|
|
|
|
|
|
Done
|
|
|
|
|
|
</button>
|
2026-05-31 21:27:13 +02:00
|
|
|
|
</div>
|
|
|
|
|
|
</div>
|
|
|
|
|
|
</div>
|
|
|
|
|
|
);
|
|
|
|
|
|
})()}
|
|
|
|
|
|
|
2026-05-29 17:59:25 +02:00
|
|
|
|
{/* Hero Asset Picker Modal */}
|
2026-05-31 21:27:13 +02:00
|
|
|
|
{heroPickerTarget && (
|
2026-05-29 17:59:25 +02:00
|
|
|
|
<AssetPicker
|
2026-05-31 21:27:13 +02:00
|
|
|
|
albumId={heroPickerTarget.albumId}
|
|
|
|
|
|
onSelect={heroPickerTarget.onSelect}
|
|
|
|
|
|
onClose={() => setHeroPickerTarget(null)}
|
|
|
|
|
|
currentAssetIds={heroPickerTarget.currentAssetIds}
|
|
|
|
|
|
title={heroPickerTarget.title}
|
2026-05-29 17:59:25 +02:00
|
|
|
|
/>
|
|
|
|
|
|
)}
|
2026-08-14 11:10:42 +02:00
|
|
|
|
|
|
|
|
|
|
{/* Manual Photo Order Editor */}
|
|
|
|
|
|
{orderEditorTarget && (
|
|
|
|
|
|
<AssetOrderEditor
|
|
|
|
|
|
albumId={orderEditorTarget.albumId}
|
|
|
|
|
|
albumName={orderEditorTarget.albumName}
|
|
|
|
|
|
assetOrder={orderEditorTarget.assetOrder}
|
|
|
|
|
|
onSave={orderEditorTarget.onSave}
|
|
|
|
|
|
onClose={() => setOrderEditorTarget(null)}
|
|
|
|
|
|
/>
|
|
|
|
|
|
)}
|
feat: add visual admin panel with page builder and settings editor
- Add /admin route with password-protected visual page builder
- Page Builder: manage hero images, standalone albums, subpages, and sections
- Album Picker: browse all shared Immich albums with search and filtering
- Settings Editor: theme, grid, footer, legal, SEO configuration
- YAML service with atomic writes and automatic backups (content/.backups/)
- HMAC-signed admin sessions (24h expiry, HttpOnly cookies)
- API endpoints: /api/admin/{auth,gallery,settings,albums,reload}
- Enable with ADMIN_PASSWORD env var; disabled by default
- invalidateConfigCache() export for hot-reload after saves
2026-05-29 17:04:37 +02:00
|
|
|
|
</div>
|
|
|
|
|
|
);
|
|
|
|
|
|
|
2026-05-31 21:27:13 +02:00
|
|
|
|
function getEditingAlbumInfo(addr: ActiveEditAlbumAddress) {
|
|
|
|
|
|
let album: AlbumEntry;
|
|
|
|
|
|
let name: string;
|
|
|
|
|
|
let count: number;
|
|
|
|
|
|
let thumbnailId: string | null;
|
|
|
|
|
|
let onUpdate: (updates: Partial<AlbumEntry>) => void;
|
|
|
|
|
|
let onRemove: () => void;
|
|
|
|
|
|
|
|
|
|
|
|
if (addr.type === 'standalone') {
|
|
|
|
|
|
album = gallery.albums[addr.albumIndex];
|
|
|
|
|
|
if (!album) return null;
|
|
|
|
|
|
name = getAlbumName(album.id);
|
|
|
|
|
|
count = getAlbumCount(album.id);
|
|
|
|
|
|
thumbnailId = getAlbumThumbnailId(album.id);
|
|
|
|
|
|
onUpdate = (updates) => {
|
|
|
|
|
|
setGallery((g) => {
|
|
|
|
|
|
const albums = [...g.albums];
|
|
|
|
|
|
albums[addr.albumIndex] = { ...albums[addr.albumIndex], ...updates };
|
|
|
|
|
|
return { ...g, albums };
|
|
|
|
|
|
});
|
|
|
|
|
|
markDirty();
|
|
|
|
|
|
};
|
|
|
|
|
|
onRemove = () => {
|
|
|
|
|
|
removeStandaloneAlbum(addr.albumIndex);
|
|
|
|
|
|
};
|
|
|
|
|
|
} else if (addr.type === 'subpage') {
|
|
|
|
|
|
const sp = gallery.subpages[addr.subpageIndex!];
|
|
|
|
|
|
if (!sp) return null;
|
|
|
|
|
|
album = sp.albums[addr.albumIndex];
|
|
|
|
|
|
if (!album) return null;
|
|
|
|
|
|
name = getAlbumName(album.id);
|
|
|
|
|
|
count = getAlbumCount(album.id);
|
|
|
|
|
|
thumbnailId = getAlbumThumbnailId(album.id);
|
|
|
|
|
|
onUpdate = (updates) => {
|
|
|
|
|
|
setGallery((g) => {
|
|
|
|
|
|
const subpages = [...g.subpages];
|
|
|
|
|
|
const sp2 = { ...subpages[addr.subpageIndex!] };
|
|
|
|
|
|
const albums = [...sp2.albums];
|
|
|
|
|
|
albums[addr.albumIndex] = { ...albums[addr.albumIndex], ...updates };
|
|
|
|
|
|
sp2.albums = albums;
|
|
|
|
|
|
subpages[addr.subpageIndex!] = sp2;
|
|
|
|
|
|
return { ...g, subpages };
|
|
|
|
|
|
});
|
|
|
|
|
|
markDirty();
|
|
|
|
|
|
};
|
|
|
|
|
|
onRemove = () => {
|
|
|
|
|
|
removeSubpageAlbum(addr.subpageIndex!, addr.albumIndex);
|
|
|
|
|
|
};
|
|
|
|
|
|
} else {
|
|
|
|
|
|
const sp = gallery.subpages[addr.subpageIndex!];
|
|
|
|
|
|
if (!sp) return null;
|
|
|
|
|
|
const sec = sp.sections?.[addr.sectionIndex!];
|
|
|
|
|
|
if (!sec) return null;
|
|
|
|
|
|
album = sec.albums[addr.albumIndex];
|
|
|
|
|
|
if (!album) return null;
|
|
|
|
|
|
name = getAlbumName(album.id);
|
|
|
|
|
|
count = getAlbumCount(album.id);
|
|
|
|
|
|
thumbnailId = getAlbumThumbnailId(album.id);
|
|
|
|
|
|
onUpdate = (updates) => {
|
|
|
|
|
|
setGallery((g) => {
|
|
|
|
|
|
const subpages = [...g.subpages];
|
|
|
|
|
|
const sp2 = { ...subpages[addr.subpageIndex!] };
|
|
|
|
|
|
const sections = [...(sp2.sections || [])];
|
|
|
|
|
|
const sec2 = { ...sections[addr.sectionIndex!] };
|
|
|
|
|
|
const albums = [...sec2.albums];
|
|
|
|
|
|
albums[addr.albumIndex] = { ...albums[addr.albumIndex], ...updates };
|
|
|
|
|
|
sec2.albums = albums;
|
|
|
|
|
|
sections[addr.sectionIndex!] = sec2;
|
|
|
|
|
|
sp2.sections = sections;
|
|
|
|
|
|
subpages[addr.subpageIndex!] = sp2;
|
|
|
|
|
|
return { ...g, subpages };
|
|
|
|
|
|
});
|
|
|
|
|
|
markDirty();
|
|
|
|
|
|
};
|
|
|
|
|
|
onRemove = () => {
|
|
|
|
|
|
removeSectionAlbum(addr.subpageIndex!, addr.sectionIndex!, addr.albumIndex);
|
|
|
|
|
|
};
|
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
return { album, name, count, thumbnailId, onUpdate, onRemove };
|
|
|
|
|
|
}
|
|
|
|
|
|
|
feat: add visual admin panel with page builder and settings editor
- Add /admin route with password-protected visual page builder
- Page Builder: manage hero images, standalone albums, subpages, and sections
- Album Picker: browse all shared Immich albums with search and filtering
- Settings Editor: theme, grid, footer, legal, SEO configuration
- YAML service with atomic writes and automatic backups (content/.backups/)
- HMAC-signed admin sessions (24h expiry, HttpOnly cookies)
- API endpoints: /api/admin/{auth,gallery,settings,albums,reload}
- Enable with ADMIN_PASSWORD env var; disabled by default
- invalidateConfigCache() export for hot-reload after saves
2026-05-29 17:04:37 +02:00
|
|
|
|
function getAllUsedAlbumIds(): Set<string> {
|
|
|
|
|
|
const ids = new Set<string>();
|
|
|
|
|
|
gallery.albums.forEach((a) => ids.add(a.id));
|
|
|
|
|
|
gallery.subpages.forEach((sp) => {
|
|
|
|
|
|
sp.albums.forEach((a) => ids.add(a.id));
|
|
|
|
|
|
sp.sections?.forEach((sec) => sec.albums.forEach((a) => ids.add(a.id)));
|
|
|
|
|
|
});
|
|
|
|
|
|
return ids;
|
|
|
|
|
|
}
|
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
// ── Album Card Sub-component ───────────────────────────────────
|
|
|
|
|
|
|
|
|
|
|
|
interface AlbumCardProps {
|
|
|
|
|
|
album: AlbumEntry;
|
|
|
|
|
|
name: string;
|
|
|
|
|
|
count: number;
|
2026-05-29 17:14:58 +02:00
|
|
|
|
thumbnailId: string | null;
|
feat: add visual admin panel with page builder and settings editor
- Add /admin route with password-protected visual page builder
- Page Builder: manage hero images, standalone albums, subpages, and sections
- Album Picker: browse all shared Immich albums with search and filtering
- Settings Editor: theme, grid, footer, legal, SEO configuration
- YAML service with atomic writes and automatic backups (content/.backups/)
- HMAC-signed admin sessions (24h expiry, HttpOnly cookies)
- API endpoints: /api/admin/{auth,gallery,settings,albums,reload}
- Enable with ADMIN_PASSWORD env var; disabled by default
- invalidateConfigCache() export for hot-reload after saves
2026-05-29 17:04:37 +02:00
|
|
|
|
onRemove: () => void;
|
2026-05-31 21:27:13 +02:00
|
|
|
|
onEdit: () => void;
|
2026-05-29 17:59:25 +02:00
|
|
|
|
dragListeners?: Record<string, unknown>;
|
feat: add visual admin panel with page builder and settings editor
- Add /admin route with password-protected visual page builder
- Page Builder: manage hero images, standalone albums, subpages, and sections
- Album Picker: browse all shared Immich albums with search and filtering
- Settings Editor: theme, grid, footer, legal, SEO configuration
- YAML service with atomic writes and automatic backups (content/.backups/)
- HMAC-signed admin sessions (24h expiry, HttpOnly cookies)
- API endpoints: /api/admin/{auth,gallery,settings,albums,reload}
- Enable with ADMIN_PASSWORD env var; disabled by default
- invalidateConfigCache() export for hot-reload after saves
2026-05-29 17:04:37 +02:00
|
|
|
|
}
|
|
|
|
|
|
|
2026-05-29 17:59:25 +02:00
|
|
|
|
function AlbumCard({
|
|
|
|
|
|
album,
|
|
|
|
|
|
name,
|
|
|
|
|
|
count,
|
|
|
|
|
|
thumbnailId,
|
|
|
|
|
|
onRemove,
|
2026-05-31 21:27:13 +02:00
|
|
|
|
onEdit,
|
2026-05-29 17:59:25 +02:00
|
|
|
|
dragListeners,
|
|
|
|
|
|
}: AlbumCardProps) {
|
2026-05-31 21:27:13 +02:00
|
|
|
|
const heroThumb = album.heroImage || thumbnailId;
|
|
|
|
|
|
const hasPassword = !!album.password;
|
|
|
|
|
|
const hasTitleOverride = !!album.title;
|
feat: add visual admin panel with page builder and settings editor
- Add /admin route with password-protected visual page builder
- Page Builder: manage hero images, standalone albums, subpages, and sections
- Album Picker: browse all shared Immich albums with search and filtering
- Settings Editor: theme, grid, footer, legal, SEO configuration
- YAML service with atomic writes and automatic backups (content/.backups/)
- HMAC-signed admin sessions (24h expiry, HttpOnly cookies)
- API endpoints: /api/admin/{auth,gallery,settings,albums,reload}
- Enable with ADMIN_PASSWORD env var; disabled by default
- invalidateConfigCache() export for hot-reload after saves
2026-05-29 17:04:37 +02:00
|
|
|
|
|
|
|
|
|
|
return (
|
2026-05-31 21:27:13 +02:00
|
|
|
|
<div className={`album-tile ${hasPassword ? 'has-password' : ''}`}>
|
2026-05-29 17:24:53 +02:00
|
|
|
|
<div className="album-tile-cover">
|
2026-05-29 17:59:25 +02:00
|
|
|
|
{dragListeners && (
|
|
|
|
|
|
<div className="album-tile-drag" {...dragListeners} title="Drag to reorder">
|
2026-08-14 11:10:42 +02:00
|
|
|
|
<IconGripVertical size={18} className="svg-icon svg-drag" />
|
2026-05-29 17:59:25 +02:00
|
|
|
|
</div>
|
|
|
|
|
|
)}
|
2026-05-31 21:27:13 +02:00
|
|
|
|
{heroThumb ? (
|
|
|
|
|
|
<img src={`/api/admin/thumbnail/${heroThumb}`} alt="" loading="lazy" />
|
2026-05-29 17:24:53 +02:00
|
|
|
|
) : (
|
2026-05-31 21:27:13 +02:00
|
|
|
|
<div className="album-tile-placeholder">
|
2026-08-14 11:10:42 +02:00
|
|
|
|
<IconCamera />
|
2026-05-31 21:27:13 +02:00
|
|
|
|
</div>
|
2026-05-29 17:14:58 +02:00
|
|
|
|
)}
|
2026-05-29 17:24:53 +02:00
|
|
|
|
<div className="album-tile-overlay">
|
release: v0.11.0 (#459)
Ships `dev` as **v0.11.0**. `main` contains nothing that `dev` does not,
so this is a clean sync.
## Headline changes since v0.10.0
- **Journal & Journal Studio** — photo essays at `/journal`,
split-screen block editor with live preview, drafts, per-entry
passwords, cover images
- **First-run setup wizard at `/install`** — configure a fresh
deployment from the browser; credentials are verified against Immich
before anything is written, and the wizard is gated by a one-time token
- **About page editor and toggle** in the admin panel
- **Per-album photo order** independent of Immich, with a drag & drop
editor
- **Custom favicon upload**
- **Experimental portfolio features** — justified grid, `cover` hero,
unlisted subpages, per-album grid overrides, cover focal points,
external nav links
- **Security** — asset tokens length-capped before decoding (#423),
journal author markdown escaped rather than filtered, journal file paths
contained, admin session key derived with scrypt (#432), Next.js 16.3.0
for CVE-2025-13465
- **Fixed** — client proofing honours its own configuration again
(#454); journal photo rendering (#432)
Full detail in [CHANGELOG.md](CHANGELOG.md#0110--2026-08-15).
## Verified
`npx tsc --noEmit` clean · `npx vitest run` 435 tests pass · `npm run
build` succeeds · lint 0 errors · `prettier --check` clean · local
`docker build` of the release tree.
## After merge
Tag `v0.11.0` on `main` and publish the release — that triggers
`docker-publish.yml`, which pushes the image and moves `latest`.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
---------
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
2026-08-15 09:09:18 +02:00
|
|
|
|
<button className="album-tile-btn" onClick={onEdit} title="Edit details">
|
2026-08-14 11:10:42 +02:00
|
|
|
|
<IconPencil size={14} />
|
feat: add visual admin panel with page builder and settings editor
- Add /admin route with password-protected visual page builder
- Page Builder: manage hero images, standalone albums, subpages, and sections
- Album Picker: browse all shared Immich albums with search and filtering
- Settings Editor: theme, grid, footer, legal, SEO configuration
- YAML service with atomic writes and automatic backups (content/.backups/)
- HMAC-signed admin sessions (24h expiry, HttpOnly cookies)
- API endpoints: /api/admin/{auth,gallery,settings,albums,reload}
- Enable with ADMIN_PASSWORD env var; disabled by default
- invalidateConfigCache() export for hot-reload after saves
2026-05-29 17:04:37 +02:00
|
|
|
|
</button>
|
2026-05-31 21:27:13 +02:00
|
|
|
|
<button
|
|
|
|
|
|
className="album-tile-btn album-tile-btn-danger"
|
|
|
|
|
|
onClick={onRemove}
|
|
|
|
|
|
title="Remove album"
|
|
|
|
|
|
>
|
2026-08-14 11:10:42 +02:00
|
|
|
|
<IconTrash size={14} />
|
feat: add visual admin panel with page builder and settings editor
- Add /admin route with password-protected visual page builder
- Page Builder: manage hero images, standalone albums, subpages, and sections
- Album Picker: browse all shared Immich albums with search and filtering
- Settings Editor: theme, grid, footer, legal, SEO configuration
- YAML service with atomic writes and automatic backups (content/.backups/)
- HMAC-signed admin sessions (24h expiry, HttpOnly cookies)
- API endpoints: /api/admin/{auth,gallery,settings,albums,reload}
- Enable with ADMIN_PASSWORD env var; disabled by default
- invalidateConfigCache() export for hot-reload after saves
2026-05-29 17:04:37 +02:00
|
|
|
|
</button>
|
|
|
|
|
|
</div>
|
|
|
|
|
|
</div>
|
2026-05-29 17:24:53 +02:00
|
|
|
|
<div className="album-tile-info">
|
2026-05-31 21:27:13 +02:00
|
|
|
|
<div className="album-tile-title-row">
|
release: v0.11.0 (#459)
Ships `dev` as **v0.11.0**. `main` contains nothing that `dev` does not,
so this is a clean sync.
## Headline changes since v0.10.0
- **Journal & Journal Studio** — photo essays at `/journal`,
split-screen block editor with live preview, drafts, per-entry
passwords, cover images
- **First-run setup wizard at `/install`** — configure a fresh
deployment from the browser; credentials are verified against Immich
before anything is written, and the wizard is gated by a one-time token
- **About page editor and toggle** in the admin panel
- **Per-album photo order** independent of Immich, with a drag & drop
editor
- **Custom favicon upload**
- **Experimental portfolio features** — justified grid, `cover` hero,
unlisted subpages, per-album grid overrides, cover focal points,
external nav links
- **Security** — asset tokens length-capped before decoding (#423),
journal author markdown escaped rather than filtered, journal file paths
contained, admin session key derived with scrypt (#432), Next.js 16.3.0
for CVE-2025-13465
- **Fixed** — client proofing honours its own configuration again
(#454); journal photo rendering (#432)
Full detail in [CHANGELOG.md](CHANGELOG.md#0110--2026-08-15).
## Verified
`npx tsc --noEmit` clean · `npx vitest run` 435 tests pass · `npm run
build` succeeds · lint 0 errors · `prettier --check` clean · local
`docker build` of the release tree.
## After merge
Tag `v0.11.0` on `main` and publish the release — that triggers
`docker-publish.yml`, which pushes the image and moves `latest`.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
---------
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
2026-08-15 09:09:18 +02:00
|
|
|
|
<span
|
|
|
|
|
|
className={`album-tile-name ${hasTitleOverride ? 'custom-title' : ''}`}
|
|
|
|
|
|
title={album.title || name}
|
|
|
|
|
|
>
|
2026-05-31 21:27:13 +02:00
|
|
|
|
{album.title || name}
|
|
|
|
|
|
</span>
|
|
|
|
|
|
<div className="album-tile-badges">
|
|
|
|
|
|
{hasPassword && (
|
|
|
|
|
|
<span className="badge badge-password" title="Password protected">
|
2026-08-14 11:10:42 +02:00
|
|
|
|
<IconLock size={12} />
|
2026-05-31 21:27:13 +02:00
|
|
|
|
</span>
|
|
|
|
|
|
)}
|
|
|
|
|
|
{album.heroImage && (
|
|
|
|
|
|
<span className="badge badge-hero" title="Custom Hero Image set">
|
2026-08-14 11:10:42 +02:00
|
|
|
|
<IconImage size={12} />
|
|
|
|
|
|
</span>
|
|
|
|
|
|
)}
|
|
|
|
|
|
{album.sort && album.sort !== DEFAULT_ALBUM_SORT && (
|
|
|
|
|
|
<span className="badge badge-sort" title={`Photo order: ${SORT_LABELS[album.sort]}`}>
|
release: v0.11.0 (#459)
Ships `dev` as **v0.11.0**. `main` contains nothing that `dev` does not,
so this is a clean sync.
## Headline changes since v0.10.0
- **Journal & Journal Studio** — photo essays at `/journal`,
split-screen block editor with live preview, drafts, per-entry
passwords, cover images
- **First-run setup wizard at `/install`** — configure a fresh
deployment from the browser; credentials are verified against Immich
before anything is written, and the wizard is gated by a one-time token
- **About page editor and toggle** in the admin panel
- **Per-album photo order** independent of Immich, with a drag & drop
editor
- **Custom favicon upload**
- **Experimental portfolio features** — justified grid, `cover` hero,
unlisted subpages, per-album grid overrides, cover focal points,
external nav links
- **Security** — asset tokens length-capped before decoding (#423),
journal author markdown escaped rather than filtered, journal file paths
contained, admin session key derived with scrypt (#432), Next.js 16.3.0
for CVE-2025-13465
- **Fixed** — client proofing honours its own configuration again
(#454); journal photo rendering (#432)
Full detail in [CHANGELOG.md](CHANGELOG.md#0110--2026-08-15).
## Verified
`npx tsc --noEmit` clean · `npx vitest run` 435 tests pass · `npm run
build` succeeds · lint 0 errors · `prettier --check` clean · local
`docker build` of the release tree.
## After merge
Tag `v0.11.0` on `main` and publish the release — that triggers
`docker-publish.yml`, which pushes the image and moves `latest`.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
---------
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
2026-08-15 09:09:18 +02:00
|
|
|
|
{album.sort === 'manual' ? (
|
|
|
|
|
|
<IconGripVertical size={18} className="svg-icon svg-drag" />
|
|
|
|
|
|
) : (
|
|
|
|
|
|
album.sort
|
|
|
|
|
|
)}
|
2026-05-31 21:27:13 +02:00
|
|
|
|
</span>
|
|
|
|
|
|
)}
|
feat: add visual admin panel with page builder and settings editor
- Add /admin route with password-protected visual page builder
- Page Builder: manage hero images, standalone albums, subpages, and sections
- Album Picker: browse all shared Immich albums with search and filtering
- Settings Editor: theme, grid, footer, legal, SEO configuration
- YAML service with atomic writes and automatic backups (content/.backups/)
- HMAC-signed admin sessions (24h expiry, HttpOnly cookies)
- API endpoints: /api/admin/{auth,gallery,settings,albums,reload}
- Enable with ADMIN_PASSWORD env var; disabled by default
- invalidateConfigCache() export for hot-reload after saves
2026-05-29 17:04:37 +02:00
|
|
|
|
</div>
|
|
|
|
|
|
</div>
|
2026-05-31 21:27:13 +02:00
|
|
|
|
<span className="album-tile-count">{count} photos</span>
|
|
|
|
|
|
</div>
|
feat: add visual admin panel with page builder and settings editor
- Add /admin route with password-protected visual page builder
- Page Builder: manage hero images, standalone albums, subpages, and sections
- Album Picker: browse all shared Immich albums with search and filtering
- Settings Editor: theme, grid, footer, legal, SEO configuration
- YAML service with atomic writes and automatic backups (content/.backups/)
- HMAC-signed admin sessions (24h expiry, HttpOnly cookies)
- API endpoints: /api/admin/{auth,gallery,settings,albums,reload}
- Enable with ADMIN_PASSWORD env var; disabled by default
- invalidateConfigCache() export for hot-reload after saves
2026-05-29 17:04:37 +02:00
|
|
|
|
</div>
|
|
|
|
|
|
);
|
|
|
|
|
|
}
|