Files
immich-folio/app/admin/components/SettingsEditor.tsx

2119 lines
83 KiB
TypeScript
Raw Normal View History

'use client';
import { useState, useEffect, useCallback } from 'react';
security: add Trivy container scan to Docker publish workflow (#399) * feat(admin): add backup manager UI with 1-click restore * feat(admin): collapse older backup entries by default * fix(theme): isolate admin layout, instant DOM theme updates, and add Light/Dark mode toggle * feat(admin): replace text controls for Photo Frame and Hero Style with visual preview cards * fix(admin): define missing CSS rules for button system (.btn, .preset-btn) * feat(admin): redesign theme settings with segmented mode toggle, accent color swatches, and custom iOS-style toggle cards * feat(admin): upgrade all settings tabs with visual grid previews, Google SEO snippet preview, and toggle cards * feat(admin): overhaul Pages Builder UX with slide-over drawer, card hover badges, real-time search, and floating save bar * fix(admin): remove leftover dangling syntax snippet in PageBuilder.tsx * fix(admin): add position: relative to subpage-tile so hover overlay is contained inside the tile * style(admin): replace all emojis with clean Leica-style vector SVG icons * fix(types): extend IconProps with SVGProps to allow style prop on Leica SVG icons * feat(admin): add subpage live-preview, privacy analytics, and asset protection settings * fix(typecheck): fix AlbumEntry property access in subpage drawer preview mode * fix(types): fix ImmichAlbumInfo property names thumbnailAssetId and albumName in PageBuilder.tsx * fix(types): add protection and watermark optional properties to AppConfig interface * feat(settings): add toggle for disabling analytics tracking (defaults to enabled) * feat(ux): show status banner when analytics tracking is disabled + add live sync indicator * feat(watermark): render customizable watermark overlay on Lightbox images + rename section to Portfolio Features & Modules * fix(types): import type LightboxWatermark in PhotoGrid.tsx * fix(types): destructure watermark prop in PhotoGrid function signature * feat(seo): add configurable subpage title template and metadata descriptions * feat(seo): add generateMetadata to about page for title template support * feat(proofing): add client proofing, favorites selection, compact URL bitmasking, and export modal * feat(essay): add Photo Essay storytelling mode with RSC markdown parser and fullbleed/pair layouts * feat(subpages): add page enabled toggle to deactivate subpages without deleting them * feat(admin): add visual essay block builder for photo essay storytelling pages * security: add Trivy container scan to Docker publish workflow Scans the built image for CRITICAL/HIGH CVEs on every release and uploads results to the GitHub Security tab. Non-blocking for now (exit-code 0) so releases aren't gated on findings. Also documents the scan and existing Dependabot coverage in the README. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-08-07 11:08:04 +02:00
import { useRouter } from 'next/navigation';
release: v0.11.0 — journal fixes, admin URLs, design system cleanup (#432) * fix(screenshots): sharp-Typen fuer 0.34 und 0.35 gleichzeitig (#410) sharp 0.35 ist von `export =` auf ESM umgestellt: der Modul-Namespace ist nicht mehr aufrufbar, die Factory sitzt unter .default. Der Type-Check brach damit in scripts/screenshots.ts weg, sobald der Next-Bump (#402) sharp von 0.34.5 auf 0.35.3 mitzieht -- sharp ist hier keine deklarierte Dependency, sondern kommt ueber Next mit. Die Form wird jetzt aus dem installierten Paket abgeleitet statt festgeschrieben, zur Laufzeit wie im Typ. Geprueft mit beiden Versionen: tsc laeuft mit 0.34.5 und mit 0.35.3 fehlerfrei durch. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(deps): bump the nextjs group across 1 directory with 2 updates (#402) Bumps the nextjs group with 2 updates in the / directory: [next](https://github.com/vercel/next.js) and [eslint-config-next](https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next). Updates `next` from 16.2.12 to 16.3.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/compare/v16.2.12...v16.3.0) Updates `eslint-config-next` from 16.2.12 to 16.3.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/commits/v16.3.0/packages/eslint-config-next) --- updated-dependencies: - dependency-name: eslint-config-next dependency-version: 16.3.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: nextjs - dependency-name: next dependency-version: 16.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nextjs ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps-dev): bump prettier from 3.8.3 to 3.9.6 (#405) Bumps [prettier](https://github.com/prettier/prettier) from 3.8.3 to 3.9.6. - [Release notes](https://github.com/prettier/prettier/releases) - [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md) - [Commits](https://github.com/prettier/prettier/compare/3.8.3...3.9.6) --- updated-dependencies: - dependency-name: prettier dependency-version: 3.9.6 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * docs(changelog): Unreleased-Sektion fuer die Bumps nach v0.10.0 (#413) Die Dependency-PRs sind nach dem Release auf dev gelandet, teils auch auf main. Ohne Eintrag waeren sie beim naechsten Release unsichtbar -- inklusive Next 16.3.0, das CVE-2025-13465 mitbringt. Ausserdem im 0.10.0-Abschnitt nachgetragen, dass der Trivy-Scan bis #409 nie gelaufen ist. Der Fix steckt im Tag v0.10.0, fehlte aber in der Aufzaehlung -- und "Images werden bei jedem Publish gescannt" stand im Changelog, waehrend der Job im Action-Setup abbrach. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(gallery): per-album sort order, independent of Immich (#408) (#414) Album order was dictated entirely by Immich: getAlbum() sorted by the album's own asc/desc flag, so a Folio album always mirrored the archive. A curated series has a narrative order that has nothing to do with capture time, and changing the Immich album's sort to fit the website changes it for the archive too. Adds an optional per-album `sort` in gallery.yaml, editable in /admin, defaulting to today's behaviour so every existing config is unchanged: immich (default) | newest | oldest | filename | manual `manual` is a pinned *prefix*: `assetOrder` lists only the photos placed by hand, everything else follows in the album's Immich order. A full permutation of a 2,000-photo album would be ~80 KB of UUIDs in a file that is rewritten and copied to content/.backups/ on every admin save. It also makes drift fall out for free — photos removed in Immich never match, new ones land in the tail rather than being hidden. Sorting is applied after the cache read, not before the cache write, so the LRU keeps one canonical Immich-ordered copy per album. That avoids putting the mode in the cache key, lets a config change take effect without depending on invalidation, and keeps the stale-serving path correct. cache.get() returns the stored object by reference, so withSort() returns a shallow clone with a new array — sorting in place would reorder the shared entry, and under request coalescing every concurrent caller would be sorting the same array. Also fixes a prerequisite bug: /api/admin/albums/[albumId]/assets read album.assets from GET /albums/:id, which Immich 3.x no longer populates (lib/immich.ts:507). The hero picker's "This Album" tab returned nothing and threw outright when the key was absent. It now goes through the client's paginated metadata search, with ?types=all to opt videos in for the reorder editor. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): drop decorative emoji from the sort select labels (#415) An <option> cannot contain markup, so the SVG set in Icons is not reachable there — but a decorative emoji is not a substitute for it. Plain text instead; the album card badge already uses a real icon. The remaining emoji in the admin panel (asset picker tabs, section headings, layout picker options) predate this branch and are left for a separate cleanup. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): replace emoji icons with the shared SVG icon set (#416) The admin panel mixed two icon conventions: inline SVGs from `Icons.tsx` in most components, and decorative emoji in the asset picker and a few PageBuilder labels. Emoji render inconsistently across platforms, ignore the accent colour, and cannot inherit the `.svg-icon` sizing rules. - Icons.tsx: add `IconStar` (filled — it marks a state, not an action) and `IconImage`. - AssetPicker: the three tab labels and the favourite tile badge now use IconFolder / IconStar / IconImage. - PageBuilder: the "Standalone Albums" and "Subpages" headings use the icon set instead of an emoji. - PageBuilder: the layout picker drops its emoji for plain text. An <option> cannot contain markup, so an SVG is impossible there and a decorative glyph is not a substitute. - admin.css: align icon and label in the picker tabs, and swap the favourite badge's text-shadow for drop-shadow, which is what applies to an inline SVG. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): fold PageBuilder's local icons into the shared Icons module (#418) * refactor(admin): fold PageBuilder's local icons into the shared module PageBuilder.tsx carried its own `Icons` object duplicating most of the glyphs already exported by Icons.tsx, with hardcoded sizes and slightly divergent paths. Migrate all 32 call sites to the shared module and delete the local object. Five glyphs had no counterpart and are added to Icons.tsx as 1:1 ports of the local paths: IconX, IconPlus, IconHome, IconCopy, IconImage. The local ExternalLink and Check are dropped rather than ported — both had zero call sites. Two glyphs change shape slightly, which is the point of consolidating: the shared IconCamera includes the viewfinder bump the local copy omitted, and drag handles now use IconGripVertical. IconGripVertical uses the module's square 24x24 viewBox, so `.svg-drag` goes from 12x18 to 18x18 — the old non-square box would letterbox the glyph down to 12x12 and shrink the handle. * fix(admin): resolve icon-module integration after #416 Merging dev brought in #416, which added a second IconImage to Icons.tsx and two <Icons.Camera>/<Icons.Folder> section headers that reference the local Icons object this PR removes. Git merged both cleanly but the result did not type-check. - drop the duplicate IconImage (both copies were byte-identical) - point the two section headers at the imported IconCamera/IconFolder - refresh the SORT_LABELS comment: the icon set is imported now, not declared below --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> * fix(config): allow an empty gallery, guard against a double /api suffix (#421) An empty gallery is now a valid, rendered state instead of a throw: deriveGallery() no longer requires at least one album or subpage, so a deployment with no albums yet renders a bare homepage the owner can fill in via /admin. getConfig() also stops appending /api to an Immich URL that already ends in it, which previously produced .../api/api and broke every upstream request. Includes a restore of the per-album sort test cases, which the branch had lost by being cut before #408/#414. * feat(admin): favicon upload, served from the content volume (#422) Adds a bundled default favicon, an upload widget in admin Settings > General, and a route that serves the icon from the writable content/ volume with a fallback to the bundled default. Raster uploads (PNG/ICO/JPEG) are wrapped in an SVG container; the response carries its own CSP so an uploaded SVG cannot execute script on the origin. The GET route revalidates with an ETag instead of caching immutably, so a newly uploaded icon shows up immediately. Uploads are written via temp file + rename, and a Reset button restores the bundled default. * ci: flag unformatted files in a PR, without blocking it (#424) Prettier is configured as an error rule in eslint.config.mjs but has never run in CI, so part of the tree predates it. A final CI step now diffs against the PR base, runs prettier --list-different over the changed files, and emits a warning annotation per offender plus a job summary. Advisory by design: it never fails the job. Blocking would turn a PR red for merely touching a file that was already unformatted, and normalising the tree in one commit would wreck git blame and conflict with the PRs in flight. Requires fetch-depth: 0, since diffing against the base needs its history. * feat(install): first-run wizard gated by a one-time setup token (#419) Adds /install, a four-step first-run wizard: connect to Immich, optionally pick albums, name the site, finish. It verifies the credentials against the Immich server before writing anything, then writes gallery.yaml, settings.yaml and a content/install.json carrying the Immich credentials and a generated site secret. install.json exists because a running process cannot pick up new env vars — the wizard has to write configuration that takes effect without a restart. getInstallCredentials() merges it under the real environment, so env vars always win and rotation stays a matter of setting one. Both the page and the API routes are gated by a one-time setup token printed to the server log, so a deployment that is reachable before gallery.yaml exists cannot be configured by whoever finds it first. The token is stored in content/.setup-token (0600) rather than a module variable: Next.js bundles the page and each route handler separately, so a module-level token left the page and the API disagreeing inside one process and the wizard stuck on step 1. It is removed once the install completes. The admin password is stored as an scrypt hash using the scheme lib/auth.ts already applies to album passwords; a plaintext ADMIN_PASSWORD env var keeps working. * docs: document the setup wizard, fix the read-only content mount (#425) Quick Start now leads with the /install wizard, with the hand-written YAML route kept alongside it, and a First-Run Setup section covers the setup token, the files the wizard writes, and env-var precedence. Two corrections: both Docker examples mounted content/ as :ro, which silently breaks the wizard, the admin panel and the backup rotation alike — docs/admin-panel.md already said so and the README contradicted it. And nothing documented that content/install.json holds the Immich API key, so a backup of content/ is a backup of credentials. Also adds a Contributors section crediting the people whose work is in the project. * feat(admin): floating save bar pinned to the bottom of the viewport (#426) The save bar was the first, static element inside .admin-main. Since the document itself scrolls, it left the viewport as soon as you scrolled down — editing a subpage section or a settings block far below gave no visible dirty hint and no reachable save button. Replace it with a bottom-pinned floating bar shared by both editors. It only mounts while there is something to act on (unsaved changes, an in-flight save, or a result message), so it never covers content while idle. The success message clears after 5s, which hides the bar again. - new SaveBar component, replacing the duplicated markup in PageBuilder and SettingsEditor - adopt the previously unused .floating-save-bar CSS: slide-in keyframes (carrying translateX(-50%)), dirty border, wrap/gap, mobile variant and a prefers-reduced-motion opt-out; z-index 900 keeps it below modals - .admin-main gains bottom padding so the bar never covers page content - drop the now-unreachable idle hints: the ⌘S hint becomes a button title, the Live Sync note becomes a static line above the settings layout - header "Site" link now bypasses the cache (/?fresh=1), so the preview stays reachable when the bar is hidden Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(admin): themed listbox for the album sort control (#427) The per-album "Photo order" control was a native <select>. Because an <option> cannot contain markup, its choices could not use the admin panel's currentColor SVG set — the reason #415 had to fall back to plain text after dropping the emoji labels. Adds a Listbox component implementing the ARIA combobox/listbox pattern, so options can render a glyph beside their label: - DOM focus stays on the trigger button; the active option is announced through aria-activedescendant, keeping focus management to one element - Keyboard: arrows (clamped at the ends, like a native select), Home/End, Enter/Space to commit, Escape to cancel, Tab commits and moves on, and prefix type-ahead with a repeat-key cycle - Outside dismissal on pointerdown, so a press starting outside closes the popup before the click retargets The sort options now carry an icon each: calendar, arrow-down, arrow-up, an A→Z marker, and the drag glyph for manual — matching the badge the album card already shows. SORT_LABELS stays plain text because the badge feeds it to a title attribute. Closes #417 Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(git): ignore generated design handoff folders * fix(admin): stop the album sort dropdown clipping, and simplify the panel (#428) * fix(admin): render listbox popup in a portal so it escapes modal clipping The sort control's popup was position:absolute inside three clipping ancestors (.album-drawer overflow:hidden > .album-drawer-body overflow-y:auto > .modal-right-column overflow-y:auto), so it was cut off at the bottom of the Edit Album Details modal. z-index could not help: clipping happens before stacking. It also always hung below the trigger, with no flip. Portal the popup to document.body and position it from the trigger's viewport rect, flipping above when there is more room there and capping max-height to the space available so it scrolls internally rather than overflowing. It is dismissed on scroll and resize, since the anchor is only measured on open. The outside-pointerdown handler now also treats the popup as inside; without that the portalled list counts as outside, and a click on an option would close it before the selection commits. * refactor(admin): single-column album details panel The left column spent 1.2fr on a cover thumbnail and three stat rows, two of which (Status, Custom Hero) only restated the form fields opposite them, while the form itself was squeezed into 1.8fr behind a second nested scroller. Stack the drawer in one column instead: cover as a banner, then the form at full width, with the UUID moved into the footer. The body is now the only scroll container, which also removes one of the ancestors that was clipping the sort popup. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> * fix(admin): give the portalled listbox its theme back, lock the page behind modals (#429) Two defects in the album editor. The sort listbox popup painted transparent. Every --admin-* variable is scoped to .admin-layout, and since the popup moved into document.body it sits outside that subtree, so background/border/text all resolved to nothing. It now carries its own copy of the palette in both colour schemes, plus the font it no longer inherits. Scrolling inside a modal also moved the page behind it. No admin modal ever locked body scroll: the overlay covers the page but does not absorb wheel events, so a scroll starting on the backdrop — or continuing past the end of the modal's own scroller — reaches the document. overscroll-behavior cannot cover that case on its own, because it only applies to scroll containers and the backdrop is not one. useScrollLock freezes body while a modal is open and compensates for the width the scrollbar gives up, so nothing shifts underneath. Each lock restores the inline value it found, which makes nesting work without a counter — a picker opened from the drawer restores the drawer's hidden state instead of clearing it. Applied to both drawers and all four picker modals, which share the defect. overscroll-behavior: contain on the scrollers stops the chaining they can handle themselves. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com> * fix(security): allow unsafe-eval in CSP script-src during dev mode * feat(journal): add Journal Studio with split-screen editor, live preview and dedicated routes * fix(build): separate client parser from server journal-service and fix build type errors * fix(journal): Fotos rendern, Layout und Lightbox-Steuerung korrigieren Fünf unabhängige Fehler in der öffentlichen Journal- und Essay-Ansicht: * Foto-Blöcke wurden nie angezeigt. EssayView löst ein Foto über PhotoItem.id auf, und das sind verschlüsselte Tokens — die Blöcke aus dem Markdown tragen aber rohe Asset-UUIDs. Jede Zuordnung lief ins Leere, und nicht auflösbare Blöcke werden still verworfen. Die IDs werden jetzt serverseitig übersetzt; damit verschwinden nebenbei die rohen UUIDs aus dem Client-Payload, die dort laut Projektregel nie auftauchen dürfen. Nicht auflösbare Referenzen werden geloggt. * Überschriften standen weiter links als der Fließtext. Jeder Block hatte einzeln `max-width: 68ch`, und `ch` ist relativ zur Schrift des Elements — die Serif-Überschrift ergab eine breitere Spalte. Ersetzt durch eine gemeinsame, font-unabhängige `--essay-measure`. * Fullbleed-Fotos bluteten nur nach links aus: `.essay-figure` ist `width: 100%`, wodurch die Box überbestimmt ist und der negative rechte Margin verworfen wird. * Foto-Paare stellten beide Bilder gleich breit dar, wodurch ein Hochformat neben einem Querformat doppelt so hoch wurde. Jetzt eine Justified-Reihe: Breite proportional zum Seitenverhältnis, dadurch exakt gleiche Höhen ohne Beschnitt. * Die Lightbox hatte im Journal keine Tastatursteuerung und keine Scroll-Sperre — beides lag in PhotoGrid, also nur im Album-Raster. Verlagert in die Lightbox selbst, der doppelte Handler in PhotoGrid entfernt (sonst wäre pro Pfeildruck zwei Bilder weitergesprungen). Zusätzlich sind Proofing-Herzen und das EXIF-Panel im redaktionellen Modus abschaltbar und im Journal aus: Client-Proofing ist ein Übergabe-Workflow für Alben, keine Funktion einer Reportage. Auf der Übersicht wurde der Untertitel doppelt gerendert, weil extractExcerpt() auf ihn zurückfällt. * feat(admin): eigene URLs für alle Bereiche und überarbeiteter Journal Studio Das Panel war eine einzige Client-Komponente, die ihre Tabs über useState umschaltet: keine Route pro Bereich, kein Deep-Link, kein Zurück-Button, und nach jedem Reload landete man wieder auf "Pages". Auch der Journal-Editor hatte keine eigene URL. Jetzt sieben echte Routen (/admin, /admin/pages, /admin/journal, /admin/journal/<slug>, /admin/settings, /admin/settings/<section>, /admin/analytics). Die Shell mit Auth-Prüfung und Kopfzeile sitzt im Layout und umschließt children — so bleibt die Session-Prüfung über Routenwechsel montiert, statt bei jedem Tab-Wechsel neu zu laufen und den Spinner aufblitzen zu lassen. Unbekannte Settings-Sections fallen auf General zurück. Im selben Zug der Journal Studio, der die Routing-Änderung ohnehin berührt: * Alle Eingabefelder nutzten die Klasse `admin-input`, die in keinem CSS definiert war — sie fielen auf Browser-Defaults zurück. Jetzt gestylt, gescoped, damit der generische Name nicht ins übrige Panel leckt. * Der Split View ist per Divider verschiebbar (Maus, Tastatur, Doppelklick zum Zurücksetzen), Breite in localStorage. * Das Studio bricht aus der 1120px-Spalte aus, die Preview hat Platz. * Die Preview zeigte für jedes Foto fest 3:2 und log damit über das Layout der veröffentlichten Seite; die echten Verhältnisse werden jetzt an den Thumbnails gemessen. * Blöcke mit alten positionsbasierten Foto-Referenzen werden markiert — die lassen sich auf einer eigenständigen Journal-Seite nicht auflösen und verschwanden bisher stillschweigend. * Blocktyp-Chips als gemeinsame Komponente, monochrom und per Icon unterschieden statt in einer eigenen Blau/Lila/Orange-Palette, die sonst nirgends im Panel vorkommt. * Emojis raus, SVG-Icons rein. * fix(admin): Designsystem-Lücken im Panel schließen Eine systematische Suche nach Klassen, die im TSX benutzt, aber in keinem CSS definiert sind, hat vier Stellen mit demselben Muster gefunden: * `admin-btn-secondary` und `admin-btn-danger` existierten nicht. Sämtliche Löschen-Buttons sahen aus wie normale Buttons — keine Warnwirkung. Als `.admin-btn.admin-btn-danger` geschrieben, weil die Varianten mit den Größenklassen kombiniert werden, die weiter unten ihren eigenen Hintergrund setzen. * `page-progress-fill` fehlte: die Balken im Analytics-Panel waren leere Rinnen, der Wert unsichtbar. Ebenso `analytics-empty` und `admin-loading-container`. * `subpage-drawer-section`, `subpage-drawer-title-group` und `input-with-icon` im PageBuilder waren wirkungslos und teils mit Inline-Styles notdürftig kompensiert. * `grid-card-preview` fehlte, wodurch alle Layout-Vorschauen auf Höhe null kollabierten. Nur "Showcase" war sichtbar — und das aus Versehen, weil sein Tile `hero-tile` hieß und damit die `aspect-ratio` einer fremden PageBuilder-Klasse erbte. Umbenannt. Dazu die Theme-Vorschauen, die praktisch identisch aussahen: alle sieben zeigten dieselben drei quadratischen Kacheln, einziger Unterschied war die Hintergrundfarbe. Sie spiegeln jetzt die echten Preset-Daten aus lib/config/theme.ts — Schriftcharakter, Eckradius, Rasterdichte, Passepartout bzw. Schatten. Die Kopfzeile richtet sich an einer gemeinsamen Steuerhöhe aus. Der "Site"-Link war höher als die Buttons daneben: `.admin-btn` hatte keine explizite line-height, und <button> bekommt box-sizing: border-box vom Browser, <a> nicht. Die Statusanzeige setzte weder Schriftfamilie noch -größe und fiel auf den Browser-Default zurück — sie war nie Teil des Designsystems. Jetzt gleiche Höhe und Typografie, Pillenform als Zustandsanzeige, Trenner zur Aktionsgruppe. Das dauerhafte Pulsieren des grünen Punkts entfällt; Animation bleibt den Zuständen vorbehalten, die Aufmerksamkeit brauchen. Restliche Emojis durch SVG-Icons ersetzt. * feat(admin): add scroll-to-top toggle and SVG arrow The back-to-top button was always on and drew its arrow with the ↑ text character. Add a `scrollToTop` setting (General section in the admin panel, defaults to on so existing sites are unaffected) and replace the glyph with a stroked SVG that inherits currentColor across all presets. Scroll handling is now rAF-throttled, and prefers-reduced-motion turns off both the hover lift and the smooth scroll. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * security(journal): escape author HTML instead of filtering it CodeQL flags 26 high-severity alerts on the release PR; the bulk of them point at sanitizeHtml(), a denylist of three regexes whose output goes into dangerouslySetInnerHTML. I reproduced the bypasses before changing anything — all four pass the old filter: <img src=x onerror=alert(1)> unquoted handler, regex wants quotes <img src=x onerror='alert(1)'> single quotes, same reason <svg onload=alert(1)> not a <script> tag javasjavascript:cript:alert(1) one-pass replace, the rest recombines Plus an attribute breakout in the link renderer, which interpolated the URL into href="${url}" unescaped: [x](" onmouseover=alert(1) x=") -> <a href="" onmouseover=alert(1" ...> Replaced with escaping. Every `&<>"'` in author text becomes an entity before any markdown rule runs, so the only tags in the output are the ones renderInlineMarkdown builds itself and a URL cannot leave its attribute. Link schemes are now an allowlist (http, https, mailto, tel, relative, anchor); anything else renders as plain text. The serializer needed decodeHtmlEntities to match: without it a save would write `&lt;` into the Markdown file and the next parse would escape the `&` again, corrupting the text further on every round trip. A test covers parse -> serialize -> parse stability. Two existing tests asserted the old behaviour and were rewritten rather than deleted: one expected the script tag to be *removed* from the output, the other expected the substring "onerror" to be absent. Both now assert the property that matters — that no tag can form — because `onerror` surviving as inert text is fine. Exploitation required admin access either way: journal and essay text comes from the studio or from content/*.md. This removes the weakness, it does not close an open door. * fix(journal): contain file paths, fix frontmatter escaping, defuse two regexes Follow-up to the CodeQL findings on release PR #432. I went through all 23 alerts individually; this addresses the ones that are worth addressing and documents the ones that are not. Path containment (12 alerts, all false positives). Every path built from a slug goes through isValidSlug(), a strict `/^[a-zA-Z0-9_-]+$/` allowlist — verified against `../../etc/passwd`, `foo/../../bar`, `a/b`, `..` and friends, all rejected. CodeQL cannot see it because the check lives in another module. Added a containedPath() helper that resolves the path and refuses anything landing outside the content directory: a second lock on a door that was already locked, and a barrier the analysis can follow. Also removed the dead `slug.endsWith('.md')` branches — isValidSlug rejects dots, so they could never be taken. Frontmatter escaping (1 alert, a real bug). The serializer escaped `"` but not `\`, and the parser never unescaped anything. A title containing either character gained a backslash on every save/load cycle: Path C:\Users "quoted" -> Path C:\\Users \"quoted\" -> ... Escaping now covers the backslash first and the parser undoes both. A round trip test covers quotes, backslashes, colons and apostrophes. Two of three ReDoS regexes (2 alerts). The heading pattern had `\s+` next to `(.+)`, which overlap, so the engine tried every split of the whitespace run before failing; it is `[ \t]+` and `(\S.*)` now. The quote author pattern wrapped a lazy group around an optional group — the quadratic case — and is an index split on the first separator now. The third regex, the bold/italic pass, is deliberately left alone. Rewriting it with a negated class removes the backtracking but breaks nesting: `**bold *and italic* here**` renders as `*<em>bold </em>and italic<em> here</em>*`. The input is Markdown from an authenticated admin, never a visitor, so the worst case is an author slowing down their own page. The comment in the code says so. Not addressed: 5 js/insufficient-password-hash alerts. They ask for a slow KDF where the code uses SHA-256/HMAC — correct in general, but the admin password comes from an environment variable and is never stored, so a stronger KDF protects nothing that is not already in plaintext in the environment. 399 unit tests pass (18 new), build and tsc clean. * fix(journal): split the quote author by scanning, not by pattern Cleaning up after myself. #439 replaced the quote author regex `/^(.*?)(?:\s+--\s+(.+))?$/` — a lazy group around an optional one, the quadratic case — with `/\s+--\s+/`, and CodeQL promptly flagged the replacement for the same reason. One reported pattern traded for another. splitQuoteAuthor() scans for the first `--` that has whitespace on both sides. Linear, and it needs no reasoning about the regex engine at all. Behaviour is identical to the original regex, checked case by case against it: separator, no separator, several separators, tabs, wide gaps, `a--b` without spaces, leading and trailing separators, empty string. All nine are covered by tests, plus one asserting it stays fast on a 50k whitespace run. * security(admin): derive the session signing key with scrypt getSigningKey() ran the admin password through a single SHA-256 digest. It is key derivation rather than password storage, so it was never a stored-hash problem — but if the derived key ever leaked, one fast hash makes recovering the password by brute force cheap. CodeQL flags it as js/insufficient-password-hash and, for this particular alert, has a point. scrypt now. Two details that matter: The salt has to be stable. A random salt would produce a different key on every call and invalidate every session; it is derived from AUTH_SECRET, which is deployment-specific. Verified across separate processes: same inputs produce a verifying token, so a restart or redeploy does not log everyone out. The result is cached for the process lifetime. scrypt is deliberately slow and getSigningKey() runs on every admin request — deriving per call would add ~24ms to each one. The cache key is a digest of secret plus password, so a rotation misses the cache and derives again, and no extra plaintext copy of the password is kept around. Measured: first derivation 24ms, subsequent calls 0.12ms. Password change and secret change both invalidate an existing token, checked in separate processes. Note the one-time effect: existing admin sessions are invalidated by the change in derivation, so everyone logs in once more. * security(admin): key the signing-key cache on its inputs, not a digest #441 removed the SHA-256 digest of the admin password from the key derivation and introduced a new one three lines above it, as the cache key. Same rule, same file: CodeQL reported it immediately. The comment justifying it was wrong too. It claimed no second plaintext copy of the password was retained, while building the digest input allocates exactly that in order to hash it. The cache now holds the two input strings and compares them directly. They are the same objects the env and install caches already hold, so nothing extra is retained, and no fast hash of the password exists in memory for the life of the process. Re-verified after the change, in separate processes: a token from one process verifies in another with the same inputs, a changed password or secret rejects it, first derivation 24ms, cached calls 0.001ms. That leaves scrypt as the only place the password is hashed here. The two HMACs further down operate on the derived key and on token data, not on the password; the constant-time comparison in verifyAdminPassword is the previously dismissed one. --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
2026-08-14 16:55:07 +02:00
import Link from 'next/link';
security: add Trivy container scan to Docker publish workflow (#399) * feat(admin): add backup manager UI with 1-click restore * feat(admin): collapse older backup entries by default * fix(theme): isolate admin layout, instant DOM theme updates, and add Light/Dark mode toggle * feat(admin): replace text controls for Photo Frame and Hero Style with visual preview cards * fix(admin): define missing CSS rules for button system (.btn, .preset-btn) * feat(admin): redesign theme settings with segmented mode toggle, accent color swatches, and custom iOS-style toggle cards * feat(admin): upgrade all settings tabs with visual grid previews, Google SEO snippet preview, and toggle cards * feat(admin): overhaul Pages Builder UX with slide-over drawer, card hover badges, real-time search, and floating save bar * fix(admin): remove leftover dangling syntax snippet in PageBuilder.tsx * fix(admin): add position: relative to subpage-tile so hover overlay is contained inside the tile * style(admin): replace all emojis with clean Leica-style vector SVG icons * fix(types): extend IconProps with SVGProps to allow style prop on Leica SVG icons * feat(admin): add subpage live-preview, privacy analytics, and asset protection settings * fix(typecheck): fix AlbumEntry property access in subpage drawer preview mode * fix(types): fix ImmichAlbumInfo property names thumbnailAssetId and albumName in PageBuilder.tsx * fix(types): add protection and watermark optional properties to AppConfig interface * feat(settings): add toggle for disabling analytics tracking (defaults to enabled) * feat(ux): show status banner when analytics tracking is disabled + add live sync indicator * feat(watermark): render customizable watermark overlay on Lightbox images + rename section to Portfolio Features & Modules * fix(types): import type LightboxWatermark in PhotoGrid.tsx * fix(types): destructure watermark prop in PhotoGrid function signature * feat(seo): add configurable subpage title template and metadata descriptions * feat(seo): add generateMetadata to about page for title template support * feat(proofing): add client proofing, favorites selection, compact URL bitmasking, and export modal * feat(essay): add Photo Essay storytelling mode with RSC markdown parser and fullbleed/pair layouts * feat(subpages): add page enabled toggle to deactivate subpages without deleting them * feat(admin): add visual essay block builder for photo essay storytelling pages * security: add Trivy container scan to Docker publish workflow Scans the built image for CRITICAL/HIGH CVEs on every release and uploads results to the GitHub Security tab. Non-blocking for now (exit-code 0) so releases aren't gated on findings. Also documents the scan and existing Dependabot coverage in the README. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-08-07 11:08:04 +02:00
import * as Icons from './Icons';
release: v0.11.0 — journal fixes, admin URLs, design system cleanup (#432) * fix(screenshots): sharp-Typen fuer 0.34 und 0.35 gleichzeitig (#410) sharp 0.35 ist von `export =` auf ESM umgestellt: der Modul-Namespace ist nicht mehr aufrufbar, die Factory sitzt unter .default. Der Type-Check brach damit in scripts/screenshots.ts weg, sobald der Next-Bump (#402) sharp von 0.34.5 auf 0.35.3 mitzieht -- sharp ist hier keine deklarierte Dependency, sondern kommt ueber Next mit. Die Form wird jetzt aus dem installierten Paket abgeleitet statt festgeschrieben, zur Laufzeit wie im Typ. Geprueft mit beiden Versionen: tsc laeuft mit 0.34.5 und mit 0.35.3 fehlerfrei durch. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(deps): bump the nextjs group across 1 directory with 2 updates (#402) Bumps the nextjs group with 2 updates in the / directory: [next](https://github.com/vercel/next.js) and [eslint-config-next](https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next). Updates `next` from 16.2.12 to 16.3.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/compare/v16.2.12...v16.3.0) Updates `eslint-config-next` from 16.2.12 to 16.3.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/commits/v16.3.0/packages/eslint-config-next) --- updated-dependencies: - dependency-name: eslint-config-next dependency-version: 16.3.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: nextjs - dependency-name: next dependency-version: 16.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nextjs ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps-dev): bump prettier from 3.8.3 to 3.9.6 (#405) Bumps [prettier](https://github.com/prettier/prettier) from 3.8.3 to 3.9.6. - [Release notes](https://github.com/prettier/prettier/releases) - [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md) - [Commits](https://github.com/prettier/prettier/compare/3.8.3...3.9.6) --- updated-dependencies: - dependency-name: prettier dependency-version: 3.9.6 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * docs(changelog): Unreleased-Sektion fuer die Bumps nach v0.10.0 (#413) Die Dependency-PRs sind nach dem Release auf dev gelandet, teils auch auf main. Ohne Eintrag waeren sie beim naechsten Release unsichtbar -- inklusive Next 16.3.0, das CVE-2025-13465 mitbringt. Ausserdem im 0.10.0-Abschnitt nachgetragen, dass der Trivy-Scan bis #409 nie gelaufen ist. Der Fix steckt im Tag v0.10.0, fehlte aber in der Aufzaehlung -- und "Images werden bei jedem Publish gescannt" stand im Changelog, waehrend der Job im Action-Setup abbrach. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(gallery): per-album sort order, independent of Immich (#408) (#414) Album order was dictated entirely by Immich: getAlbum() sorted by the album's own asc/desc flag, so a Folio album always mirrored the archive. A curated series has a narrative order that has nothing to do with capture time, and changing the Immich album's sort to fit the website changes it for the archive too. Adds an optional per-album `sort` in gallery.yaml, editable in /admin, defaulting to today's behaviour so every existing config is unchanged: immich (default) | newest | oldest | filename | manual `manual` is a pinned *prefix*: `assetOrder` lists only the photos placed by hand, everything else follows in the album's Immich order. A full permutation of a 2,000-photo album would be ~80 KB of UUIDs in a file that is rewritten and copied to content/.backups/ on every admin save. It also makes drift fall out for free — photos removed in Immich never match, new ones land in the tail rather than being hidden. Sorting is applied after the cache read, not before the cache write, so the LRU keeps one canonical Immich-ordered copy per album. That avoids putting the mode in the cache key, lets a config change take effect without depending on invalidation, and keeps the stale-serving path correct. cache.get() returns the stored object by reference, so withSort() returns a shallow clone with a new array — sorting in place would reorder the shared entry, and under request coalescing every concurrent caller would be sorting the same array. Also fixes a prerequisite bug: /api/admin/albums/[albumId]/assets read album.assets from GET /albums/:id, which Immich 3.x no longer populates (lib/immich.ts:507). The hero picker's "This Album" tab returned nothing and threw outright when the key was absent. It now goes through the client's paginated metadata search, with ?types=all to opt videos in for the reorder editor. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): drop decorative emoji from the sort select labels (#415) An <option> cannot contain markup, so the SVG set in Icons is not reachable there — but a decorative emoji is not a substitute for it. Plain text instead; the album card badge already uses a real icon. The remaining emoji in the admin panel (asset picker tabs, section headings, layout picker options) predate this branch and are left for a separate cleanup. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): replace emoji icons with the shared SVG icon set (#416) The admin panel mixed two icon conventions: inline SVGs from `Icons.tsx` in most components, and decorative emoji in the asset picker and a few PageBuilder labels. Emoji render inconsistently across platforms, ignore the accent colour, and cannot inherit the `.svg-icon` sizing rules. - Icons.tsx: add `IconStar` (filled — it marks a state, not an action) and `IconImage`. - AssetPicker: the three tab labels and the favourite tile badge now use IconFolder / IconStar / IconImage. - PageBuilder: the "Standalone Albums" and "Subpages" headings use the icon set instead of an emoji. - PageBuilder: the layout picker drops its emoji for plain text. An <option> cannot contain markup, so an SVG is impossible there and a decorative glyph is not a substitute. - admin.css: align icon and label in the picker tabs, and swap the favourite badge's text-shadow for drop-shadow, which is what applies to an inline SVG. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): fold PageBuilder's local icons into the shared Icons module (#418) * refactor(admin): fold PageBuilder's local icons into the shared module PageBuilder.tsx carried its own `Icons` object duplicating most of the glyphs already exported by Icons.tsx, with hardcoded sizes and slightly divergent paths. Migrate all 32 call sites to the shared module and delete the local object. Five glyphs had no counterpart and are added to Icons.tsx as 1:1 ports of the local paths: IconX, IconPlus, IconHome, IconCopy, IconImage. The local ExternalLink and Check are dropped rather than ported — both had zero call sites. Two glyphs change shape slightly, which is the point of consolidating: the shared IconCamera includes the viewfinder bump the local copy omitted, and drag handles now use IconGripVertical. IconGripVertical uses the module's square 24x24 viewBox, so `.svg-drag` goes from 12x18 to 18x18 — the old non-square box would letterbox the glyph down to 12x12 and shrink the handle. * fix(admin): resolve icon-module integration after #416 Merging dev brought in #416, which added a second IconImage to Icons.tsx and two <Icons.Camera>/<Icons.Folder> section headers that reference the local Icons object this PR removes. Git merged both cleanly but the result did not type-check. - drop the duplicate IconImage (both copies were byte-identical) - point the two section headers at the imported IconCamera/IconFolder - refresh the SORT_LABELS comment: the icon set is imported now, not declared below --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> * fix(config): allow an empty gallery, guard against a double /api suffix (#421) An empty gallery is now a valid, rendered state instead of a throw: deriveGallery() no longer requires at least one album or subpage, so a deployment with no albums yet renders a bare homepage the owner can fill in via /admin. getConfig() also stops appending /api to an Immich URL that already ends in it, which previously produced .../api/api and broke every upstream request. Includes a restore of the per-album sort test cases, which the branch had lost by being cut before #408/#414. * feat(admin): favicon upload, served from the content volume (#422) Adds a bundled default favicon, an upload widget in admin Settings > General, and a route that serves the icon from the writable content/ volume with a fallback to the bundled default. Raster uploads (PNG/ICO/JPEG) are wrapped in an SVG container; the response carries its own CSP so an uploaded SVG cannot execute script on the origin. The GET route revalidates with an ETag instead of caching immutably, so a newly uploaded icon shows up immediately. Uploads are written via temp file + rename, and a Reset button restores the bundled default. * ci: flag unformatted files in a PR, without blocking it (#424) Prettier is configured as an error rule in eslint.config.mjs but has never run in CI, so part of the tree predates it. A final CI step now diffs against the PR base, runs prettier --list-different over the changed files, and emits a warning annotation per offender plus a job summary. Advisory by design: it never fails the job. Blocking would turn a PR red for merely touching a file that was already unformatted, and normalising the tree in one commit would wreck git blame and conflict with the PRs in flight. Requires fetch-depth: 0, since diffing against the base needs its history. * feat(install): first-run wizard gated by a one-time setup token (#419) Adds /install, a four-step first-run wizard: connect to Immich, optionally pick albums, name the site, finish. It verifies the credentials against the Immich server before writing anything, then writes gallery.yaml, settings.yaml and a content/install.json carrying the Immich credentials and a generated site secret. install.json exists because a running process cannot pick up new env vars — the wizard has to write configuration that takes effect without a restart. getInstallCredentials() merges it under the real environment, so env vars always win and rotation stays a matter of setting one. Both the page and the API routes are gated by a one-time setup token printed to the server log, so a deployment that is reachable before gallery.yaml exists cannot be configured by whoever finds it first. The token is stored in content/.setup-token (0600) rather than a module variable: Next.js bundles the page and each route handler separately, so a module-level token left the page and the API disagreeing inside one process and the wizard stuck on step 1. It is removed once the install completes. The admin password is stored as an scrypt hash using the scheme lib/auth.ts already applies to album passwords; a plaintext ADMIN_PASSWORD env var keeps working. * docs: document the setup wizard, fix the read-only content mount (#425) Quick Start now leads with the /install wizard, with the hand-written YAML route kept alongside it, and a First-Run Setup section covers the setup token, the files the wizard writes, and env-var precedence. Two corrections: both Docker examples mounted content/ as :ro, which silently breaks the wizard, the admin panel and the backup rotation alike — docs/admin-panel.md already said so and the README contradicted it. And nothing documented that content/install.json holds the Immich API key, so a backup of content/ is a backup of credentials. Also adds a Contributors section crediting the people whose work is in the project. * feat(admin): floating save bar pinned to the bottom of the viewport (#426) The save bar was the first, static element inside .admin-main. Since the document itself scrolls, it left the viewport as soon as you scrolled down — editing a subpage section or a settings block far below gave no visible dirty hint and no reachable save button. Replace it with a bottom-pinned floating bar shared by both editors. It only mounts while there is something to act on (unsaved changes, an in-flight save, or a result message), so it never covers content while idle. The success message clears after 5s, which hides the bar again. - new SaveBar component, replacing the duplicated markup in PageBuilder and SettingsEditor - adopt the previously unused .floating-save-bar CSS: slide-in keyframes (carrying translateX(-50%)), dirty border, wrap/gap, mobile variant and a prefers-reduced-motion opt-out; z-index 900 keeps it below modals - .admin-main gains bottom padding so the bar never covers page content - drop the now-unreachable idle hints: the ⌘S hint becomes a button title, the Live Sync note becomes a static line above the settings layout - header "Site" link now bypasses the cache (/?fresh=1), so the preview stays reachable when the bar is hidden Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(admin): themed listbox for the album sort control (#427) The per-album "Photo order" control was a native <select>. Because an <option> cannot contain markup, its choices could not use the admin panel's currentColor SVG set — the reason #415 had to fall back to plain text after dropping the emoji labels. Adds a Listbox component implementing the ARIA combobox/listbox pattern, so options can render a glyph beside their label: - DOM focus stays on the trigger button; the active option is announced through aria-activedescendant, keeping focus management to one element - Keyboard: arrows (clamped at the ends, like a native select), Home/End, Enter/Space to commit, Escape to cancel, Tab commits and moves on, and prefix type-ahead with a repeat-key cycle - Outside dismissal on pointerdown, so a press starting outside closes the popup before the click retargets The sort options now carry an icon each: calendar, arrow-down, arrow-up, an A→Z marker, and the drag glyph for manual — matching the badge the album card already shows. SORT_LABELS stays plain text because the badge feeds it to a title attribute. Closes #417 Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(git): ignore generated design handoff folders * fix(admin): stop the album sort dropdown clipping, and simplify the panel (#428) * fix(admin): render listbox popup in a portal so it escapes modal clipping The sort control's popup was position:absolute inside three clipping ancestors (.album-drawer overflow:hidden > .album-drawer-body overflow-y:auto > .modal-right-column overflow-y:auto), so it was cut off at the bottom of the Edit Album Details modal. z-index could not help: clipping happens before stacking. It also always hung below the trigger, with no flip. Portal the popup to document.body and position it from the trigger's viewport rect, flipping above when there is more room there and capping max-height to the space available so it scrolls internally rather than overflowing. It is dismissed on scroll and resize, since the anchor is only measured on open. The outside-pointerdown handler now also treats the popup as inside; without that the portalled list counts as outside, and a click on an option would close it before the selection commits. * refactor(admin): single-column album details panel The left column spent 1.2fr on a cover thumbnail and three stat rows, two of which (Status, Custom Hero) only restated the form fields opposite them, while the form itself was squeezed into 1.8fr behind a second nested scroller. Stack the drawer in one column instead: cover as a banner, then the form at full width, with the UUID moved into the footer. The body is now the only scroll container, which also removes one of the ancestors that was clipping the sort popup. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> * fix(admin): give the portalled listbox its theme back, lock the page behind modals (#429) Two defects in the album editor. The sort listbox popup painted transparent. Every --admin-* variable is scoped to .admin-layout, and since the popup moved into document.body it sits outside that subtree, so background/border/text all resolved to nothing. It now carries its own copy of the palette in both colour schemes, plus the font it no longer inherits. Scrolling inside a modal also moved the page behind it. No admin modal ever locked body scroll: the overlay covers the page but does not absorb wheel events, so a scroll starting on the backdrop — or continuing past the end of the modal's own scroller — reaches the document. overscroll-behavior cannot cover that case on its own, because it only applies to scroll containers and the backdrop is not one. useScrollLock freezes body while a modal is open and compensates for the width the scrollbar gives up, so nothing shifts underneath. Each lock restores the inline value it found, which makes nesting work without a counter — a picker opened from the drawer restores the drawer's hidden state instead of clearing it. Applied to both drawers and all four picker modals, which share the defect. overscroll-behavior: contain on the scrollers stops the chaining they can handle themselves. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com> * fix(security): allow unsafe-eval in CSP script-src during dev mode * feat(journal): add Journal Studio with split-screen editor, live preview and dedicated routes * fix(build): separate client parser from server journal-service and fix build type errors * fix(journal): Fotos rendern, Layout und Lightbox-Steuerung korrigieren Fünf unabhängige Fehler in der öffentlichen Journal- und Essay-Ansicht: * Foto-Blöcke wurden nie angezeigt. EssayView löst ein Foto über PhotoItem.id auf, und das sind verschlüsselte Tokens — die Blöcke aus dem Markdown tragen aber rohe Asset-UUIDs. Jede Zuordnung lief ins Leere, und nicht auflösbare Blöcke werden still verworfen. Die IDs werden jetzt serverseitig übersetzt; damit verschwinden nebenbei die rohen UUIDs aus dem Client-Payload, die dort laut Projektregel nie auftauchen dürfen. Nicht auflösbare Referenzen werden geloggt. * Überschriften standen weiter links als der Fließtext. Jeder Block hatte einzeln `max-width: 68ch`, und `ch` ist relativ zur Schrift des Elements — die Serif-Überschrift ergab eine breitere Spalte. Ersetzt durch eine gemeinsame, font-unabhängige `--essay-measure`. * Fullbleed-Fotos bluteten nur nach links aus: `.essay-figure` ist `width: 100%`, wodurch die Box überbestimmt ist und der negative rechte Margin verworfen wird. * Foto-Paare stellten beide Bilder gleich breit dar, wodurch ein Hochformat neben einem Querformat doppelt so hoch wurde. Jetzt eine Justified-Reihe: Breite proportional zum Seitenverhältnis, dadurch exakt gleiche Höhen ohne Beschnitt. * Die Lightbox hatte im Journal keine Tastatursteuerung und keine Scroll-Sperre — beides lag in PhotoGrid, also nur im Album-Raster. Verlagert in die Lightbox selbst, der doppelte Handler in PhotoGrid entfernt (sonst wäre pro Pfeildruck zwei Bilder weitergesprungen). Zusätzlich sind Proofing-Herzen und das EXIF-Panel im redaktionellen Modus abschaltbar und im Journal aus: Client-Proofing ist ein Übergabe-Workflow für Alben, keine Funktion einer Reportage. Auf der Übersicht wurde der Untertitel doppelt gerendert, weil extractExcerpt() auf ihn zurückfällt. * feat(admin): eigene URLs für alle Bereiche und überarbeiteter Journal Studio Das Panel war eine einzige Client-Komponente, die ihre Tabs über useState umschaltet: keine Route pro Bereich, kein Deep-Link, kein Zurück-Button, und nach jedem Reload landete man wieder auf "Pages". Auch der Journal-Editor hatte keine eigene URL. Jetzt sieben echte Routen (/admin, /admin/pages, /admin/journal, /admin/journal/<slug>, /admin/settings, /admin/settings/<section>, /admin/analytics). Die Shell mit Auth-Prüfung und Kopfzeile sitzt im Layout und umschließt children — so bleibt die Session-Prüfung über Routenwechsel montiert, statt bei jedem Tab-Wechsel neu zu laufen und den Spinner aufblitzen zu lassen. Unbekannte Settings-Sections fallen auf General zurück. Im selben Zug der Journal Studio, der die Routing-Änderung ohnehin berührt: * Alle Eingabefelder nutzten die Klasse `admin-input`, die in keinem CSS definiert war — sie fielen auf Browser-Defaults zurück. Jetzt gestylt, gescoped, damit der generische Name nicht ins übrige Panel leckt. * Der Split View ist per Divider verschiebbar (Maus, Tastatur, Doppelklick zum Zurücksetzen), Breite in localStorage. * Das Studio bricht aus der 1120px-Spalte aus, die Preview hat Platz. * Die Preview zeigte für jedes Foto fest 3:2 und log damit über das Layout der veröffentlichten Seite; die echten Verhältnisse werden jetzt an den Thumbnails gemessen. * Blöcke mit alten positionsbasierten Foto-Referenzen werden markiert — die lassen sich auf einer eigenständigen Journal-Seite nicht auflösen und verschwanden bisher stillschweigend. * Blocktyp-Chips als gemeinsame Komponente, monochrom und per Icon unterschieden statt in einer eigenen Blau/Lila/Orange-Palette, die sonst nirgends im Panel vorkommt. * Emojis raus, SVG-Icons rein. * fix(admin): Designsystem-Lücken im Panel schließen Eine systematische Suche nach Klassen, die im TSX benutzt, aber in keinem CSS definiert sind, hat vier Stellen mit demselben Muster gefunden: * `admin-btn-secondary` und `admin-btn-danger` existierten nicht. Sämtliche Löschen-Buttons sahen aus wie normale Buttons — keine Warnwirkung. Als `.admin-btn.admin-btn-danger` geschrieben, weil die Varianten mit den Größenklassen kombiniert werden, die weiter unten ihren eigenen Hintergrund setzen. * `page-progress-fill` fehlte: die Balken im Analytics-Panel waren leere Rinnen, der Wert unsichtbar. Ebenso `analytics-empty` und `admin-loading-container`. * `subpage-drawer-section`, `subpage-drawer-title-group` und `input-with-icon` im PageBuilder waren wirkungslos und teils mit Inline-Styles notdürftig kompensiert. * `grid-card-preview` fehlte, wodurch alle Layout-Vorschauen auf Höhe null kollabierten. Nur "Showcase" war sichtbar — und das aus Versehen, weil sein Tile `hero-tile` hieß und damit die `aspect-ratio` einer fremden PageBuilder-Klasse erbte. Umbenannt. Dazu die Theme-Vorschauen, die praktisch identisch aussahen: alle sieben zeigten dieselben drei quadratischen Kacheln, einziger Unterschied war die Hintergrundfarbe. Sie spiegeln jetzt die echten Preset-Daten aus lib/config/theme.ts — Schriftcharakter, Eckradius, Rasterdichte, Passepartout bzw. Schatten. Die Kopfzeile richtet sich an einer gemeinsamen Steuerhöhe aus. Der "Site"-Link war höher als die Buttons daneben: `.admin-btn` hatte keine explizite line-height, und <button> bekommt box-sizing: border-box vom Browser, <a> nicht. Die Statusanzeige setzte weder Schriftfamilie noch -größe und fiel auf den Browser-Default zurück — sie war nie Teil des Designsystems. Jetzt gleiche Höhe und Typografie, Pillenform als Zustandsanzeige, Trenner zur Aktionsgruppe. Das dauerhafte Pulsieren des grünen Punkts entfällt; Animation bleibt den Zuständen vorbehalten, die Aufmerksamkeit brauchen. Restliche Emojis durch SVG-Icons ersetzt. * feat(admin): add scroll-to-top toggle and SVG arrow The back-to-top button was always on and drew its arrow with the ↑ text character. Add a `scrollToTop` setting (General section in the admin panel, defaults to on so existing sites are unaffected) and replace the glyph with a stroked SVG that inherits currentColor across all presets. Scroll handling is now rAF-throttled, and prefers-reduced-motion turns off both the hover lift and the smooth scroll. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * security(journal): escape author HTML instead of filtering it CodeQL flags 26 high-severity alerts on the release PR; the bulk of them point at sanitizeHtml(), a denylist of three regexes whose output goes into dangerouslySetInnerHTML. I reproduced the bypasses before changing anything — all four pass the old filter: <img src=x onerror=alert(1)> unquoted handler, regex wants quotes <img src=x onerror='alert(1)'> single quotes, same reason <svg onload=alert(1)> not a <script> tag javasjavascript:cript:alert(1) one-pass replace, the rest recombines Plus an attribute breakout in the link renderer, which interpolated the URL into href="${url}" unescaped: [x](" onmouseover=alert(1) x=") -> <a href="" onmouseover=alert(1" ...> Replaced with escaping. Every `&<>"'` in author text becomes an entity before any markdown rule runs, so the only tags in the output are the ones renderInlineMarkdown builds itself and a URL cannot leave its attribute. Link schemes are now an allowlist (http, https, mailto, tel, relative, anchor); anything else renders as plain text. The serializer needed decodeHtmlEntities to match: without it a save would write `&lt;` into the Markdown file and the next parse would escape the `&` again, corrupting the text further on every round trip. A test covers parse -> serialize -> parse stability. Two existing tests asserted the old behaviour and were rewritten rather than deleted: one expected the script tag to be *removed* from the output, the other expected the substring "onerror" to be absent. Both now assert the property that matters — that no tag can form — because `onerror` surviving as inert text is fine. Exploitation required admin access either way: journal and essay text comes from the studio or from content/*.md. This removes the weakness, it does not close an open door. * fix(journal): contain file paths, fix frontmatter escaping, defuse two regexes Follow-up to the CodeQL findings on release PR #432. I went through all 23 alerts individually; this addresses the ones that are worth addressing and documents the ones that are not. Path containment (12 alerts, all false positives). Every path built from a slug goes through isValidSlug(), a strict `/^[a-zA-Z0-9_-]+$/` allowlist — verified against `../../etc/passwd`, `foo/../../bar`, `a/b`, `..` and friends, all rejected. CodeQL cannot see it because the check lives in another module. Added a containedPath() helper that resolves the path and refuses anything landing outside the content directory: a second lock on a door that was already locked, and a barrier the analysis can follow. Also removed the dead `slug.endsWith('.md')` branches — isValidSlug rejects dots, so they could never be taken. Frontmatter escaping (1 alert, a real bug). The serializer escaped `"` but not `\`, and the parser never unescaped anything. A title containing either character gained a backslash on every save/load cycle: Path C:\Users "quoted" -> Path C:\\Users \"quoted\" -> ... Escaping now covers the backslash first and the parser undoes both. A round trip test covers quotes, backslashes, colons and apostrophes. Two of three ReDoS regexes (2 alerts). The heading pattern had `\s+` next to `(.+)`, which overlap, so the engine tried every split of the whitespace run before failing; it is `[ \t]+` and `(\S.*)` now. The quote author pattern wrapped a lazy group around an optional group — the quadratic case — and is an index split on the first separator now. The third regex, the bold/italic pass, is deliberately left alone. Rewriting it with a negated class removes the backtracking but breaks nesting: `**bold *and italic* here**` renders as `*<em>bold </em>and italic<em> here</em>*`. The input is Markdown from an authenticated admin, never a visitor, so the worst case is an author slowing down their own page. The comment in the code says so. Not addressed: 5 js/insufficient-password-hash alerts. They ask for a slow KDF where the code uses SHA-256/HMAC — correct in general, but the admin password comes from an environment variable and is never stored, so a stronger KDF protects nothing that is not already in plaintext in the environment. 399 unit tests pass (18 new), build and tsc clean. * fix(journal): split the quote author by scanning, not by pattern Cleaning up after myself. #439 replaced the quote author regex `/^(.*?)(?:\s+--\s+(.+))?$/` — a lazy group around an optional one, the quadratic case — with `/\s+--\s+/`, and CodeQL promptly flagged the replacement for the same reason. One reported pattern traded for another. splitQuoteAuthor() scans for the first `--` that has whitespace on both sides. Linear, and it needs no reasoning about the regex engine at all. Behaviour is identical to the original regex, checked case by case against it: separator, no separator, several separators, tabs, wide gaps, `a--b` without spaces, leading and trailing separators, empty string. All nine are covered by tests, plus one asserting it stays fast on a 50k whitespace run. * security(admin): derive the session signing key with scrypt getSigningKey() ran the admin password through a single SHA-256 digest. It is key derivation rather than password storage, so it was never a stored-hash problem — but if the derived key ever leaked, one fast hash makes recovering the password by brute force cheap. CodeQL flags it as js/insufficient-password-hash and, for this particular alert, has a point. scrypt now. Two details that matter: The salt has to be stable. A random salt would produce a different key on every call and invalidate every session; it is derived from AUTH_SECRET, which is deployment-specific. Verified across separate processes: same inputs produce a verifying token, so a restart or redeploy does not log everyone out. The result is cached for the process lifetime. scrypt is deliberately slow and getSigningKey() runs on every admin request — deriving per call would add ~24ms to each one. The cache key is a digest of secret plus password, so a rotation misses the cache and derives again, and no extra plaintext copy of the password is kept around. Measured: first derivation 24ms, subsequent calls 0.12ms. Password change and secret change both invalidate an existing token, checked in separate processes. Note the one-time effect: existing admin sessions are invalidated by the change in derivation, so everyone logs in once more. * security(admin): key the signing-key cache on its inputs, not a digest #441 removed the SHA-256 digest of the admin password from the key derivation and introduced a new one three lines above it, as the cache key. Same rule, same file: CodeQL reported it immediately. The comment justifying it was wrong too. It claimed no second plaintext copy of the password was retained, while building the digest input allocates exactly that in order to hash it. The cache now holds the two input strings and compares them directly. They are the same objects the env and install caches already hold, so nothing extra is retained, and no fast hash of the password exists in memory for the life of the process. Re-verified after the change, in separate processes: a token from one process verifies in another with the same inputs, a changed password or secret rejects it, first derivation 24ms, cached calls 0.001ms. That leaves scrypt as the only place the password is hashed here. The two HMACs further down operate on the derived key and on token data, not on the password; the constant-time comparison in verifyAdminPassword is the previously dismissed one. --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
2026-08-14 16:55:07 +02:00
import SaveBar from './SaveBar';
release: v0.11.0 (#459) Ships `dev` as **v0.11.0**. `main` contains nothing that `dev` does not, so this is a clean sync. ## Headline changes since v0.10.0 - **Journal & Journal Studio** — photo essays at `/journal`, split-screen block editor with live preview, drafts, per-entry passwords, cover images - **First-run setup wizard at `/install`** — configure a fresh deployment from the browser; credentials are verified against Immich before anything is written, and the wizard is gated by a one-time token - **About page editor and toggle** in the admin panel - **Per-album photo order** independent of Immich, with a drag & drop editor - **Custom favicon upload** - **Experimental portfolio features** — justified grid, `cover` hero, unlisted subpages, per-album grid overrides, cover focal points, external nav links - **Security** — asset tokens length-capped before decoding (#423), journal author markdown escaped rather than filtered, journal file paths contained, admin session key derived with scrypt (#432), Next.js 16.3.0 for CVE-2025-13465 - **Fixed** — client proofing honours its own configuration again (#454); journal photo rendering (#432) Full detail in [CHANGELOG.md](CHANGELOG.md#0110--2026-08-15). ## Verified `npx tsc --noEmit` clean · `npx vitest run` 435 tests pass · `npm run build` succeeds · lint 0 errors · `prettier --check` clean · local `docker build` of the release tree. ## After merge Tag `v0.11.0` on `main` and publish the release — that triggers `docker-publish.yml`, which pushes the image and moves `latest`. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
2026-08-15 09:09:18 +02:00
// Direct import from the theme module, not from '@/lib/config': the config
// index pulls in `fs` and cannot be bundled into a client component.
import { DEFAULT_PRESET } from '@/lib/config/theme';
import { resolveExifDisplay, resolveWatermarkOpacity } from '@/lib/config/schema';
import { SUPPORTED_LOCALES } from '@/lib/i18n';
interface Settings {
title?: string;
subtitle?: string;
lang?: string;
sitePassword?: string;
mode?: 'light' | 'dark' | 'auto';
exifOnHover?: boolean;
exif?: {
camera?: boolean;
settings?: boolean;
location?: boolean;
caption?: boolean;
};
map?: boolean;
transitions?: boolean;
release: v0.11.0 — journal fixes, admin URLs, design system cleanup (#432) * fix(screenshots): sharp-Typen fuer 0.34 und 0.35 gleichzeitig (#410) sharp 0.35 ist von `export =` auf ESM umgestellt: der Modul-Namespace ist nicht mehr aufrufbar, die Factory sitzt unter .default. Der Type-Check brach damit in scripts/screenshots.ts weg, sobald der Next-Bump (#402) sharp von 0.34.5 auf 0.35.3 mitzieht -- sharp ist hier keine deklarierte Dependency, sondern kommt ueber Next mit. Die Form wird jetzt aus dem installierten Paket abgeleitet statt festgeschrieben, zur Laufzeit wie im Typ. Geprueft mit beiden Versionen: tsc laeuft mit 0.34.5 und mit 0.35.3 fehlerfrei durch. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(deps): bump the nextjs group across 1 directory with 2 updates (#402) Bumps the nextjs group with 2 updates in the / directory: [next](https://github.com/vercel/next.js) and [eslint-config-next](https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next). Updates `next` from 16.2.12 to 16.3.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/compare/v16.2.12...v16.3.0) Updates `eslint-config-next` from 16.2.12 to 16.3.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/commits/v16.3.0/packages/eslint-config-next) --- updated-dependencies: - dependency-name: eslint-config-next dependency-version: 16.3.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: nextjs - dependency-name: next dependency-version: 16.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nextjs ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps-dev): bump prettier from 3.8.3 to 3.9.6 (#405) Bumps [prettier](https://github.com/prettier/prettier) from 3.8.3 to 3.9.6. - [Release notes](https://github.com/prettier/prettier/releases) - [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md) - [Commits](https://github.com/prettier/prettier/compare/3.8.3...3.9.6) --- updated-dependencies: - dependency-name: prettier dependency-version: 3.9.6 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * docs(changelog): Unreleased-Sektion fuer die Bumps nach v0.10.0 (#413) Die Dependency-PRs sind nach dem Release auf dev gelandet, teils auch auf main. Ohne Eintrag waeren sie beim naechsten Release unsichtbar -- inklusive Next 16.3.0, das CVE-2025-13465 mitbringt. Ausserdem im 0.10.0-Abschnitt nachgetragen, dass der Trivy-Scan bis #409 nie gelaufen ist. Der Fix steckt im Tag v0.10.0, fehlte aber in der Aufzaehlung -- und "Images werden bei jedem Publish gescannt" stand im Changelog, waehrend der Job im Action-Setup abbrach. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(gallery): per-album sort order, independent of Immich (#408) (#414) Album order was dictated entirely by Immich: getAlbum() sorted by the album's own asc/desc flag, so a Folio album always mirrored the archive. A curated series has a narrative order that has nothing to do with capture time, and changing the Immich album's sort to fit the website changes it for the archive too. Adds an optional per-album `sort` in gallery.yaml, editable in /admin, defaulting to today's behaviour so every existing config is unchanged: immich (default) | newest | oldest | filename | manual `manual` is a pinned *prefix*: `assetOrder` lists only the photos placed by hand, everything else follows in the album's Immich order. A full permutation of a 2,000-photo album would be ~80 KB of UUIDs in a file that is rewritten and copied to content/.backups/ on every admin save. It also makes drift fall out for free — photos removed in Immich never match, new ones land in the tail rather than being hidden. Sorting is applied after the cache read, not before the cache write, so the LRU keeps one canonical Immich-ordered copy per album. That avoids putting the mode in the cache key, lets a config change take effect without depending on invalidation, and keeps the stale-serving path correct. cache.get() returns the stored object by reference, so withSort() returns a shallow clone with a new array — sorting in place would reorder the shared entry, and under request coalescing every concurrent caller would be sorting the same array. Also fixes a prerequisite bug: /api/admin/albums/[albumId]/assets read album.assets from GET /albums/:id, which Immich 3.x no longer populates (lib/immich.ts:507). The hero picker's "This Album" tab returned nothing and threw outright when the key was absent. It now goes through the client's paginated metadata search, with ?types=all to opt videos in for the reorder editor. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): drop decorative emoji from the sort select labels (#415) An <option> cannot contain markup, so the SVG set in Icons is not reachable there — but a decorative emoji is not a substitute for it. Plain text instead; the album card badge already uses a real icon. The remaining emoji in the admin panel (asset picker tabs, section headings, layout picker options) predate this branch and are left for a separate cleanup. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): replace emoji icons with the shared SVG icon set (#416) The admin panel mixed two icon conventions: inline SVGs from `Icons.tsx` in most components, and decorative emoji in the asset picker and a few PageBuilder labels. Emoji render inconsistently across platforms, ignore the accent colour, and cannot inherit the `.svg-icon` sizing rules. - Icons.tsx: add `IconStar` (filled — it marks a state, not an action) and `IconImage`. - AssetPicker: the three tab labels and the favourite tile badge now use IconFolder / IconStar / IconImage. - PageBuilder: the "Standalone Albums" and "Subpages" headings use the icon set instead of an emoji. - PageBuilder: the layout picker drops its emoji for plain text. An <option> cannot contain markup, so an SVG is impossible there and a decorative glyph is not a substitute. - admin.css: align icon and label in the picker tabs, and swap the favourite badge's text-shadow for drop-shadow, which is what applies to an inline SVG. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): fold PageBuilder's local icons into the shared Icons module (#418) * refactor(admin): fold PageBuilder's local icons into the shared module PageBuilder.tsx carried its own `Icons` object duplicating most of the glyphs already exported by Icons.tsx, with hardcoded sizes and slightly divergent paths. Migrate all 32 call sites to the shared module and delete the local object. Five glyphs had no counterpart and are added to Icons.tsx as 1:1 ports of the local paths: IconX, IconPlus, IconHome, IconCopy, IconImage. The local ExternalLink and Check are dropped rather than ported — both had zero call sites. Two glyphs change shape slightly, which is the point of consolidating: the shared IconCamera includes the viewfinder bump the local copy omitted, and drag handles now use IconGripVertical. IconGripVertical uses the module's square 24x24 viewBox, so `.svg-drag` goes from 12x18 to 18x18 — the old non-square box would letterbox the glyph down to 12x12 and shrink the handle. * fix(admin): resolve icon-module integration after #416 Merging dev brought in #416, which added a second IconImage to Icons.tsx and two <Icons.Camera>/<Icons.Folder> section headers that reference the local Icons object this PR removes. Git merged both cleanly but the result did not type-check. - drop the duplicate IconImage (both copies were byte-identical) - point the two section headers at the imported IconCamera/IconFolder - refresh the SORT_LABELS comment: the icon set is imported now, not declared below --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> * fix(config): allow an empty gallery, guard against a double /api suffix (#421) An empty gallery is now a valid, rendered state instead of a throw: deriveGallery() no longer requires at least one album or subpage, so a deployment with no albums yet renders a bare homepage the owner can fill in via /admin. getConfig() also stops appending /api to an Immich URL that already ends in it, which previously produced .../api/api and broke every upstream request. Includes a restore of the per-album sort test cases, which the branch had lost by being cut before #408/#414. * feat(admin): favicon upload, served from the content volume (#422) Adds a bundled default favicon, an upload widget in admin Settings > General, and a route that serves the icon from the writable content/ volume with a fallback to the bundled default. Raster uploads (PNG/ICO/JPEG) are wrapped in an SVG container; the response carries its own CSP so an uploaded SVG cannot execute script on the origin. The GET route revalidates with an ETag instead of caching immutably, so a newly uploaded icon shows up immediately. Uploads are written via temp file + rename, and a Reset button restores the bundled default. * ci: flag unformatted files in a PR, without blocking it (#424) Prettier is configured as an error rule in eslint.config.mjs but has never run in CI, so part of the tree predates it. A final CI step now diffs against the PR base, runs prettier --list-different over the changed files, and emits a warning annotation per offender plus a job summary. Advisory by design: it never fails the job. Blocking would turn a PR red for merely touching a file that was already unformatted, and normalising the tree in one commit would wreck git blame and conflict with the PRs in flight. Requires fetch-depth: 0, since diffing against the base needs its history. * feat(install): first-run wizard gated by a one-time setup token (#419) Adds /install, a four-step first-run wizard: connect to Immich, optionally pick albums, name the site, finish. It verifies the credentials against the Immich server before writing anything, then writes gallery.yaml, settings.yaml and a content/install.json carrying the Immich credentials and a generated site secret. install.json exists because a running process cannot pick up new env vars — the wizard has to write configuration that takes effect without a restart. getInstallCredentials() merges it under the real environment, so env vars always win and rotation stays a matter of setting one. Both the page and the API routes are gated by a one-time setup token printed to the server log, so a deployment that is reachable before gallery.yaml exists cannot be configured by whoever finds it first. The token is stored in content/.setup-token (0600) rather than a module variable: Next.js bundles the page and each route handler separately, so a module-level token left the page and the API disagreeing inside one process and the wizard stuck on step 1. It is removed once the install completes. The admin password is stored as an scrypt hash using the scheme lib/auth.ts already applies to album passwords; a plaintext ADMIN_PASSWORD env var keeps working. * docs: document the setup wizard, fix the read-only content mount (#425) Quick Start now leads with the /install wizard, with the hand-written YAML route kept alongside it, and a First-Run Setup section covers the setup token, the files the wizard writes, and env-var precedence. Two corrections: both Docker examples mounted content/ as :ro, which silently breaks the wizard, the admin panel and the backup rotation alike — docs/admin-panel.md already said so and the README contradicted it. And nothing documented that content/install.json holds the Immich API key, so a backup of content/ is a backup of credentials. Also adds a Contributors section crediting the people whose work is in the project. * feat(admin): floating save bar pinned to the bottom of the viewport (#426) The save bar was the first, static element inside .admin-main. Since the document itself scrolls, it left the viewport as soon as you scrolled down — editing a subpage section or a settings block far below gave no visible dirty hint and no reachable save button. Replace it with a bottom-pinned floating bar shared by both editors. It only mounts while there is something to act on (unsaved changes, an in-flight save, or a result message), so it never covers content while idle. The success message clears after 5s, which hides the bar again. - new SaveBar component, replacing the duplicated markup in PageBuilder and SettingsEditor - adopt the previously unused .floating-save-bar CSS: slide-in keyframes (carrying translateX(-50%)), dirty border, wrap/gap, mobile variant and a prefers-reduced-motion opt-out; z-index 900 keeps it below modals - .admin-main gains bottom padding so the bar never covers page content - drop the now-unreachable idle hints: the ⌘S hint becomes a button title, the Live Sync note becomes a static line above the settings layout - header "Site" link now bypasses the cache (/?fresh=1), so the preview stays reachable when the bar is hidden Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(admin): themed listbox for the album sort control (#427) The per-album "Photo order" control was a native <select>. Because an <option> cannot contain markup, its choices could not use the admin panel's currentColor SVG set — the reason #415 had to fall back to plain text after dropping the emoji labels. Adds a Listbox component implementing the ARIA combobox/listbox pattern, so options can render a glyph beside their label: - DOM focus stays on the trigger button; the active option is announced through aria-activedescendant, keeping focus management to one element - Keyboard: arrows (clamped at the ends, like a native select), Home/End, Enter/Space to commit, Escape to cancel, Tab commits and moves on, and prefix type-ahead with a repeat-key cycle - Outside dismissal on pointerdown, so a press starting outside closes the popup before the click retargets The sort options now carry an icon each: calendar, arrow-down, arrow-up, an A→Z marker, and the drag glyph for manual — matching the badge the album card already shows. SORT_LABELS stays plain text because the badge feeds it to a title attribute. Closes #417 Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(git): ignore generated design handoff folders * fix(admin): stop the album sort dropdown clipping, and simplify the panel (#428) * fix(admin): render listbox popup in a portal so it escapes modal clipping The sort control's popup was position:absolute inside three clipping ancestors (.album-drawer overflow:hidden > .album-drawer-body overflow-y:auto > .modal-right-column overflow-y:auto), so it was cut off at the bottom of the Edit Album Details modal. z-index could not help: clipping happens before stacking. It also always hung below the trigger, with no flip. Portal the popup to document.body and position it from the trigger's viewport rect, flipping above when there is more room there and capping max-height to the space available so it scrolls internally rather than overflowing. It is dismissed on scroll and resize, since the anchor is only measured on open. The outside-pointerdown handler now also treats the popup as inside; without that the portalled list counts as outside, and a click on an option would close it before the selection commits. * refactor(admin): single-column album details panel The left column spent 1.2fr on a cover thumbnail and three stat rows, two of which (Status, Custom Hero) only restated the form fields opposite them, while the form itself was squeezed into 1.8fr behind a second nested scroller. Stack the drawer in one column instead: cover as a banner, then the form at full width, with the UUID moved into the footer. The body is now the only scroll container, which also removes one of the ancestors that was clipping the sort popup. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> * fix(admin): give the portalled listbox its theme back, lock the page behind modals (#429) Two defects in the album editor. The sort listbox popup painted transparent. Every --admin-* variable is scoped to .admin-layout, and since the popup moved into document.body it sits outside that subtree, so background/border/text all resolved to nothing. It now carries its own copy of the palette in both colour schemes, plus the font it no longer inherits. Scrolling inside a modal also moved the page behind it. No admin modal ever locked body scroll: the overlay covers the page but does not absorb wheel events, so a scroll starting on the backdrop — or continuing past the end of the modal's own scroller — reaches the document. overscroll-behavior cannot cover that case on its own, because it only applies to scroll containers and the backdrop is not one. useScrollLock freezes body while a modal is open and compensates for the width the scrollbar gives up, so nothing shifts underneath. Each lock restores the inline value it found, which makes nesting work without a counter — a picker opened from the drawer restores the drawer's hidden state instead of clearing it. Applied to both drawers and all four picker modals, which share the defect. overscroll-behavior: contain on the scrollers stops the chaining they can handle themselves. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com> * fix(security): allow unsafe-eval in CSP script-src during dev mode * feat(journal): add Journal Studio with split-screen editor, live preview and dedicated routes * fix(build): separate client parser from server journal-service and fix build type errors * fix(journal): Fotos rendern, Layout und Lightbox-Steuerung korrigieren Fünf unabhängige Fehler in der öffentlichen Journal- und Essay-Ansicht: * Foto-Blöcke wurden nie angezeigt. EssayView löst ein Foto über PhotoItem.id auf, und das sind verschlüsselte Tokens — die Blöcke aus dem Markdown tragen aber rohe Asset-UUIDs. Jede Zuordnung lief ins Leere, und nicht auflösbare Blöcke werden still verworfen. Die IDs werden jetzt serverseitig übersetzt; damit verschwinden nebenbei die rohen UUIDs aus dem Client-Payload, die dort laut Projektregel nie auftauchen dürfen. Nicht auflösbare Referenzen werden geloggt. * Überschriften standen weiter links als der Fließtext. Jeder Block hatte einzeln `max-width: 68ch`, und `ch` ist relativ zur Schrift des Elements — die Serif-Überschrift ergab eine breitere Spalte. Ersetzt durch eine gemeinsame, font-unabhängige `--essay-measure`. * Fullbleed-Fotos bluteten nur nach links aus: `.essay-figure` ist `width: 100%`, wodurch die Box überbestimmt ist und der negative rechte Margin verworfen wird. * Foto-Paare stellten beide Bilder gleich breit dar, wodurch ein Hochformat neben einem Querformat doppelt so hoch wurde. Jetzt eine Justified-Reihe: Breite proportional zum Seitenverhältnis, dadurch exakt gleiche Höhen ohne Beschnitt. * Die Lightbox hatte im Journal keine Tastatursteuerung und keine Scroll-Sperre — beides lag in PhotoGrid, also nur im Album-Raster. Verlagert in die Lightbox selbst, der doppelte Handler in PhotoGrid entfernt (sonst wäre pro Pfeildruck zwei Bilder weitergesprungen). Zusätzlich sind Proofing-Herzen und das EXIF-Panel im redaktionellen Modus abschaltbar und im Journal aus: Client-Proofing ist ein Übergabe-Workflow für Alben, keine Funktion einer Reportage. Auf der Übersicht wurde der Untertitel doppelt gerendert, weil extractExcerpt() auf ihn zurückfällt. * feat(admin): eigene URLs für alle Bereiche und überarbeiteter Journal Studio Das Panel war eine einzige Client-Komponente, die ihre Tabs über useState umschaltet: keine Route pro Bereich, kein Deep-Link, kein Zurück-Button, und nach jedem Reload landete man wieder auf "Pages". Auch der Journal-Editor hatte keine eigene URL. Jetzt sieben echte Routen (/admin, /admin/pages, /admin/journal, /admin/journal/<slug>, /admin/settings, /admin/settings/<section>, /admin/analytics). Die Shell mit Auth-Prüfung und Kopfzeile sitzt im Layout und umschließt children — so bleibt die Session-Prüfung über Routenwechsel montiert, statt bei jedem Tab-Wechsel neu zu laufen und den Spinner aufblitzen zu lassen. Unbekannte Settings-Sections fallen auf General zurück. Im selben Zug der Journal Studio, der die Routing-Änderung ohnehin berührt: * Alle Eingabefelder nutzten die Klasse `admin-input`, die in keinem CSS definiert war — sie fielen auf Browser-Defaults zurück. Jetzt gestylt, gescoped, damit der generische Name nicht ins übrige Panel leckt. * Der Split View ist per Divider verschiebbar (Maus, Tastatur, Doppelklick zum Zurücksetzen), Breite in localStorage. * Das Studio bricht aus der 1120px-Spalte aus, die Preview hat Platz. * Die Preview zeigte für jedes Foto fest 3:2 und log damit über das Layout der veröffentlichten Seite; die echten Verhältnisse werden jetzt an den Thumbnails gemessen. * Blöcke mit alten positionsbasierten Foto-Referenzen werden markiert — die lassen sich auf einer eigenständigen Journal-Seite nicht auflösen und verschwanden bisher stillschweigend. * Blocktyp-Chips als gemeinsame Komponente, monochrom und per Icon unterschieden statt in einer eigenen Blau/Lila/Orange-Palette, die sonst nirgends im Panel vorkommt. * Emojis raus, SVG-Icons rein. * fix(admin): Designsystem-Lücken im Panel schließen Eine systematische Suche nach Klassen, die im TSX benutzt, aber in keinem CSS definiert sind, hat vier Stellen mit demselben Muster gefunden: * `admin-btn-secondary` und `admin-btn-danger` existierten nicht. Sämtliche Löschen-Buttons sahen aus wie normale Buttons — keine Warnwirkung. Als `.admin-btn.admin-btn-danger` geschrieben, weil die Varianten mit den Größenklassen kombiniert werden, die weiter unten ihren eigenen Hintergrund setzen. * `page-progress-fill` fehlte: die Balken im Analytics-Panel waren leere Rinnen, der Wert unsichtbar. Ebenso `analytics-empty` und `admin-loading-container`. * `subpage-drawer-section`, `subpage-drawer-title-group` und `input-with-icon` im PageBuilder waren wirkungslos und teils mit Inline-Styles notdürftig kompensiert. * `grid-card-preview` fehlte, wodurch alle Layout-Vorschauen auf Höhe null kollabierten. Nur "Showcase" war sichtbar — und das aus Versehen, weil sein Tile `hero-tile` hieß und damit die `aspect-ratio` einer fremden PageBuilder-Klasse erbte. Umbenannt. Dazu die Theme-Vorschauen, die praktisch identisch aussahen: alle sieben zeigten dieselben drei quadratischen Kacheln, einziger Unterschied war die Hintergrundfarbe. Sie spiegeln jetzt die echten Preset-Daten aus lib/config/theme.ts — Schriftcharakter, Eckradius, Rasterdichte, Passepartout bzw. Schatten. Die Kopfzeile richtet sich an einer gemeinsamen Steuerhöhe aus. Der "Site"-Link war höher als die Buttons daneben: `.admin-btn` hatte keine explizite line-height, und <button> bekommt box-sizing: border-box vom Browser, <a> nicht. Die Statusanzeige setzte weder Schriftfamilie noch -größe und fiel auf den Browser-Default zurück — sie war nie Teil des Designsystems. Jetzt gleiche Höhe und Typografie, Pillenform als Zustandsanzeige, Trenner zur Aktionsgruppe. Das dauerhafte Pulsieren des grünen Punkts entfällt; Animation bleibt den Zuständen vorbehalten, die Aufmerksamkeit brauchen. Restliche Emojis durch SVG-Icons ersetzt. * feat(admin): add scroll-to-top toggle and SVG arrow The back-to-top button was always on and drew its arrow with the ↑ text character. Add a `scrollToTop` setting (General section in the admin panel, defaults to on so existing sites are unaffected) and replace the glyph with a stroked SVG that inherits currentColor across all presets. Scroll handling is now rAF-throttled, and prefers-reduced-motion turns off both the hover lift and the smooth scroll. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * security(journal): escape author HTML instead of filtering it CodeQL flags 26 high-severity alerts on the release PR; the bulk of them point at sanitizeHtml(), a denylist of three regexes whose output goes into dangerouslySetInnerHTML. I reproduced the bypasses before changing anything — all four pass the old filter: <img src=x onerror=alert(1)> unquoted handler, regex wants quotes <img src=x onerror='alert(1)'> single quotes, same reason <svg onload=alert(1)> not a <script> tag javasjavascript:cript:alert(1) one-pass replace, the rest recombines Plus an attribute breakout in the link renderer, which interpolated the URL into href="${url}" unescaped: [x](" onmouseover=alert(1) x=") -> <a href="" onmouseover=alert(1" ...> Replaced with escaping. Every `&<>"'` in author text becomes an entity before any markdown rule runs, so the only tags in the output are the ones renderInlineMarkdown builds itself and a URL cannot leave its attribute. Link schemes are now an allowlist (http, https, mailto, tel, relative, anchor); anything else renders as plain text. The serializer needed decodeHtmlEntities to match: without it a save would write `&lt;` into the Markdown file and the next parse would escape the `&` again, corrupting the text further on every round trip. A test covers parse -> serialize -> parse stability. Two existing tests asserted the old behaviour and were rewritten rather than deleted: one expected the script tag to be *removed* from the output, the other expected the substring "onerror" to be absent. Both now assert the property that matters — that no tag can form — because `onerror` surviving as inert text is fine. Exploitation required admin access either way: journal and essay text comes from the studio or from content/*.md. This removes the weakness, it does not close an open door. * fix(journal): contain file paths, fix frontmatter escaping, defuse two regexes Follow-up to the CodeQL findings on release PR #432. I went through all 23 alerts individually; this addresses the ones that are worth addressing and documents the ones that are not. Path containment (12 alerts, all false positives). Every path built from a slug goes through isValidSlug(), a strict `/^[a-zA-Z0-9_-]+$/` allowlist — verified against `../../etc/passwd`, `foo/../../bar`, `a/b`, `..` and friends, all rejected. CodeQL cannot see it because the check lives in another module. Added a containedPath() helper that resolves the path and refuses anything landing outside the content directory: a second lock on a door that was already locked, and a barrier the analysis can follow. Also removed the dead `slug.endsWith('.md')` branches — isValidSlug rejects dots, so they could never be taken. Frontmatter escaping (1 alert, a real bug). The serializer escaped `"` but not `\`, and the parser never unescaped anything. A title containing either character gained a backslash on every save/load cycle: Path C:\Users "quoted" -> Path C:\\Users \"quoted\" -> ... Escaping now covers the backslash first and the parser undoes both. A round trip test covers quotes, backslashes, colons and apostrophes. Two of three ReDoS regexes (2 alerts). The heading pattern had `\s+` next to `(.+)`, which overlap, so the engine tried every split of the whitespace run before failing; it is `[ \t]+` and `(\S.*)` now. The quote author pattern wrapped a lazy group around an optional group — the quadratic case — and is an index split on the first separator now. The third regex, the bold/italic pass, is deliberately left alone. Rewriting it with a negated class removes the backtracking but breaks nesting: `**bold *and italic* here**` renders as `*<em>bold </em>and italic<em> here</em>*`. The input is Markdown from an authenticated admin, never a visitor, so the worst case is an author slowing down their own page. The comment in the code says so. Not addressed: 5 js/insufficient-password-hash alerts. They ask for a slow KDF where the code uses SHA-256/HMAC — correct in general, but the admin password comes from an environment variable and is never stored, so a stronger KDF protects nothing that is not already in plaintext in the environment. 399 unit tests pass (18 new), build and tsc clean. * fix(journal): split the quote author by scanning, not by pattern Cleaning up after myself. #439 replaced the quote author regex `/^(.*?)(?:\s+--\s+(.+))?$/` — a lazy group around an optional one, the quadratic case — with `/\s+--\s+/`, and CodeQL promptly flagged the replacement for the same reason. One reported pattern traded for another. splitQuoteAuthor() scans for the first `--` that has whitespace on both sides. Linear, and it needs no reasoning about the regex engine at all. Behaviour is identical to the original regex, checked case by case against it: separator, no separator, several separators, tabs, wide gaps, `a--b` without spaces, leading and trailing separators, empty string. All nine are covered by tests, plus one asserting it stays fast on a 50k whitespace run. * security(admin): derive the session signing key with scrypt getSigningKey() ran the admin password through a single SHA-256 digest. It is key derivation rather than password storage, so it was never a stored-hash problem — but if the derived key ever leaked, one fast hash makes recovering the password by brute force cheap. CodeQL flags it as js/insufficient-password-hash and, for this particular alert, has a point. scrypt now. Two details that matter: The salt has to be stable. A random salt would produce a different key on every call and invalidate every session; it is derived from AUTH_SECRET, which is deployment-specific. Verified across separate processes: same inputs produce a verifying token, so a restart or redeploy does not log everyone out. The result is cached for the process lifetime. scrypt is deliberately slow and getSigningKey() runs on every admin request — deriving per call would add ~24ms to each one. The cache key is a digest of secret plus password, so a rotation misses the cache and derives again, and no extra plaintext copy of the password is kept around. Measured: first derivation 24ms, subsequent calls 0.12ms. Password change and secret change both invalidate an existing token, checked in separate processes. Note the one-time effect: existing admin sessions are invalidated by the change in derivation, so everyone logs in once more. * security(admin): key the signing-key cache on its inputs, not a digest #441 removed the SHA-256 digest of the admin password from the key derivation and introduced a new one three lines above it, as the cache key. Same rule, same file: CodeQL reported it immediately. The comment justifying it was wrong too. It claimed no second plaintext copy of the password was retained, while building the digest input allocates exactly that in order to hash it. The cache now holds the two input strings and compares them directly. They are the same objects the env and install caches already hold, so nothing extra is retained, and no fast hash of the password exists in memory for the life of the process. Re-verified after the change, in separate processes: a token from one process verifies in another with the same inputs, a changed password or secret rejects it, first derivation 24ms, cached calls 0.001ms. That leaves scrypt as the only place the password is hashed here. The two HMACs further down operate on the derived key and on token data, not on the password; the constant-time comparison in verifyAdminPassword is the previously dismissed one. --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
2026-08-14 16:55:07 +02:00
scrollToTop?: boolean;
security: add Trivy container scan to Docker publish workflow (#399) * feat(admin): add backup manager UI with 1-click restore * feat(admin): collapse older backup entries by default * fix(theme): isolate admin layout, instant DOM theme updates, and add Light/Dark mode toggle * feat(admin): replace text controls for Photo Frame and Hero Style with visual preview cards * fix(admin): define missing CSS rules for button system (.btn, .preset-btn) * feat(admin): redesign theme settings with segmented mode toggle, accent color swatches, and custom iOS-style toggle cards * feat(admin): upgrade all settings tabs with visual grid previews, Google SEO snippet preview, and toggle cards * feat(admin): overhaul Pages Builder UX with slide-over drawer, card hover badges, real-time search, and floating save bar * fix(admin): remove leftover dangling syntax snippet in PageBuilder.tsx * fix(admin): add position: relative to subpage-tile so hover overlay is contained inside the tile * style(admin): replace all emojis with clean Leica-style vector SVG icons * fix(types): extend IconProps with SVGProps to allow style prop on Leica SVG icons * feat(admin): add subpage live-preview, privacy analytics, and asset protection settings * fix(typecheck): fix AlbumEntry property access in subpage drawer preview mode * fix(types): fix ImmichAlbumInfo property names thumbnailAssetId and albumName in PageBuilder.tsx * fix(types): add protection and watermark optional properties to AppConfig interface * feat(settings): add toggle for disabling analytics tracking (defaults to enabled) * feat(ux): show status banner when analytics tracking is disabled + add live sync indicator * feat(watermark): render customizable watermark overlay on Lightbox images + rename section to Portfolio Features & Modules * fix(types): import type LightboxWatermark in PhotoGrid.tsx * fix(types): destructure watermark prop in PhotoGrid function signature * feat(seo): add configurable subpage title template and metadata descriptions * feat(seo): add generateMetadata to about page for title template support * feat(proofing): add client proofing, favorites selection, compact URL bitmasking, and export modal * feat(essay): add Photo Essay storytelling mode with RSC markdown parser and fullbleed/pair layouts * feat(subpages): add page enabled toggle to deactivate subpages without deleting them * feat(admin): add visual essay block builder for photo essay storytelling pages * security: add Trivy container scan to Docker publish workflow Scans the built image for CRITICAL/HIGH CVEs on every release and uploads results to the GitHub Security tab. Non-blocking for now (exit-code 0) so releases aren't gated on findings. Also documents the scan and existing Dependabot coverage in the README. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-08-07 11:08:04 +02:00
analytics?: boolean;
theme?: {
preset?: string;
accent?: string;
photoFrame?: string;
grain?: boolean;
headerDot?: boolean;
heroStyle?: string;
};
grid?: {
columns?: number;
gap?: number;
aspectRatio?: string;
layout?: string;
};
footer?: {
name?: string;
instagram?: string;
email?: string;
website?: string;
};
experimental: portfolio features (justified layout, unlisted pages, captions, per-album grid, focal point, nav links, cover hero) (#431) ## Was ist das? Sieben neue Portfolio-Features, alle als **experimental** gekennzeichnet — in YAML-Kommentaren, Admin-Panel-Labels und Commit-Scopes, damit sie einzeln nachvollziehbar und revertierbar bleiben. ## Features (je ein Commit) | Commit | Feature | | --- | --- | | `justified rows gallery layout` | Neues Grid-Layout `justified`: zeilenbasiert, gleiche Höhen, volle Breite — Flexbox ohne JS-Messung, letzte Zeile bleibt natürlich klein | | `hide subpages from navigation` | `hidden: true`: Seite aus Nav/Homepage raus, per Direktlink erreichbar — im Gegensatz zu `enabled: false` (404) | | `lightbox captions` | Immich-Asset-Description als Bildunterschrift im Info-Panel; EXIF-Route liefert bei `exifOnHover: false` jetzt nur noch die Caption statt 403 | | `per-album grid overrides` | `grid:` pro Album-Eintrag, Präzedenz global < Subpage < Album | | `per-album cover focal point` | `coverPosition:` → `object-position` auf Cover-Karten, strikt validiert | | `external links in header navigation` | `navLinks:` in settings.yaml, nur http(s), sanitisiert | | `cover splash hero style` | `heroStyle: cover`: Fullscreen-Splash mit Enter-Link ins Portfolio | Alle Optionen sind im Admin-Panel editierbar (PageBuilder / SettingsEditor). ## Tests - 356 Unit-Tests grün (13 neue: deriveGallery hidden/grid/coverPosition, sanitizeNavLinks, EXIF-Route-Captions, justified-Layout-Validierung) - `npx tsc --noEmit`: 0 Fehler - `npm run build`: sauber - Justified-Zeilenmathematik und Cover-Splash per Browser-Harness visuell/numerisch verifiziert (volle Zeilen enden exakt an der Containerkante, letzte Zeile bleibt natürlich) --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
2026-08-14 17:56:22 +02:00
/** EXPERIMENTAL: external links appended to the header navigation */
navLinks?: Array<{ label?: string; url?: string }>;
legal?: {
enabled?: boolean;
name?: string;
address?: string;
zipCity?: string;
country?: string;
email?: string;
phone?: string;
taxId?: string;
vatId?: string;
extraInfo?: string;
};
seo?: {
title?: string;
description?: string;
security: add Trivy container scan to Docker publish workflow (#399) * feat(admin): add backup manager UI with 1-click restore * feat(admin): collapse older backup entries by default * fix(theme): isolate admin layout, instant DOM theme updates, and add Light/Dark mode toggle * feat(admin): replace text controls for Photo Frame and Hero Style with visual preview cards * fix(admin): define missing CSS rules for button system (.btn, .preset-btn) * feat(admin): redesign theme settings with segmented mode toggle, accent color swatches, and custom iOS-style toggle cards * feat(admin): upgrade all settings tabs with visual grid previews, Google SEO snippet preview, and toggle cards * feat(admin): overhaul Pages Builder UX with slide-over drawer, card hover badges, real-time search, and floating save bar * fix(admin): remove leftover dangling syntax snippet in PageBuilder.tsx * fix(admin): add position: relative to subpage-tile so hover overlay is contained inside the tile * style(admin): replace all emojis with clean Leica-style vector SVG icons * fix(types): extend IconProps with SVGProps to allow style prop on Leica SVG icons * feat(admin): add subpage live-preview, privacy analytics, and asset protection settings * fix(typecheck): fix AlbumEntry property access in subpage drawer preview mode * fix(types): fix ImmichAlbumInfo property names thumbnailAssetId and albumName in PageBuilder.tsx * fix(types): add protection and watermark optional properties to AppConfig interface * feat(settings): add toggle for disabling analytics tracking (defaults to enabled) * feat(ux): show status banner when analytics tracking is disabled + add live sync indicator * feat(watermark): render customizable watermark overlay on Lightbox images + rename section to Portfolio Features & Modules * fix(types): import type LightboxWatermark in PhotoGrid.tsx * fix(types): destructure watermark prop in PhotoGrid function signature * feat(seo): add configurable subpage title template and metadata descriptions * feat(seo): add generateMetadata to about page for title template support * feat(proofing): add client proofing, favorites selection, compact URL bitmasking, and export modal * feat(essay): add Photo Essay storytelling mode with RSC markdown parser and fullbleed/pair layouts * feat(subpages): add page enabled toggle to deactivate subpages without deleting them * feat(admin): add visual essay block builder for photo essay storytelling pages * security: add Trivy container scan to Docker publish workflow Scans the built image for CRITICAL/HIGH CVEs on every release and uploads results to the GitHub Security tab. Non-blocking for now (exit-code 0) so releases aren't gated on findings. Also documents the scan and existing Dependabot coverage in the README. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-08-07 11:08:04 +02:00
titleTemplate?: string;
noIndex?: boolean;
noFollow?: boolean;
};
security: add Trivy container scan to Docker publish workflow (#399) * feat(admin): add backup manager UI with 1-click restore * feat(admin): collapse older backup entries by default * fix(theme): isolate admin layout, instant DOM theme updates, and add Light/Dark mode toggle * feat(admin): replace text controls for Photo Frame and Hero Style with visual preview cards * fix(admin): define missing CSS rules for button system (.btn, .preset-btn) * feat(admin): redesign theme settings with segmented mode toggle, accent color swatches, and custom iOS-style toggle cards * feat(admin): upgrade all settings tabs with visual grid previews, Google SEO snippet preview, and toggle cards * feat(admin): overhaul Pages Builder UX with slide-over drawer, card hover badges, real-time search, and floating save bar * fix(admin): remove leftover dangling syntax snippet in PageBuilder.tsx * fix(admin): add position: relative to subpage-tile so hover overlay is contained inside the tile * style(admin): replace all emojis with clean Leica-style vector SVG icons * fix(types): extend IconProps with SVGProps to allow style prop on Leica SVG icons * feat(admin): add subpage live-preview, privacy analytics, and asset protection settings * fix(typecheck): fix AlbumEntry property access in subpage drawer preview mode * fix(types): fix ImmichAlbumInfo property names thumbnailAssetId and albumName in PageBuilder.tsx * fix(types): add protection and watermark optional properties to AppConfig interface * feat(settings): add toggle for disabling analytics tracking (defaults to enabled) * feat(ux): show status banner when analytics tracking is disabled + add live sync indicator * feat(watermark): render customizable watermark overlay on Lightbox images + rename section to Portfolio Features & Modules * fix(types): import type LightboxWatermark in PhotoGrid.tsx * fix(types): destructure watermark prop in PhotoGrid function signature * feat(seo): add configurable subpage title template and metadata descriptions * feat(seo): add generateMetadata to about page for title template support * feat(proofing): add client proofing, favorites selection, compact URL bitmasking, and export modal * feat(essay): add Photo Essay storytelling mode with RSC markdown parser and fullbleed/pair layouts * feat(subpages): add page enabled toggle to deactivate subpages without deleting them * feat(admin): add visual essay block builder for photo essay storytelling pages * security: add Trivy container scan to Docker publish workflow Scans the built image for CRITICAL/HIGH CVEs on every release and uploads results to the GitHub Security tab. Non-blocking for now (exit-code 0) so releases aren't gated on findings. Also documents the scan and existing Dependabot coverage in the README. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-08-07 11:08:04 +02:00
protection?: {
disableRightClick?: boolean;
disableImageDrag?: boolean;
};
proofing?: {
enabled?: boolean;
allowMailto?: boolean;
};
watermark?: {
enabled?: boolean;
text?: string;
opacity?: number;
position?: 'bottom-right' | 'bottom-left' | 'center';
};
about?: { enabled?: boolean };
}
release: v0.11.0 (#459) Ships `dev` as **v0.11.0**. `main` contains nothing that `dev` does not, so this is a clean sync. ## Headline changes since v0.10.0 - **Journal & Journal Studio** — photo essays at `/journal`, split-screen block editor with live preview, drafts, per-entry passwords, cover images - **First-run setup wizard at `/install`** — configure a fresh deployment from the browser; credentials are verified against Immich before anything is written, and the wizard is gated by a one-time token - **About page editor and toggle** in the admin panel - **Per-album photo order** independent of Immich, with a drag & drop editor - **Custom favicon upload** - **Experimental portfolio features** — justified grid, `cover` hero, unlisted subpages, per-album grid overrides, cover focal points, external nav links - **Security** — asset tokens length-capped before decoding (#423), journal author markdown escaped rather than filtered, journal file paths contained, admin session key derived with scrypt (#432), Next.js 16.3.0 for CVE-2025-13465 - **Fixed** — client proofing honours its own configuration again (#454); journal photo rendering (#432) Full detail in [CHANGELOG.md](CHANGELOG.md#0110--2026-08-15). ## Verified `npx tsc --noEmit` clean · `npx vitest run` 435 tests pass · `npm run build` succeeds · lint 0 errors · `prettier --check` clean · local `docker build` of the release tree. ## After merge Tag `v0.11.0` on `main` and publish the release — that triggers `docker-publish.yml`, which pushes the image and moves `latest`. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
2026-08-15 09:09:18 +02:00
const PRESETS = ['studio-modern', 'studio', 'minimal', 'editorial', 'classic', 'noir', 'monograph'];
experimental: portfolio features (justified layout, unlisted pages, captions, per-album grid, focal point, nav links, cover hero) (#431) ## Was ist das? Sieben neue Portfolio-Features, alle als **experimental** gekennzeichnet — in YAML-Kommentaren, Admin-Panel-Labels und Commit-Scopes, damit sie einzeln nachvollziehbar und revertierbar bleiben. ## Features (je ein Commit) | Commit | Feature | | --- | --- | | `justified rows gallery layout` | Neues Grid-Layout `justified`: zeilenbasiert, gleiche Höhen, volle Breite — Flexbox ohne JS-Messung, letzte Zeile bleibt natürlich klein | | `hide subpages from navigation` | `hidden: true`: Seite aus Nav/Homepage raus, per Direktlink erreichbar — im Gegensatz zu `enabled: false` (404) | | `lightbox captions` | Immich-Asset-Description als Bildunterschrift im Info-Panel; EXIF-Route liefert bei `exifOnHover: false` jetzt nur noch die Caption statt 403 | | `per-album grid overrides` | `grid:` pro Album-Eintrag, Präzedenz global < Subpage < Album | | `per-album cover focal point` | `coverPosition:` → `object-position` auf Cover-Karten, strikt validiert | | `external links in header navigation` | `navLinks:` in settings.yaml, nur http(s), sanitisiert | | `cover splash hero style` | `heroStyle: cover`: Fullscreen-Splash mit Enter-Link ins Portfolio | Alle Optionen sind im Admin-Panel editierbar (PageBuilder / SettingsEditor). ## Tests - 356 Unit-Tests grün (13 neue: deriveGallery hidden/grid/coverPosition, sanitizeNavLinks, EXIF-Route-Captions, justified-Layout-Validierung) - `npx tsc --noEmit`: 0 Fehler - `npm run build`: sauber - Justified-Zeilenmathematik und Cover-Splash per Browser-Harness visuell/numerisch verifiziert (volle Zeilen enden exakt an der Containerkante, letzte Zeile bleibt natürlich) --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
2026-08-14 17:56:22 +02:00
const LAYOUTS = ['masonry', 'uniform', 'showcase', 'filmstrip', 'editorial-flow', 'justified'];
const PHOTO_FRAMES = ['none', 'passepartout', 'shadow'];
experimental: portfolio features (justified layout, unlisted pages, captions, per-album grid, focal point, nav links, cover hero) (#431) ## Was ist das? Sieben neue Portfolio-Features, alle als **experimental** gekennzeichnet — in YAML-Kommentaren, Admin-Panel-Labels und Commit-Scopes, damit sie einzeln nachvollziehbar und revertierbar bleiben. ## Features (je ein Commit) | Commit | Feature | | --- | --- | | `justified rows gallery layout` | Neues Grid-Layout `justified`: zeilenbasiert, gleiche Höhen, volle Breite — Flexbox ohne JS-Messung, letzte Zeile bleibt natürlich klein | | `hide subpages from navigation` | `hidden: true`: Seite aus Nav/Homepage raus, per Direktlink erreichbar — im Gegensatz zu `enabled: false` (404) | | `lightbox captions` | Immich-Asset-Description als Bildunterschrift im Info-Panel; EXIF-Route liefert bei `exifOnHover: false` jetzt nur noch die Caption statt 403 | | `per-album grid overrides` | `grid:` pro Album-Eintrag, Präzedenz global < Subpage < Album | | `per-album cover focal point` | `coverPosition:` → `object-position` auf Cover-Karten, strikt validiert | | `external links in header navigation` | `navLinks:` in settings.yaml, nur http(s), sanitisiert | | `cover splash hero style` | `heroStyle: cover`: Fullscreen-Splash mit Enter-Link ins Portfolio | Alle Optionen sind im Admin-Panel editierbar (PageBuilder / SettingsEditor). ## Tests - 356 Unit-Tests grün (13 neue: deriveGallery hidden/grid/coverPosition, sanitizeNavLinks, EXIF-Route-Captions, justified-Layout-Validierung) - `npx tsc --noEmit`: 0 Fehler - `npm run build`: sauber - Justified-Zeilenmathematik und Cover-Splash per Browser-Harness visuell/numerisch verifiziert (volle Zeilen enden exakt an der Containerkante, letzte Zeile bleibt natürlich) --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
2026-08-14 17:56:22 +02:00
const HERO_STYLES = ['split', 'fullbleed', 'minimal', 'stacked', 'typographic', 'mosaic', 'cover'];
const ASPECT_RATIOS = ['1', '3/2', '2/3', '16/9', 'auto'];
release: v0.11.0 — journal fixes, admin URLs, design system cleanup (#432) * fix(screenshots): sharp-Typen fuer 0.34 und 0.35 gleichzeitig (#410) sharp 0.35 ist von `export =` auf ESM umgestellt: der Modul-Namespace ist nicht mehr aufrufbar, die Factory sitzt unter .default. Der Type-Check brach damit in scripts/screenshots.ts weg, sobald der Next-Bump (#402) sharp von 0.34.5 auf 0.35.3 mitzieht -- sharp ist hier keine deklarierte Dependency, sondern kommt ueber Next mit. Die Form wird jetzt aus dem installierten Paket abgeleitet statt festgeschrieben, zur Laufzeit wie im Typ. Geprueft mit beiden Versionen: tsc laeuft mit 0.34.5 und mit 0.35.3 fehlerfrei durch. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(deps): bump the nextjs group across 1 directory with 2 updates (#402) Bumps the nextjs group with 2 updates in the / directory: [next](https://github.com/vercel/next.js) and [eslint-config-next](https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next). Updates `next` from 16.2.12 to 16.3.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/compare/v16.2.12...v16.3.0) Updates `eslint-config-next` from 16.2.12 to 16.3.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/commits/v16.3.0/packages/eslint-config-next) --- updated-dependencies: - dependency-name: eslint-config-next dependency-version: 16.3.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: nextjs - dependency-name: next dependency-version: 16.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nextjs ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps-dev): bump prettier from 3.8.3 to 3.9.6 (#405) Bumps [prettier](https://github.com/prettier/prettier) from 3.8.3 to 3.9.6. - [Release notes](https://github.com/prettier/prettier/releases) - [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md) - [Commits](https://github.com/prettier/prettier/compare/3.8.3...3.9.6) --- updated-dependencies: - dependency-name: prettier dependency-version: 3.9.6 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * docs(changelog): Unreleased-Sektion fuer die Bumps nach v0.10.0 (#413) Die Dependency-PRs sind nach dem Release auf dev gelandet, teils auch auf main. Ohne Eintrag waeren sie beim naechsten Release unsichtbar -- inklusive Next 16.3.0, das CVE-2025-13465 mitbringt. Ausserdem im 0.10.0-Abschnitt nachgetragen, dass der Trivy-Scan bis #409 nie gelaufen ist. Der Fix steckt im Tag v0.10.0, fehlte aber in der Aufzaehlung -- und "Images werden bei jedem Publish gescannt" stand im Changelog, waehrend der Job im Action-Setup abbrach. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(gallery): per-album sort order, independent of Immich (#408) (#414) Album order was dictated entirely by Immich: getAlbum() sorted by the album's own asc/desc flag, so a Folio album always mirrored the archive. A curated series has a narrative order that has nothing to do with capture time, and changing the Immich album's sort to fit the website changes it for the archive too. Adds an optional per-album `sort` in gallery.yaml, editable in /admin, defaulting to today's behaviour so every existing config is unchanged: immich (default) | newest | oldest | filename | manual `manual` is a pinned *prefix*: `assetOrder` lists only the photos placed by hand, everything else follows in the album's Immich order. A full permutation of a 2,000-photo album would be ~80 KB of UUIDs in a file that is rewritten and copied to content/.backups/ on every admin save. It also makes drift fall out for free — photos removed in Immich never match, new ones land in the tail rather than being hidden. Sorting is applied after the cache read, not before the cache write, so the LRU keeps one canonical Immich-ordered copy per album. That avoids putting the mode in the cache key, lets a config change take effect without depending on invalidation, and keeps the stale-serving path correct. cache.get() returns the stored object by reference, so withSort() returns a shallow clone with a new array — sorting in place would reorder the shared entry, and under request coalescing every concurrent caller would be sorting the same array. Also fixes a prerequisite bug: /api/admin/albums/[albumId]/assets read album.assets from GET /albums/:id, which Immich 3.x no longer populates (lib/immich.ts:507). The hero picker's "This Album" tab returned nothing and threw outright when the key was absent. It now goes through the client's paginated metadata search, with ?types=all to opt videos in for the reorder editor. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): drop decorative emoji from the sort select labels (#415) An <option> cannot contain markup, so the SVG set in Icons is not reachable there — but a decorative emoji is not a substitute for it. Plain text instead; the album card badge already uses a real icon. The remaining emoji in the admin panel (asset picker tabs, section headings, layout picker options) predate this branch and are left for a separate cleanup. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): replace emoji icons with the shared SVG icon set (#416) The admin panel mixed two icon conventions: inline SVGs from `Icons.tsx` in most components, and decorative emoji in the asset picker and a few PageBuilder labels. Emoji render inconsistently across platforms, ignore the accent colour, and cannot inherit the `.svg-icon` sizing rules. - Icons.tsx: add `IconStar` (filled — it marks a state, not an action) and `IconImage`. - AssetPicker: the three tab labels and the favourite tile badge now use IconFolder / IconStar / IconImage. - PageBuilder: the "Standalone Albums" and "Subpages" headings use the icon set instead of an emoji. - PageBuilder: the layout picker drops its emoji for plain text. An <option> cannot contain markup, so an SVG is impossible there and a decorative glyph is not a substitute. - admin.css: align icon and label in the picker tabs, and swap the favourite badge's text-shadow for drop-shadow, which is what applies to an inline SVG. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): fold PageBuilder's local icons into the shared Icons module (#418) * refactor(admin): fold PageBuilder's local icons into the shared module PageBuilder.tsx carried its own `Icons` object duplicating most of the glyphs already exported by Icons.tsx, with hardcoded sizes and slightly divergent paths. Migrate all 32 call sites to the shared module and delete the local object. Five glyphs had no counterpart and are added to Icons.tsx as 1:1 ports of the local paths: IconX, IconPlus, IconHome, IconCopy, IconImage. The local ExternalLink and Check are dropped rather than ported — both had zero call sites. Two glyphs change shape slightly, which is the point of consolidating: the shared IconCamera includes the viewfinder bump the local copy omitted, and drag handles now use IconGripVertical. IconGripVertical uses the module's square 24x24 viewBox, so `.svg-drag` goes from 12x18 to 18x18 — the old non-square box would letterbox the glyph down to 12x12 and shrink the handle. * fix(admin): resolve icon-module integration after #416 Merging dev brought in #416, which added a second IconImage to Icons.tsx and two <Icons.Camera>/<Icons.Folder> section headers that reference the local Icons object this PR removes. Git merged both cleanly but the result did not type-check. - drop the duplicate IconImage (both copies were byte-identical) - point the two section headers at the imported IconCamera/IconFolder - refresh the SORT_LABELS comment: the icon set is imported now, not declared below --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> * fix(config): allow an empty gallery, guard against a double /api suffix (#421) An empty gallery is now a valid, rendered state instead of a throw: deriveGallery() no longer requires at least one album or subpage, so a deployment with no albums yet renders a bare homepage the owner can fill in via /admin. getConfig() also stops appending /api to an Immich URL that already ends in it, which previously produced .../api/api and broke every upstream request. Includes a restore of the per-album sort test cases, which the branch had lost by being cut before #408/#414. * feat(admin): favicon upload, served from the content volume (#422) Adds a bundled default favicon, an upload widget in admin Settings > General, and a route that serves the icon from the writable content/ volume with a fallback to the bundled default. Raster uploads (PNG/ICO/JPEG) are wrapped in an SVG container; the response carries its own CSP so an uploaded SVG cannot execute script on the origin. The GET route revalidates with an ETag instead of caching immutably, so a newly uploaded icon shows up immediately. Uploads are written via temp file + rename, and a Reset button restores the bundled default. * ci: flag unformatted files in a PR, without blocking it (#424) Prettier is configured as an error rule in eslint.config.mjs but has never run in CI, so part of the tree predates it. A final CI step now diffs against the PR base, runs prettier --list-different over the changed files, and emits a warning annotation per offender plus a job summary. Advisory by design: it never fails the job. Blocking would turn a PR red for merely touching a file that was already unformatted, and normalising the tree in one commit would wreck git blame and conflict with the PRs in flight. Requires fetch-depth: 0, since diffing against the base needs its history. * feat(install): first-run wizard gated by a one-time setup token (#419) Adds /install, a four-step first-run wizard: connect to Immich, optionally pick albums, name the site, finish. It verifies the credentials against the Immich server before writing anything, then writes gallery.yaml, settings.yaml and a content/install.json carrying the Immich credentials and a generated site secret. install.json exists because a running process cannot pick up new env vars — the wizard has to write configuration that takes effect without a restart. getInstallCredentials() merges it under the real environment, so env vars always win and rotation stays a matter of setting one. Both the page and the API routes are gated by a one-time setup token printed to the server log, so a deployment that is reachable before gallery.yaml exists cannot be configured by whoever finds it first. The token is stored in content/.setup-token (0600) rather than a module variable: Next.js bundles the page and each route handler separately, so a module-level token left the page and the API disagreeing inside one process and the wizard stuck on step 1. It is removed once the install completes. The admin password is stored as an scrypt hash using the scheme lib/auth.ts already applies to album passwords; a plaintext ADMIN_PASSWORD env var keeps working. * docs: document the setup wizard, fix the read-only content mount (#425) Quick Start now leads with the /install wizard, with the hand-written YAML route kept alongside it, and a First-Run Setup section covers the setup token, the files the wizard writes, and env-var precedence. Two corrections: both Docker examples mounted content/ as :ro, which silently breaks the wizard, the admin panel and the backup rotation alike — docs/admin-panel.md already said so and the README contradicted it. And nothing documented that content/install.json holds the Immich API key, so a backup of content/ is a backup of credentials. Also adds a Contributors section crediting the people whose work is in the project. * feat(admin): floating save bar pinned to the bottom of the viewport (#426) The save bar was the first, static element inside .admin-main. Since the document itself scrolls, it left the viewport as soon as you scrolled down — editing a subpage section or a settings block far below gave no visible dirty hint and no reachable save button. Replace it with a bottom-pinned floating bar shared by both editors. It only mounts while there is something to act on (unsaved changes, an in-flight save, or a result message), so it never covers content while idle. The success message clears after 5s, which hides the bar again. - new SaveBar component, replacing the duplicated markup in PageBuilder and SettingsEditor - adopt the previously unused .floating-save-bar CSS: slide-in keyframes (carrying translateX(-50%)), dirty border, wrap/gap, mobile variant and a prefers-reduced-motion opt-out; z-index 900 keeps it below modals - .admin-main gains bottom padding so the bar never covers page content - drop the now-unreachable idle hints: the ⌘S hint becomes a button title, the Live Sync note becomes a static line above the settings layout - header "Site" link now bypasses the cache (/?fresh=1), so the preview stays reachable when the bar is hidden Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(admin): themed listbox for the album sort control (#427) The per-album "Photo order" control was a native <select>. Because an <option> cannot contain markup, its choices could not use the admin panel's currentColor SVG set — the reason #415 had to fall back to plain text after dropping the emoji labels. Adds a Listbox component implementing the ARIA combobox/listbox pattern, so options can render a glyph beside their label: - DOM focus stays on the trigger button; the active option is announced through aria-activedescendant, keeping focus management to one element - Keyboard: arrows (clamped at the ends, like a native select), Home/End, Enter/Space to commit, Escape to cancel, Tab commits and moves on, and prefix type-ahead with a repeat-key cycle - Outside dismissal on pointerdown, so a press starting outside closes the popup before the click retargets The sort options now carry an icon each: calendar, arrow-down, arrow-up, an A→Z marker, and the drag glyph for manual — matching the badge the album card already shows. SORT_LABELS stays plain text because the badge feeds it to a title attribute. Closes #417 Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(git): ignore generated design handoff folders * fix(admin): stop the album sort dropdown clipping, and simplify the panel (#428) * fix(admin): render listbox popup in a portal so it escapes modal clipping The sort control's popup was position:absolute inside three clipping ancestors (.album-drawer overflow:hidden > .album-drawer-body overflow-y:auto > .modal-right-column overflow-y:auto), so it was cut off at the bottom of the Edit Album Details modal. z-index could not help: clipping happens before stacking. It also always hung below the trigger, with no flip. Portal the popup to document.body and position it from the trigger's viewport rect, flipping above when there is more room there and capping max-height to the space available so it scrolls internally rather than overflowing. It is dismissed on scroll and resize, since the anchor is only measured on open. The outside-pointerdown handler now also treats the popup as inside; without that the portalled list counts as outside, and a click on an option would close it before the selection commits. * refactor(admin): single-column album details panel The left column spent 1.2fr on a cover thumbnail and three stat rows, two of which (Status, Custom Hero) only restated the form fields opposite them, while the form itself was squeezed into 1.8fr behind a second nested scroller. Stack the drawer in one column instead: cover as a banner, then the form at full width, with the UUID moved into the footer. The body is now the only scroll container, which also removes one of the ancestors that was clipping the sort popup. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> * fix(admin): give the portalled listbox its theme back, lock the page behind modals (#429) Two defects in the album editor. The sort listbox popup painted transparent. Every --admin-* variable is scoped to .admin-layout, and since the popup moved into document.body it sits outside that subtree, so background/border/text all resolved to nothing. It now carries its own copy of the palette in both colour schemes, plus the font it no longer inherits. Scrolling inside a modal also moved the page behind it. No admin modal ever locked body scroll: the overlay covers the page but does not absorb wheel events, so a scroll starting on the backdrop — or continuing past the end of the modal's own scroller — reaches the document. overscroll-behavior cannot cover that case on its own, because it only applies to scroll containers and the backdrop is not one. useScrollLock freezes body while a modal is open and compensates for the width the scrollbar gives up, so nothing shifts underneath. Each lock restores the inline value it found, which makes nesting work without a counter — a picker opened from the drawer restores the drawer's hidden state instead of clearing it. Applied to both drawers and all four picker modals, which share the defect. overscroll-behavior: contain on the scrollers stops the chaining they can handle themselves. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com> * fix(security): allow unsafe-eval in CSP script-src during dev mode * feat(journal): add Journal Studio with split-screen editor, live preview and dedicated routes * fix(build): separate client parser from server journal-service and fix build type errors * fix(journal): Fotos rendern, Layout und Lightbox-Steuerung korrigieren Fünf unabhängige Fehler in der öffentlichen Journal- und Essay-Ansicht: * Foto-Blöcke wurden nie angezeigt. EssayView löst ein Foto über PhotoItem.id auf, und das sind verschlüsselte Tokens — die Blöcke aus dem Markdown tragen aber rohe Asset-UUIDs. Jede Zuordnung lief ins Leere, und nicht auflösbare Blöcke werden still verworfen. Die IDs werden jetzt serverseitig übersetzt; damit verschwinden nebenbei die rohen UUIDs aus dem Client-Payload, die dort laut Projektregel nie auftauchen dürfen. Nicht auflösbare Referenzen werden geloggt. * Überschriften standen weiter links als der Fließtext. Jeder Block hatte einzeln `max-width: 68ch`, und `ch` ist relativ zur Schrift des Elements — die Serif-Überschrift ergab eine breitere Spalte. Ersetzt durch eine gemeinsame, font-unabhängige `--essay-measure`. * Fullbleed-Fotos bluteten nur nach links aus: `.essay-figure` ist `width: 100%`, wodurch die Box überbestimmt ist und der negative rechte Margin verworfen wird. * Foto-Paare stellten beide Bilder gleich breit dar, wodurch ein Hochformat neben einem Querformat doppelt so hoch wurde. Jetzt eine Justified-Reihe: Breite proportional zum Seitenverhältnis, dadurch exakt gleiche Höhen ohne Beschnitt. * Die Lightbox hatte im Journal keine Tastatursteuerung und keine Scroll-Sperre — beides lag in PhotoGrid, also nur im Album-Raster. Verlagert in die Lightbox selbst, der doppelte Handler in PhotoGrid entfernt (sonst wäre pro Pfeildruck zwei Bilder weitergesprungen). Zusätzlich sind Proofing-Herzen und das EXIF-Panel im redaktionellen Modus abschaltbar und im Journal aus: Client-Proofing ist ein Übergabe-Workflow für Alben, keine Funktion einer Reportage. Auf der Übersicht wurde der Untertitel doppelt gerendert, weil extractExcerpt() auf ihn zurückfällt. * feat(admin): eigene URLs für alle Bereiche und überarbeiteter Journal Studio Das Panel war eine einzige Client-Komponente, die ihre Tabs über useState umschaltet: keine Route pro Bereich, kein Deep-Link, kein Zurück-Button, und nach jedem Reload landete man wieder auf "Pages". Auch der Journal-Editor hatte keine eigene URL. Jetzt sieben echte Routen (/admin, /admin/pages, /admin/journal, /admin/journal/<slug>, /admin/settings, /admin/settings/<section>, /admin/analytics). Die Shell mit Auth-Prüfung und Kopfzeile sitzt im Layout und umschließt children — so bleibt die Session-Prüfung über Routenwechsel montiert, statt bei jedem Tab-Wechsel neu zu laufen und den Spinner aufblitzen zu lassen. Unbekannte Settings-Sections fallen auf General zurück. Im selben Zug der Journal Studio, der die Routing-Änderung ohnehin berührt: * Alle Eingabefelder nutzten die Klasse `admin-input`, die in keinem CSS definiert war — sie fielen auf Browser-Defaults zurück. Jetzt gestylt, gescoped, damit der generische Name nicht ins übrige Panel leckt. * Der Split View ist per Divider verschiebbar (Maus, Tastatur, Doppelklick zum Zurücksetzen), Breite in localStorage. * Das Studio bricht aus der 1120px-Spalte aus, die Preview hat Platz. * Die Preview zeigte für jedes Foto fest 3:2 und log damit über das Layout der veröffentlichten Seite; die echten Verhältnisse werden jetzt an den Thumbnails gemessen. * Blöcke mit alten positionsbasierten Foto-Referenzen werden markiert — die lassen sich auf einer eigenständigen Journal-Seite nicht auflösen und verschwanden bisher stillschweigend. * Blocktyp-Chips als gemeinsame Komponente, monochrom und per Icon unterschieden statt in einer eigenen Blau/Lila/Orange-Palette, die sonst nirgends im Panel vorkommt. * Emojis raus, SVG-Icons rein. * fix(admin): Designsystem-Lücken im Panel schließen Eine systematische Suche nach Klassen, die im TSX benutzt, aber in keinem CSS definiert sind, hat vier Stellen mit demselben Muster gefunden: * `admin-btn-secondary` und `admin-btn-danger` existierten nicht. Sämtliche Löschen-Buttons sahen aus wie normale Buttons — keine Warnwirkung. Als `.admin-btn.admin-btn-danger` geschrieben, weil die Varianten mit den Größenklassen kombiniert werden, die weiter unten ihren eigenen Hintergrund setzen. * `page-progress-fill` fehlte: die Balken im Analytics-Panel waren leere Rinnen, der Wert unsichtbar. Ebenso `analytics-empty` und `admin-loading-container`. * `subpage-drawer-section`, `subpage-drawer-title-group` und `input-with-icon` im PageBuilder waren wirkungslos und teils mit Inline-Styles notdürftig kompensiert. * `grid-card-preview` fehlte, wodurch alle Layout-Vorschauen auf Höhe null kollabierten. Nur "Showcase" war sichtbar — und das aus Versehen, weil sein Tile `hero-tile` hieß und damit die `aspect-ratio` einer fremden PageBuilder-Klasse erbte. Umbenannt. Dazu die Theme-Vorschauen, die praktisch identisch aussahen: alle sieben zeigten dieselben drei quadratischen Kacheln, einziger Unterschied war die Hintergrundfarbe. Sie spiegeln jetzt die echten Preset-Daten aus lib/config/theme.ts — Schriftcharakter, Eckradius, Rasterdichte, Passepartout bzw. Schatten. Die Kopfzeile richtet sich an einer gemeinsamen Steuerhöhe aus. Der "Site"-Link war höher als die Buttons daneben: `.admin-btn` hatte keine explizite line-height, und <button> bekommt box-sizing: border-box vom Browser, <a> nicht. Die Statusanzeige setzte weder Schriftfamilie noch -größe und fiel auf den Browser-Default zurück — sie war nie Teil des Designsystems. Jetzt gleiche Höhe und Typografie, Pillenform als Zustandsanzeige, Trenner zur Aktionsgruppe. Das dauerhafte Pulsieren des grünen Punkts entfällt; Animation bleibt den Zuständen vorbehalten, die Aufmerksamkeit brauchen. Restliche Emojis durch SVG-Icons ersetzt. * feat(admin): add scroll-to-top toggle and SVG arrow The back-to-top button was always on and drew its arrow with the ↑ text character. Add a `scrollToTop` setting (General section in the admin panel, defaults to on so existing sites are unaffected) and replace the glyph with a stroked SVG that inherits currentColor across all presets. Scroll handling is now rAF-throttled, and prefers-reduced-motion turns off both the hover lift and the smooth scroll. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * security(journal): escape author HTML instead of filtering it CodeQL flags 26 high-severity alerts on the release PR; the bulk of them point at sanitizeHtml(), a denylist of three regexes whose output goes into dangerouslySetInnerHTML. I reproduced the bypasses before changing anything — all four pass the old filter: <img src=x onerror=alert(1)> unquoted handler, regex wants quotes <img src=x onerror='alert(1)'> single quotes, same reason <svg onload=alert(1)> not a <script> tag javasjavascript:cript:alert(1) one-pass replace, the rest recombines Plus an attribute breakout in the link renderer, which interpolated the URL into href="${url}" unescaped: [x](" onmouseover=alert(1) x=") -> <a href="" onmouseover=alert(1" ...> Replaced with escaping. Every `&<>"'` in author text becomes an entity before any markdown rule runs, so the only tags in the output are the ones renderInlineMarkdown builds itself and a URL cannot leave its attribute. Link schemes are now an allowlist (http, https, mailto, tel, relative, anchor); anything else renders as plain text. The serializer needed decodeHtmlEntities to match: without it a save would write `&lt;` into the Markdown file and the next parse would escape the `&` again, corrupting the text further on every round trip. A test covers parse -> serialize -> parse stability. Two existing tests asserted the old behaviour and were rewritten rather than deleted: one expected the script tag to be *removed* from the output, the other expected the substring "onerror" to be absent. Both now assert the property that matters — that no tag can form — because `onerror` surviving as inert text is fine. Exploitation required admin access either way: journal and essay text comes from the studio or from content/*.md. This removes the weakness, it does not close an open door. * fix(journal): contain file paths, fix frontmatter escaping, defuse two regexes Follow-up to the CodeQL findings on release PR #432. I went through all 23 alerts individually; this addresses the ones that are worth addressing and documents the ones that are not. Path containment (12 alerts, all false positives). Every path built from a slug goes through isValidSlug(), a strict `/^[a-zA-Z0-9_-]+$/` allowlist — verified against `../../etc/passwd`, `foo/../../bar`, `a/b`, `..` and friends, all rejected. CodeQL cannot see it because the check lives in another module. Added a containedPath() helper that resolves the path and refuses anything landing outside the content directory: a second lock on a door that was already locked, and a barrier the analysis can follow. Also removed the dead `slug.endsWith('.md')` branches — isValidSlug rejects dots, so they could never be taken. Frontmatter escaping (1 alert, a real bug). The serializer escaped `"` but not `\`, and the parser never unescaped anything. A title containing either character gained a backslash on every save/load cycle: Path C:\Users "quoted" -> Path C:\\Users \"quoted\" -> ... Escaping now covers the backslash first and the parser undoes both. A round trip test covers quotes, backslashes, colons and apostrophes. Two of three ReDoS regexes (2 alerts). The heading pattern had `\s+` next to `(.+)`, which overlap, so the engine tried every split of the whitespace run before failing; it is `[ \t]+` and `(\S.*)` now. The quote author pattern wrapped a lazy group around an optional group — the quadratic case — and is an index split on the first separator now. The third regex, the bold/italic pass, is deliberately left alone. Rewriting it with a negated class removes the backtracking but breaks nesting: `**bold *and italic* here**` renders as `*<em>bold </em>and italic<em> here</em>*`. The input is Markdown from an authenticated admin, never a visitor, so the worst case is an author slowing down their own page. The comment in the code says so. Not addressed: 5 js/insufficient-password-hash alerts. They ask for a slow KDF where the code uses SHA-256/HMAC — correct in general, but the admin password comes from an environment variable and is never stored, so a stronger KDF protects nothing that is not already in plaintext in the environment. 399 unit tests pass (18 new), build and tsc clean. * fix(journal): split the quote author by scanning, not by pattern Cleaning up after myself. #439 replaced the quote author regex `/^(.*?)(?:\s+--\s+(.+))?$/` — a lazy group around an optional one, the quadratic case — with `/\s+--\s+/`, and CodeQL promptly flagged the replacement for the same reason. One reported pattern traded for another. splitQuoteAuthor() scans for the first `--` that has whitespace on both sides. Linear, and it needs no reasoning about the regex engine at all. Behaviour is identical to the original regex, checked case by case against it: separator, no separator, several separators, tabs, wide gaps, `a--b` without spaces, leading and trailing separators, empty string. All nine are covered by tests, plus one asserting it stays fast on a 50k whitespace run. * security(admin): derive the session signing key with scrypt getSigningKey() ran the admin password through a single SHA-256 digest. It is key derivation rather than password storage, so it was never a stored-hash problem — but if the derived key ever leaked, one fast hash makes recovering the password by brute force cheap. CodeQL flags it as js/insufficient-password-hash and, for this particular alert, has a point. scrypt now. Two details that matter: The salt has to be stable. A random salt would produce a different key on every call and invalidate every session; it is derived from AUTH_SECRET, which is deployment-specific. Verified across separate processes: same inputs produce a verifying token, so a restart or redeploy does not log everyone out. The result is cached for the process lifetime. scrypt is deliberately slow and getSigningKey() runs on every admin request — deriving per call would add ~24ms to each one. The cache key is a digest of secret plus password, so a rotation misses the cache and derives again, and no extra plaintext copy of the password is kept around. Measured: first derivation 24ms, subsequent calls 0.12ms. Password change and secret change both invalidate an existing token, checked in separate processes. Note the one-time effect: existing admin sessions are invalidated by the change in derivation, so everyone logs in once more. * security(admin): key the signing-key cache on its inputs, not a digest #441 removed the SHA-256 digest of the admin password from the key derivation and introduced a new one three lines above it, as the cache key. Same rule, same file: CodeQL reported it immediately. The comment justifying it was wrong too. It claimed no second plaintext copy of the password was retained, while building the digest input allocates exactly that in order to hash it. The cache now holds the two input strings and compares them directly. They are the same objects the env and install caches already hold, so nothing extra is retained, and no fast hash of the password exists in memory for the life of the process. Re-verified after the change, in separate processes: a token from one process verifies in another with the same inputs, a changed password or secret rejects it, first derivation 24ms, cached calls 0.001ms. That leaves scrypt as the only place the password is hashed here. The two HMACs further down operate on the derived key and on token data, not on the password; the constant-time comparison in verifyAdminPassword is the previously dismissed one. --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
2026-08-14 16:55:07 +02:00
/**
* Card metadata for the theme picker. `font`, `radius` and `frame` mirror the
* real preset definitions in lib/config/theme.ts so the mini mockups show what
* the preset actually does; `gap` is the visual density of its gallery grid.
*/
const THEME_INFO: Record<
string,
{
desc: string;
label: string;
accent: string;
bg: string;
tile: string;
font: string;
type: 'serif' | 'sans' | 'mono';
radius: number;
frame: 'none' | 'passepartout' | 'shadow';
gap: number;
}
> = {
studio: {
label: 'Studio',
desc: 'Clean, high-contrast grid with sans-serif type.',
bg: '#141414',
tile: '#242424',
accent: '#e60012',
release: v0.11.0 — journal fixes, admin URLs, design system cleanup (#432) * fix(screenshots): sharp-Typen fuer 0.34 und 0.35 gleichzeitig (#410) sharp 0.35 ist von `export =` auf ESM umgestellt: der Modul-Namespace ist nicht mehr aufrufbar, die Factory sitzt unter .default. Der Type-Check brach damit in scripts/screenshots.ts weg, sobald der Next-Bump (#402) sharp von 0.34.5 auf 0.35.3 mitzieht -- sharp ist hier keine deklarierte Dependency, sondern kommt ueber Next mit. Die Form wird jetzt aus dem installierten Paket abgeleitet statt festgeschrieben, zur Laufzeit wie im Typ. Geprueft mit beiden Versionen: tsc laeuft mit 0.34.5 und mit 0.35.3 fehlerfrei durch. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(deps): bump the nextjs group across 1 directory with 2 updates (#402) Bumps the nextjs group with 2 updates in the / directory: [next](https://github.com/vercel/next.js) and [eslint-config-next](https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next). Updates `next` from 16.2.12 to 16.3.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/compare/v16.2.12...v16.3.0) Updates `eslint-config-next` from 16.2.12 to 16.3.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/commits/v16.3.0/packages/eslint-config-next) --- updated-dependencies: - dependency-name: eslint-config-next dependency-version: 16.3.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: nextjs - dependency-name: next dependency-version: 16.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nextjs ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps-dev): bump prettier from 3.8.3 to 3.9.6 (#405) Bumps [prettier](https://github.com/prettier/prettier) from 3.8.3 to 3.9.6. - [Release notes](https://github.com/prettier/prettier/releases) - [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md) - [Commits](https://github.com/prettier/prettier/compare/3.8.3...3.9.6) --- updated-dependencies: - dependency-name: prettier dependency-version: 3.9.6 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * docs(changelog): Unreleased-Sektion fuer die Bumps nach v0.10.0 (#413) Die Dependency-PRs sind nach dem Release auf dev gelandet, teils auch auf main. Ohne Eintrag waeren sie beim naechsten Release unsichtbar -- inklusive Next 16.3.0, das CVE-2025-13465 mitbringt. Ausserdem im 0.10.0-Abschnitt nachgetragen, dass der Trivy-Scan bis #409 nie gelaufen ist. Der Fix steckt im Tag v0.10.0, fehlte aber in der Aufzaehlung -- und "Images werden bei jedem Publish gescannt" stand im Changelog, waehrend der Job im Action-Setup abbrach. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(gallery): per-album sort order, independent of Immich (#408) (#414) Album order was dictated entirely by Immich: getAlbum() sorted by the album's own asc/desc flag, so a Folio album always mirrored the archive. A curated series has a narrative order that has nothing to do with capture time, and changing the Immich album's sort to fit the website changes it for the archive too. Adds an optional per-album `sort` in gallery.yaml, editable in /admin, defaulting to today's behaviour so every existing config is unchanged: immich (default) | newest | oldest | filename | manual `manual` is a pinned *prefix*: `assetOrder` lists only the photos placed by hand, everything else follows in the album's Immich order. A full permutation of a 2,000-photo album would be ~80 KB of UUIDs in a file that is rewritten and copied to content/.backups/ on every admin save. It also makes drift fall out for free — photos removed in Immich never match, new ones land in the tail rather than being hidden. Sorting is applied after the cache read, not before the cache write, so the LRU keeps one canonical Immich-ordered copy per album. That avoids putting the mode in the cache key, lets a config change take effect without depending on invalidation, and keeps the stale-serving path correct. cache.get() returns the stored object by reference, so withSort() returns a shallow clone with a new array — sorting in place would reorder the shared entry, and under request coalescing every concurrent caller would be sorting the same array. Also fixes a prerequisite bug: /api/admin/albums/[albumId]/assets read album.assets from GET /albums/:id, which Immich 3.x no longer populates (lib/immich.ts:507). The hero picker's "This Album" tab returned nothing and threw outright when the key was absent. It now goes through the client's paginated metadata search, with ?types=all to opt videos in for the reorder editor. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): drop decorative emoji from the sort select labels (#415) An <option> cannot contain markup, so the SVG set in Icons is not reachable there — but a decorative emoji is not a substitute for it. Plain text instead; the album card badge already uses a real icon. The remaining emoji in the admin panel (asset picker tabs, section headings, layout picker options) predate this branch and are left for a separate cleanup. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): replace emoji icons with the shared SVG icon set (#416) The admin panel mixed two icon conventions: inline SVGs from `Icons.tsx` in most components, and decorative emoji in the asset picker and a few PageBuilder labels. Emoji render inconsistently across platforms, ignore the accent colour, and cannot inherit the `.svg-icon` sizing rules. - Icons.tsx: add `IconStar` (filled — it marks a state, not an action) and `IconImage`. - AssetPicker: the three tab labels and the favourite tile badge now use IconFolder / IconStar / IconImage. - PageBuilder: the "Standalone Albums" and "Subpages" headings use the icon set instead of an emoji. - PageBuilder: the layout picker drops its emoji for plain text. An <option> cannot contain markup, so an SVG is impossible there and a decorative glyph is not a substitute. - admin.css: align icon and label in the picker tabs, and swap the favourite badge's text-shadow for drop-shadow, which is what applies to an inline SVG. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): fold PageBuilder's local icons into the shared Icons module (#418) * refactor(admin): fold PageBuilder's local icons into the shared module PageBuilder.tsx carried its own `Icons` object duplicating most of the glyphs already exported by Icons.tsx, with hardcoded sizes and slightly divergent paths. Migrate all 32 call sites to the shared module and delete the local object. Five glyphs had no counterpart and are added to Icons.tsx as 1:1 ports of the local paths: IconX, IconPlus, IconHome, IconCopy, IconImage. The local ExternalLink and Check are dropped rather than ported — both had zero call sites. Two glyphs change shape slightly, which is the point of consolidating: the shared IconCamera includes the viewfinder bump the local copy omitted, and drag handles now use IconGripVertical. IconGripVertical uses the module's square 24x24 viewBox, so `.svg-drag` goes from 12x18 to 18x18 — the old non-square box would letterbox the glyph down to 12x12 and shrink the handle. * fix(admin): resolve icon-module integration after #416 Merging dev brought in #416, which added a second IconImage to Icons.tsx and two <Icons.Camera>/<Icons.Folder> section headers that reference the local Icons object this PR removes. Git merged both cleanly but the result did not type-check. - drop the duplicate IconImage (both copies were byte-identical) - point the two section headers at the imported IconCamera/IconFolder - refresh the SORT_LABELS comment: the icon set is imported now, not declared below --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> * fix(config): allow an empty gallery, guard against a double /api suffix (#421) An empty gallery is now a valid, rendered state instead of a throw: deriveGallery() no longer requires at least one album or subpage, so a deployment with no albums yet renders a bare homepage the owner can fill in via /admin. getConfig() also stops appending /api to an Immich URL that already ends in it, which previously produced .../api/api and broke every upstream request. Includes a restore of the per-album sort test cases, which the branch had lost by being cut before #408/#414. * feat(admin): favicon upload, served from the content volume (#422) Adds a bundled default favicon, an upload widget in admin Settings > General, and a route that serves the icon from the writable content/ volume with a fallback to the bundled default. Raster uploads (PNG/ICO/JPEG) are wrapped in an SVG container; the response carries its own CSP so an uploaded SVG cannot execute script on the origin. The GET route revalidates with an ETag instead of caching immutably, so a newly uploaded icon shows up immediately. Uploads are written via temp file + rename, and a Reset button restores the bundled default. * ci: flag unformatted files in a PR, without blocking it (#424) Prettier is configured as an error rule in eslint.config.mjs but has never run in CI, so part of the tree predates it. A final CI step now diffs against the PR base, runs prettier --list-different over the changed files, and emits a warning annotation per offender plus a job summary. Advisory by design: it never fails the job. Blocking would turn a PR red for merely touching a file that was already unformatted, and normalising the tree in one commit would wreck git blame and conflict with the PRs in flight. Requires fetch-depth: 0, since diffing against the base needs its history. * feat(install): first-run wizard gated by a one-time setup token (#419) Adds /install, a four-step first-run wizard: connect to Immich, optionally pick albums, name the site, finish. It verifies the credentials against the Immich server before writing anything, then writes gallery.yaml, settings.yaml and a content/install.json carrying the Immich credentials and a generated site secret. install.json exists because a running process cannot pick up new env vars — the wizard has to write configuration that takes effect without a restart. getInstallCredentials() merges it under the real environment, so env vars always win and rotation stays a matter of setting one. Both the page and the API routes are gated by a one-time setup token printed to the server log, so a deployment that is reachable before gallery.yaml exists cannot be configured by whoever finds it first. The token is stored in content/.setup-token (0600) rather than a module variable: Next.js bundles the page and each route handler separately, so a module-level token left the page and the API disagreeing inside one process and the wizard stuck on step 1. It is removed once the install completes. The admin password is stored as an scrypt hash using the scheme lib/auth.ts already applies to album passwords; a plaintext ADMIN_PASSWORD env var keeps working. * docs: document the setup wizard, fix the read-only content mount (#425) Quick Start now leads with the /install wizard, with the hand-written YAML route kept alongside it, and a First-Run Setup section covers the setup token, the files the wizard writes, and env-var precedence. Two corrections: both Docker examples mounted content/ as :ro, which silently breaks the wizard, the admin panel and the backup rotation alike — docs/admin-panel.md already said so and the README contradicted it. And nothing documented that content/install.json holds the Immich API key, so a backup of content/ is a backup of credentials. Also adds a Contributors section crediting the people whose work is in the project. * feat(admin): floating save bar pinned to the bottom of the viewport (#426) The save bar was the first, static element inside .admin-main. Since the document itself scrolls, it left the viewport as soon as you scrolled down — editing a subpage section or a settings block far below gave no visible dirty hint and no reachable save button. Replace it with a bottom-pinned floating bar shared by both editors. It only mounts while there is something to act on (unsaved changes, an in-flight save, or a result message), so it never covers content while idle. The success message clears after 5s, which hides the bar again. - new SaveBar component, replacing the duplicated markup in PageBuilder and SettingsEditor - adopt the previously unused .floating-save-bar CSS: slide-in keyframes (carrying translateX(-50%)), dirty border, wrap/gap, mobile variant and a prefers-reduced-motion opt-out; z-index 900 keeps it below modals - .admin-main gains bottom padding so the bar never covers page content - drop the now-unreachable idle hints: the ⌘S hint becomes a button title, the Live Sync note becomes a static line above the settings layout - header "Site" link now bypasses the cache (/?fresh=1), so the preview stays reachable when the bar is hidden Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(admin): themed listbox for the album sort control (#427) The per-album "Photo order" control was a native <select>. Because an <option> cannot contain markup, its choices could not use the admin panel's currentColor SVG set — the reason #415 had to fall back to plain text after dropping the emoji labels. Adds a Listbox component implementing the ARIA combobox/listbox pattern, so options can render a glyph beside their label: - DOM focus stays on the trigger button; the active option is announced through aria-activedescendant, keeping focus management to one element - Keyboard: arrows (clamped at the ends, like a native select), Home/End, Enter/Space to commit, Escape to cancel, Tab commits and moves on, and prefix type-ahead with a repeat-key cycle - Outside dismissal on pointerdown, so a press starting outside closes the popup before the click retargets The sort options now carry an icon each: calendar, arrow-down, arrow-up, an A→Z marker, and the drag glyph for manual — matching the badge the album card already shows. SORT_LABELS stays plain text because the badge feeds it to a title attribute. Closes #417 Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(git): ignore generated design handoff folders * fix(admin): stop the album sort dropdown clipping, and simplify the panel (#428) * fix(admin): render listbox popup in a portal so it escapes modal clipping The sort control's popup was position:absolute inside three clipping ancestors (.album-drawer overflow:hidden > .album-drawer-body overflow-y:auto > .modal-right-column overflow-y:auto), so it was cut off at the bottom of the Edit Album Details modal. z-index could not help: clipping happens before stacking. It also always hung below the trigger, with no flip. Portal the popup to document.body and position it from the trigger's viewport rect, flipping above when there is more room there and capping max-height to the space available so it scrolls internally rather than overflowing. It is dismissed on scroll and resize, since the anchor is only measured on open. The outside-pointerdown handler now also treats the popup as inside; without that the portalled list counts as outside, and a click on an option would close it before the selection commits. * refactor(admin): single-column album details panel The left column spent 1.2fr on a cover thumbnail and three stat rows, two of which (Status, Custom Hero) only restated the form fields opposite them, while the form itself was squeezed into 1.8fr behind a second nested scroller. Stack the drawer in one column instead: cover as a banner, then the form at full width, with the UUID moved into the footer. The body is now the only scroll container, which also removes one of the ancestors that was clipping the sort popup. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> * fix(admin): give the portalled listbox its theme back, lock the page behind modals (#429) Two defects in the album editor. The sort listbox popup painted transparent. Every --admin-* variable is scoped to .admin-layout, and since the popup moved into document.body it sits outside that subtree, so background/border/text all resolved to nothing. It now carries its own copy of the palette in both colour schemes, plus the font it no longer inherits. Scrolling inside a modal also moved the page behind it. No admin modal ever locked body scroll: the overlay covers the page but does not absorb wheel events, so a scroll starting on the backdrop — or continuing past the end of the modal's own scroller — reaches the document. overscroll-behavior cannot cover that case on its own, because it only applies to scroll containers and the backdrop is not one. useScrollLock freezes body while a modal is open and compensates for the width the scrollbar gives up, so nothing shifts underneath. Each lock restores the inline value it found, which makes nesting work without a counter — a picker opened from the drawer restores the drawer's hidden state instead of clearing it. Applied to both drawers and all four picker modals, which share the defect. overscroll-behavior: contain on the scrollers stops the chaining they can handle themselves. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com> * fix(security): allow unsafe-eval in CSP script-src during dev mode * feat(journal): add Journal Studio with split-screen editor, live preview and dedicated routes * fix(build): separate client parser from server journal-service and fix build type errors * fix(journal): Fotos rendern, Layout und Lightbox-Steuerung korrigieren Fünf unabhängige Fehler in der öffentlichen Journal- und Essay-Ansicht: * Foto-Blöcke wurden nie angezeigt. EssayView löst ein Foto über PhotoItem.id auf, und das sind verschlüsselte Tokens — die Blöcke aus dem Markdown tragen aber rohe Asset-UUIDs. Jede Zuordnung lief ins Leere, und nicht auflösbare Blöcke werden still verworfen. Die IDs werden jetzt serverseitig übersetzt; damit verschwinden nebenbei die rohen UUIDs aus dem Client-Payload, die dort laut Projektregel nie auftauchen dürfen. Nicht auflösbare Referenzen werden geloggt. * Überschriften standen weiter links als der Fließtext. Jeder Block hatte einzeln `max-width: 68ch`, und `ch` ist relativ zur Schrift des Elements — die Serif-Überschrift ergab eine breitere Spalte. Ersetzt durch eine gemeinsame, font-unabhängige `--essay-measure`. * Fullbleed-Fotos bluteten nur nach links aus: `.essay-figure` ist `width: 100%`, wodurch die Box überbestimmt ist und der negative rechte Margin verworfen wird. * Foto-Paare stellten beide Bilder gleich breit dar, wodurch ein Hochformat neben einem Querformat doppelt so hoch wurde. Jetzt eine Justified-Reihe: Breite proportional zum Seitenverhältnis, dadurch exakt gleiche Höhen ohne Beschnitt. * Die Lightbox hatte im Journal keine Tastatursteuerung und keine Scroll-Sperre — beides lag in PhotoGrid, also nur im Album-Raster. Verlagert in die Lightbox selbst, der doppelte Handler in PhotoGrid entfernt (sonst wäre pro Pfeildruck zwei Bilder weitergesprungen). Zusätzlich sind Proofing-Herzen und das EXIF-Panel im redaktionellen Modus abschaltbar und im Journal aus: Client-Proofing ist ein Übergabe-Workflow für Alben, keine Funktion einer Reportage. Auf der Übersicht wurde der Untertitel doppelt gerendert, weil extractExcerpt() auf ihn zurückfällt. * feat(admin): eigene URLs für alle Bereiche und überarbeiteter Journal Studio Das Panel war eine einzige Client-Komponente, die ihre Tabs über useState umschaltet: keine Route pro Bereich, kein Deep-Link, kein Zurück-Button, und nach jedem Reload landete man wieder auf "Pages". Auch der Journal-Editor hatte keine eigene URL. Jetzt sieben echte Routen (/admin, /admin/pages, /admin/journal, /admin/journal/<slug>, /admin/settings, /admin/settings/<section>, /admin/analytics). Die Shell mit Auth-Prüfung und Kopfzeile sitzt im Layout und umschließt children — so bleibt die Session-Prüfung über Routenwechsel montiert, statt bei jedem Tab-Wechsel neu zu laufen und den Spinner aufblitzen zu lassen. Unbekannte Settings-Sections fallen auf General zurück. Im selben Zug der Journal Studio, der die Routing-Änderung ohnehin berührt: * Alle Eingabefelder nutzten die Klasse `admin-input`, die in keinem CSS definiert war — sie fielen auf Browser-Defaults zurück. Jetzt gestylt, gescoped, damit der generische Name nicht ins übrige Panel leckt. * Der Split View ist per Divider verschiebbar (Maus, Tastatur, Doppelklick zum Zurücksetzen), Breite in localStorage. * Das Studio bricht aus der 1120px-Spalte aus, die Preview hat Platz. * Die Preview zeigte für jedes Foto fest 3:2 und log damit über das Layout der veröffentlichten Seite; die echten Verhältnisse werden jetzt an den Thumbnails gemessen. * Blöcke mit alten positionsbasierten Foto-Referenzen werden markiert — die lassen sich auf einer eigenständigen Journal-Seite nicht auflösen und verschwanden bisher stillschweigend. * Blocktyp-Chips als gemeinsame Komponente, monochrom und per Icon unterschieden statt in einer eigenen Blau/Lila/Orange-Palette, die sonst nirgends im Panel vorkommt. * Emojis raus, SVG-Icons rein. * fix(admin): Designsystem-Lücken im Panel schließen Eine systematische Suche nach Klassen, die im TSX benutzt, aber in keinem CSS definiert sind, hat vier Stellen mit demselben Muster gefunden: * `admin-btn-secondary` und `admin-btn-danger` existierten nicht. Sämtliche Löschen-Buttons sahen aus wie normale Buttons — keine Warnwirkung. Als `.admin-btn.admin-btn-danger` geschrieben, weil die Varianten mit den Größenklassen kombiniert werden, die weiter unten ihren eigenen Hintergrund setzen. * `page-progress-fill` fehlte: die Balken im Analytics-Panel waren leere Rinnen, der Wert unsichtbar. Ebenso `analytics-empty` und `admin-loading-container`. * `subpage-drawer-section`, `subpage-drawer-title-group` und `input-with-icon` im PageBuilder waren wirkungslos und teils mit Inline-Styles notdürftig kompensiert. * `grid-card-preview` fehlte, wodurch alle Layout-Vorschauen auf Höhe null kollabierten. Nur "Showcase" war sichtbar — und das aus Versehen, weil sein Tile `hero-tile` hieß und damit die `aspect-ratio` einer fremden PageBuilder-Klasse erbte. Umbenannt. Dazu die Theme-Vorschauen, die praktisch identisch aussahen: alle sieben zeigten dieselben drei quadratischen Kacheln, einziger Unterschied war die Hintergrundfarbe. Sie spiegeln jetzt die echten Preset-Daten aus lib/config/theme.ts — Schriftcharakter, Eckradius, Rasterdichte, Passepartout bzw. Schatten. Die Kopfzeile richtet sich an einer gemeinsamen Steuerhöhe aus. Der "Site"-Link war höher als die Buttons daneben: `.admin-btn` hatte keine explizite line-height, und <button> bekommt box-sizing: border-box vom Browser, <a> nicht. Die Statusanzeige setzte weder Schriftfamilie noch -größe und fiel auf den Browser-Default zurück — sie war nie Teil des Designsystems. Jetzt gleiche Höhe und Typografie, Pillenform als Zustandsanzeige, Trenner zur Aktionsgruppe. Das dauerhafte Pulsieren des grünen Punkts entfällt; Animation bleibt den Zuständen vorbehalten, die Aufmerksamkeit brauchen. Restliche Emojis durch SVG-Icons ersetzt. * feat(admin): add scroll-to-top toggle and SVG arrow The back-to-top button was always on and drew its arrow with the ↑ text character. Add a `scrollToTop` setting (General section in the admin panel, defaults to on so existing sites are unaffected) and replace the glyph with a stroked SVG that inherits currentColor across all presets. Scroll handling is now rAF-throttled, and prefers-reduced-motion turns off both the hover lift and the smooth scroll. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * security(journal): escape author HTML instead of filtering it CodeQL flags 26 high-severity alerts on the release PR; the bulk of them point at sanitizeHtml(), a denylist of three regexes whose output goes into dangerouslySetInnerHTML. I reproduced the bypasses before changing anything — all four pass the old filter: <img src=x onerror=alert(1)> unquoted handler, regex wants quotes <img src=x onerror='alert(1)'> single quotes, same reason <svg onload=alert(1)> not a <script> tag javasjavascript:cript:alert(1) one-pass replace, the rest recombines Plus an attribute breakout in the link renderer, which interpolated the URL into href="${url}" unescaped: [x](" onmouseover=alert(1) x=") -> <a href="" onmouseover=alert(1" ...> Replaced with escaping. Every `&<>"'` in author text becomes an entity before any markdown rule runs, so the only tags in the output are the ones renderInlineMarkdown builds itself and a URL cannot leave its attribute. Link schemes are now an allowlist (http, https, mailto, tel, relative, anchor); anything else renders as plain text. The serializer needed decodeHtmlEntities to match: without it a save would write `&lt;` into the Markdown file and the next parse would escape the `&` again, corrupting the text further on every round trip. A test covers parse -> serialize -> parse stability. Two existing tests asserted the old behaviour and were rewritten rather than deleted: one expected the script tag to be *removed* from the output, the other expected the substring "onerror" to be absent. Both now assert the property that matters — that no tag can form — because `onerror` surviving as inert text is fine. Exploitation required admin access either way: journal and essay text comes from the studio or from content/*.md. This removes the weakness, it does not close an open door. * fix(journal): contain file paths, fix frontmatter escaping, defuse two regexes Follow-up to the CodeQL findings on release PR #432. I went through all 23 alerts individually; this addresses the ones that are worth addressing and documents the ones that are not. Path containment (12 alerts, all false positives). Every path built from a slug goes through isValidSlug(), a strict `/^[a-zA-Z0-9_-]+$/` allowlist — verified against `../../etc/passwd`, `foo/../../bar`, `a/b`, `..` and friends, all rejected. CodeQL cannot see it because the check lives in another module. Added a containedPath() helper that resolves the path and refuses anything landing outside the content directory: a second lock on a door that was already locked, and a barrier the analysis can follow. Also removed the dead `slug.endsWith('.md')` branches — isValidSlug rejects dots, so they could never be taken. Frontmatter escaping (1 alert, a real bug). The serializer escaped `"` but not `\`, and the parser never unescaped anything. A title containing either character gained a backslash on every save/load cycle: Path C:\Users "quoted" -> Path C:\\Users \"quoted\" -> ... Escaping now covers the backslash first and the parser undoes both. A round trip test covers quotes, backslashes, colons and apostrophes. Two of three ReDoS regexes (2 alerts). The heading pattern had `\s+` next to `(.+)`, which overlap, so the engine tried every split of the whitespace run before failing; it is `[ \t]+` and `(\S.*)` now. The quote author pattern wrapped a lazy group around an optional group — the quadratic case — and is an index split on the first separator now. The third regex, the bold/italic pass, is deliberately left alone. Rewriting it with a negated class removes the backtracking but breaks nesting: `**bold *and italic* here**` renders as `*<em>bold </em>and italic<em> here</em>*`. The input is Markdown from an authenticated admin, never a visitor, so the worst case is an author slowing down their own page. The comment in the code says so. Not addressed: 5 js/insufficient-password-hash alerts. They ask for a slow KDF where the code uses SHA-256/HMAC — correct in general, but the admin password comes from an environment variable and is never stored, so a stronger KDF protects nothing that is not already in plaintext in the environment. 399 unit tests pass (18 new), build and tsc clean. * fix(journal): split the quote author by scanning, not by pattern Cleaning up after myself. #439 replaced the quote author regex `/^(.*?)(?:\s+--\s+(.+))?$/` — a lazy group around an optional one, the quadratic case — with `/\s+--\s+/`, and CodeQL promptly flagged the replacement for the same reason. One reported pattern traded for another. splitQuoteAuthor() scans for the first `--` that has whitespace on both sides. Linear, and it needs no reasoning about the regex engine at all. Behaviour is identical to the original regex, checked case by case against it: separator, no separator, several separators, tabs, wide gaps, `a--b` without spaces, leading and trailing separators, empty string. All nine are covered by tests, plus one asserting it stays fast on a 50k whitespace run. * security(admin): derive the session signing key with scrypt getSigningKey() ran the admin password through a single SHA-256 digest. It is key derivation rather than password storage, so it was never a stored-hash problem — but if the derived key ever leaked, one fast hash makes recovering the password by brute force cheap. CodeQL flags it as js/insufficient-password-hash and, for this particular alert, has a point. scrypt now. Two details that matter: The salt has to be stable. A random salt would produce a different key on every call and invalidate every session; it is derived from AUTH_SECRET, which is deployment-specific. Verified across separate processes: same inputs produce a verifying token, so a restart or redeploy does not log everyone out. The result is cached for the process lifetime. scrypt is deliberately slow and getSigningKey() runs on every admin request — deriving per call would add ~24ms to each one. The cache key is a digest of secret plus password, so a rotation misses the cache and derives again, and no extra plaintext copy of the password is kept around. Measured: first derivation 24ms, subsequent calls 0.12ms. Password change and secret change both invalidate an existing token, checked in separate processes. Note the one-time effect: existing admin sessions are invalidated by the change in derivation, so everyone logs in once more. * security(admin): key the signing-key cache on its inputs, not a digest #441 removed the SHA-256 digest of the admin password from the key derivation and introduced a new one three lines above it, as the cache key. Same rule, same file: CodeQL reported it immediately. The comment justifying it was wrong too. It claimed no second plaintext copy of the password was retained, while building the digest input allocates exactly that in order to hash it. The cache now holds the two input strings and compares them directly. They are the same objects the env and install caches already hold, so nothing extra is retained, and no fast hash of the password exists in memory for the life of the process. Re-verified after the change, in separate processes: a token from one process verifies in another with the same inputs, a changed password or secret rejects it, first derivation 24ms, cached calls 0.001ms. That leaves scrypt as the only place the password is hashed here. The two HMACs further down operate on the derived key and on token data, not on the password; the constant-time comparison in verifyAdminPassword is the previously dismissed one. --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
2026-08-14 16:55:07 +02:00
font: 'Playfair Display',
type: 'serif',
radius: 0,
frame: 'passepartout',
gap: 4,
},
'studio-modern': {
label: 'Studio Modern',
desc: 'Leica precision: Archivo grotesque, mono EXIF, red signal accents.',
bg: '#121212',
tile: '#191919',
accent: '#e60012',
release: v0.11.0 — journal fixes, admin URLs, design system cleanup (#432) * fix(screenshots): sharp-Typen fuer 0.34 und 0.35 gleichzeitig (#410) sharp 0.35 ist von `export =` auf ESM umgestellt: der Modul-Namespace ist nicht mehr aufrufbar, die Factory sitzt unter .default. Der Type-Check brach damit in scripts/screenshots.ts weg, sobald der Next-Bump (#402) sharp von 0.34.5 auf 0.35.3 mitzieht -- sharp ist hier keine deklarierte Dependency, sondern kommt ueber Next mit. Die Form wird jetzt aus dem installierten Paket abgeleitet statt festgeschrieben, zur Laufzeit wie im Typ. Geprueft mit beiden Versionen: tsc laeuft mit 0.34.5 und mit 0.35.3 fehlerfrei durch. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(deps): bump the nextjs group across 1 directory with 2 updates (#402) Bumps the nextjs group with 2 updates in the / directory: [next](https://github.com/vercel/next.js) and [eslint-config-next](https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next). Updates `next` from 16.2.12 to 16.3.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/compare/v16.2.12...v16.3.0) Updates `eslint-config-next` from 16.2.12 to 16.3.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/commits/v16.3.0/packages/eslint-config-next) --- updated-dependencies: - dependency-name: eslint-config-next dependency-version: 16.3.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: nextjs - dependency-name: next dependency-version: 16.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nextjs ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps-dev): bump prettier from 3.8.3 to 3.9.6 (#405) Bumps [prettier](https://github.com/prettier/prettier) from 3.8.3 to 3.9.6. - [Release notes](https://github.com/prettier/prettier/releases) - [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md) - [Commits](https://github.com/prettier/prettier/compare/3.8.3...3.9.6) --- updated-dependencies: - dependency-name: prettier dependency-version: 3.9.6 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * docs(changelog): Unreleased-Sektion fuer die Bumps nach v0.10.0 (#413) Die Dependency-PRs sind nach dem Release auf dev gelandet, teils auch auf main. Ohne Eintrag waeren sie beim naechsten Release unsichtbar -- inklusive Next 16.3.0, das CVE-2025-13465 mitbringt. Ausserdem im 0.10.0-Abschnitt nachgetragen, dass der Trivy-Scan bis #409 nie gelaufen ist. Der Fix steckt im Tag v0.10.0, fehlte aber in der Aufzaehlung -- und "Images werden bei jedem Publish gescannt" stand im Changelog, waehrend der Job im Action-Setup abbrach. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(gallery): per-album sort order, independent of Immich (#408) (#414) Album order was dictated entirely by Immich: getAlbum() sorted by the album's own asc/desc flag, so a Folio album always mirrored the archive. A curated series has a narrative order that has nothing to do with capture time, and changing the Immich album's sort to fit the website changes it for the archive too. Adds an optional per-album `sort` in gallery.yaml, editable in /admin, defaulting to today's behaviour so every existing config is unchanged: immich (default) | newest | oldest | filename | manual `manual` is a pinned *prefix*: `assetOrder` lists only the photos placed by hand, everything else follows in the album's Immich order. A full permutation of a 2,000-photo album would be ~80 KB of UUIDs in a file that is rewritten and copied to content/.backups/ on every admin save. It also makes drift fall out for free — photos removed in Immich never match, new ones land in the tail rather than being hidden. Sorting is applied after the cache read, not before the cache write, so the LRU keeps one canonical Immich-ordered copy per album. That avoids putting the mode in the cache key, lets a config change take effect without depending on invalidation, and keeps the stale-serving path correct. cache.get() returns the stored object by reference, so withSort() returns a shallow clone with a new array — sorting in place would reorder the shared entry, and under request coalescing every concurrent caller would be sorting the same array. Also fixes a prerequisite bug: /api/admin/albums/[albumId]/assets read album.assets from GET /albums/:id, which Immich 3.x no longer populates (lib/immich.ts:507). The hero picker's "This Album" tab returned nothing and threw outright when the key was absent. It now goes through the client's paginated metadata search, with ?types=all to opt videos in for the reorder editor. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): drop decorative emoji from the sort select labels (#415) An <option> cannot contain markup, so the SVG set in Icons is not reachable there — but a decorative emoji is not a substitute for it. Plain text instead; the album card badge already uses a real icon. The remaining emoji in the admin panel (asset picker tabs, section headings, layout picker options) predate this branch and are left for a separate cleanup. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): replace emoji icons with the shared SVG icon set (#416) The admin panel mixed two icon conventions: inline SVGs from `Icons.tsx` in most components, and decorative emoji in the asset picker and a few PageBuilder labels. Emoji render inconsistently across platforms, ignore the accent colour, and cannot inherit the `.svg-icon` sizing rules. - Icons.tsx: add `IconStar` (filled — it marks a state, not an action) and `IconImage`. - AssetPicker: the three tab labels and the favourite tile badge now use IconFolder / IconStar / IconImage. - PageBuilder: the "Standalone Albums" and "Subpages" headings use the icon set instead of an emoji. - PageBuilder: the layout picker drops its emoji for plain text. An <option> cannot contain markup, so an SVG is impossible there and a decorative glyph is not a substitute. - admin.css: align icon and label in the picker tabs, and swap the favourite badge's text-shadow for drop-shadow, which is what applies to an inline SVG. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): fold PageBuilder's local icons into the shared Icons module (#418) * refactor(admin): fold PageBuilder's local icons into the shared module PageBuilder.tsx carried its own `Icons` object duplicating most of the glyphs already exported by Icons.tsx, with hardcoded sizes and slightly divergent paths. Migrate all 32 call sites to the shared module and delete the local object. Five glyphs had no counterpart and are added to Icons.tsx as 1:1 ports of the local paths: IconX, IconPlus, IconHome, IconCopy, IconImage. The local ExternalLink and Check are dropped rather than ported — both had zero call sites. Two glyphs change shape slightly, which is the point of consolidating: the shared IconCamera includes the viewfinder bump the local copy omitted, and drag handles now use IconGripVertical. IconGripVertical uses the module's square 24x24 viewBox, so `.svg-drag` goes from 12x18 to 18x18 — the old non-square box would letterbox the glyph down to 12x12 and shrink the handle. * fix(admin): resolve icon-module integration after #416 Merging dev brought in #416, which added a second IconImage to Icons.tsx and two <Icons.Camera>/<Icons.Folder> section headers that reference the local Icons object this PR removes. Git merged both cleanly but the result did not type-check. - drop the duplicate IconImage (both copies were byte-identical) - point the two section headers at the imported IconCamera/IconFolder - refresh the SORT_LABELS comment: the icon set is imported now, not declared below --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> * fix(config): allow an empty gallery, guard against a double /api suffix (#421) An empty gallery is now a valid, rendered state instead of a throw: deriveGallery() no longer requires at least one album or subpage, so a deployment with no albums yet renders a bare homepage the owner can fill in via /admin. getConfig() also stops appending /api to an Immich URL that already ends in it, which previously produced .../api/api and broke every upstream request. Includes a restore of the per-album sort test cases, which the branch had lost by being cut before #408/#414. * feat(admin): favicon upload, served from the content volume (#422) Adds a bundled default favicon, an upload widget in admin Settings > General, and a route that serves the icon from the writable content/ volume with a fallback to the bundled default. Raster uploads (PNG/ICO/JPEG) are wrapped in an SVG container; the response carries its own CSP so an uploaded SVG cannot execute script on the origin. The GET route revalidates with an ETag instead of caching immutably, so a newly uploaded icon shows up immediately. Uploads are written via temp file + rename, and a Reset button restores the bundled default. * ci: flag unformatted files in a PR, without blocking it (#424) Prettier is configured as an error rule in eslint.config.mjs but has never run in CI, so part of the tree predates it. A final CI step now diffs against the PR base, runs prettier --list-different over the changed files, and emits a warning annotation per offender plus a job summary. Advisory by design: it never fails the job. Blocking would turn a PR red for merely touching a file that was already unformatted, and normalising the tree in one commit would wreck git blame and conflict with the PRs in flight. Requires fetch-depth: 0, since diffing against the base needs its history. * feat(install): first-run wizard gated by a one-time setup token (#419) Adds /install, a four-step first-run wizard: connect to Immich, optionally pick albums, name the site, finish. It verifies the credentials against the Immich server before writing anything, then writes gallery.yaml, settings.yaml and a content/install.json carrying the Immich credentials and a generated site secret. install.json exists because a running process cannot pick up new env vars — the wizard has to write configuration that takes effect without a restart. getInstallCredentials() merges it under the real environment, so env vars always win and rotation stays a matter of setting one. Both the page and the API routes are gated by a one-time setup token printed to the server log, so a deployment that is reachable before gallery.yaml exists cannot be configured by whoever finds it first. The token is stored in content/.setup-token (0600) rather than a module variable: Next.js bundles the page and each route handler separately, so a module-level token left the page and the API disagreeing inside one process and the wizard stuck on step 1. It is removed once the install completes. The admin password is stored as an scrypt hash using the scheme lib/auth.ts already applies to album passwords; a plaintext ADMIN_PASSWORD env var keeps working. * docs: document the setup wizard, fix the read-only content mount (#425) Quick Start now leads with the /install wizard, with the hand-written YAML route kept alongside it, and a First-Run Setup section covers the setup token, the files the wizard writes, and env-var precedence. Two corrections: both Docker examples mounted content/ as :ro, which silently breaks the wizard, the admin panel and the backup rotation alike — docs/admin-panel.md already said so and the README contradicted it. And nothing documented that content/install.json holds the Immich API key, so a backup of content/ is a backup of credentials. Also adds a Contributors section crediting the people whose work is in the project. * feat(admin): floating save bar pinned to the bottom of the viewport (#426) The save bar was the first, static element inside .admin-main. Since the document itself scrolls, it left the viewport as soon as you scrolled down — editing a subpage section or a settings block far below gave no visible dirty hint and no reachable save button. Replace it with a bottom-pinned floating bar shared by both editors. It only mounts while there is something to act on (unsaved changes, an in-flight save, or a result message), so it never covers content while idle. The success message clears after 5s, which hides the bar again. - new SaveBar component, replacing the duplicated markup in PageBuilder and SettingsEditor - adopt the previously unused .floating-save-bar CSS: slide-in keyframes (carrying translateX(-50%)), dirty border, wrap/gap, mobile variant and a prefers-reduced-motion opt-out; z-index 900 keeps it below modals - .admin-main gains bottom padding so the bar never covers page content - drop the now-unreachable idle hints: the ⌘S hint becomes a button title, the Live Sync note becomes a static line above the settings layout - header "Site" link now bypasses the cache (/?fresh=1), so the preview stays reachable when the bar is hidden Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(admin): themed listbox for the album sort control (#427) The per-album "Photo order" control was a native <select>. Because an <option> cannot contain markup, its choices could not use the admin panel's currentColor SVG set — the reason #415 had to fall back to plain text after dropping the emoji labels. Adds a Listbox component implementing the ARIA combobox/listbox pattern, so options can render a glyph beside their label: - DOM focus stays on the trigger button; the active option is announced through aria-activedescendant, keeping focus management to one element - Keyboard: arrows (clamped at the ends, like a native select), Home/End, Enter/Space to commit, Escape to cancel, Tab commits and moves on, and prefix type-ahead with a repeat-key cycle - Outside dismissal on pointerdown, so a press starting outside closes the popup before the click retargets The sort options now carry an icon each: calendar, arrow-down, arrow-up, an A→Z marker, and the drag glyph for manual — matching the badge the album card already shows. SORT_LABELS stays plain text because the badge feeds it to a title attribute. Closes #417 Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(git): ignore generated design handoff folders * fix(admin): stop the album sort dropdown clipping, and simplify the panel (#428) * fix(admin): render listbox popup in a portal so it escapes modal clipping The sort control's popup was position:absolute inside three clipping ancestors (.album-drawer overflow:hidden > .album-drawer-body overflow-y:auto > .modal-right-column overflow-y:auto), so it was cut off at the bottom of the Edit Album Details modal. z-index could not help: clipping happens before stacking. It also always hung below the trigger, with no flip. Portal the popup to document.body and position it from the trigger's viewport rect, flipping above when there is more room there and capping max-height to the space available so it scrolls internally rather than overflowing. It is dismissed on scroll and resize, since the anchor is only measured on open. The outside-pointerdown handler now also treats the popup as inside; without that the portalled list counts as outside, and a click on an option would close it before the selection commits. * refactor(admin): single-column album details panel The left column spent 1.2fr on a cover thumbnail and three stat rows, two of which (Status, Custom Hero) only restated the form fields opposite them, while the form itself was squeezed into 1.8fr behind a second nested scroller. Stack the drawer in one column instead: cover as a banner, then the form at full width, with the UUID moved into the footer. The body is now the only scroll container, which also removes one of the ancestors that was clipping the sort popup. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> * fix(admin): give the portalled listbox its theme back, lock the page behind modals (#429) Two defects in the album editor. The sort listbox popup painted transparent. Every --admin-* variable is scoped to .admin-layout, and since the popup moved into document.body it sits outside that subtree, so background/border/text all resolved to nothing. It now carries its own copy of the palette in both colour schemes, plus the font it no longer inherits. Scrolling inside a modal also moved the page behind it. No admin modal ever locked body scroll: the overlay covers the page but does not absorb wheel events, so a scroll starting on the backdrop — or continuing past the end of the modal's own scroller — reaches the document. overscroll-behavior cannot cover that case on its own, because it only applies to scroll containers and the backdrop is not one. useScrollLock freezes body while a modal is open and compensates for the width the scrollbar gives up, so nothing shifts underneath. Each lock restores the inline value it found, which makes nesting work without a counter — a picker opened from the drawer restores the drawer's hidden state instead of clearing it. Applied to both drawers and all four picker modals, which share the defect. overscroll-behavior: contain on the scrollers stops the chaining they can handle themselves. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com> * fix(security): allow unsafe-eval in CSP script-src during dev mode * feat(journal): add Journal Studio with split-screen editor, live preview and dedicated routes * fix(build): separate client parser from server journal-service and fix build type errors * fix(journal): Fotos rendern, Layout und Lightbox-Steuerung korrigieren Fünf unabhängige Fehler in der öffentlichen Journal- und Essay-Ansicht: * Foto-Blöcke wurden nie angezeigt. EssayView löst ein Foto über PhotoItem.id auf, und das sind verschlüsselte Tokens — die Blöcke aus dem Markdown tragen aber rohe Asset-UUIDs. Jede Zuordnung lief ins Leere, und nicht auflösbare Blöcke werden still verworfen. Die IDs werden jetzt serverseitig übersetzt; damit verschwinden nebenbei die rohen UUIDs aus dem Client-Payload, die dort laut Projektregel nie auftauchen dürfen. Nicht auflösbare Referenzen werden geloggt. * Überschriften standen weiter links als der Fließtext. Jeder Block hatte einzeln `max-width: 68ch`, und `ch` ist relativ zur Schrift des Elements — die Serif-Überschrift ergab eine breitere Spalte. Ersetzt durch eine gemeinsame, font-unabhängige `--essay-measure`. * Fullbleed-Fotos bluteten nur nach links aus: `.essay-figure` ist `width: 100%`, wodurch die Box überbestimmt ist und der negative rechte Margin verworfen wird. * Foto-Paare stellten beide Bilder gleich breit dar, wodurch ein Hochformat neben einem Querformat doppelt so hoch wurde. Jetzt eine Justified-Reihe: Breite proportional zum Seitenverhältnis, dadurch exakt gleiche Höhen ohne Beschnitt. * Die Lightbox hatte im Journal keine Tastatursteuerung und keine Scroll-Sperre — beides lag in PhotoGrid, also nur im Album-Raster. Verlagert in die Lightbox selbst, der doppelte Handler in PhotoGrid entfernt (sonst wäre pro Pfeildruck zwei Bilder weitergesprungen). Zusätzlich sind Proofing-Herzen und das EXIF-Panel im redaktionellen Modus abschaltbar und im Journal aus: Client-Proofing ist ein Übergabe-Workflow für Alben, keine Funktion einer Reportage. Auf der Übersicht wurde der Untertitel doppelt gerendert, weil extractExcerpt() auf ihn zurückfällt. * feat(admin): eigene URLs für alle Bereiche und überarbeiteter Journal Studio Das Panel war eine einzige Client-Komponente, die ihre Tabs über useState umschaltet: keine Route pro Bereich, kein Deep-Link, kein Zurück-Button, und nach jedem Reload landete man wieder auf "Pages". Auch der Journal-Editor hatte keine eigene URL. Jetzt sieben echte Routen (/admin, /admin/pages, /admin/journal, /admin/journal/<slug>, /admin/settings, /admin/settings/<section>, /admin/analytics). Die Shell mit Auth-Prüfung und Kopfzeile sitzt im Layout und umschließt children — so bleibt die Session-Prüfung über Routenwechsel montiert, statt bei jedem Tab-Wechsel neu zu laufen und den Spinner aufblitzen zu lassen. Unbekannte Settings-Sections fallen auf General zurück. Im selben Zug der Journal Studio, der die Routing-Änderung ohnehin berührt: * Alle Eingabefelder nutzten die Klasse `admin-input`, die in keinem CSS definiert war — sie fielen auf Browser-Defaults zurück. Jetzt gestylt, gescoped, damit der generische Name nicht ins übrige Panel leckt. * Der Split View ist per Divider verschiebbar (Maus, Tastatur, Doppelklick zum Zurücksetzen), Breite in localStorage. * Das Studio bricht aus der 1120px-Spalte aus, die Preview hat Platz. * Die Preview zeigte für jedes Foto fest 3:2 und log damit über das Layout der veröffentlichten Seite; die echten Verhältnisse werden jetzt an den Thumbnails gemessen. * Blöcke mit alten positionsbasierten Foto-Referenzen werden markiert — die lassen sich auf einer eigenständigen Journal-Seite nicht auflösen und verschwanden bisher stillschweigend. * Blocktyp-Chips als gemeinsame Komponente, monochrom und per Icon unterschieden statt in einer eigenen Blau/Lila/Orange-Palette, die sonst nirgends im Panel vorkommt. * Emojis raus, SVG-Icons rein. * fix(admin): Designsystem-Lücken im Panel schließen Eine systematische Suche nach Klassen, die im TSX benutzt, aber in keinem CSS definiert sind, hat vier Stellen mit demselben Muster gefunden: * `admin-btn-secondary` und `admin-btn-danger` existierten nicht. Sämtliche Löschen-Buttons sahen aus wie normale Buttons — keine Warnwirkung. Als `.admin-btn.admin-btn-danger` geschrieben, weil die Varianten mit den Größenklassen kombiniert werden, die weiter unten ihren eigenen Hintergrund setzen. * `page-progress-fill` fehlte: die Balken im Analytics-Panel waren leere Rinnen, der Wert unsichtbar. Ebenso `analytics-empty` und `admin-loading-container`. * `subpage-drawer-section`, `subpage-drawer-title-group` und `input-with-icon` im PageBuilder waren wirkungslos und teils mit Inline-Styles notdürftig kompensiert. * `grid-card-preview` fehlte, wodurch alle Layout-Vorschauen auf Höhe null kollabierten. Nur "Showcase" war sichtbar — und das aus Versehen, weil sein Tile `hero-tile` hieß und damit die `aspect-ratio` einer fremden PageBuilder-Klasse erbte. Umbenannt. Dazu die Theme-Vorschauen, die praktisch identisch aussahen: alle sieben zeigten dieselben drei quadratischen Kacheln, einziger Unterschied war die Hintergrundfarbe. Sie spiegeln jetzt die echten Preset-Daten aus lib/config/theme.ts — Schriftcharakter, Eckradius, Rasterdichte, Passepartout bzw. Schatten. Die Kopfzeile richtet sich an einer gemeinsamen Steuerhöhe aus. Der "Site"-Link war höher als die Buttons daneben: `.admin-btn` hatte keine explizite line-height, und <button> bekommt box-sizing: border-box vom Browser, <a> nicht. Die Statusanzeige setzte weder Schriftfamilie noch -größe und fiel auf den Browser-Default zurück — sie war nie Teil des Designsystems. Jetzt gleiche Höhe und Typografie, Pillenform als Zustandsanzeige, Trenner zur Aktionsgruppe. Das dauerhafte Pulsieren des grünen Punkts entfällt; Animation bleibt den Zuständen vorbehalten, die Aufmerksamkeit brauchen. Restliche Emojis durch SVG-Icons ersetzt. * feat(admin): add scroll-to-top toggle and SVG arrow The back-to-top button was always on and drew its arrow with the ↑ text character. Add a `scrollToTop` setting (General section in the admin panel, defaults to on so existing sites are unaffected) and replace the glyph with a stroked SVG that inherits currentColor across all presets. Scroll handling is now rAF-throttled, and prefers-reduced-motion turns off both the hover lift and the smooth scroll. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * security(journal): escape author HTML instead of filtering it CodeQL flags 26 high-severity alerts on the release PR; the bulk of them point at sanitizeHtml(), a denylist of three regexes whose output goes into dangerouslySetInnerHTML. I reproduced the bypasses before changing anything — all four pass the old filter: <img src=x onerror=alert(1)> unquoted handler, regex wants quotes <img src=x onerror='alert(1)'> single quotes, same reason <svg onload=alert(1)> not a <script> tag javasjavascript:cript:alert(1) one-pass replace, the rest recombines Plus an attribute breakout in the link renderer, which interpolated the URL into href="${url}" unescaped: [x](" onmouseover=alert(1) x=") -> <a href="" onmouseover=alert(1" ...> Replaced with escaping. Every `&<>"'` in author text becomes an entity before any markdown rule runs, so the only tags in the output are the ones renderInlineMarkdown builds itself and a URL cannot leave its attribute. Link schemes are now an allowlist (http, https, mailto, tel, relative, anchor); anything else renders as plain text. The serializer needed decodeHtmlEntities to match: without it a save would write `&lt;` into the Markdown file and the next parse would escape the `&` again, corrupting the text further on every round trip. A test covers parse -> serialize -> parse stability. Two existing tests asserted the old behaviour and were rewritten rather than deleted: one expected the script tag to be *removed* from the output, the other expected the substring "onerror" to be absent. Both now assert the property that matters — that no tag can form — because `onerror` surviving as inert text is fine. Exploitation required admin access either way: journal and essay text comes from the studio or from content/*.md. This removes the weakness, it does not close an open door. * fix(journal): contain file paths, fix frontmatter escaping, defuse two regexes Follow-up to the CodeQL findings on release PR #432. I went through all 23 alerts individually; this addresses the ones that are worth addressing and documents the ones that are not. Path containment (12 alerts, all false positives). Every path built from a slug goes through isValidSlug(), a strict `/^[a-zA-Z0-9_-]+$/` allowlist — verified against `../../etc/passwd`, `foo/../../bar`, `a/b`, `..` and friends, all rejected. CodeQL cannot see it because the check lives in another module. Added a containedPath() helper that resolves the path and refuses anything landing outside the content directory: a second lock on a door that was already locked, and a barrier the analysis can follow. Also removed the dead `slug.endsWith('.md')` branches — isValidSlug rejects dots, so they could never be taken. Frontmatter escaping (1 alert, a real bug). The serializer escaped `"` but not `\`, and the parser never unescaped anything. A title containing either character gained a backslash on every save/load cycle: Path C:\Users "quoted" -> Path C:\\Users \"quoted\" -> ... Escaping now covers the backslash first and the parser undoes both. A round trip test covers quotes, backslashes, colons and apostrophes. Two of three ReDoS regexes (2 alerts). The heading pattern had `\s+` next to `(.+)`, which overlap, so the engine tried every split of the whitespace run before failing; it is `[ \t]+` and `(\S.*)` now. The quote author pattern wrapped a lazy group around an optional group — the quadratic case — and is an index split on the first separator now. The third regex, the bold/italic pass, is deliberately left alone. Rewriting it with a negated class removes the backtracking but breaks nesting: `**bold *and italic* here**` renders as `*<em>bold </em>and italic<em> here</em>*`. The input is Markdown from an authenticated admin, never a visitor, so the worst case is an author slowing down their own page. The comment in the code says so. Not addressed: 5 js/insufficient-password-hash alerts. They ask for a slow KDF where the code uses SHA-256/HMAC — correct in general, but the admin password comes from an environment variable and is never stored, so a stronger KDF protects nothing that is not already in plaintext in the environment. 399 unit tests pass (18 new), build and tsc clean. * fix(journal): split the quote author by scanning, not by pattern Cleaning up after myself. #439 replaced the quote author regex `/^(.*?)(?:\s+--\s+(.+))?$/` — a lazy group around an optional one, the quadratic case — with `/\s+--\s+/`, and CodeQL promptly flagged the replacement for the same reason. One reported pattern traded for another. splitQuoteAuthor() scans for the first `--` that has whitespace on both sides. Linear, and it needs no reasoning about the regex engine at all. Behaviour is identical to the original regex, checked case by case against it: separator, no separator, several separators, tabs, wide gaps, `a--b` without spaces, leading and trailing separators, empty string. All nine are covered by tests, plus one asserting it stays fast on a 50k whitespace run. * security(admin): derive the session signing key with scrypt getSigningKey() ran the admin password through a single SHA-256 digest. It is key derivation rather than password storage, so it was never a stored-hash problem — but if the derived key ever leaked, one fast hash makes recovering the password by brute force cheap. CodeQL flags it as js/insufficient-password-hash and, for this particular alert, has a point. scrypt now. Two details that matter: The salt has to be stable. A random salt would produce a different key on every call and invalidate every session; it is derived from AUTH_SECRET, which is deployment-specific. Verified across separate processes: same inputs produce a verifying token, so a restart or redeploy does not log everyone out. The result is cached for the process lifetime. scrypt is deliberately slow and getSigningKey() runs on every admin request — deriving per call would add ~24ms to each one. The cache key is a digest of secret plus password, so a rotation misses the cache and derives again, and no extra plaintext copy of the password is kept around. Measured: first derivation 24ms, subsequent calls 0.12ms. Password change and secret change both invalidate an existing token, checked in separate processes. Note the one-time effect: existing admin sessions are invalidated by the change in derivation, so everyone logs in once more. * security(admin): key the signing-key cache on its inputs, not a digest #441 removed the SHA-256 digest of the admin password from the key derivation and introduced a new one three lines above it, as the cache key. Same rule, same file: CodeQL reported it immediately. The comment justifying it was wrong too. It claimed no second plaintext copy of the password was retained, while building the digest input allocates exactly that in order to hash it. The cache now holds the two input strings and compares them directly. They are the same objects the env and install caches already hold, so nothing extra is retained, and no fast hash of the password exists in memory for the life of the process. Re-verified after the change, in separate processes: a token from one process verifies in another with the same inputs, a changed password or secret rejects it, first derivation 24ms, cached calls 0.001ms. That leaves scrypt as the only place the password is hashed here. The two HMACs further down operate on the derived key and on token data, not on the password; the constant-time comparison in verifyAdminPassword is the previously dismissed one. --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
2026-08-14 16:55:07 +02:00
font: 'Archivo',
type: 'sans',
radius: 0,
frame: 'none',
gap: 3,
},
minimal: {
label: 'Minimal',
desc: 'Pure raw layouts with tiny gaps and high whitespace.',
bg: '#ffffff',
tile: '#f3f3f3',
accent: '#111111',
release: v0.11.0 — journal fixes, admin URLs, design system cleanup (#432) * fix(screenshots): sharp-Typen fuer 0.34 und 0.35 gleichzeitig (#410) sharp 0.35 ist von `export =` auf ESM umgestellt: der Modul-Namespace ist nicht mehr aufrufbar, die Factory sitzt unter .default. Der Type-Check brach damit in scripts/screenshots.ts weg, sobald der Next-Bump (#402) sharp von 0.34.5 auf 0.35.3 mitzieht -- sharp ist hier keine deklarierte Dependency, sondern kommt ueber Next mit. Die Form wird jetzt aus dem installierten Paket abgeleitet statt festgeschrieben, zur Laufzeit wie im Typ. Geprueft mit beiden Versionen: tsc laeuft mit 0.34.5 und mit 0.35.3 fehlerfrei durch. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(deps): bump the nextjs group across 1 directory with 2 updates (#402) Bumps the nextjs group with 2 updates in the / directory: [next](https://github.com/vercel/next.js) and [eslint-config-next](https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next). Updates `next` from 16.2.12 to 16.3.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/compare/v16.2.12...v16.3.0) Updates `eslint-config-next` from 16.2.12 to 16.3.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/commits/v16.3.0/packages/eslint-config-next) --- updated-dependencies: - dependency-name: eslint-config-next dependency-version: 16.3.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: nextjs - dependency-name: next dependency-version: 16.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nextjs ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps-dev): bump prettier from 3.8.3 to 3.9.6 (#405) Bumps [prettier](https://github.com/prettier/prettier) from 3.8.3 to 3.9.6. - [Release notes](https://github.com/prettier/prettier/releases) - [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md) - [Commits](https://github.com/prettier/prettier/compare/3.8.3...3.9.6) --- updated-dependencies: - dependency-name: prettier dependency-version: 3.9.6 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * docs(changelog): Unreleased-Sektion fuer die Bumps nach v0.10.0 (#413) Die Dependency-PRs sind nach dem Release auf dev gelandet, teils auch auf main. Ohne Eintrag waeren sie beim naechsten Release unsichtbar -- inklusive Next 16.3.0, das CVE-2025-13465 mitbringt. Ausserdem im 0.10.0-Abschnitt nachgetragen, dass der Trivy-Scan bis #409 nie gelaufen ist. Der Fix steckt im Tag v0.10.0, fehlte aber in der Aufzaehlung -- und "Images werden bei jedem Publish gescannt" stand im Changelog, waehrend der Job im Action-Setup abbrach. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(gallery): per-album sort order, independent of Immich (#408) (#414) Album order was dictated entirely by Immich: getAlbum() sorted by the album's own asc/desc flag, so a Folio album always mirrored the archive. A curated series has a narrative order that has nothing to do with capture time, and changing the Immich album's sort to fit the website changes it for the archive too. Adds an optional per-album `sort` in gallery.yaml, editable in /admin, defaulting to today's behaviour so every existing config is unchanged: immich (default) | newest | oldest | filename | manual `manual` is a pinned *prefix*: `assetOrder` lists only the photos placed by hand, everything else follows in the album's Immich order. A full permutation of a 2,000-photo album would be ~80 KB of UUIDs in a file that is rewritten and copied to content/.backups/ on every admin save. It also makes drift fall out for free — photos removed in Immich never match, new ones land in the tail rather than being hidden. Sorting is applied after the cache read, not before the cache write, so the LRU keeps one canonical Immich-ordered copy per album. That avoids putting the mode in the cache key, lets a config change take effect without depending on invalidation, and keeps the stale-serving path correct. cache.get() returns the stored object by reference, so withSort() returns a shallow clone with a new array — sorting in place would reorder the shared entry, and under request coalescing every concurrent caller would be sorting the same array. Also fixes a prerequisite bug: /api/admin/albums/[albumId]/assets read album.assets from GET /albums/:id, which Immich 3.x no longer populates (lib/immich.ts:507). The hero picker's "This Album" tab returned nothing and threw outright when the key was absent. It now goes through the client's paginated metadata search, with ?types=all to opt videos in for the reorder editor. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): drop decorative emoji from the sort select labels (#415) An <option> cannot contain markup, so the SVG set in Icons is not reachable there — but a decorative emoji is not a substitute for it. Plain text instead; the album card badge already uses a real icon. The remaining emoji in the admin panel (asset picker tabs, section headings, layout picker options) predate this branch and are left for a separate cleanup. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): replace emoji icons with the shared SVG icon set (#416) The admin panel mixed two icon conventions: inline SVGs from `Icons.tsx` in most components, and decorative emoji in the asset picker and a few PageBuilder labels. Emoji render inconsistently across platforms, ignore the accent colour, and cannot inherit the `.svg-icon` sizing rules. - Icons.tsx: add `IconStar` (filled — it marks a state, not an action) and `IconImage`. - AssetPicker: the three tab labels and the favourite tile badge now use IconFolder / IconStar / IconImage. - PageBuilder: the "Standalone Albums" and "Subpages" headings use the icon set instead of an emoji. - PageBuilder: the layout picker drops its emoji for plain text. An <option> cannot contain markup, so an SVG is impossible there and a decorative glyph is not a substitute. - admin.css: align icon and label in the picker tabs, and swap the favourite badge's text-shadow for drop-shadow, which is what applies to an inline SVG. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): fold PageBuilder's local icons into the shared Icons module (#418) * refactor(admin): fold PageBuilder's local icons into the shared module PageBuilder.tsx carried its own `Icons` object duplicating most of the glyphs already exported by Icons.tsx, with hardcoded sizes and slightly divergent paths. Migrate all 32 call sites to the shared module and delete the local object. Five glyphs had no counterpart and are added to Icons.tsx as 1:1 ports of the local paths: IconX, IconPlus, IconHome, IconCopy, IconImage. The local ExternalLink and Check are dropped rather than ported — both had zero call sites. Two glyphs change shape slightly, which is the point of consolidating: the shared IconCamera includes the viewfinder bump the local copy omitted, and drag handles now use IconGripVertical. IconGripVertical uses the module's square 24x24 viewBox, so `.svg-drag` goes from 12x18 to 18x18 — the old non-square box would letterbox the glyph down to 12x12 and shrink the handle. * fix(admin): resolve icon-module integration after #416 Merging dev brought in #416, which added a second IconImage to Icons.tsx and two <Icons.Camera>/<Icons.Folder> section headers that reference the local Icons object this PR removes. Git merged both cleanly but the result did not type-check. - drop the duplicate IconImage (both copies were byte-identical) - point the two section headers at the imported IconCamera/IconFolder - refresh the SORT_LABELS comment: the icon set is imported now, not declared below --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> * fix(config): allow an empty gallery, guard against a double /api suffix (#421) An empty gallery is now a valid, rendered state instead of a throw: deriveGallery() no longer requires at least one album or subpage, so a deployment with no albums yet renders a bare homepage the owner can fill in via /admin. getConfig() also stops appending /api to an Immich URL that already ends in it, which previously produced .../api/api and broke every upstream request. Includes a restore of the per-album sort test cases, which the branch had lost by being cut before #408/#414. * feat(admin): favicon upload, served from the content volume (#422) Adds a bundled default favicon, an upload widget in admin Settings > General, and a route that serves the icon from the writable content/ volume with a fallback to the bundled default. Raster uploads (PNG/ICO/JPEG) are wrapped in an SVG container; the response carries its own CSP so an uploaded SVG cannot execute script on the origin. The GET route revalidates with an ETag instead of caching immutably, so a newly uploaded icon shows up immediately. Uploads are written via temp file + rename, and a Reset button restores the bundled default. * ci: flag unformatted files in a PR, without blocking it (#424) Prettier is configured as an error rule in eslint.config.mjs but has never run in CI, so part of the tree predates it. A final CI step now diffs against the PR base, runs prettier --list-different over the changed files, and emits a warning annotation per offender plus a job summary. Advisory by design: it never fails the job. Blocking would turn a PR red for merely touching a file that was already unformatted, and normalising the tree in one commit would wreck git blame and conflict with the PRs in flight. Requires fetch-depth: 0, since diffing against the base needs its history. * feat(install): first-run wizard gated by a one-time setup token (#419) Adds /install, a four-step first-run wizard: connect to Immich, optionally pick albums, name the site, finish. It verifies the credentials against the Immich server before writing anything, then writes gallery.yaml, settings.yaml and a content/install.json carrying the Immich credentials and a generated site secret. install.json exists because a running process cannot pick up new env vars — the wizard has to write configuration that takes effect without a restart. getInstallCredentials() merges it under the real environment, so env vars always win and rotation stays a matter of setting one. Both the page and the API routes are gated by a one-time setup token printed to the server log, so a deployment that is reachable before gallery.yaml exists cannot be configured by whoever finds it first. The token is stored in content/.setup-token (0600) rather than a module variable: Next.js bundles the page and each route handler separately, so a module-level token left the page and the API disagreeing inside one process and the wizard stuck on step 1. It is removed once the install completes. The admin password is stored as an scrypt hash using the scheme lib/auth.ts already applies to album passwords; a plaintext ADMIN_PASSWORD env var keeps working. * docs: document the setup wizard, fix the read-only content mount (#425) Quick Start now leads with the /install wizard, with the hand-written YAML route kept alongside it, and a First-Run Setup section covers the setup token, the files the wizard writes, and env-var precedence. Two corrections: both Docker examples mounted content/ as :ro, which silently breaks the wizard, the admin panel and the backup rotation alike — docs/admin-panel.md already said so and the README contradicted it. And nothing documented that content/install.json holds the Immich API key, so a backup of content/ is a backup of credentials. Also adds a Contributors section crediting the people whose work is in the project. * feat(admin): floating save bar pinned to the bottom of the viewport (#426) The save bar was the first, static element inside .admin-main. Since the document itself scrolls, it left the viewport as soon as you scrolled down — editing a subpage section or a settings block far below gave no visible dirty hint and no reachable save button. Replace it with a bottom-pinned floating bar shared by both editors. It only mounts while there is something to act on (unsaved changes, an in-flight save, or a result message), so it never covers content while idle. The success message clears after 5s, which hides the bar again. - new SaveBar component, replacing the duplicated markup in PageBuilder and SettingsEditor - adopt the previously unused .floating-save-bar CSS: slide-in keyframes (carrying translateX(-50%)), dirty border, wrap/gap, mobile variant and a prefers-reduced-motion opt-out; z-index 900 keeps it below modals - .admin-main gains bottom padding so the bar never covers page content - drop the now-unreachable idle hints: the ⌘S hint becomes a button title, the Live Sync note becomes a static line above the settings layout - header "Site" link now bypasses the cache (/?fresh=1), so the preview stays reachable when the bar is hidden Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(admin): themed listbox for the album sort control (#427) The per-album "Photo order" control was a native <select>. Because an <option> cannot contain markup, its choices could not use the admin panel's currentColor SVG set — the reason #415 had to fall back to plain text after dropping the emoji labels. Adds a Listbox component implementing the ARIA combobox/listbox pattern, so options can render a glyph beside their label: - DOM focus stays on the trigger button; the active option is announced through aria-activedescendant, keeping focus management to one element - Keyboard: arrows (clamped at the ends, like a native select), Home/End, Enter/Space to commit, Escape to cancel, Tab commits and moves on, and prefix type-ahead with a repeat-key cycle - Outside dismissal on pointerdown, so a press starting outside closes the popup before the click retargets The sort options now carry an icon each: calendar, arrow-down, arrow-up, an A→Z marker, and the drag glyph for manual — matching the badge the album card already shows. SORT_LABELS stays plain text because the badge feeds it to a title attribute. Closes #417 Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(git): ignore generated design handoff folders * fix(admin): stop the album sort dropdown clipping, and simplify the panel (#428) * fix(admin): render listbox popup in a portal so it escapes modal clipping The sort control's popup was position:absolute inside three clipping ancestors (.album-drawer overflow:hidden > .album-drawer-body overflow-y:auto > .modal-right-column overflow-y:auto), so it was cut off at the bottom of the Edit Album Details modal. z-index could not help: clipping happens before stacking. It also always hung below the trigger, with no flip. Portal the popup to document.body and position it from the trigger's viewport rect, flipping above when there is more room there and capping max-height to the space available so it scrolls internally rather than overflowing. It is dismissed on scroll and resize, since the anchor is only measured on open. The outside-pointerdown handler now also treats the popup as inside; without that the portalled list counts as outside, and a click on an option would close it before the selection commits. * refactor(admin): single-column album details panel The left column spent 1.2fr on a cover thumbnail and three stat rows, two of which (Status, Custom Hero) only restated the form fields opposite them, while the form itself was squeezed into 1.8fr behind a second nested scroller. Stack the drawer in one column instead: cover as a banner, then the form at full width, with the UUID moved into the footer. The body is now the only scroll container, which also removes one of the ancestors that was clipping the sort popup. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> * fix(admin): give the portalled listbox its theme back, lock the page behind modals (#429) Two defects in the album editor. The sort listbox popup painted transparent. Every --admin-* variable is scoped to .admin-layout, and since the popup moved into document.body it sits outside that subtree, so background/border/text all resolved to nothing. It now carries its own copy of the palette in both colour schemes, plus the font it no longer inherits. Scrolling inside a modal also moved the page behind it. No admin modal ever locked body scroll: the overlay covers the page but does not absorb wheel events, so a scroll starting on the backdrop — or continuing past the end of the modal's own scroller — reaches the document. overscroll-behavior cannot cover that case on its own, because it only applies to scroll containers and the backdrop is not one. useScrollLock freezes body while a modal is open and compensates for the width the scrollbar gives up, so nothing shifts underneath. Each lock restores the inline value it found, which makes nesting work without a counter — a picker opened from the drawer restores the drawer's hidden state instead of clearing it. Applied to both drawers and all four picker modals, which share the defect. overscroll-behavior: contain on the scrollers stops the chaining they can handle themselves. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com> * fix(security): allow unsafe-eval in CSP script-src during dev mode * feat(journal): add Journal Studio with split-screen editor, live preview and dedicated routes * fix(build): separate client parser from server journal-service and fix build type errors * fix(journal): Fotos rendern, Layout und Lightbox-Steuerung korrigieren Fünf unabhängige Fehler in der öffentlichen Journal- und Essay-Ansicht: * Foto-Blöcke wurden nie angezeigt. EssayView löst ein Foto über PhotoItem.id auf, und das sind verschlüsselte Tokens — die Blöcke aus dem Markdown tragen aber rohe Asset-UUIDs. Jede Zuordnung lief ins Leere, und nicht auflösbare Blöcke werden still verworfen. Die IDs werden jetzt serverseitig übersetzt; damit verschwinden nebenbei die rohen UUIDs aus dem Client-Payload, die dort laut Projektregel nie auftauchen dürfen. Nicht auflösbare Referenzen werden geloggt. * Überschriften standen weiter links als der Fließtext. Jeder Block hatte einzeln `max-width: 68ch`, und `ch` ist relativ zur Schrift des Elements — die Serif-Überschrift ergab eine breitere Spalte. Ersetzt durch eine gemeinsame, font-unabhängige `--essay-measure`. * Fullbleed-Fotos bluteten nur nach links aus: `.essay-figure` ist `width: 100%`, wodurch die Box überbestimmt ist und der negative rechte Margin verworfen wird. * Foto-Paare stellten beide Bilder gleich breit dar, wodurch ein Hochformat neben einem Querformat doppelt so hoch wurde. Jetzt eine Justified-Reihe: Breite proportional zum Seitenverhältnis, dadurch exakt gleiche Höhen ohne Beschnitt. * Die Lightbox hatte im Journal keine Tastatursteuerung und keine Scroll-Sperre — beides lag in PhotoGrid, also nur im Album-Raster. Verlagert in die Lightbox selbst, der doppelte Handler in PhotoGrid entfernt (sonst wäre pro Pfeildruck zwei Bilder weitergesprungen). Zusätzlich sind Proofing-Herzen und das EXIF-Panel im redaktionellen Modus abschaltbar und im Journal aus: Client-Proofing ist ein Übergabe-Workflow für Alben, keine Funktion einer Reportage. Auf der Übersicht wurde der Untertitel doppelt gerendert, weil extractExcerpt() auf ihn zurückfällt. * feat(admin): eigene URLs für alle Bereiche und überarbeiteter Journal Studio Das Panel war eine einzige Client-Komponente, die ihre Tabs über useState umschaltet: keine Route pro Bereich, kein Deep-Link, kein Zurück-Button, und nach jedem Reload landete man wieder auf "Pages". Auch der Journal-Editor hatte keine eigene URL. Jetzt sieben echte Routen (/admin, /admin/pages, /admin/journal, /admin/journal/<slug>, /admin/settings, /admin/settings/<section>, /admin/analytics). Die Shell mit Auth-Prüfung und Kopfzeile sitzt im Layout und umschließt children — so bleibt die Session-Prüfung über Routenwechsel montiert, statt bei jedem Tab-Wechsel neu zu laufen und den Spinner aufblitzen zu lassen. Unbekannte Settings-Sections fallen auf General zurück. Im selben Zug der Journal Studio, der die Routing-Änderung ohnehin berührt: * Alle Eingabefelder nutzten die Klasse `admin-input`, die in keinem CSS definiert war — sie fielen auf Browser-Defaults zurück. Jetzt gestylt, gescoped, damit der generische Name nicht ins übrige Panel leckt. * Der Split View ist per Divider verschiebbar (Maus, Tastatur, Doppelklick zum Zurücksetzen), Breite in localStorage. * Das Studio bricht aus der 1120px-Spalte aus, die Preview hat Platz. * Die Preview zeigte für jedes Foto fest 3:2 und log damit über das Layout der veröffentlichten Seite; die echten Verhältnisse werden jetzt an den Thumbnails gemessen. * Blöcke mit alten positionsbasierten Foto-Referenzen werden markiert — die lassen sich auf einer eigenständigen Journal-Seite nicht auflösen und verschwanden bisher stillschweigend. * Blocktyp-Chips als gemeinsame Komponente, monochrom und per Icon unterschieden statt in einer eigenen Blau/Lila/Orange-Palette, die sonst nirgends im Panel vorkommt. * Emojis raus, SVG-Icons rein. * fix(admin): Designsystem-Lücken im Panel schließen Eine systematische Suche nach Klassen, die im TSX benutzt, aber in keinem CSS definiert sind, hat vier Stellen mit demselben Muster gefunden: * `admin-btn-secondary` und `admin-btn-danger` existierten nicht. Sämtliche Löschen-Buttons sahen aus wie normale Buttons — keine Warnwirkung. Als `.admin-btn.admin-btn-danger` geschrieben, weil die Varianten mit den Größenklassen kombiniert werden, die weiter unten ihren eigenen Hintergrund setzen. * `page-progress-fill` fehlte: die Balken im Analytics-Panel waren leere Rinnen, der Wert unsichtbar. Ebenso `analytics-empty` und `admin-loading-container`. * `subpage-drawer-section`, `subpage-drawer-title-group` und `input-with-icon` im PageBuilder waren wirkungslos und teils mit Inline-Styles notdürftig kompensiert. * `grid-card-preview` fehlte, wodurch alle Layout-Vorschauen auf Höhe null kollabierten. Nur "Showcase" war sichtbar — und das aus Versehen, weil sein Tile `hero-tile` hieß und damit die `aspect-ratio` einer fremden PageBuilder-Klasse erbte. Umbenannt. Dazu die Theme-Vorschauen, die praktisch identisch aussahen: alle sieben zeigten dieselben drei quadratischen Kacheln, einziger Unterschied war die Hintergrundfarbe. Sie spiegeln jetzt die echten Preset-Daten aus lib/config/theme.ts — Schriftcharakter, Eckradius, Rasterdichte, Passepartout bzw. Schatten. Die Kopfzeile richtet sich an einer gemeinsamen Steuerhöhe aus. Der "Site"-Link war höher als die Buttons daneben: `.admin-btn` hatte keine explizite line-height, und <button> bekommt box-sizing: border-box vom Browser, <a> nicht. Die Statusanzeige setzte weder Schriftfamilie noch -größe und fiel auf den Browser-Default zurück — sie war nie Teil des Designsystems. Jetzt gleiche Höhe und Typografie, Pillenform als Zustandsanzeige, Trenner zur Aktionsgruppe. Das dauerhafte Pulsieren des grünen Punkts entfällt; Animation bleibt den Zuständen vorbehalten, die Aufmerksamkeit brauchen. Restliche Emojis durch SVG-Icons ersetzt. * feat(admin): add scroll-to-top toggle and SVG arrow The back-to-top button was always on and drew its arrow with the ↑ text character. Add a `scrollToTop` setting (General section in the admin panel, defaults to on so existing sites are unaffected) and replace the glyph with a stroked SVG that inherits currentColor across all presets. Scroll handling is now rAF-throttled, and prefers-reduced-motion turns off both the hover lift and the smooth scroll. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * security(journal): escape author HTML instead of filtering it CodeQL flags 26 high-severity alerts on the release PR; the bulk of them point at sanitizeHtml(), a denylist of three regexes whose output goes into dangerouslySetInnerHTML. I reproduced the bypasses before changing anything — all four pass the old filter: <img src=x onerror=alert(1)> unquoted handler, regex wants quotes <img src=x onerror='alert(1)'> single quotes, same reason <svg onload=alert(1)> not a <script> tag javasjavascript:cript:alert(1) one-pass replace, the rest recombines Plus an attribute breakout in the link renderer, which interpolated the URL into href="${url}" unescaped: [x](" onmouseover=alert(1) x=") -> <a href="" onmouseover=alert(1" ...> Replaced with escaping. Every `&<>"'` in author text becomes an entity before any markdown rule runs, so the only tags in the output are the ones renderInlineMarkdown builds itself and a URL cannot leave its attribute. Link schemes are now an allowlist (http, https, mailto, tel, relative, anchor); anything else renders as plain text. The serializer needed decodeHtmlEntities to match: without it a save would write `&lt;` into the Markdown file and the next parse would escape the `&` again, corrupting the text further on every round trip. A test covers parse -> serialize -> parse stability. Two existing tests asserted the old behaviour and were rewritten rather than deleted: one expected the script tag to be *removed* from the output, the other expected the substring "onerror" to be absent. Both now assert the property that matters — that no tag can form — because `onerror` surviving as inert text is fine. Exploitation required admin access either way: journal and essay text comes from the studio or from content/*.md. This removes the weakness, it does not close an open door. * fix(journal): contain file paths, fix frontmatter escaping, defuse two regexes Follow-up to the CodeQL findings on release PR #432. I went through all 23 alerts individually; this addresses the ones that are worth addressing and documents the ones that are not. Path containment (12 alerts, all false positives). Every path built from a slug goes through isValidSlug(), a strict `/^[a-zA-Z0-9_-]+$/` allowlist — verified against `../../etc/passwd`, `foo/../../bar`, `a/b`, `..` and friends, all rejected. CodeQL cannot see it because the check lives in another module. Added a containedPath() helper that resolves the path and refuses anything landing outside the content directory: a second lock on a door that was already locked, and a barrier the analysis can follow. Also removed the dead `slug.endsWith('.md')` branches — isValidSlug rejects dots, so they could never be taken. Frontmatter escaping (1 alert, a real bug). The serializer escaped `"` but not `\`, and the parser never unescaped anything. A title containing either character gained a backslash on every save/load cycle: Path C:\Users "quoted" -> Path C:\\Users \"quoted\" -> ... Escaping now covers the backslash first and the parser undoes both. A round trip test covers quotes, backslashes, colons and apostrophes. Two of three ReDoS regexes (2 alerts). The heading pattern had `\s+` next to `(.+)`, which overlap, so the engine tried every split of the whitespace run before failing; it is `[ \t]+` and `(\S.*)` now. The quote author pattern wrapped a lazy group around an optional group — the quadratic case — and is an index split on the first separator now. The third regex, the bold/italic pass, is deliberately left alone. Rewriting it with a negated class removes the backtracking but breaks nesting: `**bold *and italic* here**` renders as `*<em>bold </em>and italic<em> here</em>*`. The input is Markdown from an authenticated admin, never a visitor, so the worst case is an author slowing down their own page. The comment in the code says so. Not addressed: 5 js/insufficient-password-hash alerts. They ask for a slow KDF where the code uses SHA-256/HMAC — correct in general, but the admin password comes from an environment variable and is never stored, so a stronger KDF protects nothing that is not already in plaintext in the environment. 399 unit tests pass (18 new), build and tsc clean. * fix(journal): split the quote author by scanning, not by pattern Cleaning up after myself. #439 replaced the quote author regex `/^(.*?)(?:\s+--\s+(.+))?$/` — a lazy group around an optional one, the quadratic case — with `/\s+--\s+/`, and CodeQL promptly flagged the replacement for the same reason. One reported pattern traded for another. splitQuoteAuthor() scans for the first `--` that has whitespace on both sides. Linear, and it needs no reasoning about the regex engine at all. Behaviour is identical to the original regex, checked case by case against it: separator, no separator, several separators, tabs, wide gaps, `a--b` without spaces, leading and trailing separators, empty string. All nine are covered by tests, plus one asserting it stays fast on a 50k whitespace run. * security(admin): derive the session signing key with scrypt getSigningKey() ran the admin password through a single SHA-256 digest. It is key derivation rather than password storage, so it was never a stored-hash problem — but if the derived key ever leaked, one fast hash makes recovering the password by brute force cheap. CodeQL flags it as js/insufficient-password-hash and, for this particular alert, has a point. scrypt now. Two details that matter: The salt has to be stable. A random salt would produce a different key on every call and invalidate every session; it is derived from AUTH_SECRET, which is deployment-specific. Verified across separate processes: same inputs produce a verifying token, so a restart or redeploy does not log everyone out. The result is cached for the process lifetime. scrypt is deliberately slow and getSigningKey() runs on every admin request — deriving per call would add ~24ms to each one. The cache key is a digest of secret plus password, so a rotation misses the cache and derives again, and no extra plaintext copy of the password is kept around. Measured: first derivation 24ms, subsequent calls 0.12ms. Password change and secret change both invalidate an existing token, checked in separate processes. Note the one-time effect: existing admin sessions are invalidated by the change in derivation, so everyone logs in once more. * security(admin): key the signing-key cache on its inputs, not a digest #441 removed the SHA-256 digest of the admin password from the key derivation and introduced a new one three lines above it, as the cache key. Same rule, same file: CodeQL reported it immediately. The comment justifying it was wrong too. It claimed no second plaintext copy of the password was retained, while building the digest input allocates exactly that in order to hash it. The cache now holds the two input strings and compares them directly. They are the same objects the env and install caches already hold, so nothing extra is retained, and no fast hash of the password exists in memory for the life of the process. Re-verified after the change, in separate processes: a token from one process verifies in another with the same inputs, a changed password or secret rejects it, first derivation 24ms, cached calls 0.001ms. That leaves scrypt as the only place the password is hashed here. The two HMACs further down operate on the derived key and on token data, not on the password; the constant-time comparison in verifyAdminPassword is the previously dismissed one. --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
2026-08-14 16:55:07 +02:00
font: 'Geist',
type: 'sans',
radius: 0,
frame: 'none',
gap: 2,
},
editorial: {
label: 'Editorial',
desc: 'Warm backgrounds, elegant serifs and large headers.',
bg: '#fbf9f4',
tile: '#e5dfd4',
accent: '#b89053',
release: v0.11.0 — journal fixes, admin URLs, design system cleanup (#432) * fix(screenshots): sharp-Typen fuer 0.34 und 0.35 gleichzeitig (#410) sharp 0.35 ist von `export =` auf ESM umgestellt: der Modul-Namespace ist nicht mehr aufrufbar, die Factory sitzt unter .default. Der Type-Check brach damit in scripts/screenshots.ts weg, sobald der Next-Bump (#402) sharp von 0.34.5 auf 0.35.3 mitzieht -- sharp ist hier keine deklarierte Dependency, sondern kommt ueber Next mit. Die Form wird jetzt aus dem installierten Paket abgeleitet statt festgeschrieben, zur Laufzeit wie im Typ. Geprueft mit beiden Versionen: tsc laeuft mit 0.34.5 und mit 0.35.3 fehlerfrei durch. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(deps): bump the nextjs group across 1 directory with 2 updates (#402) Bumps the nextjs group with 2 updates in the / directory: [next](https://github.com/vercel/next.js) and [eslint-config-next](https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next). Updates `next` from 16.2.12 to 16.3.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/compare/v16.2.12...v16.3.0) Updates `eslint-config-next` from 16.2.12 to 16.3.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/commits/v16.3.0/packages/eslint-config-next) --- updated-dependencies: - dependency-name: eslint-config-next dependency-version: 16.3.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: nextjs - dependency-name: next dependency-version: 16.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nextjs ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps-dev): bump prettier from 3.8.3 to 3.9.6 (#405) Bumps [prettier](https://github.com/prettier/prettier) from 3.8.3 to 3.9.6. - [Release notes](https://github.com/prettier/prettier/releases) - [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md) - [Commits](https://github.com/prettier/prettier/compare/3.8.3...3.9.6) --- updated-dependencies: - dependency-name: prettier dependency-version: 3.9.6 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * docs(changelog): Unreleased-Sektion fuer die Bumps nach v0.10.0 (#413) Die Dependency-PRs sind nach dem Release auf dev gelandet, teils auch auf main. Ohne Eintrag waeren sie beim naechsten Release unsichtbar -- inklusive Next 16.3.0, das CVE-2025-13465 mitbringt. Ausserdem im 0.10.0-Abschnitt nachgetragen, dass der Trivy-Scan bis #409 nie gelaufen ist. Der Fix steckt im Tag v0.10.0, fehlte aber in der Aufzaehlung -- und "Images werden bei jedem Publish gescannt" stand im Changelog, waehrend der Job im Action-Setup abbrach. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(gallery): per-album sort order, independent of Immich (#408) (#414) Album order was dictated entirely by Immich: getAlbum() sorted by the album's own asc/desc flag, so a Folio album always mirrored the archive. A curated series has a narrative order that has nothing to do with capture time, and changing the Immich album's sort to fit the website changes it for the archive too. Adds an optional per-album `sort` in gallery.yaml, editable in /admin, defaulting to today's behaviour so every existing config is unchanged: immich (default) | newest | oldest | filename | manual `manual` is a pinned *prefix*: `assetOrder` lists only the photos placed by hand, everything else follows in the album's Immich order. A full permutation of a 2,000-photo album would be ~80 KB of UUIDs in a file that is rewritten and copied to content/.backups/ on every admin save. It also makes drift fall out for free — photos removed in Immich never match, new ones land in the tail rather than being hidden. Sorting is applied after the cache read, not before the cache write, so the LRU keeps one canonical Immich-ordered copy per album. That avoids putting the mode in the cache key, lets a config change take effect without depending on invalidation, and keeps the stale-serving path correct. cache.get() returns the stored object by reference, so withSort() returns a shallow clone with a new array — sorting in place would reorder the shared entry, and under request coalescing every concurrent caller would be sorting the same array. Also fixes a prerequisite bug: /api/admin/albums/[albumId]/assets read album.assets from GET /albums/:id, which Immich 3.x no longer populates (lib/immich.ts:507). The hero picker's "This Album" tab returned nothing and threw outright when the key was absent. It now goes through the client's paginated metadata search, with ?types=all to opt videos in for the reorder editor. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): drop decorative emoji from the sort select labels (#415) An <option> cannot contain markup, so the SVG set in Icons is not reachable there — but a decorative emoji is not a substitute for it. Plain text instead; the album card badge already uses a real icon. The remaining emoji in the admin panel (asset picker tabs, section headings, layout picker options) predate this branch and are left for a separate cleanup. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): replace emoji icons with the shared SVG icon set (#416) The admin panel mixed two icon conventions: inline SVGs from `Icons.tsx` in most components, and decorative emoji in the asset picker and a few PageBuilder labels. Emoji render inconsistently across platforms, ignore the accent colour, and cannot inherit the `.svg-icon` sizing rules. - Icons.tsx: add `IconStar` (filled — it marks a state, not an action) and `IconImage`. - AssetPicker: the three tab labels and the favourite tile badge now use IconFolder / IconStar / IconImage. - PageBuilder: the "Standalone Albums" and "Subpages" headings use the icon set instead of an emoji. - PageBuilder: the layout picker drops its emoji for plain text. An <option> cannot contain markup, so an SVG is impossible there and a decorative glyph is not a substitute. - admin.css: align icon and label in the picker tabs, and swap the favourite badge's text-shadow for drop-shadow, which is what applies to an inline SVG. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): fold PageBuilder's local icons into the shared Icons module (#418) * refactor(admin): fold PageBuilder's local icons into the shared module PageBuilder.tsx carried its own `Icons` object duplicating most of the glyphs already exported by Icons.tsx, with hardcoded sizes and slightly divergent paths. Migrate all 32 call sites to the shared module and delete the local object. Five glyphs had no counterpart and are added to Icons.tsx as 1:1 ports of the local paths: IconX, IconPlus, IconHome, IconCopy, IconImage. The local ExternalLink and Check are dropped rather than ported — both had zero call sites. Two glyphs change shape slightly, which is the point of consolidating: the shared IconCamera includes the viewfinder bump the local copy omitted, and drag handles now use IconGripVertical. IconGripVertical uses the module's square 24x24 viewBox, so `.svg-drag` goes from 12x18 to 18x18 — the old non-square box would letterbox the glyph down to 12x12 and shrink the handle. * fix(admin): resolve icon-module integration after #416 Merging dev brought in #416, which added a second IconImage to Icons.tsx and two <Icons.Camera>/<Icons.Folder> section headers that reference the local Icons object this PR removes. Git merged both cleanly but the result did not type-check. - drop the duplicate IconImage (both copies were byte-identical) - point the two section headers at the imported IconCamera/IconFolder - refresh the SORT_LABELS comment: the icon set is imported now, not declared below --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> * fix(config): allow an empty gallery, guard against a double /api suffix (#421) An empty gallery is now a valid, rendered state instead of a throw: deriveGallery() no longer requires at least one album or subpage, so a deployment with no albums yet renders a bare homepage the owner can fill in via /admin. getConfig() also stops appending /api to an Immich URL that already ends in it, which previously produced .../api/api and broke every upstream request. Includes a restore of the per-album sort test cases, which the branch had lost by being cut before #408/#414. * feat(admin): favicon upload, served from the content volume (#422) Adds a bundled default favicon, an upload widget in admin Settings > General, and a route that serves the icon from the writable content/ volume with a fallback to the bundled default. Raster uploads (PNG/ICO/JPEG) are wrapped in an SVG container; the response carries its own CSP so an uploaded SVG cannot execute script on the origin. The GET route revalidates with an ETag instead of caching immutably, so a newly uploaded icon shows up immediately. Uploads are written via temp file + rename, and a Reset button restores the bundled default. * ci: flag unformatted files in a PR, without blocking it (#424) Prettier is configured as an error rule in eslint.config.mjs but has never run in CI, so part of the tree predates it. A final CI step now diffs against the PR base, runs prettier --list-different over the changed files, and emits a warning annotation per offender plus a job summary. Advisory by design: it never fails the job. Blocking would turn a PR red for merely touching a file that was already unformatted, and normalising the tree in one commit would wreck git blame and conflict with the PRs in flight. Requires fetch-depth: 0, since diffing against the base needs its history. * feat(install): first-run wizard gated by a one-time setup token (#419) Adds /install, a four-step first-run wizard: connect to Immich, optionally pick albums, name the site, finish. It verifies the credentials against the Immich server before writing anything, then writes gallery.yaml, settings.yaml and a content/install.json carrying the Immich credentials and a generated site secret. install.json exists because a running process cannot pick up new env vars — the wizard has to write configuration that takes effect without a restart. getInstallCredentials() merges it under the real environment, so env vars always win and rotation stays a matter of setting one. Both the page and the API routes are gated by a one-time setup token printed to the server log, so a deployment that is reachable before gallery.yaml exists cannot be configured by whoever finds it first. The token is stored in content/.setup-token (0600) rather than a module variable: Next.js bundles the page and each route handler separately, so a module-level token left the page and the API disagreeing inside one process and the wizard stuck on step 1. It is removed once the install completes. The admin password is stored as an scrypt hash using the scheme lib/auth.ts already applies to album passwords; a plaintext ADMIN_PASSWORD env var keeps working. * docs: document the setup wizard, fix the read-only content mount (#425) Quick Start now leads with the /install wizard, with the hand-written YAML route kept alongside it, and a First-Run Setup section covers the setup token, the files the wizard writes, and env-var precedence. Two corrections: both Docker examples mounted content/ as :ro, which silently breaks the wizard, the admin panel and the backup rotation alike — docs/admin-panel.md already said so and the README contradicted it. And nothing documented that content/install.json holds the Immich API key, so a backup of content/ is a backup of credentials. Also adds a Contributors section crediting the people whose work is in the project. * feat(admin): floating save bar pinned to the bottom of the viewport (#426) The save bar was the first, static element inside .admin-main. Since the document itself scrolls, it left the viewport as soon as you scrolled down — editing a subpage section or a settings block far below gave no visible dirty hint and no reachable save button. Replace it with a bottom-pinned floating bar shared by both editors. It only mounts while there is something to act on (unsaved changes, an in-flight save, or a result message), so it never covers content while idle. The success message clears after 5s, which hides the bar again. - new SaveBar component, replacing the duplicated markup in PageBuilder and SettingsEditor - adopt the previously unused .floating-save-bar CSS: slide-in keyframes (carrying translateX(-50%)), dirty border, wrap/gap, mobile variant and a prefers-reduced-motion opt-out; z-index 900 keeps it below modals - .admin-main gains bottom padding so the bar never covers page content - drop the now-unreachable idle hints: the ⌘S hint becomes a button title, the Live Sync note becomes a static line above the settings layout - header "Site" link now bypasses the cache (/?fresh=1), so the preview stays reachable when the bar is hidden Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(admin): themed listbox for the album sort control (#427) The per-album "Photo order" control was a native <select>. Because an <option> cannot contain markup, its choices could not use the admin panel's currentColor SVG set — the reason #415 had to fall back to plain text after dropping the emoji labels. Adds a Listbox component implementing the ARIA combobox/listbox pattern, so options can render a glyph beside their label: - DOM focus stays on the trigger button; the active option is announced through aria-activedescendant, keeping focus management to one element - Keyboard: arrows (clamped at the ends, like a native select), Home/End, Enter/Space to commit, Escape to cancel, Tab commits and moves on, and prefix type-ahead with a repeat-key cycle - Outside dismissal on pointerdown, so a press starting outside closes the popup before the click retargets The sort options now carry an icon each: calendar, arrow-down, arrow-up, an A→Z marker, and the drag glyph for manual — matching the badge the album card already shows. SORT_LABELS stays plain text because the badge feeds it to a title attribute. Closes #417 Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(git): ignore generated design handoff folders * fix(admin): stop the album sort dropdown clipping, and simplify the panel (#428) * fix(admin): render listbox popup in a portal so it escapes modal clipping The sort control's popup was position:absolute inside three clipping ancestors (.album-drawer overflow:hidden > .album-drawer-body overflow-y:auto > .modal-right-column overflow-y:auto), so it was cut off at the bottom of the Edit Album Details modal. z-index could not help: clipping happens before stacking. It also always hung below the trigger, with no flip. Portal the popup to document.body and position it from the trigger's viewport rect, flipping above when there is more room there and capping max-height to the space available so it scrolls internally rather than overflowing. It is dismissed on scroll and resize, since the anchor is only measured on open. The outside-pointerdown handler now also treats the popup as inside; without that the portalled list counts as outside, and a click on an option would close it before the selection commits. * refactor(admin): single-column album details panel The left column spent 1.2fr on a cover thumbnail and three stat rows, two of which (Status, Custom Hero) only restated the form fields opposite them, while the form itself was squeezed into 1.8fr behind a second nested scroller. Stack the drawer in one column instead: cover as a banner, then the form at full width, with the UUID moved into the footer. The body is now the only scroll container, which also removes one of the ancestors that was clipping the sort popup. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> * fix(admin): give the portalled listbox its theme back, lock the page behind modals (#429) Two defects in the album editor. The sort listbox popup painted transparent. Every --admin-* variable is scoped to .admin-layout, and since the popup moved into document.body it sits outside that subtree, so background/border/text all resolved to nothing. It now carries its own copy of the palette in both colour schemes, plus the font it no longer inherits. Scrolling inside a modal also moved the page behind it. No admin modal ever locked body scroll: the overlay covers the page but does not absorb wheel events, so a scroll starting on the backdrop — or continuing past the end of the modal's own scroller — reaches the document. overscroll-behavior cannot cover that case on its own, because it only applies to scroll containers and the backdrop is not one. useScrollLock freezes body while a modal is open and compensates for the width the scrollbar gives up, so nothing shifts underneath. Each lock restores the inline value it found, which makes nesting work without a counter — a picker opened from the drawer restores the drawer's hidden state instead of clearing it. Applied to both drawers and all four picker modals, which share the defect. overscroll-behavior: contain on the scrollers stops the chaining they can handle themselves. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com> * fix(security): allow unsafe-eval in CSP script-src during dev mode * feat(journal): add Journal Studio with split-screen editor, live preview and dedicated routes * fix(build): separate client parser from server journal-service and fix build type errors * fix(journal): Fotos rendern, Layout und Lightbox-Steuerung korrigieren Fünf unabhängige Fehler in der öffentlichen Journal- und Essay-Ansicht: * Foto-Blöcke wurden nie angezeigt. EssayView löst ein Foto über PhotoItem.id auf, und das sind verschlüsselte Tokens — die Blöcke aus dem Markdown tragen aber rohe Asset-UUIDs. Jede Zuordnung lief ins Leere, und nicht auflösbare Blöcke werden still verworfen. Die IDs werden jetzt serverseitig übersetzt; damit verschwinden nebenbei die rohen UUIDs aus dem Client-Payload, die dort laut Projektregel nie auftauchen dürfen. Nicht auflösbare Referenzen werden geloggt. * Überschriften standen weiter links als der Fließtext. Jeder Block hatte einzeln `max-width: 68ch`, und `ch` ist relativ zur Schrift des Elements — die Serif-Überschrift ergab eine breitere Spalte. Ersetzt durch eine gemeinsame, font-unabhängige `--essay-measure`. * Fullbleed-Fotos bluteten nur nach links aus: `.essay-figure` ist `width: 100%`, wodurch die Box überbestimmt ist und der negative rechte Margin verworfen wird. * Foto-Paare stellten beide Bilder gleich breit dar, wodurch ein Hochformat neben einem Querformat doppelt so hoch wurde. Jetzt eine Justified-Reihe: Breite proportional zum Seitenverhältnis, dadurch exakt gleiche Höhen ohne Beschnitt. * Die Lightbox hatte im Journal keine Tastatursteuerung und keine Scroll-Sperre — beides lag in PhotoGrid, also nur im Album-Raster. Verlagert in die Lightbox selbst, der doppelte Handler in PhotoGrid entfernt (sonst wäre pro Pfeildruck zwei Bilder weitergesprungen). Zusätzlich sind Proofing-Herzen und das EXIF-Panel im redaktionellen Modus abschaltbar und im Journal aus: Client-Proofing ist ein Übergabe-Workflow für Alben, keine Funktion einer Reportage. Auf der Übersicht wurde der Untertitel doppelt gerendert, weil extractExcerpt() auf ihn zurückfällt. * feat(admin): eigene URLs für alle Bereiche und überarbeiteter Journal Studio Das Panel war eine einzige Client-Komponente, die ihre Tabs über useState umschaltet: keine Route pro Bereich, kein Deep-Link, kein Zurück-Button, und nach jedem Reload landete man wieder auf "Pages". Auch der Journal-Editor hatte keine eigene URL. Jetzt sieben echte Routen (/admin, /admin/pages, /admin/journal, /admin/journal/<slug>, /admin/settings, /admin/settings/<section>, /admin/analytics). Die Shell mit Auth-Prüfung und Kopfzeile sitzt im Layout und umschließt children — so bleibt die Session-Prüfung über Routenwechsel montiert, statt bei jedem Tab-Wechsel neu zu laufen und den Spinner aufblitzen zu lassen. Unbekannte Settings-Sections fallen auf General zurück. Im selben Zug der Journal Studio, der die Routing-Änderung ohnehin berührt: * Alle Eingabefelder nutzten die Klasse `admin-input`, die in keinem CSS definiert war — sie fielen auf Browser-Defaults zurück. Jetzt gestylt, gescoped, damit der generische Name nicht ins übrige Panel leckt. * Der Split View ist per Divider verschiebbar (Maus, Tastatur, Doppelklick zum Zurücksetzen), Breite in localStorage. * Das Studio bricht aus der 1120px-Spalte aus, die Preview hat Platz. * Die Preview zeigte für jedes Foto fest 3:2 und log damit über das Layout der veröffentlichten Seite; die echten Verhältnisse werden jetzt an den Thumbnails gemessen. * Blöcke mit alten positionsbasierten Foto-Referenzen werden markiert — die lassen sich auf einer eigenständigen Journal-Seite nicht auflösen und verschwanden bisher stillschweigend. * Blocktyp-Chips als gemeinsame Komponente, monochrom und per Icon unterschieden statt in einer eigenen Blau/Lila/Orange-Palette, die sonst nirgends im Panel vorkommt. * Emojis raus, SVG-Icons rein. * fix(admin): Designsystem-Lücken im Panel schließen Eine systematische Suche nach Klassen, die im TSX benutzt, aber in keinem CSS definiert sind, hat vier Stellen mit demselben Muster gefunden: * `admin-btn-secondary` und `admin-btn-danger` existierten nicht. Sämtliche Löschen-Buttons sahen aus wie normale Buttons — keine Warnwirkung. Als `.admin-btn.admin-btn-danger` geschrieben, weil die Varianten mit den Größenklassen kombiniert werden, die weiter unten ihren eigenen Hintergrund setzen. * `page-progress-fill` fehlte: die Balken im Analytics-Panel waren leere Rinnen, der Wert unsichtbar. Ebenso `analytics-empty` und `admin-loading-container`. * `subpage-drawer-section`, `subpage-drawer-title-group` und `input-with-icon` im PageBuilder waren wirkungslos und teils mit Inline-Styles notdürftig kompensiert. * `grid-card-preview` fehlte, wodurch alle Layout-Vorschauen auf Höhe null kollabierten. Nur "Showcase" war sichtbar — und das aus Versehen, weil sein Tile `hero-tile` hieß und damit die `aspect-ratio` einer fremden PageBuilder-Klasse erbte. Umbenannt. Dazu die Theme-Vorschauen, die praktisch identisch aussahen: alle sieben zeigten dieselben drei quadratischen Kacheln, einziger Unterschied war die Hintergrundfarbe. Sie spiegeln jetzt die echten Preset-Daten aus lib/config/theme.ts — Schriftcharakter, Eckradius, Rasterdichte, Passepartout bzw. Schatten. Die Kopfzeile richtet sich an einer gemeinsamen Steuerhöhe aus. Der "Site"-Link war höher als die Buttons daneben: `.admin-btn` hatte keine explizite line-height, und <button> bekommt box-sizing: border-box vom Browser, <a> nicht. Die Statusanzeige setzte weder Schriftfamilie noch -größe und fiel auf den Browser-Default zurück — sie war nie Teil des Designsystems. Jetzt gleiche Höhe und Typografie, Pillenform als Zustandsanzeige, Trenner zur Aktionsgruppe. Das dauerhafte Pulsieren des grünen Punkts entfällt; Animation bleibt den Zuständen vorbehalten, die Aufmerksamkeit brauchen. Restliche Emojis durch SVG-Icons ersetzt. * feat(admin): add scroll-to-top toggle and SVG arrow The back-to-top button was always on and drew its arrow with the ↑ text character. Add a `scrollToTop` setting (General section in the admin panel, defaults to on so existing sites are unaffected) and replace the glyph with a stroked SVG that inherits currentColor across all presets. Scroll handling is now rAF-throttled, and prefers-reduced-motion turns off both the hover lift and the smooth scroll. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * security(journal): escape author HTML instead of filtering it CodeQL flags 26 high-severity alerts on the release PR; the bulk of them point at sanitizeHtml(), a denylist of three regexes whose output goes into dangerouslySetInnerHTML. I reproduced the bypasses before changing anything — all four pass the old filter: <img src=x onerror=alert(1)> unquoted handler, regex wants quotes <img src=x onerror='alert(1)'> single quotes, same reason <svg onload=alert(1)> not a <script> tag javasjavascript:cript:alert(1) one-pass replace, the rest recombines Plus an attribute breakout in the link renderer, which interpolated the URL into href="${url}" unescaped: [x](" onmouseover=alert(1) x=") -> <a href="" onmouseover=alert(1" ...> Replaced with escaping. Every `&<>"'` in author text becomes an entity before any markdown rule runs, so the only tags in the output are the ones renderInlineMarkdown builds itself and a URL cannot leave its attribute. Link schemes are now an allowlist (http, https, mailto, tel, relative, anchor); anything else renders as plain text. The serializer needed decodeHtmlEntities to match: without it a save would write `&lt;` into the Markdown file and the next parse would escape the `&` again, corrupting the text further on every round trip. A test covers parse -> serialize -> parse stability. Two existing tests asserted the old behaviour and were rewritten rather than deleted: one expected the script tag to be *removed* from the output, the other expected the substring "onerror" to be absent. Both now assert the property that matters — that no tag can form — because `onerror` surviving as inert text is fine. Exploitation required admin access either way: journal and essay text comes from the studio or from content/*.md. This removes the weakness, it does not close an open door. * fix(journal): contain file paths, fix frontmatter escaping, defuse two regexes Follow-up to the CodeQL findings on release PR #432. I went through all 23 alerts individually; this addresses the ones that are worth addressing and documents the ones that are not. Path containment (12 alerts, all false positives). Every path built from a slug goes through isValidSlug(), a strict `/^[a-zA-Z0-9_-]+$/` allowlist — verified against `../../etc/passwd`, `foo/../../bar`, `a/b`, `..` and friends, all rejected. CodeQL cannot see it because the check lives in another module. Added a containedPath() helper that resolves the path and refuses anything landing outside the content directory: a second lock on a door that was already locked, and a barrier the analysis can follow. Also removed the dead `slug.endsWith('.md')` branches — isValidSlug rejects dots, so they could never be taken. Frontmatter escaping (1 alert, a real bug). The serializer escaped `"` but not `\`, and the parser never unescaped anything. A title containing either character gained a backslash on every save/load cycle: Path C:\Users "quoted" -> Path C:\\Users \"quoted\" -> ... Escaping now covers the backslash first and the parser undoes both. A round trip test covers quotes, backslashes, colons and apostrophes. Two of three ReDoS regexes (2 alerts). The heading pattern had `\s+` next to `(.+)`, which overlap, so the engine tried every split of the whitespace run before failing; it is `[ \t]+` and `(\S.*)` now. The quote author pattern wrapped a lazy group around an optional group — the quadratic case — and is an index split on the first separator now. The third regex, the bold/italic pass, is deliberately left alone. Rewriting it with a negated class removes the backtracking but breaks nesting: `**bold *and italic* here**` renders as `*<em>bold </em>and italic<em> here</em>*`. The input is Markdown from an authenticated admin, never a visitor, so the worst case is an author slowing down their own page. The comment in the code says so. Not addressed: 5 js/insufficient-password-hash alerts. They ask for a slow KDF where the code uses SHA-256/HMAC — correct in general, but the admin password comes from an environment variable and is never stored, so a stronger KDF protects nothing that is not already in plaintext in the environment. 399 unit tests pass (18 new), build and tsc clean. * fix(journal): split the quote author by scanning, not by pattern Cleaning up after myself. #439 replaced the quote author regex `/^(.*?)(?:\s+--\s+(.+))?$/` — a lazy group around an optional one, the quadratic case — with `/\s+--\s+/`, and CodeQL promptly flagged the replacement for the same reason. One reported pattern traded for another. splitQuoteAuthor() scans for the first `--` that has whitespace on both sides. Linear, and it needs no reasoning about the regex engine at all. Behaviour is identical to the original regex, checked case by case against it: separator, no separator, several separators, tabs, wide gaps, `a--b` without spaces, leading and trailing separators, empty string. All nine are covered by tests, plus one asserting it stays fast on a 50k whitespace run. * security(admin): derive the session signing key with scrypt getSigningKey() ran the admin password through a single SHA-256 digest. It is key derivation rather than password storage, so it was never a stored-hash problem — but if the derived key ever leaked, one fast hash makes recovering the password by brute force cheap. CodeQL flags it as js/insufficient-password-hash and, for this particular alert, has a point. scrypt now. Two details that matter: The salt has to be stable. A random salt would produce a different key on every call and invalidate every session; it is derived from AUTH_SECRET, which is deployment-specific. Verified across separate processes: same inputs produce a verifying token, so a restart or redeploy does not log everyone out. The result is cached for the process lifetime. scrypt is deliberately slow and getSigningKey() runs on every admin request — deriving per call would add ~24ms to each one. The cache key is a digest of secret plus password, so a rotation misses the cache and derives again, and no extra plaintext copy of the password is kept around. Measured: first derivation 24ms, subsequent calls 0.12ms. Password change and secret change both invalidate an existing token, checked in separate processes. Note the one-time effect: existing admin sessions are invalidated by the change in derivation, so everyone logs in once more. * security(admin): key the signing-key cache on its inputs, not a digest #441 removed the SHA-256 digest of the admin password from the key derivation and introduced a new one three lines above it, as the cache key. Same rule, same file: CodeQL reported it immediately. The comment justifying it was wrong too. It claimed no second plaintext copy of the password was retained, while building the digest input allocates exactly that in order to hash it. The cache now holds the two input strings and compares them directly. They are the same objects the env and install caches already hold, so nothing extra is retained, and no fast hash of the password exists in memory for the life of the process. Re-verified after the change, in separate processes: a token from one process verifies in another with the same inputs, a changed password or secret rejects it, first derivation 24ms, cached calls 0.001ms. That leaves scrypt as the only place the password is hashed here. The two HMACs further down operate on the derived key and on token data, not on the password; the constant-time comparison in verifyAdminPassword is the previously dismissed one. --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
2026-08-14 16:55:07 +02:00
font: 'Bodoni Moda',
type: 'serif',
radius: 0,
frame: 'shadow',
gap: 8,
},
classic: {
label: 'Classic',
desc: 'Soft traditional photographer portfolio with shadows.',
bg: '#f7f7f7',
tile: '#ffffff',
accent: '#444444',
release: v0.11.0 — journal fixes, admin URLs, design system cleanup (#432) * fix(screenshots): sharp-Typen fuer 0.34 und 0.35 gleichzeitig (#410) sharp 0.35 ist von `export =` auf ESM umgestellt: der Modul-Namespace ist nicht mehr aufrufbar, die Factory sitzt unter .default. Der Type-Check brach damit in scripts/screenshots.ts weg, sobald der Next-Bump (#402) sharp von 0.34.5 auf 0.35.3 mitzieht -- sharp ist hier keine deklarierte Dependency, sondern kommt ueber Next mit. Die Form wird jetzt aus dem installierten Paket abgeleitet statt festgeschrieben, zur Laufzeit wie im Typ. Geprueft mit beiden Versionen: tsc laeuft mit 0.34.5 und mit 0.35.3 fehlerfrei durch. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(deps): bump the nextjs group across 1 directory with 2 updates (#402) Bumps the nextjs group with 2 updates in the / directory: [next](https://github.com/vercel/next.js) and [eslint-config-next](https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next). Updates `next` from 16.2.12 to 16.3.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/compare/v16.2.12...v16.3.0) Updates `eslint-config-next` from 16.2.12 to 16.3.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/commits/v16.3.0/packages/eslint-config-next) --- updated-dependencies: - dependency-name: eslint-config-next dependency-version: 16.3.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: nextjs - dependency-name: next dependency-version: 16.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nextjs ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps-dev): bump prettier from 3.8.3 to 3.9.6 (#405) Bumps [prettier](https://github.com/prettier/prettier) from 3.8.3 to 3.9.6. - [Release notes](https://github.com/prettier/prettier/releases) - [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md) - [Commits](https://github.com/prettier/prettier/compare/3.8.3...3.9.6) --- updated-dependencies: - dependency-name: prettier dependency-version: 3.9.6 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * docs(changelog): Unreleased-Sektion fuer die Bumps nach v0.10.0 (#413) Die Dependency-PRs sind nach dem Release auf dev gelandet, teils auch auf main. Ohne Eintrag waeren sie beim naechsten Release unsichtbar -- inklusive Next 16.3.0, das CVE-2025-13465 mitbringt. Ausserdem im 0.10.0-Abschnitt nachgetragen, dass der Trivy-Scan bis #409 nie gelaufen ist. Der Fix steckt im Tag v0.10.0, fehlte aber in der Aufzaehlung -- und "Images werden bei jedem Publish gescannt" stand im Changelog, waehrend der Job im Action-Setup abbrach. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(gallery): per-album sort order, independent of Immich (#408) (#414) Album order was dictated entirely by Immich: getAlbum() sorted by the album's own asc/desc flag, so a Folio album always mirrored the archive. A curated series has a narrative order that has nothing to do with capture time, and changing the Immich album's sort to fit the website changes it for the archive too. Adds an optional per-album `sort` in gallery.yaml, editable in /admin, defaulting to today's behaviour so every existing config is unchanged: immich (default) | newest | oldest | filename | manual `manual` is a pinned *prefix*: `assetOrder` lists only the photos placed by hand, everything else follows in the album's Immich order. A full permutation of a 2,000-photo album would be ~80 KB of UUIDs in a file that is rewritten and copied to content/.backups/ on every admin save. It also makes drift fall out for free — photos removed in Immich never match, new ones land in the tail rather than being hidden. Sorting is applied after the cache read, not before the cache write, so the LRU keeps one canonical Immich-ordered copy per album. That avoids putting the mode in the cache key, lets a config change take effect without depending on invalidation, and keeps the stale-serving path correct. cache.get() returns the stored object by reference, so withSort() returns a shallow clone with a new array — sorting in place would reorder the shared entry, and under request coalescing every concurrent caller would be sorting the same array. Also fixes a prerequisite bug: /api/admin/albums/[albumId]/assets read album.assets from GET /albums/:id, which Immich 3.x no longer populates (lib/immich.ts:507). The hero picker's "This Album" tab returned nothing and threw outright when the key was absent. It now goes through the client's paginated metadata search, with ?types=all to opt videos in for the reorder editor. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): drop decorative emoji from the sort select labels (#415) An <option> cannot contain markup, so the SVG set in Icons is not reachable there — but a decorative emoji is not a substitute for it. Plain text instead; the album card badge already uses a real icon. The remaining emoji in the admin panel (asset picker tabs, section headings, layout picker options) predate this branch and are left for a separate cleanup. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): replace emoji icons with the shared SVG icon set (#416) The admin panel mixed two icon conventions: inline SVGs from `Icons.tsx` in most components, and decorative emoji in the asset picker and a few PageBuilder labels. Emoji render inconsistently across platforms, ignore the accent colour, and cannot inherit the `.svg-icon` sizing rules. - Icons.tsx: add `IconStar` (filled — it marks a state, not an action) and `IconImage`. - AssetPicker: the three tab labels and the favourite tile badge now use IconFolder / IconStar / IconImage. - PageBuilder: the "Standalone Albums" and "Subpages" headings use the icon set instead of an emoji. - PageBuilder: the layout picker drops its emoji for plain text. An <option> cannot contain markup, so an SVG is impossible there and a decorative glyph is not a substitute. - admin.css: align icon and label in the picker tabs, and swap the favourite badge's text-shadow for drop-shadow, which is what applies to an inline SVG. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): fold PageBuilder's local icons into the shared Icons module (#418) * refactor(admin): fold PageBuilder's local icons into the shared module PageBuilder.tsx carried its own `Icons` object duplicating most of the glyphs already exported by Icons.tsx, with hardcoded sizes and slightly divergent paths. Migrate all 32 call sites to the shared module and delete the local object. Five glyphs had no counterpart and are added to Icons.tsx as 1:1 ports of the local paths: IconX, IconPlus, IconHome, IconCopy, IconImage. The local ExternalLink and Check are dropped rather than ported — both had zero call sites. Two glyphs change shape slightly, which is the point of consolidating: the shared IconCamera includes the viewfinder bump the local copy omitted, and drag handles now use IconGripVertical. IconGripVertical uses the module's square 24x24 viewBox, so `.svg-drag` goes from 12x18 to 18x18 — the old non-square box would letterbox the glyph down to 12x12 and shrink the handle. * fix(admin): resolve icon-module integration after #416 Merging dev brought in #416, which added a second IconImage to Icons.tsx and two <Icons.Camera>/<Icons.Folder> section headers that reference the local Icons object this PR removes. Git merged both cleanly but the result did not type-check. - drop the duplicate IconImage (both copies were byte-identical) - point the two section headers at the imported IconCamera/IconFolder - refresh the SORT_LABELS comment: the icon set is imported now, not declared below --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> * fix(config): allow an empty gallery, guard against a double /api suffix (#421) An empty gallery is now a valid, rendered state instead of a throw: deriveGallery() no longer requires at least one album or subpage, so a deployment with no albums yet renders a bare homepage the owner can fill in via /admin. getConfig() also stops appending /api to an Immich URL that already ends in it, which previously produced .../api/api and broke every upstream request. Includes a restore of the per-album sort test cases, which the branch had lost by being cut before #408/#414. * feat(admin): favicon upload, served from the content volume (#422) Adds a bundled default favicon, an upload widget in admin Settings > General, and a route that serves the icon from the writable content/ volume with a fallback to the bundled default. Raster uploads (PNG/ICO/JPEG) are wrapped in an SVG container; the response carries its own CSP so an uploaded SVG cannot execute script on the origin. The GET route revalidates with an ETag instead of caching immutably, so a newly uploaded icon shows up immediately. Uploads are written via temp file + rename, and a Reset button restores the bundled default. * ci: flag unformatted files in a PR, without blocking it (#424) Prettier is configured as an error rule in eslint.config.mjs but has never run in CI, so part of the tree predates it. A final CI step now diffs against the PR base, runs prettier --list-different over the changed files, and emits a warning annotation per offender plus a job summary. Advisory by design: it never fails the job. Blocking would turn a PR red for merely touching a file that was already unformatted, and normalising the tree in one commit would wreck git blame and conflict with the PRs in flight. Requires fetch-depth: 0, since diffing against the base needs its history. * feat(install): first-run wizard gated by a one-time setup token (#419) Adds /install, a four-step first-run wizard: connect to Immich, optionally pick albums, name the site, finish. It verifies the credentials against the Immich server before writing anything, then writes gallery.yaml, settings.yaml and a content/install.json carrying the Immich credentials and a generated site secret. install.json exists because a running process cannot pick up new env vars — the wizard has to write configuration that takes effect without a restart. getInstallCredentials() merges it under the real environment, so env vars always win and rotation stays a matter of setting one. Both the page and the API routes are gated by a one-time setup token printed to the server log, so a deployment that is reachable before gallery.yaml exists cannot be configured by whoever finds it first. The token is stored in content/.setup-token (0600) rather than a module variable: Next.js bundles the page and each route handler separately, so a module-level token left the page and the API disagreeing inside one process and the wizard stuck on step 1. It is removed once the install completes. The admin password is stored as an scrypt hash using the scheme lib/auth.ts already applies to album passwords; a plaintext ADMIN_PASSWORD env var keeps working. * docs: document the setup wizard, fix the read-only content mount (#425) Quick Start now leads with the /install wizard, with the hand-written YAML route kept alongside it, and a First-Run Setup section covers the setup token, the files the wizard writes, and env-var precedence. Two corrections: both Docker examples mounted content/ as :ro, which silently breaks the wizard, the admin panel and the backup rotation alike — docs/admin-panel.md already said so and the README contradicted it. And nothing documented that content/install.json holds the Immich API key, so a backup of content/ is a backup of credentials. Also adds a Contributors section crediting the people whose work is in the project. * feat(admin): floating save bar pinned to the bottom of the viewport (#426) The save bar was the first, static element inside .admin-main. Since the document itself scrolls, it left the viewport as soon as you scrolled down — editing a subpage section or a settings block far below gave no visible dirty hint and no reachable save button. Replace it with a bottom-pinned floating bar shared by both editors. It only mounts while there is something to act on (unsaved changes, an in-flight save, or a result message), so it never covers content while idle. The success message clears after 5s, which hides the bar again. - new SaveBar component, replacing the duplicated markup in PageBuilder and SettingsEditor - adopt the previously unused .floating-save-bar CSS: slide-in keyframes (carrying translateX(-50%)), dirty border, wrap/gap, mobile variant and a prefers-reduced-motion opt-out; z-index 900 keeps it below modals - .admin-main gains bottom padding so the bar never covers page content - drop the now-unreachable idle hints: the ⌘S hint becomes a button title, the Live Sync note becomes a static line above the settings layout - header "Site" link now bypasses the cache (/?fresh=1), so the preview stays reachable when the bar is hidden Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(admin): themed listbox for the album sort control (#427) The per-album "Photo order" control was a native <select>. Because an <option> cannot contain markup, its choices could not use the admin panel's currentColor SVG set — the reason #415 had to fall back to plain text after dropping the emoji labels. Adds a Listbox component implementing the ARIA combobox/listbox pattern, so options can render a glyph beside their label: - DOM focus stays on the trigger button; the active option is announced through aria-activedescendant, keeping focus management to one element - Keyboard: arrows (clamped at the ends, like a native select), Home/End, Enter/Space to commit, Escape to cancel, Tab commits and moves on, and prefix type-ahead with a repeat-key cycle - Outside dismissal on pointerdown, so a press starting outside closes the popup before the click retargets The sort options now carry an icon each: calendar, arrow-down, arrow-up, an A→Z marker, and the drag glyph for manual — matching the badge the album card already shows. SORT_LABELS stays plain text because the badge feeds it to a title attribute. Closes #417 Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(git): ignore generated design handoff folders * fix(admin): stop the album sort dropdown clipping, and simplify the panel (#428) * fix(admin): render listbox popup in a portal so it escapes modal clipping The sort control's popup was position:absolute inside three clipping ancestors (.album-drawer overflow:hidden > .album-drawer-body overflow-y:auto > .modal-right-column overflow-y:auto), so it was cut off at the bottom of the Edit Album Details modal. z-index could not help: clipping happens before stacking. It also always hung below the trigger, with no flip. Portal the popup to document.body and position it from the trigger's viewport rect, flipping above when there is more room there and capping max-height to the space available so it scrolls internally rather than overflowing. It is dismissed on scroll and resize, since the anchor is only measured on open. The outside-pointerdown handler now also treats the popup as inside; without that the portalled list counts as outside, and a click on an option would close it before the selection commits. * refactor(admin): single-column album details panel The left column spent 1.2fr on a cover thumbnail and three stat rows, two of which (Status, Custom Hero) only restated the form fields opposite them, while the form itself was squeezed into 1.8fr behind a second nested scroller. Stack the drawer in one column instead: cover as a banner, then the form at full width, with the UUID moved into the footer. The body is now the only scroll container, which also removes one of the ancestors that was clipping the sort popup. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> * fix(admin): give the portalled listbox its theme back, lock the page behind modals (#429) Two defects in the album editor. The sort listbox popup painted transparent. Every --admin-* variable is scoped to .admin-layout, and since the popup moved into document.body it sits outside that subtree, so background/border/text all resolved to nothing. It now carries its own copy of the palette in both colour schemes, plus the font it no longer inherits. Scrolling inside a modal also moved the page behind it. No admin modal ever locked body scroll: the overlay covers the page but does not absorb wheel events, so a scroll starting on the backdrop — or continuing past the end of the modal's own scroller — reaches the document. overscroll-behavior cannot cover that case on its own, because it only applies to scroll containers and the backdrop is not one. useScrollLock freezes body while a modal is open and compensates for the width the scrollbar gives up, so nothing shifts underneath. Each lock restores the inline value it found, which makes nesting work without a counter — a picker opened from the drawer restores the drawer's hidden state instead of clearing it. Applied to both drawers and all four picker modals, which share the defect. overscroll-behavior: contain on the scrollers stops the chaining they can handle themselves. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com> * fix(security): allow unsafe-eval in CSP script-src during dev mode * feat(journal): add Journal Studio with split-screen editor, live preview and dedicated routes * fix(build): separate client parser from server journal-service and fix build type errors * fix(journal): Fotos rendern, Layout und Lightbox-Steuerung korrigieren Fünf unabhängige Fehler in der öffentlichen Journal- und Essay-Ansicht: * Foto-Blöcke wurden nie angezeigt. EssayView löst ein Foto über PhotoItem.id auf, und das sind verschlüsselte Tokens — die Blöcke aus dem Markdown tragen aber rohe Asset-UUIDs. Jede Zuordnung lief ins Leere, und nicht auflösbare Blöcke werden still verworfen. Die IDs werden jetzt serverseitig übersetzt; damit verschwinden nebenbei die rohen UUIDs aus dem Client-Payload, die dort laut Projektregel nie auftauchen dürfen. Nicht auflösbare Referenzen werden geloggt. * Überschriften standen weiter links als der Fließtext. Jeder Block hatte einzeln `max-width: 68ch`, und `ch` ist relativ zur Schrift des Elements — die Serif-Überschrift ergab eine breitere Spalte. Ersetzt durch eine gemeinsame, font-unabhängige `--essay-measure`. * Fullbleed-Fotos bluteten nur nach links aus: `.essay-figure` ist `width: 100%`, wodurch die Box überbestimmt ist und der negative rechte Margin verworfen wird. * Foto-Paare stellten beide Bilder gleich breit dar, wodurch ein Hochformat neben einem Querformat doppelt so hoch wurde. Jetzt eine Justified-Reihe: Breite proportional zum Seitenverhältnis, dadurch exakt gleiche Höhen ohne Beschnitt. * Die Lightbox hatte im Journal keine Tastatursteuerung und keine Scroll-Sperre — beides lag in PhotoGrid, also nur im Album-Raster. Verlagert in die Lightbox selbst, der doppelte Handler in PhotoGrid entfernt (sonst wäre pro Pfeildruck zwei Bilder weitergesprungen). Zusätzlich sind Proofing-Herzen und das EXIF-Panel im redaktionellen Modus abschaltbar und im Journal aus: Client-Proofing ist ein Übergabe-Workflow für Alben, keine Funktion einer Reportage. Auf der Übersicht wurde der Untertitel doppelt gerendert, weil extractExcerpt() auf ihn zurückfällt. * feat(admin): eigene URLs für alle Bereiche und überarbeiteter Journal Studio Das Panel war eine einzige Client-Komponente, die ihre Tabs über useState umschaltet: keine Route pro Bereich, kein Deep-Link, kein Zurück-Button, und nach jedem Reload landete man wieder auf "Pages". Auch der Journal-Editor hatte keine eigene URL. Jetzt sieben echte Routen (/admin, /admin/pages, /admin/journal, /admin/journal/<slug>, /admin/settings, /admin/settings/<section>, /admin/analytics). Die Shell mit Auth-Prüfung und Kopfzeile sitzt im Layout und umschließt children — so bleibt die Session-Prüfung über Routenwechsel montiert, statt bei jedem Tab-Wechsel neu zu laufen und den Spinner aufblitzen zu lassen. Unbekannte Settings-Sections fallen auf General zurück. Im selben Zug der Journal Studio, der die Routing-Änderung ohnehin berührt: * Alle Eingabefelder nutzten die Klasse `admin-input`, die in keinem CSS definiert war — sie fielen auf Browser-Defaults zurück. Jetzt gestylt, gescoped, damit der generische Name nicht ins übrige Panel leckt. * Der Split View ist per Divider verschiebbar (Maus, Tastatur, Doppelklick zum Zurücksetzen), Breite in localStorage. * Das Studio bricht aus der 1120px-Spalte aus, die Preview hat Platz. * Die Preview zeigte für jedes Foto fest 3:2 und log damit über das Layout der veröffentlichten Seite; die echten Verhältnisse werden jetzt an den Thumbnails gemessen. * Blöcke mit alten positionsbasierten Foto-Referenzen werden markiert — die lassen sich auf einer eigenständigen Journal-Seite nicht auflösen und verschwanden bisher stillschweigend. * Blocktyp-Chips als gemeinsame Komponente, monochrom und per Icon unterschieden statt in einer eigenen Blau/Lila/Orange-Palette, die sonst nirgends im Panel vorkommt. * Emojis raus, SVG-Icons rein. * fix(admin): Designsystem-Lücken im Panel schließen Eine systematische Suche nach Klassen, die im TSX benutzt, aber in keinem CSS definiert sind, hat vier Stellen mit demselben Muster gefunden: * `admin-btn-secondary` und `admin-btn-danger` existierten nicht. Sämtliche Löschen-Buttons sahen aus wie normale Buttons — keine Warnwirkung. Als `.admin-btn.admin-btn-danger` geschrieben, weil die Varianten mit den Größenklassen kombiniert werden, die weiter unten ihren eigenen Hintergrund setzen. * `page-progress-fill` fehlte: die Balken im Analytics-Panel waren leere Rinnen, der Wert unsichtbar. Ebenso `analytics-empty` und `admin-loading-container`. * `subpage-drawer-section`, `subpage-drawer-title-group` und `input-with-icon` im PageBuilder waren wirkungslos und teils mit Inline-Styles notdürftig kompensiert. * `grid-card-preview` fehlte, wodurch alle Layout-Vorschauen auf Höhe null kollabierten. Nur "Showcase" war sichtbar — und das aus Versehen, weil sein Tile `hero-tile` hieß und damit die `aspect-ratio` einer fremden PageBuilder-Klasse erbte. Umbenannt. Dazu die Theme-Vorschauen, die praktisch identisch aussahen: alle sieben zeigten dieselben drei quadratischen Kacheln, einziger Unterschied war die Hintergrundfarbe. Sie spiegeln jetzt die echten Preset-Daten aus lib/config/theme.ts — Schriftcharakter, Eckradius, Rasterdichte, Passepartout bzw. Schatten. Die Kopfzeile richtet sich an einer gemeinsamen Steuerhöhe aus. Der "Site"-Link war höher als die Buttons daneben: `.admin-btn` hatte keine explizite line-height, und <button> bekommt box-sizing: border-box vom Browser, <a> nicht. Die Statusanzeige setzte weder Schriftfamilie noch -größe und fiel auf den Browser-Default zurück — sie war nie Teil des Designsystems. Jetzt gleiche Höhe und Typografie, Pillenform als Zustandsanzeige, Trenner zur Aktionsgruppe. Das dauerhafte Pulsieren des grünen Punkts entfällt; Animation bleibt den Zuständen vorbehalten, die Aufmerksamkeit brauchen. Restliche Emojis durch SVG-Icons ersetzt. * feat(admin): add scroll-to-top toggle and SVG arrow The back-to-top button was always on and drew its arrow with the ↑ text character. Add a `scrollToTop` setting (General section in the admin panel, defaults to on so existing sites are unaffected) and replace the glyph with a stroked SVG that inherits currentColor across all presets. Scroll handling is now rAF-throttled, and prefers-reduced-motion turns off both the hover lift and the smooth scroll. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * security(journal): escape author HTML instead of filtering it CodeQL flags 26 high-severity alerts on the release PR; the bulk of them point at sanitizeHtml(), a denylist of three regexes whose output goes into dangerouslySetInnerHTML. I reproduced the bypasses before changing anything — all four pass the old filter: <img src=x onerror=alert(1)> unquoted handler, regex wants quotes <img src=x onerror='alert(1)'> single quotes, same reason <svg onload=alert(1)> not a <script> tag javasjavascript:cript:alert(1) one-pass replace, the rest recombines Plus an attribute breakout in the link renderer, which interpolated the URL into href="${url}" unescaped: [x](" onmouseover=alert(1) x=") -> <a href="" onmouseover=alert(1" ...> Replaced with escaping. Every `&<>"'` in author text becomes an entity before any markdown rule runs, so the only tags in the output are the ones renderInlineMarkdown builds itself and a URL cannot leave its attribute. Link schemes are now an allowlist (http, https, mailto, tel, relative, anchor); anything else renders as plain text. The serializer needed decodeHtmlEntities to match: without it a save would write `&lt;` into the Markdown file and the next parse would escape the `&` again, corrupting the text further on every round trip. A test covers parse -> serialize -> parse stability. Two existing tests asserted the old behaviour and were rewritten rather than deleted: one expected the script tag to be *removed* from the output, the other expected the substring "onerror" to be absent. Both now assert the property that matters — that no tag can form — because `onerror` surviving as inert text is fine. Exploitation required admin access either way: journal and essay text comes from the studio or from content/*.md. This removes the weakness, it does not close an open door. * fix(journal): contain file paths, fix frontmatter escaping, defuse two regexes Follow-up to the CodeQL findings on release PR #432. I went through all 23 alerts individually; this addresses the ones that are worth addressing and documents the ones that are not. Path containment (12 alerts, all false positives). Every path built from a slug goes through isValidSlug(), a strict `/^[a-zA-Z0-9_-]+$/` allowlist — verified against `../../etc/passwd`, `foo/../../bar`, `a/b`, `..` and friends, all rejected. CodeQL cannot see it because the check lives in another module. Added a containedPath() helper that resolves the path and refuses anything landing outside the content directory: a second lock on a door that was already locked, and a barrier the analysis can follow. Also removed the dead `slug.endsWith('.md')` branches — isValidSlug rejects dots, so they could never be taken. Frontmatter escaping (1 alert, a real bug). The serializer escaped `"` but not `\`, and the parser never unescaped anything. A title containing either character gained a backslash on every save/load cycle: Path C:\Users "quoted" -> Path C:\\Users \"quoted\" -> ... Escaping now covers the backslash first and the parser undoes both. A round trip test covers quotes, backslashes, colons and apostrophes. Two of three ReDoS regexes (2 alerts). The heading pattern had `\s+` next to `(.+)`, which overlap, so the engine tried every split of the whitespace run before failing; it is `[ \t]+` and `(\S.*)` now. The quote author pattern wrapped a lazy group around an optional group — the quadratic case — and is an index split on the first separator now. The third regex, the bold/italic pass, is deliberately left alone. Rewriting it with a negated class removes the backtracking but breaks nesting: `**bold *and italic* here**` renders as `*<em>bold </em>and italic<em> here</em>*`. The input is Markdown from an authenticated admin, never a visitor, so the worst case is an author slowing down their own page. The comment in the code says so. Not addressed: 5 js/insufficient-password-hash alerts. They ask for a slow KDF where the code uses SHA-256/HMAC — correct in general, but the admin password comes from an environment variable and is never stored, so a stronger KDF protects nothing that is not already in plaintext in the environment. 399 unit tests pass (18 new), build and tsc clean. * fix(journal): split the quote author by scanning, not by pattern Cleaning up after myself. #439 replaced the quote author regex `/^(.*?)(?:\s+--\s+(.+))?$/` — a lazy group around an optional one, the quadratic case — with `/\s+--\s+/`, and CodeQL promptly flagged the replacement for the same reason. One reported pattern traded for another. splitQuoteAuthor() scans for the first `--` that has whitespace on both sides. Linear, and it needs no reasoning about the regex engine at all. Behaviour is identical to the original regex, checked case by case against it: separator, no separator, several separators, tabs, wide gaps, `a--b` without spaces, leading and trailing separators, empty string. All nine are covered by tests, plus one asserting it stays fast on a 50k whitespace run. * security(admin): derive the session signing key with scrypt getSigningKey() ran the admin password through a single SHA-256 digest. It is key derivation rather than password storage, so it was never a stored-hash problem — but if the derived key ever leaked, one fast hash makes recovering the password by brute force cheap. CodeQL flags it as js/insufficient-password-hash and, for this particular alert, has a point. scrypt now. Two details that matter: The salt has to be stable. A random salt would produce a different key on every call and invalidate every session; it is derived from AUTH_SECRET, which is deployment-specific. Verified across separate processes: same inputs produce a verifying token, so a restart or redeploy does not log everyone out. The result is cached for the process lifetime. scrypt is deliberately slow and getSigningKey() runs on every admin request — deriving per call would add ~24ms to each one. The cache key is a digest of secret plus password, so a rotation misses the cache and derives again, and no extra plaintext copy of the password is kept around. Measured: first derivation 24ms, subsequent calls 0.12ms. Password change and secret change both invalidate an existing token, checked in separate processes. Note the one-time effect: existing admin sessions are invalidated by the change in derivation, so everyone logs in once more. * security(admin): key the signing-key cache on its inputs, not a digest #441 removed the SHA-256 digest of the admin password from the key derivation and introduced a new one three lines above it, as the cache key. Same rule, same file: CodeQL reported it immediately. The comment justifying it was wrong too. It claimed no second plaintext copy of the password was retained, while building the digest input allocates exactly that in order to hash it. The cache now holds the two input strings and compares them directly. They are the same objects the env and install caches already hold, so nothing extra is retained, and no fast hash of the password exists in memory for the life of the process. Re-verified after the change, in separate processes: a token from one process verifies in another with the same inputs, a changed password or secret rejects it, first derivation 24ms, cached calls 0.001ms. That leaves scrypt as the only place the password is hashed here. The two HMACs further down operate on the derived key and on token data, not on the password; the constant-time comparison in verifyAdminPassword is the previously dismissed one. --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
2026-08-14 16:55:07 +02:00
font: 'Cinzel',
type: 'serif',
radius: 12,
frame: 'passepartout',
gap: 7,
},
noir: {
label: 'Noir',
desc: 'High drama absolute pitch black, stark high-fashion look.',
bg: '#000000',
tile: '#151515',
accent: '#ffffff',
release: v0.11.0 — journal fixes, admin URLs, design system cleanup (#432) * fix(screenshots): sharp-Typen fuer 0.34 und 0.35 gleichzeitig (#410) sharp 0.35 ist von `export =` auf ESM umgestellt: der Modul-Namespace ist nicht mehr aufrufbar, die Factory sitzt unter .default. Der Type-Check brach damit in scripts/screenshots.ts weg, sobald der Next-Bump (#402) sharp von 0.34.5 auf 0.35.3 mitzieht -- sharp ist hier keine deklarierte Dependency, sondern kommt ueber Next mit. Die Form wird jetzt aus dem installierten Paket abgeleitet statt festgeschrieben, zur Laufzeit wie im Typ. Geprueft mit beiden Versionen: tsc laeuft mit 0.34.5 und mit 0.35.3 fehlerfrei durch. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(deps): bump the nextjs group across 1 directory with 2 updates (#402) Bumps the nextjs group with 2 updates in the / directory: [next](https://github.com/vercel/next.js) and [eslint-config-next](https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next). Updates `next` from 16.2.12 to 16.3.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/compare/v16.2.12...v16.3.0) Updates `eslint-config-next` from 16.2.12 to 16.3.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/commits/v16.3.0/packages/eslint-config-next) --- updated-dependencies: - dependency-name: eslint-config-next dependency-version: 16.3.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: nextjs - dependency-name: next dependency-version: 16.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nextjs ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps-dev): bump prettier from 3.8.3 to 3.9.6 (#405) Bumps [prettier](https://github.com/prettier/prettier) from 3.8.3 to 3.9.6. - [Release notes](https://github.com/prettier/prettier/releases) - [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md) - [Commits](https://github.com/prettier/prettier/compare/3.8.3...3.9.6) --- updated-dependencies: - dependency-name: prettier dependency-version: 3.9.6 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * docs(changelog): Unreleased-Sektion fuer die Bumps nach v0.10.0 (#413) Die Dependency-PRs sind nach dem Release auf dev gelandet, teils auch auf main. Ohne Eintrag waeren sie beim naechsten Release unsichtbar -- inklusive Next 16.3.0, das CVE-2025-13465 mitbringt. Ausserdem im 0.10.0-Abschnitt nachgetragen, dass der Trivy-Scan bis #409 nie gelaufen ist. Der Fix steckt im Tag v0.10.0, fehlte aber in der Aufzaehlung -- und "Images werden bei jedem Publish gescannt" stand im Changelog, waehrend der Job im Action-Setup abbrach. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(gallery): per-album sort order, independent of Immich (#408) (#414) Album order was dictated entirely by Immich: getAlbum() sorted by the album's own asc/desc flag, so a Folio album always mirrored the archive. A curated series has a narrative order that has nothing to do with capture time, and changing the Immich album's sort to fit the website changes it for the archive too. Adds an optional per-album `sort` in gallery.yaml, editable in /admin, defaulting to today's behaviour so every existing config is unchanged: immich (default) | newest | oldest | filename | manual `manual` is a pinned *prefix*: `assetOrder` lists only the photos placed by hand, everything else follows in the album's Immich order. A full permutation of a 2,000-photo album would be ~80 KB of UUIDs in a file that is rewritten and copied to content/.backups/ on every admin save. It also makes drift fall out for free — photos removed in Immich never match, new ones land in the tail rather than being hidden. Sorting is applied after the cache read, not before the cache write, so the LRU keeps one canonical Immich-ordered copy per album. That avoids putting the mode in the cache key, lets a config change take effect without depending on invalidation, and keeps the stale-serving path correct. cache.get() returns the stored object by reference, so withSort() returns a shallow clone with a new array — sorting in place would reorder the shared entry, and under request coalescing every concurrent caller would be sorting the same array. Also fixes a prerequisite bug: /api/admin/albums/[albumId]/assets read album.assets from GET /albums/:id, which Immich 3.x no longer populates (lib/immich.ts:507). The hero picker's "This Album" tab returned nothing and threw outright when the key was absent. It now goes through the client's paginated metadata search, with ?types=all to opt videos in for the reorder editor. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): drop decorative emoji from the sort select labels (#415) An <option> cannot contain markup, so the SVG set in Icons is not reachable there — but a decorative emoji is not a substitute for it. Plain text instead; the album card badge already uses a real icon. The remaining emoji in the admin panel (asset picker tabs, section headings, layout picker options) predate this branch and are left for a separate cleanup. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): replace emoji icons with the shared SVG icon set (#416) The admin panel mixed two icon conventions: inline SVGs from `Icons.tsx` in most components, and decorative emoji in the asset picker and a few PageBuilder labels. Emoji render inconsistently across platforms, ignore the accent colour, and cannot inherit the `.svg-icon` sizing rules. - Icons.tsx: add `IconStar` (filled — it marks a state, not an action) and `IconImage`. - AssetPicker: the three tab labels and the favourite tile badge now use IconFolder / IconStar / IconImage. - PageBuilder: the "Standalone Albums" and "Subpages" headings use the icon set instead of an emoji. - PageBuilder: the layout picker drops its emoji for plain text. An <option> cannot contain markup, so an SVG is impossible there and a decorative glyph is not a substitute. - admin.css: align icon and label in the picker tabs, and swap the favourite badge's text-shadow for drop-shadow, which is what applies to an inline SVG. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): fold PageBuilder's local icons into the shared Icons module (#418) * refactor(admin): fold PageBuilder's local icons into the shared module PageBuilder.tsx carried its own `Icons` object duplicating most of the glyphs already exported by Icons.tsx, with hardcoded sizes and slightly divergent paths. Migrate all 32 call sites to the shared module and delete the local object. Five glyphs had no counterpart and are added to Icons.tsx as 1:1 ports of the local paths: IconX, IconPlus, IconHome, IconCopy, IconImage. The local ExternalLink and Check are dropped rather than ported — both had zero call sites. Two glyphs change shape slightly, which is the point of consolidating: the shared IconCamera includes the viewfinder bump the local copy omitted, and drag handles now use IconGripVertical. IconGripVertical uses the module's square 24x24 viewBox, so `.svg-drag` goes from 12x18 to 18x18 — the old non-square box would letterbox the glyph down to 12x12 and shrink the handle. * fix(admin): resolve icon-module integration after #416 Merging dev brought in #416, which added a second IconImage to Icons.tsx and two <Icons.Camera>/<Icons.Folder> section headers that reference the local Icons object this PR removes. Git merged both cleanly but the result did not type-check. - drop the duplicate IconImage (both copies were byte-identical) - point the two section headers at the imported IconCamera/IconFolder - refresh the SORT_LABELS comment: the icon set is imported now, not declared below --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> * fix(config): allow an empty gallery, guard against a double /api suffix (#421) An empty gallery is now a valid, rendered state instead of a throw: deriveGallery() no longer requires at least one album or subpage, so a deployment with no albums yet renders a bare homepage the owner can fill in via /admin. getConfig() also stops appending /api to an Immich URL that already ends in it, which previously produced .../api/api and broke every upstream request. Includes a restore of the per-album sort test cases, which the branch had lost by being cut before #408/#414. * feat(admin): favicon upload, served from the content volume (#422) Adds a bundled default favicon, an upload widget in admin Settings > General, and a route that serves the icon from the writable content/ volume with a fallback to the bundled default. Raster uploads (PNG/ICO/JPEG) are wrapped in an SVG container; the response carries its own CSP so an uploaded SVG cannot execute script on the origin. The GET route revalidates with an ETag instead of caching immutably, so a newly uploaded icon shows up immediately. Uploads are written via temp file + rename, and a Reset button restores the bundled default. * ci: flag unformatted files in a PR, without blocking it (#424) Prettier is configured as an error rule in eslint.config.mjs but has never run in CI, so part of the tree predates it. A final CI step now diffs against the PR base, runs prettier --list-different over the changed files, and emits a warning annotation per offender plus a job summary. Advisory by design: it never fails the job. Blocking would turn a PR red for merely touching a file that was already unformatted, and normalising the tree in one commit would wreck git blame and conflict with the PRs in flight. Requires fetch-depth: 0, since diffing against the base needs its history. * feat(install): first-run wizard gated by a one-time setup token (#419) Adds /install, a four-step first-run wizard: connect to Immich, optionally pick albums, name the site, finish. It verifies the credentials against the Immich server before writing anything, then writes gallery.yaml, settings.yaml and a content/install.json carrying the Immich credentials and a generated site secret. install.json exists because a running process cannot pick up new env vars — the wizard has to write configuration that takes effect without a restart. getInstallCredentials() merges it under the real environment, so env vars always win and rotation stays a matter of setting one. Both the page and the API routes are gated by a one-time setup token printed to the server log, so a deployment that is reachable before gallery.yaml exists cannot be configured by whoever finds it first. The token is stored in content/.setup-token (0600) rather than a module variable: Next.js bundles the page and each route handler separately, so a module-level token left the page and the API disagreeing inside one process and the wizard stuck on step 1. It is removed once the install completes. The admin password is stored as an scrypt hash using the scheme lib/auth.ts already applies to album passwords; a plaintext ADMIN_PASSWORD env var keeps working. * docs: document the setup wizard, fix the read-only content mount (#425) Quick Start now leads with the /install wizard, with the hand-written YAML route kept alongside it, and a First-Run Setup section covers the setup token, the files the wizard writes, and env-var precedence. Two corrections: both Docker examples mounted content/ as :ro, which silently breaks the wizard, the admin panel and the backup rotation alike — docs/admin-panel.md already said so and the README contradicted it. And nothing documented that content/install.json holds the Immich API key, so a backup of content/ is a backup of credentials. Also adds a Contributors section crediting the people whose work is in the project. * feat(admin): floating save bar pinned to the bottom of the viewport (#426) The save bar was the first, static element inside .admin-main. Since the document itself scrolls, it left the viewport as soon as you scrolled down — editing a subpage section or a settings block far below gave no visible dirty hint and no reachable save button. Replace it with a bottom-pinned floating bar shared by both editors. It only mounts while there is something to act on (unsaved changes, an in-flight save, or a result message), so it never covers content while idle. The success message clears after 5s, which hides the bar again. - new SaveBar component, replacing the duplicated markup in PageBuilder and SettingsEditor - adopt the previously unused .floating-save-bar CSS: slide-in keyframes (carrying translateX(-50%)), dirty border, wrap/gap, mobile variant and a prefers-reduced-motion opt-out; z-index 900 keeps it below modals - .admin-main gains bottom padding so the bar never covers page content - drop the now-unreachable idle hints: the ⌘S hint becomes a button title, the Live Sync note becomes a static line above the settings layout - header "Site" link now bypasses the cache (/?fresh=1), so the preview stays reachable when the bar is hidden Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(admin): themed listbox for the album sort control (#427) The per-album "Photo order" control was a native <select>. Because an <option> cannot contain markup, its choices could not use the admin panel's currentColor SVG set — the reason #415 had to fall back to plain text after dropping the emoji labels. Adds a Listbox component implementing the ARIA combobox/listbox pattern, so options can render a glyph beside their label: - DOM focus stays on the trigger button; the active option is announced through aria-activedescendant, keeping focus management to one element - Keyboard: arrows (clamped at the ends, like a native select), Home/End, Enter/Space to commit, Escape to cancel, Tab commits and moves on, and prefix type-ahead with a repeat-key cycle - Outside dismissal on pointerdown, so a press starting outside closes the popup before the click retargets The sort options now carry an icon each: calendar, arrow-down, arrow-up, an A→Z marker, and the drag glyph for manual — matching the badge the album card already shows. SORT_LABELS stays plain text because the badge feeds it to a title attribute. Closes #417 Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(git): ignore generated design handoff folders * fix(admin): stop the album sort dropdown clipping, and simplify the panel (#428) * fix(admin): render listbox popup in a portal so it escapes modal clipping The sort control's popup was position:absolute inside three clipping ancestors (.album-drawer overflow:hidden > .album-drawer-body overflow-y:auto > .modal-right-column overflow-y:auto), so it was cut off at the bottom of the Edit Album Details modal. z-index could not help: clipping happens before stacking. It also always hung below the trigger, with no flip. Portal the popup to document.body and position it from the trigger's viewport rect, flipping above when there is more room there and capping max-height to the space available so it scrolls internally rather than overflowing. It is dismissed on scroll and resize, since the anchor is only measured on open. The outside-pointerdown handler now also treats the popup as inside; without that the portalled list counts as outside, and a click on an option would close it before the selection commits. * refactor(admin): single-column album details panel The left column spent 1.2fr on a cover thumbnail and three stat rows, two of which (Status, Custom Hero) only restated the form fields opposite them, while the form itself was squeezed into 1.8fr behind a second nested scroller. Stack the drawer in one column instead: cover as a banner, then the form at full width, with the UUID moved into the footer. The body is now the only scroll container, which also removes one of the ancestors that was clipping the sort popup. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> * fix(admin): give the portalled listbox its theme back, lock the page behind modals (#429) Two defects in the album editor. The sort listbox popup painted transparent. Every --admin-* variable is scoped to .admin-layout, and since the popup moved into document.body it sits outside that subtree, so background/border/text all resolved to nothing. It now carries its own copy of the palette in both colour schemes, plus the font it no longer inherits. Scrolling inside a modal also moved the page behind it. No admin modal ever locked body scroll: the overlay covers the page but does not absorb wheel events, so a scroll starting on the backdrop — or continuing past the end of the modal's own scroller — reaches the document. overscroll-behavior cannot cover that case on its own, because it only applies to scroll containers and the backdrop is not one. useScrollLock freezes body while a modal is open and compensates for the width the scrollbar gives up, so nothing shifts underneath. Each lock restores the inline value it found, which makes nesting work without a counter — a picker opened from the drawer restores the drawer's hidden state instead of clearing it. Applied to both drawers and all four picker modals, which share the defect. overscroll-behavior: contain on the scrollers stops the chaining they can handle themselves. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com> * fix(security): allow unsafe-eval in CSP script-src during dev mode * feat(journal): add Journal Studio with split-screen editor, live preview and dedicated routes * fix(build): separate client parser from server journal-service and fix build type errors * fix(journal): Fotos rendern, Layout und Lightbox-Steuerung korrigieren Fünf unabhängige Fehler in der öffentlichen Journal- und Essay-Ansicht: * Foto-Blöcke wurden nie angezeigt. EssayView löst ein Foto über PhotoItem.id auf, und das sind verschlüsselte Tokens — die Blöcke aus dem Markdown tragen aber rohe Asset-UUIDs. Jede Zuordnung lief ins Leere, und nicht auflösbare Blöcke werden still verworfen. Die IDs werden jetzt serverseitig übersetzt; damit verschwinden nebenbei die rohen UUIDs aus dem Client-Payload, die dort laut Projektregel nie auftauchen dürfen. Nicht auflösbare Referenzen werden geloggt. * Überschriften standen weiter links als der Fließtext. Jeder Block hatte einzeln `max-width: 68ch`, und `ch` ist relativ zur Schrift des Elements — die Serif-Überschrift ergab eine breitere Spalte. Ersetzt durch eine gemeinsame, font-unabhängige `--essay-measure`. * Fullbleed-Fotos bluteten nur nach links aus: `.essay-figure` ist `width: 100%`, wodurch die Box überbestimmt ist und der negative rechte Margin verworfen wird. * Foto-Paare stellten beide Bilder gleich breit dar, wodurch ein Hochformat neben einem Querformat doppelt so hoch wurde. Jetzt eine Justified-Reihe: Breite proportional zum Seitenverhältnis, dadurch exakt gleiche Höhen ohne Beschnitt. * Die Lightbox hatte im Journal keine Tastatursteuerung und keine Scroll-Sperre — beides lag in PhotoGrid, also nur im Album-Raster. Verlagert in die Lightbox selbst, der doppelte Handler in PhotoGrid entfernt (sonst wäre pro Pfeildruck zwei Bilder weitergesprungen). Zusätzlich sind Proofing-Herzen und das EXIF-Panel im redaktionellen Modus abschaltbar und im Journal aus: Client-Proofing ist ein Übergabe-Workflow für Alben, keine Funktion einer Reportage. Auf der Übersicht wurde der Untertitel doppelt gerendert, weil extractExcerpt() auf ihn zurückfällt. * feat(admin): eigene URLs für alle Bereiche und überarbeiteter Journal Studio Das Panel war eine einzige Client-Komponente, die ihre Tabs über useState umschaltet: keine Route pro Bereich, kein Deep-Link, kein Zurück-Button, und nach jedem Reload landete man wieder auf "Pages". Auch der Journal-Editor hatte keine eigene URL. Jetzt sieben echte Routen (/admin, /admin/pages, /admin/journal, /admin/journal/<slug>, /admin/settings, /admin/settings/<section>, /admin/analytics). Die Shell mit Auth-Prüfung und Kopfzeile sitzt im Layout und umschließt children — so bleibt die Session-Prüfung über Routenwechsel montiert, statt bei jedem Tab-Wechsel neu zu laufen und den Spinner aufblitzen zu lassen. Unbekannte Settings-Sections fallen auf General zurück. Im selben Zug der Journal Studio, der die Routing-Änderung ohnehin berührt: * Alle Eingabefelder nutzten die Klasse `admin-input`, die in keinem CSS definiert war — sie fielen auf Browser-Defaults zurück. Jetzt gestylt, gescoped, damit der generische Name nicht ins übrige Panel leckt. * Der Split View ist per Divider verschiebbar (Maus, Tastatur, Doppelklick zum Zurücksetzen), Breite in localStorage. * Das Studio bricht aus der 1120px-Spalte aus, die Preview hat Platz. * Die Preview zeigte für jedes Foto fest 3:2 und log damit über das Layout der veröffentlichten Seite; die echten Verhältnisse werden jetzt an den Thumbnails gemessen. * Blöcke mit alten positionsbasierten Foto-Referenzen werden markiert — die lassen sich auf einer eigenständigen Journal-Seite nicht auflösen und verschwanden bisher stillschweigend. * Blocktyp-Chips als gemeinsame Komponente, monochrom und per Icon unterschieden statt in einer eigenen Blau/Lila/Orange-Palette, die sonst nirgends im Panel vorkommt. * Emojis raus, SVG-Icons rein. * fix(admin): Designsystem-Lücken im Panel schließen Eine systematische Suche nach Klassen, die im TSX benutzt, aber in keinem CSS definiert sind, hat vier Stellen mit demselben Muster gefunden: * `admin-btn-secondary` und `admin-btn-danger` existierten nicht. Sämtliche Löschen-Buttons sahen aus wie normale Buttons — keine Warnwirkung. Als `.admin-btn.admin-btn-danger` geschrieben, weil die Varianten mit den Größenklassen kombiniert werden, die weiter unten ihren eigenen Hintergrund setzen. * `page-progress-fill` fehlte: die Balken im Analytics-Panel waren leere Rinnen, der Wert unsichtbar. Ebenso `analytics-empty` und `admin-loading-container`. * `subpage-drawer-section`, `subpage-drawer-title-group` und `input-with-icon` im PageBuilder waren wirkungslos und teils mit Inline-Styles notdürftig kompensiert. * `grid-card-preview` fehlte, wodurch alle Layout-Vorschauen auf Höhe null kollabierten. Nur "Showcase" war sichtbar — und das aus Versehen, weil sein Tile `hero-tile` hieß und damit die `aspect-ratio` einer fremden PageBuilder-Klasse erbte. Umbenannt. Dazu die Theme-Vorschauen, die praktisch identisch aussahen: alle sieben zeigten dieselben drei quadratischen Kacheln, einziger Unterschied war die Hintergrundfarbe. Sie spiegeln jetzt die echten Preset-Daten aus lib/config/theme.ts — Schriftcharakter, Eckradius, Rasterdichte, Passepartout bzw. Schatten. Die Kopfzeile richtet sich an einer gemeinsamen Steuerhöhe aus. Der "Site"-Link war höher als die Buttons daneben: `.admin-btn` hatte keine explizite line-height, und <button> bekommt box-sizing: border-box vom Browser, <a> nicht. Die Statusanzeige setzte weder Schriftfamilie noch -größe und fiel auf den Browser-Default zurück — sie war nie Teil des Designsystems. Jetzt gleiche Höhe und Typografie, Pillenform als Zustandsanzeige, Trenner zur Aktionsgruppe. Das dauerhafte Pulsieren des grünen Punkts entfällt; Animation bleibt den Zuständen vorbehalten, die Aufmerksamkeit brauchen. Restliche Emojis durch SVG-Icons ersetzt. * feat(admin): add scroll-to-top toggle and SVG arrow The back-to-top button was always on and drew its arrow with the ↑ text character. Add a `scrollToTop` setting (General section in the admin panel, defaults to on so existing sites are unaffected) and replace the glyph with a stroked SVG that inherits currentColor across all presets. Scroll handling is now rAF-throttled, and prefers-reduced-motion turns off both the hover lift and the smooth scroll. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * security(journal): escape author HTML instead of filtering it CodeQL flags 26 high-severity alerts on the release PR; the bulk of them point at sanitizeHtml(), a denylist of three regexes whose output goes into dangerouslySetInnerHTML. I reproduced the bypasses before changing anything — all four pass the old filter: <img src=x onerror=alert(1)> unquoted handler, regex wants quotes <img src=x onerror='alert(1)'> single quotes, same reason <svg onload=alert(1)> not a <script> tag javasjavascript:cript:alert(1) one-pass replace, the rest recombines Plus an attribute breakout in the link renderer, which interpolated the URL into href="${url}" unescaped: [x](" onmouseover=alert(1) x=") -> <a href="" onmouseover=alert(1" ...> Replaced with escaping. Every `&<>"'` in author text becomes an entity before any markdown rule runs, so the only tags in the output are the ones renderInlineMarkdown builds itself and a URL cannot leave its attribute. Link schemes are now an allowlist (http, https, mailto, tel, relative, anchor); anything else renders as plain text. The serializer needed decodeHtmlEntities to match: without it a save would write `&lt;` into the Markdown file and the next parse would escape the `&` again, corrupting the text further on every round trip. A test covers parse -> serialize -> parse stability. Two existing tests asserted the old behaviour and were rewritten rather than deleted: one expected the script tag to be *removed* from the output, the other expected the substring "onerror" to be absent. Both now assert the property that matters — that no tag can form — because `onerror` surviving as inert text is fine. Exploitation required admin access either way: journal and essay text comes from the studio or from content/*.md. This removes the weakness, it does not close an open door. * fix(journal): contain file paths, fix frontmatter escaping, defuse two regexes Follow-up to the CodeQL findings on release PR #432. I went through all 23 alerts individually; this addresses the ones that are worth addressing and documents the ones that are not. Path containment (12 alerts, all false positives). Every path built from a slug goes through isValidSlug(), a strict `/^[a-zA-Z0-9_-]+$/` allowlist — verified against `../../etc/passwd`, `foo/../../bar`, `a/b`, `..` and friends, all rejected. CodeQL cannot see it because the check lives in another module. Added a containedPath() helper that resolves the path and refuses anything landing outside the content directory: a second lock on a door that was already locked, and a barrier the analysis can follow. Also removed the dead `slug.endsWith('.md')` branches — isValidSlug rejects dots, so they could never be taken. Frontmatter escaping (1 alert, a real bug). The serializer escaped `"` but not `\`, and the parser never unescaped anything. A title containing either character gained a backslash on every save/load cycle: Path C:\Users "quoted" -> Path C:\\Users \"quoted\" -> ... Escaping now covers the backslash first and the parser undoes both. A round trip test covers quotes, backslashes, colons and apostrophes. Two of three ReDoS regexes (2 alerts). The heading pattern had `\s+` next to `(.+)`, which overlap, so the engine tried every split of the whitespace run before failing; it is `[ \t]+` and `(\S.*)` now. The quote author pattern wrapped a lazy group around an optional group — the quadratic case — and is an index split on the first separator now. The third regex, the bold/italic pass, is deliberately left alone. Rewriting it with a negated class removes the backtracking but breaks nesting: `**bold *and italic* here**` renders as `*<em>bold </em>and italic<em> here</em>*`. The input is Markdown from an authenticated admin, never a visitor, so the worst case is an author slowing down their own page. The comment in the code says so. Not addressed: 5 js/insufficient-password-hash alerts. They ask for a slow KDF where the code uses SHA-256/HMAC — correct in general, but the admin password comes from an environment variable and is never stored, so a stronger KDF protects nothing that is not already in plaintext in the environment. 399 unit tests pass (18 new), build and tsc clean. * fix(journal): split the quote author by scanning, not by pattern Cleaning up after myself. #439 replaced the quote author regex `/^(.*?)(?:\s+--\s+(.+))?$/` — a lazy group around an optional one, the quadratic case — with `/\s+--\s+/`, and CodeQL promptly flagged the replacement for the same reason. One reported pattern traded for another. splitQuoteAuthor() scans for the first `--` that has whitespace on both sides. Linear, and it needs no reasoning about the regex engine at all. Behaviour is identical to the original regex, checked case by case against it: separator, no separator, several separators, tabs, wide gaps, `a--b` without spaces, leading and trailing separators, empty string. All nine are covered by tests, plus one asserting it stays fast on a 50k whitespace run. * security(admin): derive the session signing key with scrypt getSigningKey() ran the admin password through a single SHA-256 digest. It is key derivation rather than password storage, so it was never a stored-hash problem — but if the derived key ever leaked, one fast hash makes recovering the password by brute force cheap. CodeQL flags it as js/insufficient-password-hash and, for this particular alert, has a point. scrypt now. Two details that matter: The salt has to be stable. A random salt would produce a different key on every call and invalidate every session; it is derived from AUTH_SECRET, which is deployment-specific. Verified across separate processes: same inputs produce a verifying token, so a restart or redeploy does not log everyone out. The result is cached for the process lifetime. scrypt is deliberately slow and getSigningKey() runs on every admin request — deriving per call would add ~24ms to each one. The cache key is a digest of secret plus password, so a rotation misses the cache and derives again, and no extra plaintext copy of the password is kept around. Measured: first derivation 24ms, subsequent calls 0.12ms. Password change and secret change both invalidate an existing token, checked in separate processes. Note the one-time effect: existing admin sessions are invalidated by the change in derivation, so everyone logs in once more. * security(admin): key the signing-key cache on its inputs, not a digest #441 removed the SHA-256 digest of the admin password from the key derivation and introduced a new one three lines above it, as the cache key. Same rule, same file: CodeQL reported it immediately. The comment justifying it was wrong too. It claimed no second plaintext copy of the password was retained, while building the digest input allocates exactly that in order to hash it. The cache now holds the two input strings and compares them directly. They are the same objects the env and install caches already hold, so nothing extra is retained, and no fast hash of the password exists in memory for the life of the process. Re-verified after the change, in separate processes: a token from one process verifies in another with the same inputs, a changed password or secret rejects it, first derivation 24ms, cached calls 0.001ms. That leaves scrypt as the only place the password is hashed here. The two HMACs further down operate on the derived key and on token data, not on the password; the constant-time comparison in verifyAdminPassword is the previously dismissed one. --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
2026-08-14 16:55:07 +02:00
font: 'Libre Baskerville',
type: 'serif',
radius: 0,
frame: 'passepartout',
gap: 6,
},
monograph: {
label: 'Monograph',
desc: 'Typewriter monospace font, grid borders and document feel.',
bg: '#f4f4f6',
tile: '#ffffff',
accent: '#555555',
release: v0.11.0 — journal fixes, admin URLs, design system cleanup (#432) * fix(screenshots): sharp-Typen fuer 0.34 und 0.35 gleichzeitig (#410) sharp 0.35 ist von `export =` auf ESM umgestellt: der Modul-Namespace ist nicht mehr aufrufbar, die Factory sitzt unter .default. Der Type-Check brach damit in scripts/screenshots.ts weg, sobald der Next-Bump (#402) sharp von 0.34.5 auf 0.35.3 mitzieht -- sharp ist hier keine deklarierte Dependency, sondern kommt ueber Next mit. Die Form wird jetzt aus dem installierten Paket abgeleitet statt festgeschrieben, zur Laufzeit wie im Typ. Geprueft mit beiden Versionen: tsc laeuft mit 0.34.5 und mit 0.35.3 fehlerfrei durch. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(deps): bump the nextjs group across 1 directory with 2 updates (#402) Bumps the nextjs group with 2 updates in the / directory: [next](https://github.com/vercel/next.js) and [eslint-config-next](https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next). Updates `next` from 16.2.12 to 16.3.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/compare/v16.2.12...v16.3.0) Updates `eslint-config-next` from 16.2.12 to 16.3.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/commits/v16.3.0/packages/eslint-config-next) --- updated-dependencies: - dependency-name: eslint-config-next dependency-version: 16.3.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: nextjs - dependency-name: next dependency-version: 16.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nextjs ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps-dev): bump prettier from 3.8.3 to 3.9.6 (#405) Bumps [prettier](https://github.com/prettier/prettier) from 3.8.3 to 3.9.6. - [Release notes](https://github.com/prettier/prettier/releases) - [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md) - [Commits](https://github.com/prettier/prettier/compare/3.8.3...3.9.6) --- updated-dependencies: - dependency-name: prettier dependency-version: 3.9.6 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * docs(changelog): Unreleased-Sektion fuer die Bumps nach v0.10.0 (#413) Die Dependency-PRs sind nach dem Release auf dev gelandet, teils auch auf main. Ohne Eintrag waeren sie beim naechsten Release unsichtbar -- inklusive Next 16.3.0, das CVE-2025-13465 mitbringt. Ausserdem im 0.10.0-Abschnitt nachgetragen, dass der Trivy-Scan bis #409 nie gelaufen ist. Der Fix steckt im Tag v0.10.0, fehlte aber in der Aufzaehlung -- und "Images werden bei jedem Publish gescannt" stand im Changelog, waehrend der Job im Action-Setup abbrach. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(gallery): per-album sort order, independent of Immich (#408) (#414) Album order was dictated entirely by Immich: getAlbum() sorted by the album's own asc/desc flag, so a Folio album always mirrored the archive. A curated series has a narrative order that has nothing to do with capture time, and changing the Immich album's sort to fit the website changes it for the archive too. Adds an optional per-album `sort` in gallery.yaml, editable in /admin, defaulting to today's behaviour so every existing config is unchanged: immich (default) | newest | oldest | filename | manual `manual` is a pinned *prefix*: `assetOrder` lists only the photos placed by hand, everything else follows in the album's Immich order. A full permutation of a 2,000-photo album would be ~80 KB of UUIDs in a file that is rewritten and copied to content/.backups/ on every admin save. It also makes drift fall out for free — photos removed in Immich never match, new ones land in the tail rather than being hidden. Sorting is applied after the cache read, not before the cache write, so the LRU keeps one canonical Immich-ordered copy per album. That avoids putting the mode in the cache key, lets a config change take effect without depending on invalidation, and keeps the stale-serving path correct. cache.get() returns the stored object by reference, so withSort() returns a shallow clone with a new array — sorting in place would reorder the shared entry, and under request coalescing every concurrent caller would be sorting the same array. Also fixes a prerequisite bug: /api/admin/albums/[albumId]/assets read album.assets from GET /albums/:id, which Immich 3.x no longer populates (lib/immich.ts:507). The hero picker's "This Album" tab returned nothing and threw outright when the key was absent. It now goes through the client's paginated metadata search, with ?types=all to opt videos in for the reorder editor. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): drop decorative emoji from the sort select labels (#415) An <option> cannot contain markup, so the SVG set in Icons is not reachable there — but a decorative emoji is not a substitute for it. Plain text instead; the album card badge already uses a real icon. The remaining emoji in the admin panel (asset picker tabs, section headings, layout picker options) predate this branch and are left for a separate cleanup. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): replace emoji icons with the shared SVG icon set (#416) The admin panel mixed two icon conventions: inline SVGs from `Icons.tsx` in most components, and decorative emoji in the asset picker and a few PageBuilder labels. Emoji render inconsistently across platforms, ignore the accent colour, and cannot inherit the `.svg-icon` sizing rules. - Icons.tsx: add `IconStar` (filled — it marks a state, not an action) and `IconImage`. - AssetPicker: the three tab labels and the favourite tile badge now use IconFolder / IconStar / IconImage. - PageBuilder: the "Standalone Albums" and "Subpages" headings use the icon set instead of an emoji. - PageBuilder: the layout picker drops its emoji for plain text. An <option> cannot contain markup, so an SVG is impossible there and a decorative glyph is not a substitute. - admin.css: align icon and label in the picker tabs, and swap the favourite badge's text-shadow for drop-shadow, which is what applies to an inline SVG. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): fold PageBuilder's local icons into the shared Icons module (#418) * refactor(admin): fold PageBuilder's local icons into the shared module PageBuilder.tsx carried its own `Icons` object duplicating most of the glyphs already exported by Icons.tsx, with hardcoded sizes and slightly divergent paths. Migrate all 32 call sites to the shared module and delete the local object. Five glyphs had no counterpart and are added to Icons.tsx as 1:1 ports of the local paths: IconX, IconPlus, IconHome, IconCopy, IconImage. The local ExternalLink and Check are dropped rather than ported — both had zero call sites. Two glyphs change shape slightly, which is the point of consolidating: the shared IconCamera includes the viewfinder bump the local copy omitted, and drag handles now use IconGripVertical. IconGripVertical uses the module's square 24x24 viewBox, so `.svg-drag` goes from 12x18 to 18x18 — the old non-square box would letterbox the glyph down to 12x12 and shrink the handle. * fix(admin): resolve icon-module integration after #416 Merging dev brought in #416, which added a second IconImage to Icons.tsx and two <Icons.Camera>/<Icons.Folder> section headers that reference the local Icons object this PR removes. Git merged both cleanly but the result did not type-check. - drop the duplicate IconImage (both copies were byte-identical) - point the two section headers at the imported IconCamera/IconFolder - refresh the SORT_LABELS comment: the icon set is imported now, not declared below --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> * fix(config): allow an empty gallery, guard against a double /api suffix (#421) An empty gallery is now a valid, rendered state instead of a throw: deriveGallery() no longer requires at least one album or subpage, so a deployment with no albums yet renders a bare homepage the owner can fill in via /admin. getConfig() also stops appending /api to an Immich URL that already ends in it, which previously produced .../api/api and broke every upstream request. Includes a restore of the per-album sort test cases, which the branch had lost by being cut before #408/#414. * feat(admin): favicon upload, served from the content volume (#422) Adds a bundled default favicon, an upload widget in admin Settings > General, and a route that serves the icon from the writable content/ volume with a fallback to the bundled default. Raster uploads (PNG/ICO/JPEG) are wrapped in an SVG container; the response carries its own CSP so an uploaded SVG cannot execute script on the origin. The GET route revalidates with an ETag instead of caching immutably, so a newly uploaded icon shows up immediately. Uploads are written via temp file + rename, and a Reset button restores the bundled default. * ci: flag unformatted files in a PR, without blocking it (#424) Prettier is configured as an error rule in eslint.config.mjs but has never run in CI, so part of the tree predates it. A final CI step now diffs against the PR base, runs prettier --list-different over the changed files, and emits a warning annotation per offender plus a job summary. Advisory by design: it never fails the job. Blocking would turn a PR red for merely touching a file that was already unformatted, and normalising the tree in one commit would wreck git blame and conflict with the PRs in flight. Requires fetch-depth: 0, since diffing against the base needs its history. * feat(install): first-run wizard gated by a one-time setup token (#419) Adds /install, a four-step first-run wizard: connect to Immich, optionally pick albums, name the site, finish. It verifies the credentials against the Immich server before writing anything, then writes gallery.yaml, settings.yaml and a content/install.json carrying the Immich credentials and a generated site secret. install.json exists because a running process cannot pick up new env vars — the wizard has to write configuration that takes effect without a restart. getInstallCredentials() merges it under the real environment, so env vars always win and rotation stays a matter of setting one. Both the page and the API routes are gated by a one-time setup token printed to the server log, so a deployment that is reachable before gallery.yaml exists cannot be configured by whoever finds it first. The token is stored in content/.setup-token (0600) rather than a module variable: Next.js bundles the page and each route handler separately, so a module-level token left the page and the API disagreeing inside one process and the wizard stuck on step 1. It is removed once the install completes. The admin password is stored as an scrypt hash using the scheme lib/auth.ts already applies to album passwords; a plaintext ADMIN_PASSWORD env var keeps working. * docs: document the setup wizard, fix the read-only content mount (#425) Quick Start now leads with the /install wizard, with the hand-written YAML route kept alongside it, and a First-Run Setup section covers the setup token, the files the wizard writes, and env-var precedence. Two corrections: both Docker examples mounted content/ as :ro, which silently breaks the wizard, the admin panel and the backup rotation alike — docs/admin-panel.md already said so and the README contradicted it. And nothing documented that content/install.json holds the Immich API key, so a backup of content/ is a backup of credentials. Also adds a Contributors section crediting the people whose work is in the project. * feat(admin): floating save bar pinned to the bottom of the viewport (#426) The save bar was the first, static element inside .admin-main. Since the document itself scrolls, it left the viewport as soon as you scrolled down — editing a subpage section or a settings block far below gave no visible dirty hint and no reachable save button. Replace it with a bottom-pinned floating bar shared by both editors. It only mounts while there is something to act on (unsaved changes, an in-flight save, or a result message), so it never covers content while idle. The success message clears after 5s, which hides the bar again. - new SaveBar component, replacing the duplicated markup in PageBuilder and SettingsEditor - adopt the previously unused .floating-save-bar CSS: slide-in keyframes (carrying translateX(-50%)), dirty border, wrap/gap, mobile variant and a prefers-reduced-motion opt-out; z-index 900 keeps it below modals - .admin-main gains bottom padding so the bar never covers page content - drop the now-unreachable idle hints: the ⌘S hint becomes a button title, the Live Sync note becomes a static line above the settings layout - header "Site" link now bypasses the cache (/?fresh=1), so the preview stays reachable when the bar is hidden Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(admin): themed listbox for the album sort control (#427) The per-album "Photo order" control was a native <select>. Because an <option> cannot contain markup, its choices could not use the admin panel's currentColor SVG set — the reason #415 had to fall back to plain text after dropping the emoji labels. Adds a Listbox component implementing the ARIA combobox/listbox pattern, so options can render a glyph beside their label: - DOM focus stays on the trigger button; the active option is announced through aria-activedescendant, keeping focus management to one element - Keyboard: arrows (clamped at the ends, like a native select), Home/End, Enter/Space to commit, Escape to cancel, Tab commits and moves on, and prefix type-ahead with a repeat-key cycle - Outside dismissal on pointerdown, so a press starting outside closes the popup before the click retargets The sort options now carry an icon each: calendar, arrow-down, arrow-up, an A→Z marker, and the drag glyph for manual — matching the badge the album card already shows. SORT_LABELS stays plain text because the badge feeds it to a title attribute. Closes #417 Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(git): ignore generated design handoff folders * fix(admin): stop the album sort dropdown clipping, and simplify the panel (#428) * fix(admin): render listbox popup in a portal so it escapes modal clipping The sort control's popup was position:absolute inside three clipping ancestors (.album-drawer overflow:hidden > .album-drawer-body overflow-y:auto > .modal-right-column overflow-y:auto), so it was cut off at the bottom of the Edit Album Details modal. z-index could not help: clipping happens before stacking. It also always hung below the trigger, with no flip. Portal the popup to document.body and position it from the trigger's viewport rect, flipping above when there is more room there and capping max-height to the space available so it scrolls internally rather than overflowing. It is dismissed on scroll and resize, since the anchor is only measured on open. The outside-pointerdown handler now also treats the popup as inside; without that the portalled list counts as outside, and a click on an option would close it before the selection commits. * refactor(admin): single-column album details panel The left column spent 1.2fr on a cover thumbnail and three stat rows, two of which (Status, Custom Hero) only restated the form fields opposite them, while the form itself was squeezed into 1.8fr behind a second nested scroller. Stack the drawer in one column instead: cover as a banner, then the form at full width, with the UUID moved into the footer. The body is now the only scroll container, which also removes one of the ancestors that was clipping the sort popup. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> * fix(admin): give the portalled listbox its theme back, lock the page behind modals (#429) Two defects in the album editor. The sort listbox popup painted transparent. Every --admin-* variable is scoped to .admin-layout, and since the popup moved into document.body it sits outside that subtree, so background/border/text all resolved to nothing. It now carries its own copy of the palette in both colour schemes, plus the font it no longer inherits. Scrolling inside a modal also moved the page behind it. No admin modal ever locked body scroll: the overlay covers the page but does not absorb wheel events, so a scroll starting on the backdrop — or continuing past the end of the modal's own scroller — reaches the document. overscroll-behavior cannot cover that case on its own, because it only applies to scroll containers and the backdrop is not one. useScrollLock freezes body while a modal is open and compensates for the width the scrollbar gives up, so nothing shifts underneath. Each lock restores the inline value it found, which makes nesting work without a counter — a picker opened from the drawer restores the drawer's hidden state instead of clearing it. Applied to both drawers and all four picker modals, which share the defect. overscroll-behavior: contain on the scrollers stops the chaining they can handle themselves. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com> * fix(security): allow unsafe-eval in CSP script-src during dev mode * feat(journal): add Journal Studio with split-screen editor, live preview and dedicated routes * fix(build): separate client parser from server journal-service and fix build type errors * fix(journal): Fotos rendern, Layout und Lightbox-Steuerung korrigieren Fünf unabhängige Fehler in der öffentlichen Journal- und Essay-Ansicht: * Foto-Blöcke wurden nie angezeigt. EssayView löst ein Foto über PhotoItem.id auf, und das sind verschlüsselte Tokens — die Blöcke aus dem Markdown tragen aber rohe Asset-UUIDs. Jede Zuordnung lief ins Leere, und nicht auflösbare Blöcke werden still verworfen. Die IDs werden jetzt serverseitig übersetzt; damit verschwinden nebenbei die rohen UUIDs aus dem Client-Payload, die dort laut Projektregel nie auftauchen dürfen. Nicht auflösbare Referenzen werden geloggt. * Überschriften standen weiter links als der Fließtext. Jeder Block hatte einzeln `max-width: 68ch`, und `ch` ist relativ zur Schrift des Elements — die Serif-Überschrift ergab eine breitere Spalte. Ersetzt durch eine gemeinsame, font-unabhängige `--essay-measure`. * Fullbleed-Fotos bluteten nur nach links aus: `.essay-figure` ist `width: 100%`, wodurch die Box überbestimmt ist und der negative rechte Margin verworfen wird. * Foto-Paare stellten beide Bilder gleich breit dar, wodurch ein Hochformat neben einem Querformat doppelt so hoch wurde. Jetzt eine Justified-Reihe: Breite proportional zum Seitenverhältnis, dadurch exakt gleiche Höhen ohne Beschnitt. * Die Lightbox hatte im Journal keine Tastatursteuerung und keine Scroll-Sperre — beides lag in PhotoGrid, also nur im Album-Raster. Verlagert in die Lightbox selbst, der doppelte Handler in PhotoGrid entfernt (sonst wäre pro Pfeildruck zwei Bilder weitergesprungen). Zusätzlich sind Proofing-Herzen und das EXIF-Panel im redaktionellen Modus abschaltbar und im Journal aus: Client-Proofing ist ein Übergabe-Workflow für Alben, keine Funktion einer Reportage. Auf der Übersicht wurde der Untertitel doppelt gerendert, weil extractExcerpt() auf ihn zurückfällt. * feat(admin): eigene URLs für alle Bereiche und überarbeiteter Journal Studio Das Panel war eine einzige Client-Komponente, die ihre Tabs über useState umschaltet: keine Route pro Bereich, kein Deep-Link, kein Zurück-Button, und nach jedem Reload landete man wieder auf "Pages". Auch der Journal-Editor hatte keine eigene URL. Jetzt sieben echte Routen (/admin, /admin/pages, /admin/journal, /admin/journal/<slug>, /admin/settings, /admin/settings/<section>, /admin/analytics). Die Shell mit Auth-Prüfung und Kopfzeile sitzt im Layout und umschließt children — so bleibt die Session-Prüfung über Routenwechsel montiert, statt bei jedem Tab-Wechsel neu zu laufen und den Spinner aufblitzen zu lassen. Unbekannte Settings-Sections fallen auf General zurück. Im selben Zug der Journal Studio, der die Routing-Änderung ohnehin berührt: * Alle Eingabefelder nutzten die Klasse `admin-input`, die in keinem CSS definiert war — sie fielen auf Browser-Defaults zurück. Jetzt gestylt, gescoped, damit der generische Name nicht ins übrige Panel leckt. * Der Split View ist per Divider verschiebbar (Maus, Tastatur, Doppelklick zum Zurücksetzen), Breite in localStorage. * Das Studio bricht aus der 1120px-Spalte aus, die Preview hat Platz. * Die Preview zeigte für jedes Foto fest 3:2 und log damit über das Layout der veröffentlichten Seite; die echten Verhältnisse werden jetzt an den Thumbnails gemessen. * Blöcke mit alten positionsbasierten Foto-Referenzen werden markiert — die lassen sich auf einer eigenständigen Journal-Seite nicht auflösen und verschwanden bisher stillschweigend. * Blocktyp-Chips als gemeinsame Komponente, monochrom und per Icon unterschieden statt in einer eigenen Blau/Lila/Orange-Palette, die sonst nirgends im Panel vorkommt. * Emojis raus, SVG-Icons rein. * fix(admin): Designsystem-Lücken im Panel schließen Eine systematische Suche nach Klassen, die im TSX benutzt, aber in keinem CSS definiert sind, hat vier Stellen mit demselben Muster gefunden: * `admin-btn-secondary` und `admin-btn-danger` existierten nicht. Sämtliche Löschen-Buttons sahen aus wie normale Buttons — keine Warnwirkung. Als `.admin-btn.admin-btn-danger` geschrieben, weil die Varianten mit den Größenklassen kombiniert werden, die weiter unten ihren eigenen Hintergrund setzen. * `page-progress-fill` fehlte: die Balken im Analytics-Panel waren leere Rinnen, der Wert unsichtbar. Ebenso `analytics-empty` und `admin-loading-container`. * `subpage-drawer-section`, `subpage-drawer-title-group` und `input-with-icon` im PageBuilder waren wirkungslos und teils mit Inline-Styles notdürftig kompensiert. * `grid-card-preview` fehlte, wodurch alle Layout-Vorschauen auf Höhe null kollabierten. Nur "Showcase" war sichtbar — und das aus Versehen, weil sein Tile `hero-tile` hieß und damit die `aspect-ratio` einer fremden PageBuilder-Klasse erbte. Umbenannt. Dazu die Theme-Vorschauen, die praktisch identisch aussahen: alle sieben zeigten dieselben drei quadratischen Kacheln, einziger Unterschied war die Hintergrundfarbe. Sie spiegeln jetzt die echten Preset-Daten aus lib/config/theme.ts — Schriftcharakter, Eckradius, Rasterdichte, Passepartout bzw. Schatten. Die Kopfzeile richtet sich an einer gemeinsamen Steuerhöhe aus. Der "Site"-Link war höher als die Buttons daneben: `.admin-btn` hatte keine explizite line-height, und <button> bekommt box-sizing: border-box vom Browser, <a> nicht. Die Statusanzeige setzte weder Schriftfamilie noch -größe und fiel auf den Browser-Default zurück — sie war nie Teil des Designsystems. Jetzt gleiche Höhe und Typografie, Pillenform als Zustandsanzeige, Trenner zur Aktionsgruppe. Das dauerhafte Pulsieren des grünen Punkts entfällt; Animation bleibt den Zuständen vorbehalten, die Aufmerksamkeit brauchen. Restliche Emojis durch SVG-Icons ersetzt. * feat(admin): add scroll-to-top toggle and SVG arrow The back-to-top button was always on and drew its arrow with the ↑ text character. Add a `scrollToTop` setting (General section in the admin panel, defaults to on so existing sites are unaffected) and replace the glyph with a stroked SVG that inherits currentColor across all presets. Scroll handling is now rAF-throttled, and prefers-reduced-motion turns off both the hover lift and the smooth scroll. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * security(journal): escape author HTML instead of filtering it CodeQL flags 26 high-severity alerts on the release PR; the bulk of them point at sanitizeHtml(), a denylist of three regexes whose output goes into dangerouslySetInnerHTML. I reproduced the bypasses before changing anything — all four pass the old filter: <img src=x onerror=alert(1)> unquoted handler, regex wants quotes <img src=x onerror='alert(1)'> single quotes, same reason <svg onload=alert(1)> not a <script> tag javasjavascript:cript:alert(1) one-pass replace, the rest recombines Plus an attribute breakout in the link renderer, which interpolated the URL into href="${url}" unescaped: [x](" onmouseover=alert(1) x=") -> <a href="" onmouseover=alert(1" ...> Replaced with escaping. Every `&<>"'` in author text becomes an entity before any markdown rule runs, so the only tags in the output are the ones renderInlineMarkdown builds itself and a URL cannot leave its attribute. Link schemes are now an allowlist (http, https, mailto, tel, relative, anchor); anything else renders as plain text. The serializer needed decodeHtmlEntities to match: without it a save would write `&lt;` into the Markdown file and the next parse would escape the `&` again, corrupting the text further on every round trip. A test covers parse -> serialize -> parse stability. Two existing tests asserted the old behaviour and were rewritten rather than deleted: one expected the script tag to be *removed* from the output, the other expected the substring "onerror" to be absent. Both now assert the property that matters — that no tag can form — because `onerror` surviving as inert text is fine. Exploitation required admin access either way: journal and essay text comes from the studio or from content/*.md. This removes the weakness, it does not close an open door. * fix(journal): contain file paths, fix frontmatter escaping, defuse two regexes Follow-up to the CodeQL findings on release PR #432. I went through all 23 alerts individually; this addresses the ones that are worth addressing and documents the ones that are not. Path containment (12 alerts, all false positives). Every path built from a slug goes through isValidSlug(), a strict `/^[a-zA-Z0-9_-]+$/` allowlist — verified against `../../etc/passwd`, `foo/../../bar`, `a/b`, `..` and friends, all rejected. CodeQL cannot see it because the check lives in another module. Added a containedPath() helper that resolves the path and refuses anything landing outside the content directory: a second lock on a door that was already locked, and a barrier the analysis can follow. Also removed the dead `slug.endsWith('.md')` branches — isValidSlug rejects dots, so they could never be taken. Frontmatter escaping (1 alert, a real bug). The serializer escaped `"` but not `\`, and the parser never unescaped anything. A title containing either character gained a backslash on every save/load cycle: Path C:\Users "quoted" -> Path C:\\Users \"quoted\" -> ... Escaping now covers the backslash first and the parser undoes both. A round trip test covers quotes, backslashes, colons and apostrophes. Two of three ReDoS regexes (2 alerts). The heading pattern had `\s+` next to `(.+)`, which overlap, so the engine tried every split of the whitespace run before failing; it is `[ \t]+` and `(\S.*)` now. The quote author pattern wrapped a lazy group around an optional group — the quadratic case — and is an index split on the first separator now. The third regex, the bold/italic pass, is deliberately left alone. Rewriting it with a negated class removes the backtracking but breaks nesting: `**bold *and italic* here**` renders as `*<em>bold </em>and italic<em> here</em>*`. The input is Markdown from an authenticated admin, never a visitor, so the worst case is an author slowing down their own page. The comment in the code says so. Not addressed: 5 js/insufficient-password-hash alerts. They ask for a slow KDF where the code uses SHA-256/HMAC — correct in general, but the admin password comes from an environment variable and is never stored, so a stronger KDF protects nothing that is not already in plaintext in the environment. 399 unit tests pass (18 new), build and tsc clean. * fix(journal): split the quote author by scanning, not by pattern Cleaning up after myself. #439 replaced the quote author regex `/^(.*?)(?:\s+--\s+(.+))?$/` — a lazy group around an optional one, the quadratic case — with `/\s+--\s+/`, and CodeQL promptly flagged the replacement for the same reason. One reported pattern traded for another. splitQuoteAuthor() scans for the first `--` that has whitespace on both sides. Linear, and it needs no reasoning about the regex engine at all. Behaviour is identical to the original regex, checked case by case against it: separator, no separator, several separators, tabs, wide gaps, `a--b` without spaces, leading and trailing separators, empty string. All nine are covered by tests, plus one asserting it stays fast on a 50k whitespace run. * security(admin): derive the session signing key with scrypt getSigningKey() ran the admin password through a single SHA-256 digest. It is key derivation rather than password storage, so it was never a stored-hash problem — but if the derived key ever leaked, one fast hash makes recovering the password by brute force cheap. CodeQL flags it as js/insufficient-password-hash and, for this particular alert, has a point. scrypt now. Two details that matter: The salt has to be stable. A random salt would produce a different key on every call and invalidate every session; it is derived from AUTH_SECRET, which is deployment-specific. Verified across separate processes: same inputs produce a verifying token, so a restart or redeploy does not log everyone out. The result is cached for the process lifetime. scrypt is deliberately slow and getSigningKey() runs on every admin request — deriving per call would add ~24ms to each one. The cache key is a digest of secret plus password, so a rotation misses the cache and derives again, and no extra plaintext copy of the password is kept around. Measured: first derivation 24ms, subsequent calls 0.12ms. Password change and secret change both invalidate an existing token, checked in separate processes. Note the one-time effect: existing admin sessions are invalidated by the change in derivation, so everyone logs in once more. * security(admin): key the signing-key cache on its inputs, not a digest #441 removed the SHA-256 digest of the admin password from the key derivation and introduced a new one three lines above it, as the cache key. Same rule, same file: CodeQL reported it immediately. The comment justifying it was wrong too. It claimed no second plaintext copy of the password was retained, while building the digest input allocates exactly that in order to hash it. The cache now holds the two input strings and compares them directly. They are the same objects the env and install caches already hold, so nothing extra is retained, and no fast hash of the password exists in memory for the life of the process. Re-verified after the change, in separate processes: a token from one process verifies in another with the same inputs, a changed password or secret rejects it, first derivation 24ms, cached calls 0.001ms. That leaves scrypt as the only place the password is hashed here. The two HMACs further down operate on the derived key and on token data, not on the password; the constant-time comparison in verifyAdminPassword is the previously dismissed one. --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
2026-08-14 16:55:07 +02:00
font: 'Instrument Serif',
type: 'mono',
radius: 0,
frame: 'none',
gap: 5,
},
};
release: v0.11.0 — journal fixes, admin URLs, design system cleanup (#432) * fix(screenshots): sharp-Typen fuer 0.34 und 0.35 gleichzeitig (#410) sharp 0.35 ist von `export =` auf ESM umgestellt: der Modul-Namespace ist nicht mehr aufrufbar, die Factory sitzt unter .default. Der Type-Check brach damit in scripts/screenshots.ts weg, sobald der Next-Bump (#402) sharp von 0.34.5 auf 0.35.3 mitzieht -- sharp ist hier keine deklarierte Dependency, sondern kommt ueber Next mit. Die Form wird jetzt aus dem installierten Paket abgeleitet statt festgeschrieben, zur Laufzeit wie im Typ. Geprueft mit beiden Versionen: tsc laeuft mit 0.34.5 und mit 0.35.3 fehlerfrei durch. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(deps): bump the nextjs group across 1 directory with 2 updates (#402) Bumps the nextjs group with 2 updates in the / directory: [next](https://github.com/vercel/next.js) and [eslint-config-next](https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next). Updates `next` from 16.2.12 to 16.3.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/compare/v16.2.12...v16.3.0) Updates `eslint-config-next` from 16.2.12 to 16.3.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/commits/v16.3.0/packages/eslint-config-next) --- updated-dependencies: - dependency-name: eslint-config-next dependency-version: 16.3.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: nextjs - dependency-name: next dependency-version: 16.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nextjs ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps-dev): bump prettier from 3.8.3 to 3.9.6 (#405) Bumps [prettier](https://github.com/prettier/prettier) from 3.8.3 to 3.9.6. - [Release notes](https://github.com/prettier/prettier/releases) - [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md) - [Commits](https://github.com/prettier/prettier/compare/3.8.3...3.9.6) --- updated-dependencies: - dependency-name: prettier dependency-version: 3.9.6 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * docs(changelog): Unreleased-Sektion fuer die Bumps nach v0.10.0 (#413) Die Dependency-PRs sind nach dem Release auf dev gelandet, teils auch auf main. Ohne Eintrag waeren sie beim naechsten Release unsichtbar -- inklusive Next 16.3.0, das CVE-2025-13465 mitbringt. Ausserdem im 0.10.0-Abschnitt nachgetragen, dass der Trivy-Scan bis #409 nie gelaufen ist. Der Fix steckt im Tag v0.10.0, fehlte aber in der Aufzaehlung -- und "Images werden bei jedem Publish gescannt" stand im Changelog, waehrend der Job im Action-Setup abbrach. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(gallery): per-album sort order, independent of Immich (#408) (#414) Album order was dictated entirely by Immich: getAlbum() sorted by the album's own asc/desc flag, so a Folio album always mirrored the archive. A curated series has a narrative order that has nothing to do with capture time, and changing the Immich album's sort to fit the website changes it for the archive too. Adds an optional per-album `sort` in gallery.yaml, editable in /admin, defaulting to today's behaviour so every existing config is unchanged: immich (default) | newest | oldest | filename | manual `manual` is a pinned *prefix*: `assetOrder` lists only the photos placed by hand, everything else follows in the album's Immich order. A full permutation of a 2,000-photo album would be ~80 KB of UUIDs in a file that is rewritten and copied to content/.backups/ on every admin save. It also makes drift fall out for free — photos removed in Immich never match, new ones land in the tail rather than being hidden. Sorting is applied after the cache read, not before the cache write, so the LRU keeps one canonical Immich-ordered copy per album. That avoids putting the mode in the cache key, lets a config change take effect without depending on invalidation, and keeps the stale-serving path correct. cache.get() returns the stored object by reference, so withSort() returns a shallow clone with a new array — sorting in place would reorder the shared entry, and under request coalescing every concurrent caller would be sorting the same array. Also fixes a prerequisite bug: /api/admin/albums/[albumId]/assets read album.assets from GET /albums/:id, which Immich 3.x no longer populates (lib/immich.ts:507). The hero picker's "This Album" tab returned nothing and threw outright when the key was absent. It now goes through the client's paginated metadata search, with ?types=all to opt videos in for the reorder editor. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): drop decorative emoji from the sort select labels (#415) An <option> cannot contain markup, so the SVG set in Icons is not reachable there — but a decorative emoji is not a substitute for it. Plain text instead; the album card badge already uses a real icon. The remaining emoji in the admin panel (asset picker tabs, section headings, layout picker options) predate this branch and are left for a separate cleanup. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): replace emoji icons with the shared SVG icon set (#416) The admin panel mixed two icon conventions: inline SVGs from `Icons.tsx` in most components, and decorative emoji in the asset picker and a few PageBuilder labels. Emoji render inconsistently across platforms, ignore the accent colour, and cannot inherit the `.svg-icon` sizing rules. - Icons.tsx: add `IconStar` (filled — it marks a state, not an action) and `IconImage`. - AssetPicker: the three tab labels and the favourite tile badge now use IconFolder / IconStar / IconImage. - PageBuilder: the "Standalone Albums" and "Subpages" headings use the icon set instead of an emoji. - PageBuilder: the layout picker drops its emoji for plain text. An <option> cannot contain markup, so an SVG is impossible there and a decorative glyph is not a substitute. - admin.css: align icon and label in the picker tabs, and swap the favourite badge's text-shadow for drop-shadow, which is what applies to an inline SVG. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): fold PageBuilder's local icons into the shared Icons module (#418) * refactor(admin): fold PageBuilder's local icons into the shared module PageBuilder.tsx carried its own `Icons` object duplicating most of the glyphs already exported by Icons.tsx, with hardcoded sizes and slightly divergent paths. Migrate all 32 call sites to the shared module and delete the local object. Five glyphs had no counterpart and are added to Icons.tsx as 1:1 ports of the local paths: IconX, IconPlus, IconHome, IconCopy, IconImage. The local ExternalLink and Check are dropped rather than ported — both had zero call sites. Two glyphs change shape slightly, which is the point of consolidating: the shared IconCamera includes the viewfinder bump the local copy omitted, and drag handles now use IconGripVertical. IconGripVertical uses the module's square 24x24 viewBox, so `.svg-drag` goes from 12x18 to 18x18 — the old non-square box would letterbox the glyph down to 12x12 and shrink the handle. * fix(admin): resolve icon-module integration after #416 Merging dev brought in #416, which added a second IconImage to Icons.tsx and two <Icons.Camera>/<Icons.Folder> section headers that reference the local Icons object this PR removes. Git merged both cleanly but the result did not type-check. - drop the duplicate IconImage (both copies were byte-identical) - point the two section headers at the imported IconCamera/IconFolder - refresh the SORT_LABELS comment: the icon set is imported now, not declared below --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> * fix(config): allow an empty gallery, guard against a double /api suffix (#421) An empty gallery is now a valid, rendered state instead of a throw: deriveGallery() no longer requires at least one album or subpage, so a deployment with no albums yet renders a bare homepage the owner can fill in via /admin. getConfig() also stops appending /api to an Immich URL that already ends in it, which previously produced .../api/api and broke every upstream request. Includes a restore of the per-album sort test cases, which the branch had lost by being cut before #408/#414. * feat(admin): favicon upload, served from the content volume (#422) Adds a bundled default favicon, an upload widget in admin Settings > General, and a route that serves the icon from the writable content/ volume with a fallback to the bundled default. Raster uploads (PNG/ICO/JPEG) are wrapped in an SVG container; the response carries its own CSP so an uploaded SVG cannot execute script on the origin. The GET route revalidates with an ETag instead of caching immutably, so a newly uploaded icon shows up immediately. Uploads are written via temp file + rename, and a Reset button restores the bundled default. * ci: flag unformatted files in a PR, without blocking it (#424) Prettier is configured as an error rule in eslint.config.mjs but has never run in CI, so part of the tree predates it. A final CI step now diffs against the PR base, runs prettier --list-different over the changed files, and emits a warning annotation per offender plus a job summary. Advisory by design: it never fails the job. Blocking would turn a PR red for merely touching a file that was already unformatted, and normalising the tree in one commit would wreck git blame and conflict with the PRs in flight. Requires fetch-depth: 0, since diffing against the base needs its history. * feat(install): first-run wizard gated by a one-time setup token (#419) Adds /install, a four-step first-run wizard: connect to Immich, optionally pick albums, name the site, finish. It verifies the credentials against the Immich server before writing anything, then writes gallery.yaml, settings.yaml and a content/install.json carrying the Immich credentials and a generated site secret. install.json exists because a running process cannot pick up new env vars — the wizard has to write configuration that takes effect without a restart. getInstallCredentials() merges it under the real environment, so env vars always win and rotation stays a matter of setting one. Both the page and the API routes are gated by a one-time setup token printed to the server log, so a deployment that is reachable before gallery.yaml exists cannot be configured by whoever finds it first. The token is stored in content/.setup-token (0600) rather than a module variable: Next.js bundles the page and each route handler separately, so a module-level token left the page and the API disagreeing inside one process and the wizard stuck on step 1. It is removed once the install completes. The admin password is stored as an scrypt hash using the scheme lib/auth.ts already applies to album passwords; a plaintext ADMIN_PASSWORD env var keeps working. * docs: document the setup wizard, fix the read-only content mount (#425) Quick Start now leads with the /install wizard, with the hand-written YAML route kept alongside it, and a First-Run Setup section covers the setup token, the files the wizard writes, and env-var precedence. Two corrections: both Docker examples mounted content/ as :ro, which silently breaks the wizard, the admin panel and the backup rotation alike — docs/admin-panel.md already said so and the README contradicted it. And nothing documented that content/install.json holds the Immich API key, so a backup of content/ is a backup of credentials. Also adds a Contributors section crediting the people whose work is in the project. * feat(admin): floating save bar pinned to the bottom of the viewport (#426) The save bar was the first, static element inside .admin-main. Since the document itself scrolls, it left the viewport as soon as you scrolled down — editing a subpage section or a settings block far below gave no visible dirty hint and no reachable save button. Replace it with a bottom-pinned floating bar shared by both editors. It only mounts while there is something to act on (unsaved changes, an in-flight save, or a result message), so it never covers content while idle. The success message clears after 5s, which hides the bar again. - new SaveBar component, replacing the duplicated markup in PageBuilder and SettingsEditor - adopt the previously unused .floating-save-bar CSS: slide-in keyframes (carrying translateX(-50%)), dirty border, wrap/gap, mobile variant and a prefers-reduced-motion opt-out; z-index 900 keeps it below modals - .admin-main gains bottom padding so the bar never covers page content - drop the now-unreachable idle hints: the ⌘S hint becomes a button title, the Live Sync note becomes a static line above the settings layout - header "Site" link now bypasses the cache (/?fresh=1), so the preview stays reachable when the bar is hidden Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(admin): themed listbox for the album sort control (#427) The per-album "Photo order" control was a native <select>. Because an <option> cannot contain markup, its choices could not use the admin panel's currentColor SVG set — the reason #415 had to fall back to plain text after dropping the emoji labels. Adds a Listbox component implementing the ARIA combobox/listbox pattern, so options can render a glyph beside their label: - DOM focus stays on the trigger button; the active option is announced through aria-activedescendant, keeping focus management to one element - Keyboard: arrows (clamped at the ends, like a native select), Home/End, Enter/Space to commit, Escape to cancel, Tab commits and moves on, and prefix type-ahead with a repeat-key cycle - Outside dismissal on pointerdown, so a press starting outside closes the popup before the click retargets The sort options now carry an icon each: calendar, arrow-down, arrow-up, an A→Z marker, and the drag glyph for manual — matching the badge the album card already shows. SORT_LABELS stays plain text because the badge feeds it to a title attribute. Closes #417 Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(git): ignore generated design handoff folders * fix(admin): stop the album sort dropdown clipping, and simplify the panel (#428) * fix(admin): render listbox popup in a portal so it escapes modal clipping The sort control's popup was position:absolute inside three clipping ancestors (.album-drawer overflow:hidden > .album-drawer-body overflow-y:auto > .modal-right-column overflow-y:auto), so it was cut off at the bottom of the Edit Album Details modal. z-index could not help: clipping happens before stacking. It also always hung below the trigger, with no flip. Portal the popup to document.body and position it from the trigger's viewport rect, flipping above when there is more room there and capping max-height to the space available so it scrolls internally rather than overflowing. It is dismissed on scroll and resize, since the anchor is only measured on open. The outside-pointerdown handler now also treats the popup as inside; without that the portalled list counts as outside, and a click on an option would close it before the selection commits. * refactor(admin): single-column album details panel The left column spent 1.2fr on a cover thumbnail and three stat rows, two of which (Status, Custom Hero) only restated the form fields opposite them, while the form itself was squeezed into 1.8fr behind a second nested scroller. Stack the drawer in one column instead: cover as a banner, then the form at full width, with the UUID moved into the footer. The body is now the only scroll container, which also removes one of the ancestors that was clipping the sort popup. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> * fix(admin): give the portalled listbox its theme back, lock the page behind modals (#429) Two defects in the album editor. The sort listbox popup painted transparent. Every --admin-* variable is scoped to .admin-layout, and since the popup moved into document.body it sits outside that subtree, so background/border/text all resolved to nothing. It now carries its own copy of the palette in both colour schemes, plus the font it no longer inherits. Scrolling inside a modal also moved the page behind it. No admin modal ever locked body scroll: the overlay covers the page but does not absorb wheel events, so a scroll starting on the backdrop — or continuing past the end of the modal's own scroller — reaches the document. overscroll-behavior cannot cover that case on its own, because it only applies to scroll containers and the backdrop is not one. useScrollLock freezes body while a modal is open and compensates for the width the scrollbar gives up, so nothing shifts underneath. Each lock restores the inline value it found, which makes nesting work without a counter — a picker opened from the drawer restores the drawer's hidden state instead of clearing it. Applied to both drawers and all four picker modals, which share the defect. overscroll-behavior: contain on the scrollers stops the chaining they can handle themselves. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com> * fix(security): allow unsafe-eval in CSP script-src during dev mode * feat(journal): add Journal Studio with split-screen editor, live preview and dedicated routes * fix(build): separate client parser from server journal-service and fix build type errors * fix(journal): Fotos rendern, Layout und Lightbox-Steuerung korrigieren Fünf unabhängige Fehler in der öffentlichen Journal- und Essay-Ansicht: * Foto-Blöcke wurden nie angezeigt. EssayView löst ein Foto über PhotoItem.id auf, und das sind verschlüsselte Tokens — die Blöcke aus dem Markdown tragen aber rohe Asset-UUIDs. Jede Zuordnung lief ins Leere, und nicht auflösbare Blöcke werden still verworfen. Die IDs werden jetzt serverseitig übersetzt; damit verschwinden nebenbei die rohen UUIDs aus dem Client-Payload, die dort laut Projektregel nie auftauchen dürfen. Nicht auflösbare Referenzen werden geloggt. * Überschriften standen weiter links als der Fließtext. Jeder Block hatte einzeln `max-width: 68ch`, und `ch` ist relativ zur Schrift des Elements — die Serif-Überschrift ergab eine breitere Spalte. Ersetzt durch eine gemeinsame, font-unabhängige `--essay-measure`. * Fullbleed-Fotos bluteten nur nach links aus: `.essay-figure` ist `width: 100%`, wodurch die Box überbestimmt ist und der negative rechte Margin verworfen wird. * Foto-Paare stellten beide Bilder gleich breit dar, wodurch ein Hochformat neben einem Querformat doppelt so hoch wurde. Jetzt eine Justified-Reihe: Breite proportional zum Seitenverhältnis, dadurch exakt gleiche Höhen ohne Beschnitt. * Die Lightbox hatte im Journal keine Tastatursteuerung und keine Scroll-Sperre — beides lag in PhotoGrid, also nur im Album-Raster. Verlagert in die Lightbox selbst, der doppelte Handler in PhotoGrid entfernt (sonst wäre pro Pfeildruck zwei Bilder weitergesprungen). Zusätzlich sind Proofing-Herzen und das EXIF-Panel im redaktionellen Modus abschaltbar und im Journal aus: Client-Proofing ist ein Übergabe-Workflow für Alben, keine Funktion einer Reportage. Auf der Übersicht wurde der Untertitel doppelt gerendert, weil extractExcerpt() auf ihn zurückfällt. * feat(admin): eigene URLs für alle Bereiche und überarbeiteter Journal Studio Das Panel war eine einzige Client-Komponente, die ihre Tabs über useState umschaltet: keine Route pro Bereich, kein Deep-Link, kein Zurück-Button, und nach jedem Reload landete man wieder auf "Pages". Auch der Journal-Editor hatte keine eigene URL. Jetzt sieben echte Routen (/admin, /admin/pages, /admin/journal, /admin/journal/<slug>, /admin/settings, /admin/settings/<section>, /admin/analytics). Die Shell mit Auth-Prüfung und Kopfzeile sitzt im Layout und umschließt children — so bleibt die Session-Prüfung über Routenwechsel montiert, statt bei jedem Tab-Wechsel neu zu laufen und den Spinner aufblitzen zu lassen. Unbekannte Settings-Sections fallen auf General zurück. Im selben Zug der Journal Studio, der die Routing-Änderung ohnehin berührt: * Alle Eingabefelder nutzten die Klasse `admin-input`, die in keinem CSS definiert war — sie fielen auf Browser-Defaults zurück. Jetzt gestylt, gescoped, damit der generische Name nicht ins übrige Panel leckt. * Der Split View ist per Divider verschiebbar (Maus, Tastatur, Doppelklick zum Zurücksetzen), Breite in localStorage. * Das Studio bricht aus der 1120px-Spalte aus, die Preview hat Platz. * Die Preview zeigte für jedes Foto fest 3:2 und log damit über das Layout der veröffentlichten Seite; die echten Verhältnisse werden jetzt an den Thumbnails gemessen. * Blöcke mit alten positionsbasierten Foto-Referenzen werden markiert — die lassen sich auf einer eigenständigen Journal-Seite nicht auflösen und verschwanden bisher stillschweigend. * Blocktyp-Chips als gemeinsame Komponente, monochrom und per Icon unterschieden statt in einer eigenen Blau/Lila/Orange-Palette, die sonst nirgends im Panel vorkommt. * Emojis raus, SVG-Icons rein. * fix(admin): Designsystem-Lücken im Panel schließen Eine systematische Suche nach Klassen, die im TSX benutzt, aber in keinem CSS definiert sind, hat vier Stellen mit demselben Muster gefunden: * `admin-btn-secondary` und `admin-btn-danger` existierten nicht. Sämtliche Löschen-Buttons sahen aus wie normale Buttons — keine Warnwirkung. Als `.admin-btn.admin-btn-danger` geschrieben, weil die Varianten mit den Größenklassen kombiniert werden, die weiter unten ihren eigenen Hintergrund setzen. * `page-progress-fill` fehlte: die Balken im Analytics-Panel waren leere Rinnen, der Wert unsichtbar. Ebenso `analytics-empty` und `admin-loading-container`. * `subpage-drawer-section`, `subpage-drawer-title-group` und `input-with-icon` im PageBuilder waren wirkungslos und teils mit Inline-Styles notdürftig kompensiert. * `grid-card-preview` fehlte, wodurch alle Layout-Vorschauen auf Höhe null kollabierten. Nur "Showcase" war sichtbar — und das aus Versehen, weil sein Tile `hero-tile` hieß und damit die `aspect-ratio` einer fremden PageBuilder-Klasse erbte. Umbenannt. Dazu die Theme-Vorschauen, die praktisch identisch aussahen: alle sieben zeigten dieselben drei quadratischen Kacheln, einziger Unterschied war die Hintergrundfarbe. Sie spiegeln jetzt die echten Preset-Daten aus lib/config/theme.ts — Schriftcharakter, Eckradius, Rasterdichte, Passepartout bzw. Schatten. Die Kopfzeile richtet sich an einer gemeinsamen Steuerhöhe aus. Der "Site"-Link war höher als die Buttons daneben: `.admin-btn` hatte keine explizite line-height, und <button> bekommt box-sizing: border-box vom Browser, <a> nicht. Die Statusanzeige setzte weder Schriftfamilie noch -größe und fiel auf den Browser-Default zurück — sie war nie Teil des Designsystems. Jetzt gleiche Höhe und Typografie, Pillenform als Zustandsanzeige, Trenner zur Aktionsgruppe. Das dauerhafte Pulsieren des grünen Punkts entfällt; Animation bleibt den Zuständen vorbehalten, die Aufmerksamkeit brauchen. Restliche Emojis durch SVG-Icons ersetzt. * feat(admin): add scroll-to-top toggle and SVG arrow The back-to-top button was always on and drew its arrow with the ↑ text character. Add a `scrollToTop` setting (General section in the admin panel, defaults to on so existing sites are unaffected) and replace the glyph with a stroked SVG that inherits currentColor across all presets. Scroll handling is now rAF-throttled, and prefers-reduced-motion turns off both the hover lift and the smooth scroll. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * security(journal): escape author HTML instead of filtering it CodeQL flags 26 high-severity alerts on the release PR; the bulk of them point at sanitizeHtml(), a denylist of three regexes whose output goes into dangerouslySetInnerHTML. I reproduced the bypasses before changing anything — all four pass the old filter: <img src=x onerror=alert(1)> unquoted handler, regex wants quotes <img src=x onerror='alert(1)'> single quotes, same reason <svg onload=alert(1)> not a <script> tag javasjavascript:cript:alert(1) one-pass replace, the rest recombines Plus an attribute breakout in the link renderer, which interpolated the URL into href="${url}" unescaped: [x](" onmouseover=alert(1) x=") -> <a href="" onmouseover=alert(1" ...> Replaced with escaping. Every `&<>"'` in author text becomes an entity before any markdown rule runs, so the only tags in the output are the ones renderInlineMarkdown builds itself and a URL cannot leave its attribute. Link schemes are now an allowlist (http, https, mailto, tel, relative, anchor); anything else renders as plain text. The serializer needed decodeHtmlEntities to match: without it a save would write `&lt;` into the Markdown file and the next parse would escape the `&` again, corrupting the text further on every round trip. A test covers parse -> serialize -> parse stability. Two existing tests asserted the old behaviour and were rewritten rather than deleted: one expected the script tag to be *removed* from the output, the other expected the substring "onerror" to be absent. Both now assert the property that matters — that no tag can form — because `onerror` surviving as inert text is fine. Exploitation required admin access either way: journal and essay text comes from the studio or from content/*.md. This removes the weakness, it does not close an open door. * fix(journal): contain file paths, fix frontmatter escaping, defuse two regexes Follow-up to the CodeQL findings on release PR #432. I went through all 23 alerts individually; this addresses the ones that are worth addressing and documents the ones that are not. Path containment (12 alerts, all false positives). Every path built from a slug goes through isValidSlug(), a strict `/^[a-zA-Z0-9_-]+$/` allowlist — verified against `../../etc/passwd`, `foo/../../bar`, `a/b`, `..` and friends, all rejected. CodeQL cannot see it because the check lives in another module. Added a containedPath() helper that resolves the path and refuses anything landing outside the content directory: a second lock on a door that was already locked, and a barrier the analysis can follow. Also removed the dead `slug.endsWith('.md')` branches — isValidSlug rejects dots, so they could never be taken. Frontmatter escaping (1 alert, a real bug). The serializer escaped `"` but not `\`, and the parser never unescaped anything. A title containing either character gained a backslash on every save/load cycle: Path C:\Users "quoted" -> Path C:\\Users \"quoted\" -> ... Escaping now covers the backslash first and the parser undoes both. A round trip test covers quotes, backslashes, colons and apostrophes. Two of three ReDoS regexes (2 alerts). The heading pattern had `\s+` next to `(.+)`, which overlap, so the engine tried every split of the whitespace run before failing; it is `[ \t]+` and `(\S.*)` now. The quote author pattern wrapped a lazy group around an optional group — the quadratic case — and is an index split on the first separator now. The third regex, the bold/italic pass, is deliberately left alone. Rewriting it with a negated class removes the backtracking but breaks nesting: `**bold *and italic* here**` renders as `*<em>bold </em>and italic<em> here</em>*`. The input is Markdown from an authenticated admin, never a visitor, so the worst case is an author slowing down their own page. The comment in the code says so. Not addressed: 5 js/insufficient-password-hash alerts. They ask for a slow KDF where the code uses SHA-256/HMAC — correct in general, but the admin password comes from an environment variable and is never stored, so a stronger KDF protects nothing that is not already in plaintext in the environment. 399 unit tests pass (18 new), build and tsc clean. * fix(journal): split the quote author by scanning, not by pattern Cleaning up after myself. #439 replaced the quote author regex `/^(.*?)(?:\s+--\s+(.+))?$/` — a lazy group around an optional one, the quadratic case — with `/\s+--\s+/`, and CodeQL promptly flagged the replacement for the same reason. One reported pattern traded for another. splitQuoteAuthor() scans for the first `--` that has whitespace on both sides. Linear, and it needs no reasoning about the regex engine at all. Behaviour is identical to the original regex, checked case by case against it: separator, no separator, several separators, tabs, wide gaps, `a--b` without spaces, leading and trailing separators, empty string. All nine are covered by tests, plus one asserting it stays fast on a 50k whitespace run. * security(admin): derive the session signing key with scrypt getSigningKey() ran the admin password through a single SHA-256 digest. It is key derivation rather than password storage, so it was never a stored-hash problem — but if the derived key ever leaked, one fast hash makes recovering the password by brute force cheap. CodeQL flags it as js/insufficient-password-hash and, for this particular alert, has a point. scrypt now. Two details that matter: The salt has to be stable. A random salt would produce a different key on every call and invalidate every session; it is derived from AUTH_SECRET, which is deployment-specific. Verified across separate processes: same inputs produce a verifying token, so a restart or redeploy does not log everyone out. The result is cached for the process lifetime. scrypt is deliberately slow and getSigningKey() runs on every admin request — deriving per call would add ~24ms to each one. The cache key is a digest of secret plus password, so a rotation misses the cache and derives again, and no extra plaintext copy of the password is kept around. Measured: first derivation 24ms, subsequent calls 0.12ms. Password change and secret change both invalidate an existing token, checked in separate processes. Note the one-time effect: existing admin sessions are invalidated by the change in derivation, so everyone logs in once more. * security(admin): key the signing-key cache on its inputs, not a digest #441 removed the SHA-256 digest of the admin password from the key derivation and introduced a new one three lines above it, as the cache key. Same rule, same file: CodeQL reported it immediately. The comment justifying it was wrong too. It claimed no second plaintext copy of the password was retained, while building the digest input allocates exactly that in order to hash it. The cache now holds the two input strings and compares them directly. They are the same objects the env and install caches already hold, so nothing extra is retained, and no fast hash of the password exists in memory for the life of the process. Re-verified after the change, in separate processes: a token from one process verifies in another with the same inputs, a changed password or secret rejects it, first derivation 24ms, cached calls 0.001ms. That leaves scrypt as the only place the password is hashed here. The two HMACs further down operate on the derived key and on token data, not on the password; the constant-time comparison in verifyAdminPassword is the previously dismissed one. --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
2026-08-14 16:55:07 +02:00
const SETTINGS_SECTIONS = [
{ id: 'general', label: 'General' },
{ id: 'theme', label: 'Theme' },
{ id: 'grid', label: 'Grid' },
{ id: 'footer', label: 'Footer' },
{ id: 'legal', label: 'Legal' },
{ id: 'seo', label: 'SEO' },
{ id: 'security', label: 'Security & Protection' },
{ id: 'about', label: 'About' },
release: v0.11.0 — journal fixes, admin URLs, design system cleanup (#432) * fix(screenshots): sharp-Typen fuer 0.34 und 0.35 gleichzeitig (#410) sharp 0.35 ist von `export =` auf ESM umgestellt: der Modul-Namespace ist nicht mehr aufrufbar, die Factory sitzt unter .default. Der Type-Check brach damit in scripts/screenshots.ts weg, sobald der Next-Bump (#402) sharp von 0.34.5 auf 0.35.3 mitzieht -- sharp ist hier keine deklarierte Dependency, sondern kommt ueber Next mit. Die Form wird jetzt aus dem installierten Paket abgeleitet statt festgeschrieben, zur Laufzeit wie im Typ. Geprueft mit beiden Versionen: tsc laeuft mit 0.34.5 und mit 0.35.3 fehlerfrei durch. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(deps): bump the nextjs group across 1 directory with 2 updates (#402) Bumps the nextjs group with 2 updates in the / directory: [next](https://github.com/vercel/next.js) and [eslint-config-next](https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next). Updates `next` from 16.2.12 to 16.3.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/compare/v16.2.12...v16.3.0) Updates `eslint-config-next` from 16.2.12 to 16.3.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/commits/v16.3.0/packages/eslint-config-next) --- updated-dependencies: - dependency-name: eslint-config-next dependency-version: 16.3.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: nextjs - dependency-name: next dependency-version: 16.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nextjs ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps-dev): bump prettier from 3.8.3 to 3.9.6 (#405) Bumps [prettier](https://github.com/prettier/prettier) from 3.8.3 to 3.9.6. - [Release notes](https://github.com/prettier/prettier/releases) - [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md) - [Commits](https://github.com/prettier/prettier/compare/3.8.3...3.9.6) --- updated-dependencies: - dependency-name: prettier dependency-version: 3.9.6 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * docs(changelog): Unreleased-Sektion fuer die Bumps nach v0.10.0 (#413) Die Dependency-PRs sind nach dem Release auf dev gelandet, teils auch auf main. Ohne Eintrag waeren sie beim naechsten Release unsichtbar -- inklusive Next 16.3.0, das CVE-2025-13465 mitbringt. Ausserdem im 0.10.0-Abschnitt nachgetragen, dass der Trivy-Scan bis #409 nie gelaufen ist. Der Fix steckt im Tag v0.10.0, fehlte aber in der Aufzaehlung -- und "Images werden bei jedem Publish gescannt" stand im Changelog, waehrend der Job im Action-Setup abbrach. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(gallery): per-album sort order, independent of Immich (#408) (#414) Album order was dictated entirely by Immich: getAlbum() sorted by the album's own asc/desc flag, so a Folio album always mirrored the archive. A curated series has a narrative order that has nothing to do with capture time, and changing the Immich album's sort to fit the website changes it for the archive too. Adds an optional per-album `sort` in gallery.yaml, editable in /admin, defaulting to today's behaviour so every existing config is unchanged: immich (default) | newest | oldest | filename | manual `manual` is a pinned *prefix*: `assetOrder` lists only the photos placed by hand, everything else follows in the album's Immich order. A full permutation of a 2,000-photo album would be ~80 KB of UUIDs in a file that is rewritten and copied to content/.backups/ on every admin save. It also makes drift fall out for free — photos removed in Immich never match, new ones land in the tail rather than being hidden. Sorting is applied after the cache read, not before the cache write, so the LRU keeps one canonical Immich-ordered copy per album. That avoids putting the mode in the cache key, lets a config change take effect without depending on invalidation, and keeps the stale-serving path correct. cache.get() returns the stored object by reference, so withSort() returns a shallow clone with a new array — sorting in place would reorder the shared entry, and under request coalescing every concurrent caller would be sorting the same array. Also fixes a prerequisite bug: /api/admin/albums/[albumId]/assets read album.assets from GET /albums/:id, which Immich 3.x no longer populates (lib/immich.ts:507). The hero picker's "This Album" tab returned nothing and threw outright when the key was absent. It now goes through the client's paginated metadata search, with ?types=all to opt videos in for the reorder editor. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): drop decorative emoji from the sort select labels (#415) An <option> cannot contain markup, so the SVG set in Icons is not reachable there — but a decorative emoji is not a substitute for it. Plain text instead; the album card badge already uses a real icon. The remaining emoji in the admin panel (asset picker tabs, section headings, layout picker options) predate this branch and are left for a separate cleanup. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): replace emoji icons with the shared SVG icon set (#416) The admin panel mixed two icon conventions: inline SVGs from `Icons.tsx` in most components, and decorative emoji in the asset picker and a few PageBuilder labels. Emoji render inconsistently across platforms, ignore the accent colour, and cannot inherit the `.svg-icon` sizing rules. - Icons.tsx: add `IconStar` (filled — it marks a state, not an action) and `IconImage`. - AssetPicker: the three tab labels and the favourite tile badge now use IconFolder / IconStar / IconImage. - PageBuilder: the "Standalone Albums" and "Subpages" headings use the icon set instead of an emoji. - PageBuilder: the layout picker drops its emoji for plain text. An <option> cannot contain markup, so an SVG is impossible there and a decorative glyph is not a substitute. - admin.css: align icon and label in the picker tabs, and swap the favourite badge's text-shadow for drop-shadow, which is what applies to an inline SVG. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): fold PageBuilder's local icons into the shared Icons module (#418) * refactor(admin): fold PageBuilder's local icons into the shared module PageBuilder.tsx carried its own `Icons` object duplicating most of the glyphs already exported by Icons.tsx, with hardcoded sizes and slightly divergent paths. Migrate all 32 call sites to the shared module and delete the local object. Five glyphs had no counterpart and are added to Icons.tsx as 1:1 ports of the local paths: IconX, IconPlus, IconHome, IconCopy, IconImage. The local ExternalLink and Check are dropped rather than ported — both had zero call sites. Two glyphs change shape slightly, which is the point of consolidating: the shared IconCamera includes the viewfinder bump the local copy omitted, and drag handles now use IconGripVertical. IconGripVertical uses the module's square 24x24 viewBox, so `.svg-drag` goes from 12x18 to 18x18 — the old non-square box would letterbox the glyph down to 12x12 and shrink the handle. * fix(admin): resolve icon-module integration after #416 Merging dev brought in #416, which added a second IconImage to Icons.tsx and two <Icons.Camera>/<Icons.Folder> section headers that reference the local Icons object this PR removes. Git merged both cleanly but the result did not type-check. - drop the duplicate IconImage (both copies were byte-identical) - point the two section headers at the imported IconCamera/IconFolder - refresh the SORT_LABELS comment: the icon set is imported now, not declared below --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> * fix(config): allow an empty gallery, guard against a double /api suffix (#421) An empty gallery is now a valid, rendered state instead of a throw: deriveGallery() no longer requires at least one album or subpage, so a deployment with no albums yet renders a bare homepage the owner can fill in via /admin. getConfig() also stops appending /api to an Immich URL that already ends in it, which previously produced .../api/api and broke every upstream request. Includes a restore of the per-album sort test cases, which the branch had lost by being cut before #408/#414. * feat(admin): favicon upload, served from the content volume (#422) Adds a bundled default favicon, an upload widget in admin Settings > General, and a route that serves the icon from the writable content/ volume with a fallback to the bundled default. Raster uploads (PNG/ICO/JPEG) are wrapped in an SVG container; the response carries its own CSP so an uploaded SVG cannot execute script on the origin. The GET route revalidates with an ETag instead of caching immutably, so a newly uploaded icon shows up immediately. Uploads are written via temp file + rename, and a Reset button restores the bundled default. * ci: flag unformatted files in a PR, without blocking it (#424) Prettier is configured as an error rule in eslint.config.mjs but has never run in CI, so part of the tree predates it. A final CI step now diffs against the PR base, runs prettier --list-different over the changed files, and emits a warning annotation per offender plus a job summary. Advisory by design: it never fails the job. Blocking would turn a PR red for merely touching a file that was already unformatted, and normalising the tree in one commit would wreck git blame and conflict with the PRs in flight. Requires fetch-depth: 0, since diffing against the base needs its history. * feat(install): first-run wizard gated by a one-time setup token (#419) Adds /install, a four-step first-run wizard: connect to Immich, optionally pick albums, name the site, finish. It verifies the credentials against the Immich server before writing anything, then writes gallery.yaml, settings.yaml and a content/install.json carrying the Immich credentials and a generated site secret. install.json exists because a running process cannot pick up new env vars — the wizard has to write configuration that takes effect without a restart. getInstallCredentials() merges it under the real environment, so env vars always win and rotation stays a matter of setting one. Both the page and the API routes are gated by a one-time setup token printed to the server log, so a deployment that is reachable before gallery.yaml exists cannot be configured by whoever finds it first. The token is stored in content/.setup-token (0600) rather than a module variable: Next.js bundles the page and each route handler separately, so a module-level token left the page and the API disagreeing inside one process and the wizard stuck on step 1. It is removed once the install completes. The admin password is stored as an scrypt hash using the scheme lib/auth.ts already applies to album passwords; a plaintext ADMIN_PASSWORD env var keeps working. * docs: document the setup wizard, fix the read-only content mount (#425) Quick Start now leads with the /install wizard, with the hand-written YAML route kept alongside it, and a First-Run Setup section covers the setup token, the files the wizard writes, and env-var precedence. Two corrections: both Docker examples mounted content/ as :ro, which silently breaks the wizard, the admin panel and the backup rotation alike — docs/admin-panel.md already said so and the README contradicted it. And nothing documented that content/install.json holds the Immich API key, so a backup of content/ is a backup of credentials. Also adds a Contributors section crediting the people whose work is in the project. * feat(admin): floating save bar pinned to the bottom of the viewport (#426) The save bar was the first, static element inside .admin-main. Since the document itself scrolls, it left the viewport as soon as you scrolled down — editing a subpage section or a settings block far below gave no visible dirty hint and no reachable save button. Replace it with a bottom-pinned floating bar shared by both editors. It only mounts while there is something to act on (unsaved changes, an in-flight save, or a result message), so it never covers content while idle. The success message clears after 5s, which hides the bar again. - new SaveBar component, replacing the duplicated markup in PageBuilder and SettingsEditor - adopt the previously unused .floating-save-bar CSS: slide-in keyframes (carrying translateX(-50%)), dirty border, wrap/gap, mobile variant and a prefers-reduced-motion opt-out; z-index 900 keeps it below modals - .admin-main gains bottom padding so the bar never covers page content - drop the now-unreachable idle hints: the ⌘S hint becomes a button title, the Live Sync note becomes a static line above the settings layout - header "Site" link now bypasses the cache (/?fresh=1), so the preview stays reachable when the bar is hidden Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(admin): themed listbox for the album sort control (#427) The per-album "Photo order" control was a native <select>. Because an <option> cannot contain markup, its choices could not use the admin panel's currentColor SVG set — the reason #415 had to fall back to plain text after dropping the emoji labels. Adds a Listbox component implementing the ARIA combobox/listbox pattern, so options can render a glyph beside their label: - DOM focus stays on the trigger button; the active option is announced through aria-activedescendant, keeping focus management to one element - Keyboard: arrows (clamped at the ends, like a native select), Home/End, Enter/Space to commit, Escape to cancel, Tab commits and moves on, and prefix type-ahead with a repeat-key cycle - Outside dismissal on pointerdown, so a press starting outside closes the popup before the click retargets The sort options now carry an icon each: calendar, arrow-down, arrow-up, an A→Z marker, and the drag glyph for manual — matching the badge the album card already shows. SORT_LABELS stays plain text because the badge feeds it to a title attribute. Closes #417 Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(git): ignore generated design handoff folders * fix(admin): stop the album sort dropdown clipping, and simplify the panel (#428) * fix(admin): render listbox popup in a portal so it escapes modal clipping The sort control's popup was position:absolute inside three clipping ancestors (.album-drawer overflow:hidden > .album-drawer-body overflow-y:auto > .modal-right-column overflow-y:auto), so it was cut off at the bottom of the Edit Album Details modal. z-index could not help: clipping happens before stacking. It also always hung below the trigger, with no flip. Portal the popup to document.body and position it from the trigger's viewport rect, flipping above when there is more room there and capping max-height to the space available so it scrolls internally rather than overflowing. It is dismissed on scroll and resize, since the anchor is only measured on open. The outside-pointerdown handler now also treats the popup as inside; without that the portalled list counts as outside, and a click on an option would close it before the selection commits. * refactor(admin): single-column album details panel The left column spent 1.2fr on a cover thumbnail and three stat rows, two of which (Status, Custom Hero) only restated the form fields opposite them, while the form itself was squeezed into 1.8fr behind a second nested scroller. Stack the drawer in one column instead: cover as a banner, then the form at full width, with the UUID moved into the footer. The body is now the only scroll container, which also removes one of the ancestors that was clipping the sort popup. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> * fix(admin): give the portalled listbox its theme back, lock the page behind modals (#429) Two defects in the album editor. The sort listbox popup painted transparent. Every --admin-* variable is scoped to .admin-layout, and since the popup moved into document.body it sits outside that subtree, so background/border/text all resolved to nothing. It now carries its own copy of the palette in both colour schemes, plus the font it no longer inherits. Scrolling inside a modal also moved the page behind it. No admin modal ever locked body scroll: the overlay covers the page but does not absorb wheel events, so a scroll starting on the backdrop — or continuing past the end of the modal's own scroller — reaches the document. overscroll-behavior cannot cover that case on its own, because it only applies to scroll containers and the backdrop is not one. useScrollLock freezes body while a modal is open and compensates for the width the scrollbar gives up, so nothing shifts underneath. Each lock restores the inline value it found, which makes nesting work without a counter — a picker opened from the drawer restores the drawer's hidden state instead of clearing it. Applied to both drawers and all four picker modals, which share the defect. overscroll-behavior: contain on the scrollers stops the chaining they can handle themselves. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com> * fix(security): allow unsafe-eval in CSP script-src during dev mode * feat(journal): add Journal Studio with split-screen editor, live preview and dedicated routes * fix(build): separate client parser from server journal-service and fix build type errors * fix(journal): Fotos rendern, Layout und Lightbox-Steuerung korrigieren Fünf unabhängige Fehler in der öffentlichen Journal- und Essay-Ansicht: * Foto-Blöcke wurden nie angezeigt. EssayView löst ein Foto über PhotoItem.id auf, und das sind verschlüsselte Tokens — die Blöcke aus dem Markdown tragen aber rohe Asset-UUIDs. Jede Zuordnung lief ins Leere, und nicht auflösbare Blöcke werden still verworfen. Die IDs werden jetzt serverseitig übersetzt; damit verschwinden nebenbei die rohen UUIDs aus dem Client-Payload, die dort laut Projektregel nie auftauchen dürfen. Nicht auflösbare Referenzen werden geloggt. * Überschriften standen weiter links als der Fließtext. Jeder Block hatte einzeln `max-width: 68ch`, und `ch` ist relativ zur Schrift des Elements — die Serif-Überschrift ergab eine breitere Spalte. Ersetzt durch eine gemeinsame, font-unabhängige `--essay-measure`. * Fullbleed-Fotos bluteten nur nach links aus: `.essay-figure` ist `width: 100%`, wodurch die Box überbestimmt ist und der negative rechte Margin verworfen wird. * Foto-Paare stellten beide Bilder gleich breit dar, wodurch ein Hochformat neben einem Querformat doppelt so hoch wurde. Jetzt eine Justified-Reihe: Breite proportional zum Seitenverhältnis, dadurch exakt gleiche Höhen ohne Beschnitt. * Die Lightbox hatte im Journal keine Tastatursteuerung und keine Scroll-Sperre — beides lag in PhotoGrid, also nur im Album-Raster. Verlagert in die Lightbox selbst, der doppelte Handler in PhotoGrid entfernt (sonst wäre pro Pfeildruck zwei Bilder weitergesprungen). Zusätzlich sind Proofing-Herzen und das EXIF-Panel im redaktionellen Modus abschaltbar und im Journal aus: Client-Proofing ist ein Übergabe-Workflow für Alben, keine Funktion einer Reportage. Auf der Übersicht wurde der Untertitel doppelt gerendert, weil extractExcerpt() auf ihn zurückfällt. * feat(admin): eigene URLs für alle Bereiche und überarbeiteter Journal Studio Das Panel war eine einzige Client-Komponente, die ihre Tabs über useState umschaltet: keine Route pro Bereich, kein Deep-Link, kein Zurück-Button, und nach jedem Reload landete man wieder auf "Pages". Auch der Journal-Editor hatte keine eigene URL. Jetzt sieben echte Routen (/admin, /admin/pages, /admin/journal, /admin/journal/<slug>, /admin/settings, /admin/settings/<section>, /admin/analytics). Die Shell mit Auth-Prüfung und Kopfzeile sitzt im Layout und umschließt children — so bleibt die Session-Prüfung über Routenwechsel montiert, statt bei jedem Tab-Wechsel neu zu laufen und den Spinner aufblitzen zu lassen. Unbekannte Settings-Sections fallen auf General zurück. Im selben Zug der Journal Studio, der die Routing-Änderung ohnehin berührt: * Alle Eingabefelder nutzten die Klasse `admin-input`, die in keinem CSS definiert war — sie fielen auf Browser-Defaults zurück. Jetzt gestylt, gescoped, damit der generische Name nicht ins übrige Panel leckt. * Der Split View ist per Divider verschiebbar (Maus, Tastatur, Doppelklick zum Zurücksetzen), Breite in localStorage. * Das Studio bricht aus der 1120px-Spalte aus, die Preview hat Platz. * Die Preview zeigte für jedes Foto fest 3:2 und log damit über das Layout der veröffentlichten Seite; die echten Verhältnisse werden jetzt an den Thumbnails gemessen. * Blöcke mit alten positionsbasierten Foto-Referenzen werden markiert — die lassen sich auf einer eigenständigen Journal-Seite nicht auflösen und verschwanden bisher stillschweigend. * Blocktyp-Chips als gemeinsame Komponente, monochrom und per Icon unterschieden statt in einer eigenen Blau/Lila/Orange-Palette, die sonst nirgends im Panel vorkommt. * Emojis raus, SVG-Icons rein. * fix(admin): Designsystem-Lücken im Panel schließen Eine systematische Suche nach Klassen, die im TSX benutzt, aber in keinem CSS definiert sind, hat vier Stellen mit demselben Muster gefunden: * `admin-btn-secondary` und `admin-btn-danger` existierten nicht. Sämtliche Löschen-Buttons sahen aus wie normale Buttons — keine Warnwirkung. Als `.admin-btn.admin-btn-danger` geschrieben, weil die Varianten mit den Größenklassen kombiniert werden, die weiter unten ihren eigenen Hintergrund setzen. * `page-progress-fill` fehlte: die Balken im Analytics-Panel waren leere Rinnen, der Wert unsichtbar. Ebenso `analytics-empty` und `admin-loading-container`. * `subpage-drawer-section`, `subpage-drawer-title-group` und `input-with-icon` im PageBuilder waren wirkungslos und teils mit Inline-Styles notdürftig kompensiert. * `grid-card-preview` fehlte, wodurch alle Layout-Vorschauen auf Höhe null kollabierten. Nur "Showcase" war sichtbar — und das aus Versehen, weil sein Tile `hero-tile` hieß und damit die `aspect-ratio` einer fremden PageBuilder-Klasse erbte. Umbenannt. Dazu die Theme-Vorschauen, die praktisch identisch aussahen: alle sieben zeigten dieselben drei quadratischen Kacheln, einziger Unterschied war die Hintergrundfarbe. Sie spiegeln jetzt die echten Preset-Daten aus lib/config/theme.ts — Schriftcharakter, Eckradius, Rasterdichte, Passepartout bzw. Schatten. Die Kopfzeile richtet sich an einer gemeinsamen Steuerhöhe aus. Der "Site"-Link war höher als die Buttons daneben: `.admin-btn` hatte keine explizite line-height, und <button> bekommt box-sizing: border-box vom Browser, <a> nicht. Die Statusanzeige setzte weder Schriftfamilie noch -größe und fiel auf den Browser-Default zurück — sie war nie Teil des Designsystems. Jetzt gleiche Höhe und Typografie, Pillenform als Zustandsanzeige, Trenner zur Aktionsgruppe. Das dauerhafte Pulsieren des grünen Punkts entfällt; Animation bleibt den Zuständen vorbehalten, die Aufmerksamkeit brauchen. Restliche Emojis durch SVG-Icons ersetzt. * feat(admin): add scroll-to-top toggle and SVG arrow The back-to-top button was always on and drew its arrow with the ↑ text character. Add a `scrollToTop` setting (General section in the admin panel, defaults to on so existing sites are unaffected) and replace the glyph with a stroked SVG that inherits currentColor across all presets. Scroll handling is now rAF-throttled, and prefers-reduced-motion turns off both the hover lift and the smooth scroll. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * security(journal): escape author HTML instead of filtering it CodeQL flags 26 high-severity alerts on the release PR; the bulk of them point at sanitizeHtml(), a denylist of three regexes whose output goes into dangerouslySetInnerHTML. I reproduced the bypasses before changing anything — all four pass the old filter: <img src=x onerror=alert(1)> unquoted handler, regex wants quotes <img src=x onerror='alert(1)'> single quotes, same reason <svg onload=alert(1)> not a <script> tag javasjavascript:cript:alert(1) one-pass replace, the rest recombines Plus an attribute breakout in the link renderer, which interpolated the URL into href="${url}" unescaped: [x](" onmouseover=alert(1) x=") -> <a href="" onmouseover=alert(1" ...> Replaced with escaping. Every `&<>"'` in author text becomes an entity before any markdown rule runs, so the only tags in the output are the ones renderInlineMarkdown builds itself and a URL cannot leave its attribute. Link schemes are now an allowlist (http, https, mailto, tel, relative, anchor); anything else renders as plain text. The serializer needed decodeHtmlEntities to match: without it a save would write `&lt;` into the Markdown file and the next parse would escape the `&` again, corrupting the text further on every round trip. A test covers parse -> serialize -> parse stability. Two existing tests asserted the old behaviour and were rewritten rather than deleted: one expected the script tag to be *removed* from the output, the other expected the substring "onerror" to be absent. Both now assert the property that matters — that no tag can form — because `onerror` surviving as inert text is fine. Exploitation required admin access either way: journal and essay text comes from the studio or from content/*.md. This removes the weakness, it does not close an open door. * fix(journal): contain file paths, fix frontmatter escaping, defuse two regexes Follow-up to the CodeQL findings on release PR #432. I went through all 23 alerts individually; this addresses the ones that are worth addressing and documents the ones that are not. Path containment (12 alerts, all false positives). Every path built from a slug goes through isValidSlug(), a strict `/^[a-zA-Z0-9_-]+$/` allowlist — verified against `../../etc/passwd`, `foo/../../bar`, `a/b`, `..` and friends, all rejected. CodeQL cannot see it because the check lives in another module. Added a containedPath() helper that resolves the path and refuses anything landing outside the content directory: a second lock on a door that was already locked, and a barrier the analysis can follow. Also removed the dead `slug.endsWith('.md')` branches — isValidSlug rejects dots, so they could never be taken. Frontmatter escaping (1 alert, a real bug). The serializer escaped `"` but not `\`, and the parser never unescaped anything. A title containing either character gained a backslash on every save/load cycle: Path C:\Users "quoted" -> Path C:\\Users \"quoted\" -> ... Escaping now covers the backslash first and the parser undoes both. A round trip test covers quotes, backslashes, colons and apostrophes. Two of three ReDoS regexes (2 alerts). The heading pattern had `\s+` next to `(.+)`, which overlap, so the engine tried every split of the whitespace run before failing; it is `[ \t]+` and `(\S.*)` now. The quote author pattern wrapped a lazy group around an optional group — the quadratic case — and is an index split on the first separator now. The third regex, the bold/italic pass, is deliberately left alone. Rewriting it with a negated class removes the backtracking but breaks nesting: `**bold *and italic* here**` renders as `*<em>bold </em>and italic<em> here</em>*`. The input is Markdown from an authenticated admin, never a visitor, so the worst case is an author slowing down their own page. The comment in the code says so. Not addressed: 5 js/insufficient-password-hash alerts. They ask for a slow KDF where the code uses SHA-256/HMAC — correct in general, but the admin password comes from an environment variable and is never stored, so a stronger KDF protects nothing that is not already in plaintext in the environment. 399 unit tests pass (18 new), build and tsc clean. * fix(journal): split the quote author by scanning, not by pattern Cleaning up after myself. #439 replaced the quote author regex `/^(.*?)(?:\s+--\s+(.+))?$/` — a lazy group around an optional one, the quadratic case — with `/\s+--\s+/`, and CodeQL promptly flagged the replacement for the same reason. One reported pattern traded for another. splitQuoteAuthor() scans for the first `--` that has whitespace on both sides. Linear, and it needs no reasoning about the regex engine at all. Behaviour is identical to the original regex, checked case by case against it: separator, no separator, several separators, tabs, wide gaps, `a--b` without spaces, leading and trailing separators, empty string. All nine are covered by tests, plus one asserting it stays fast on a 50k whitespace run. * security(admin): derive the session signing key with scrypt getSigningKey() ran the admin password through a single SHA-256 digest. It is key derivation rather than password storage, so it was never a stored-hash problem — but if the derived key ever leaked, one fast hash makes recovering the password by brute force cheap. CodeQL flags it as js/insufficient-password-hash and, for this particular alert, has a point. scrypt now. Two details that matter: The salt has to be stable. A random salt would produce a different key on every call and invalidate every session; it is derived from AUTH_SECRET, which is deployment-specific. Verified across separate processes: same inputs produce a verifying token, so a restart or redeploy does not log everyone out. The result is cached for the process lifetime. scrypt is deliberately slow and getSigningKey() runs on every admin request — deriving per call would add ~24ms to each one. The cache key is a digest of secret plus password, so a rotation misses the cache and derives again, and no extra plaintext copy of the password is kept around. Measured: first derivation 24ms, subsequent calls 0.12ms. Password change and secret change both invalidate an existing token, checked in separate processes. Note the one-time effect: existing admin sessions are invalidated by the change in derivation, so everyone logs in once more. * security(admin): key the signing-key cache on its inputs, not a digest #441 removed the SHA-256 digest of the admin password from the key derivation and introduced a new one three lines above it, as the cache key. Same rule, same file: CodeQL reported it immediately. The comment justifying it was wrong too. It claimed no second plaintext copy of the password was retained, while building the digest input allocates exactly that in order to hash it. The cache now holds the two input strings and compares them directly. They are the same objects the env and install caches already hold, so nothing extra is retained, and no fast hash of the password exists in memory for the life of the process. Re-verified after the change, in separate processes: a token from one process verifies in another with the same inputs, a changed password or secret rejects it, first derivation 24ms, cached calls 0.001ms. That leaves scrypt as the only place the password is hashed here. The two HMACs further down operate on the derived key and on token data, not on the password; the constant-time comparison in verifyAdminPassword is the previously dismissed one. --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
2026-08-14 16:55:07 +02:00
];
interface SettingsEditorProps {
/** Sub-section to show, taken from the /admin/settings/[section] route. */
section?: string;
}
/**
* One labelled block of related switches.
*
* The features panel was a single flat grid of identical cards, so nothing said
* which switches belonged together — and a switch that publishes private notes
* looked exactly like one that controls a fade (#510).
*/
function FeatureGroup({
icon,
title,
description,
chip,
children,
}: {
icon: React.ReactNode;
title: string;
description: string;
/** Short marker for a group that needs its own weight, e.g. what visitors see. */
chip?: string;
children: React.ReactNode;
}) {
return (
<div className="settings-group">
<div className="settings-group-head">
<span className="settings-group-title">
{icon}
{title}
{chip && <span className="settings-group-chip">{chip}</span>}
</span>
<span className="settings-group-desc">{description}</span>
</div>
{children}
</div>
);
}
/**
* A switch inside a group panel. Deliberately lighter than a toggle card: these
* are settings *of* the panel they sit in, and rendering them as peers of the
* top-level cards is what hid the structure in the first place.
*/
function SettingRow({
title,
description,
checked,
onToggle,
disabled,
hint,
indented,
}: {
title: string;
description: string;
checked: boolean;
onToggle: () => void;
/** A row whose parent switch is off — shown, but inert and explained. */
disabled?: boolean;
hint?: string;
indented?: boolean;
}) {
return (
<button
type="button"
className={`setting-row${indented ? ' setting-row--indented' : ''}${
disabled ? ' setting-row--disabled' : ''
}`}
onClick={onToggle}
disabled={disabled}
aria-pressed={checked}
>
<span className="setting-row-info">
<span className="setting-row-title">{title}</span>
<span className="setting-row-desc">{description}</span>
{hint && (
<span className="setting-row-hint">
<Icons.IconBan size={11} /> {hint}
</span>
)}
</span>
<span className={`switch-toggle switch-toggle--sm ${checked && !disabled ? 'on' : ''}`}>
<span className="switch-slider" />
</span>
</button>
);
}
release: v0.11.0 — journal fixes, admin URLs, design system cleanup (#432) * fix(screenshots): sharp-Typen fuer 0.34 und 0.35 gleichzeitig (#410) sharp 0.35 ist von `export =` auf ESM umgestellt: der Modul-Namespace ist nicht mehr aufrufbar, die Factory sitzt unter .default. Der Type-Check brach damit in scripts/screenshots.ts weg, sobald der Next-Bump (#402) sharp von 0.34.5 auf 0.35.3 mitzieht -- sharp ist hier keine deklarierte Dependency, sondern kommt ueber Next mit. Die Form wird jetzt aus dem installierten Paket abgeleitet statt festgeschrieben, zur Laufzeit wie im Typ. Geprueft mit beiden Versionen: tsc laeuft mit 0.34.5 und mit 0.35.3 fehlerfrei durch. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(deps): bump the nextjs group across 1 directory with 2 updates (#402) Bumps the nextjs group with 2 updates in the / directory: [next](https://github.com/vercel/next.js) and [eslint-config-next](https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next). Updates `next` from 16.2.12 to 16.3.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/compare/v16.2.12...v16.3.0) Updates `eslint-config-next` from 16.2.12 to 16.3.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/commits/v16.3.0/packages/eslint-config-next) --- updated-dependencies: - dependency-name: eslint-config-next dependency-version: 16.3.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: nextjs - dependency-name: next dependency-version: 16.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nextjs ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps-dev): bump prettier from 3.8.3 to 3.9.6 (#405) Bumps [prettier](https://github.com/prettier/prettier) from 3.8.3 to 3.9.6. - [Release notes](https://github.com/prettier/prettier/releases) - [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md) - [Commits](https://github.com/prettier/prettier/compare/3.8.3...3.9.6) --- updated-dependencies: - dependency-name: prettier dependency-version: 3.9.6 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * docs(changelog): Unreleased-Sektion fuer die Bumps nach v0.10.0 (#413) Die Dependency-PRs sind nach dem Release auf dev gelandet, teils auch auf main. Ohne Eintrag waeren sie beim naechsten Release unsichtbar -- inklusive Next 16.3.0, das CVE-2025-13465 mitbringt. Ausserdem im 0.10.0-Abschnitt nachgetragen, dass der Trivy-Scan bis #409 nie gelaufen ist. Der Fix steckt im Tag v0.10.0, fehlte aber in der Aufzaehlung -- und "Images werden bei jedem Publish gescannt" stand im Changelog, waehrend der Job im Action-Setup abbrach. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(gallery): per-album sort order, independent of Immich (#408) (#414) Album order was dictated entirely by Immich: getAlbum() sorted by the album's own asc/desc flag, so a Folio album always mirrored the archive. A curated series has a narrative order that has nothing to do with capture time, and changing the Immich album's sort to fit the website changes it for the archive too. Adds an optional per-album `sort` in gallery.yaml, editable in /admin, defaulting to today's behaviour so every existing config is unchanged: immich (default) | newest | oldest | filename | manual `manual` is a pinned *prefix*: `assetOrder` lists only the photos placed by hand, everything else follows in the album's Immich order. A full permutation of a 2,000-photo album would be ~80 KB of UUIDs in a file that is rewritten and copied to content/.backups/ on every admin save. It also makes drift fall out for free — photos removed in Immich never match, new ones land in the tail rather than being hidden. Sorting is applied after the cache read, not before the cache write, so the LRU keeps one canonical Immich-ordered copy per album. That avoids putting the mode in the cache key, lets a config change take effect without depending on invalidation, and keeps the stale-serving path correct. cache.get() returns the stored object by reference, so withSort() returns a shallow clone with a new array — sorting in place would reorder the shared entry, and under request coalescing every concurrent caller would be sorting the same array. Also fixes a prerequisite bug: /api/admin/albums/[albumId]/assets read album.assets from GET /albums/:id, which Immich 3.x no longer populates (lib/immich.ts:507). The hero picker's "This Album" tab returned nothing and threw outright when the key was absent. It now goes through the client's paginated metadata search, with ?types=all to opt videos in for the reorder editor. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): drop decorative emoji from the sort select labels (#415) An <option> cannot contain markup, so the SVG set in Icons is not reachable there — but a decorative emoji is not a substitute for it. Plain text instead; the album card badge already uses a real icon. The remaining emoji in the admin panel (asset picker tabs, section headings, layout picker options) predate this branch and are left for a separate cleanup. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): replace emoji icons with the shared SVG icon set (#416) The admin panel mixed two icon conventions: inline SVGs from `Icons.tsx` in most components, and decorative emoji in the asset picker and a few PageBuilder labels. Emoji render inconsistently across platforms, ignore the accent colour, and cannot inherit the `.svg-icon` sizing rules. - Icons.tsx: add `IconStar` (filled — it marks a state, not an action) and `IconImage`. - AssetPicker: the three tab labels and the favourite tile badge now use IconFolder / IconStar / IconImage. - PageBuilder: the "Standalone Albums" and "Subpages" headings use the icon set instead of an emoji. - PageBuilder: the layout picker drops its emoji for plain text. An <option> cannot contain markup, so an SVG is impossible there and a decorative glyph is not a substitute. - admin.css: align icon and label in the picker tabs, and swap the favourite badge's text-shadow for drop-shadow, which is what applies to an inline SVG. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): fold PageBuilder's local icons into the shared Icons module (#418) * refactor(admin): fold PageBuilder's local icons into the shared module PageBuilder.tsx carried its own `Icons` object duplicating most of the glyphs already exported by Icons.tsx, with hardcoded sizes and slightly divergent paths. Migrate all 32 call sites to the shared module and delete the local object. Five glyphs had no counterpart and are added to Icons.tsx as 1:1 ports of the local paths: IconX, IconPlus, IconHome, IconCopy, IconImage. The local ExternalLink and Check are dropped rather than ported — both had zero call sites. Two glyphs change shape slightly, which is the point of consolidating: the shared IconCamera includes the viewfinder bump the local copy omitted, and drag handles now use IconGripVertical. IconGripVertical uses the module's square 24x24 viewBox, so `.svg-drag` goes from 12x18 to 18x18 — the old non-square box would letterbox the glyph down to 12x12 and shrink the handle. * fix(admin): resolve icon-module integration after #416 Merging dev brought in #416, which added a second IconImage to Icons.tsx and two <Icons.Camera>/<Icons.Folder> section headers that reference the local Icons object this PR removes. Git merged both cleanly but the result did not type-check. - drop the duplicate IconImage (both copies were byte-identical) - point the two section headers at the imported IconCamera/IconFolder - refresh the SORT_LABELS comment: the icon set is imported now, not declared below --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> * fix(config): allow an empty gallery, guard against a double /api suffix (#421) An empty gallery is now a valid, rendered state instead of a throw: deriveGallery() no longer requires at least one album or subpage, so a deployment with no albums yet renders a bare homepage the owner can fill in via /admin. getConfig() also stops appending /api to an Immich URL that already ends in it, which previously produced .../api/api and broke every upstream request. Includes a restore of the per-album sort test cases, which the branch had lost by being cut before #408/#414. * feat(admin): favicon upload, served from the content volume (#422) Adds a bundled default favicon, an upload widget in admin Settings > General, and a route that serves the icon from the writable content/ volume with a fallback to the bundled default. Raster uploads (PNG/ICO/JPEG) are wrapped in an SVG container; the response carries its own CSP so an uploaded SVG cannot execute script on the origin. The GET route revalidates with an ETag instead of caching immutably, so a newly uploaded icon shows up immediately. Uploads are written via temp file + rename, and a Reset button restores the bundled default. * ci: flag unformatted files in a PR, without blocking it (#424) Prettier is configured as an error rule in eslint.config.mjs but has never run in CI, so part of the tree predates it. A final CI step now diffs against the PR base, runs prettier --list-different over the changed files, and emits a warning annotation per offender plus a job summary. Advisory by design: it never fails the job. Blocking would turn a PR red for merely touching a file that was already unformatted, and normalising the tree in one commit would wreck git blame and conflict with the PRs in flight. Requires fetch-depth: 0, since diffing against the base needs its history. * feat(install): first-run wizard gated by a one-time setup token (#419) Adds /install, a four-step first-run wizard: connect to Immich, optionally pick albums, name the site, finish. It verifies the credentials against the Immich server before writing anything, then writes gallery.yaml, settings.yaml and a content/install.json carrying the Immich credentials and a generated site secret. install.json exists because a running process cannot pick up new env vars — the wizard has to write configuration that takes effect without a restart. getInstallCredentials() merges it under the real environment, so env vars always win and rotation stays a matter of setting one. Both the page and the API routes are gated by a one-time setup token printed to the server log, so a deployment that is reachable before gallery.yaml exists cannot be configured by whoever finds it first. The token is stored in content/.setup-token (0600) rather than a module variable: Next.js bundles the page and each route handler separately, so a module-level token left the page and the API disagreeing inside one process and the wizard stuck on step 1. It is removed once the install completes. The admin password is stored as an scrypt hash using the scheme lib/auth.ts already applies to album passwords; a plaintext ADMIN_PASSWORD env var keeps working. * docs: document the setup wizard, fix the read-only content mount (#425) Quick Start now leads with the /install wizard, with the hand-written YAML route kept alongside it, and a First-Run Setup section covers the setup token, the files the wizard writes, and env-var precedence. Two corrections: both Docker examples mounted content/ as :ro, which silently breaks the wizard, the admin panel and the backup rotation alike — docs/admin-panel.md already said so and the README contradicted it. And nothing documented that content/install.json holds the Immich API key, so a backup of content/ is a backup of credentials. Also adds a Contributors section crediting the people whose work is in the project. * feat(admin): floating save bar pinned to the bottom of the viewport (#426) The save bar was the first, static element inside .admin-main. Since the document itself scrolls, it left the viewport as soon as you scrolled down — editing a subpage section or a settings block far below gave no visible dirty hint and no reachable save button. Replace it with a bottom-pinned floating bar shared by both editors. It only mounts while there is something to act on (unsaved changes, an in-flight save, or a result message), so it never covers content while idle. The success message clears after 5s, which hides the bar again. - new SaveBar component, replacing the duplicated markup in PageBuilder and SettingsEditor - adopt the previously unused .floating-save-bar CSS: slide-in keyframes (carrying translateX(-50%)), dirty border, wrap/gap, mobile variant and a prefers-reduced-motion opt-out; z-index 900 keeps it below modals - .admin-main gains bottom padding so the bar never covers page content - drop the now-unreachable idle hints: the ⌘S hint becomes a button title, the Live Sync note becomes a static line above the settings layout - header "Site" link now bypasses the cache (/?fresh=1), so the preview stays reachable when the bar is hidden Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(admin): themed listbox for the album sort control (#427) The per-album "Photo order" control was a native <select>. Because an <option> cannot contain markup, its choices could not use the admin panel's currentColor SVG set — the reason #415 had to fall back to plain text after dropping the emoji labels. Adds a Listbox component implementing the ARIA combobox/listbox pattern, so options can render a glyph beside their label: - DOM focus stays on the trigger button; the active option is announced through aria-activedescendant, keeping focus management to one element - Keyboard: arrows (clamped at the ends, like a native select), Home/End, Enter/Space to commit, Escape to cancel, Tab commits and moves on, and prefix type-ahead with a repeat-key cycle - Outside dismissal on pointerdown, so a press starting outside closes the popup before the click retargets The sort options now carry an icon each: calendar, arrow-down, arrow-up, an A→Z marker, and the drag glyph for manual — matching the badge the album card already shows. SORT_LABELS stays plain text because the badge feeds it to a title attribute. Closes #417 Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(git): ignore generated design handoff folders * fix(admin): stop the album sort dropdown clipping, and simplify the panel (#428) * fix(admin): render listbox popup in a portal so it escapes modal clipping The sort control's popup was position:absolute inside three clipping ancestors (.album-drawer overflow:hidden > .album-drawer-body overflow-y:auto > .modal-right-column overflow-y:auto), so it was cut off at the bottom of the Edit Album Details modal. z-index could not help: clipping happens before stacking. It also always hung below the trigger, with no flip. Portal the popup to document.body and position it from the trigger's viewport rect, flipping above when there is more room there and capping max-height to the space available so it scrolls internally rather than overflowing. It is dismissed on scroll and resize, since the anchor is only measured on open. The outside-pointerdown handler now also treats the popup as inside; without that the portalled list counts as outside, and a click on an option would close it before the selection commits. * refactor(admin): single-column album details panel The left column spent 1.2fr on a cover thumbnail and three stat rows, two of which (Status, Custom Hero) only restated the form fields opposite them, while the form itself was squeezed into 1.8fr behind a second nested scroller. Stack the drawer in one column instead: cover as a banner, then the form at full width, with the UUID moved into the footer. The body is now the only scroll container, which also removes one of the ancestors that was clipping the sort popup. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> * fix(admin): give the portalled listbox its theme back, lock the page behind modals (#429) Two defects in the album editor. The sort listbox popup painted transparent. Every --admin-* variable is scoped to .admin-layout, and since the popup moved into document.body it sits outside that subtree, so background/border/text all resolved to nothing. It now carries its own copy of the palette in both colour schemes, plus the font it no longer inherits. Scrolling inside a modal also moved the page behind it. No admin modal ever locked body scroll: the overlay covers the page but does not absorb wheel events, so a scroll starting on the backdrop — or continuing past the end of the modal's own scroller — reaches the document. overscroll-behavior cannot cover that case on its own, because it only applies to scroll containers and the backdrop is not one. useScrollLock freezes body while a modal is open and compensates for the width the scrollbar gives up, so nothing shifts underneath. Each lock restores the inline value it found, which makes nesting work without a counter — a picker opened from the drawer restores the drawer's hidden state instead of clearing it. Applied to both drawers and all four picker modals, which share the defect. overscroll-behavior: contain on the scrollers stops the chaining they can handle themselves. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com> * fix(security): allow unsafe-eval in CSP script-src during dev mode * feat(journal): add Journal Studio with split-screen editor, live preview and dedicated routes * fix(build): separate client parser from server journal-service and fix build type errors * fix(journal): Fotos rendern, Layout und Lightbox-Steuerung korrigieren Fünf unabhängige Fehler in der öffentlichen Journal- und Essay-Ansicht: * Foto-Blöcke wurden nie angezeigt. EssayView löst ein Foto über PhotoItem.id auf, und das sind verschlüsselte Tokens — die Blöcke aus dem Markdown tragen aber rohe Asset-UUIDs. Jede Zuordnung lief ins Leere, und nicht auflösbare Blöcke werden still verworfen. Die IDs werden jetzt serverseitig übersetzt; damit verschwinden nebenbei die rohen UUIDs aus dem Client-Payload, die dort laut Projektregel nie auftauchen dürfen. Nicht auflösbare Referenzen werden geloggt. * Überschriften standen weiter links als der Fließtext. Jeder Block hatte einzeln `max-width: 68ch`, und `ch` ist relativ zur Schrift des Elements — die Serif-Überschrift ergab eine breitere Spalte. Ersetzt durch eine gemeinsame, font-unabhängige `--essay-measure`. * Fullbleed-Fotos bluteten nur nach links aus: `.essay-figure` ist `width: 100%`, wodurch die Box überbestimmt ist und der negative rechte Margin verworfen wird. * Foto-Paare stellten beide Bilder gleich breit dar, wodurch ein Hochformat neben einem Querformat doppelt so hoch wurde. Jetzt eine Justified-Reihe: Breite proportional zum Seitenverhältnis, dadurch exakt gleiche Höhen ohne Beschnitt. * Die Lightbox hatte im Journal keine Tastatursteuerung und keine Scroll-Sperre — beides lag in PhotoGrid, also nur im Album-Raster. Verlagert in die Lightbox selbst, der doppelte Handler in PhotoGrid entfernt (sonst wäre pro Pfeildruck zwei Bilder weitergesprungen). Zusätzlich sind Proofing-Herzen und das EXIF-Panel im redaktionellen Modus abschaltbar und im Journal aus: Client-Proofing ist ein Übergabe-Workflow für Alben, keine Funktion einer Reportage. Auf der Übersicht wurde der Untertitel doppelt gerendert, weil extractExcerpt() auf ihn zurückfällt. * feat(admin): eigene URLs für alle Bereiche und überarbeiteter Journal Studio Das Panel war eine einzige Client-Komponente, die ihre Tabs über useState umschaltet: keine Route pro Bereich, kein Deep-Link, kein Zurück-Button, und nach jedem Reload landete man wieder auf "Pages". Auch der Journal-Editor hatte keine eigene URL. Jetzt sieben echte Routen (/admin, /admin/pages, /admin/journal, /admin/journal/<slug>, /admin/settings, /admin/settings/<section>, /admin/analytics). Die Shell mit Auth-Prüfung und Kopfzeile sitzt im Layout und umschließt children — so bleibt die Session-Prüfung über Routenwechsel montiert, statt bei jedem Tab-Wechsel neu zu laufen und den Spinner aufblitzen zu lassen. Unbekannte Settings-Sections fallen auf General zurück. Im selben Zug der Journal Studio, der die Routing-Änderung ohnehin berührt: * Alle Eingabefelder nutzten die Klasse `admin-input`, die in keinem CSS definiert war — sie fielen auf Browser-Defaults zurück. Jetzt gestylt, gescoped, damit der generische Name nicht ins übrige Panel leckt. * Der Split View ist per Divider verschiebbar (Maus, Tastatur, Doppelklick zum Zurücksetzen), Breite in localStorage. * Das Studio bricht aus der 1120px-Spalte aus, die Preview hat Platz. * Die Preview zeigte für jedes Foto fest 3:2 und log damit über das Layout der veröffentlichten Seite; die echten Verhältnisse werden jetzt an den Thumbnails gemessen. * Blöcke mit alten positionsbasierten Foto-Referenzen werden markiert — die lassen sich auf einer eigenständigen Journal-Seite nicht auflösen und verschwanden bisher stillschweigend. * Blocktyp-Chips als gemeinsame Komponente, monochrom und per Icon unterschieden statt in einer eigenen Blau/Lila/Orange-Palette, die sonst nirgends im Panel vorkommt. * Emojis raus, SVG-Icons rein. * fix(admin): Designsystem-Lücken im Panel schließen Eine systematische Suche nach Klassen, die im TSX benutzt, aber in keinem CSS definiert sind, hat vier Stellen mit demselben Muster gefunden: * `admin-btn-secondary` und `admin-btn-danger` existierten nicht. Sämtliche Löschen-Buttons sahen aus wie normale Buttons — keine Warnwirkung. Als `.admin-btn.admin-btn-danger` geschrieben, weil die Varianten mit den Größenklassen kombiniert werden, die weiter unten ihren eigenen Hintergrund setzen. * `page-progress-fill` fehlte: die Balken im Analytics-Panel waren leere Rinnen, der Wert unsichtbar. Ebenso `analytics-empty` und `admin-loading-container`. * `subpage-drawer-section`, `subpage-drawer-title-group` und `input-with-icon` im PageBuilder waren wirkungslos und teils mit Inline-Styles notdürftig kompensiert. * `grid-card-preview` fehlte, wodurch alle Layout-Vorschauen auf Höhe null kollabierten. Nur "Showcase" war sichtbar — und das aus Versehen, weil sein Tile `hero-tile` hieß und damit die `aspect-ratio` einer fremden PageBuilder-Klasse erbte. Umbenannt. Dazu die Theme-Vorschauen, die praktisch identisch aussahen: alle sieben zeigten dieselben drei quadratischen Kacheln, einziger Unterschied war die Hintergrundfarbe. Sie spiegeln jetzt die echten Preset-Daten aus lib/config/theme.ts — Schriftcharakter, Eckradius, Rasterdichte, Passepartout bzw. Schatten. Die Kopfzeile richtet sich an einer gemeinsamen Steuerhöhe aus. Der "Site"-Link war höher als die Buttons daneben: `.admin-btn` hatte keine explizite line-height, und <button> bekommt box-sizing: border-box vom Browser, <a> nicht. Die Statusanzeige setzte weder Schriftfamilie noch -größe und fiel auf den Browser-Default zurück — sie war nie Teil des Designsystems. Jetzt gleiche Höhe und Typografie, Pillenform als Zustandsanzeige, Trenner zur Aktionsgruppe. Das dauerhafte Pulsieren des grünen Punkts entfällt; Animation bleibt den Zuständen vorbehalten, die Aufmerksamkeit brauchen. Restliche Emojis durch SVG-Icons ersetzt. * feat(admin): add scroll-to-top toggle and SVG arrow The back-to-top button was always on and drew its arrow with the ↑ text character. Add a `scrollToTop` setting (General section in the admin panel, defaults to on so existing sites are unaffected) and replace the glyph with a stroked SVG that inherits currentColor across all presets. Scroll handling is now rAF-throttled, and prefers-reduced-motion turns off both the hover lift and the smooth scroll. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * security(journal): escape author HTML instead of filtering it CodeQL flags 26 high-severity alerts on the release PR; the bulk of them point at sanitizeHtml(), a denylist of three regexes whose output goes into dangerouslySetInnerHTML. I reproduced the bypasses before changing anything — all four pass the old filter: <img src=x onerror=alert(1)> unquoted handler, regex wants quotes <img src=x onerror='alert(1)'> single quotes, same reason <svg onload=alert(1)> not a <script> tag javasjavascript:cript:alert(1) one-pass replace, the rest recombines Plus an attribute breakout in the link renderer, which interpolated the URL into href="${url}" unescaped: [x](" onmouseover=alert(1) x=") -> <a href="" onmouseover=alert(1" ...> Replaced with escaping. Every `&<>"'` in author text becomes an entity before any markdown rule runs, so the only tags in the output are the ones renderInlineMarkdown builds itself and a URL cannot leave its attribute. Link schemes are now an allowlist (http, https, mailto, tel, relative, anchor); anything else renders as plain text. The serializer needed decodeHtmlEntities to match: without it a save would write `&lt;` into the Markdown file and the next parse would escape the `&` again, corrupting the text further on every round trip. A test covers parse -> serialize -> parse stability. Two existing tests asserted the old behaviour and were rewritten rather than deleted: one expected the script tag to be *removed* from the output, the other expected the substring "onerror" to be absent. Both now assert the property that matters — that no tag can form — because `onerror` surviving as inert text is fine. Exploitation required admin access either way: journal and essay text comes from the studio or from content/*.md. This removes the weakness, it does not close an open door. * fix(journal): contain file paths, fix frontmatter escaping, defuse two regexes Follow-up to the CodeQL findings on release PR #432. I went through all 23 alerts individually; this addresses the ones that are worth addressing and documents the ones that are not. Path containment (12 alerts, all false positives). Every path built from a slug goes through isValidSlug(), a strict `/^[a-zA-Z0-9_-]+$/` allowlist — verified against `../../etc/passwd`, `foo/../../bar`, `a/b`, `..` and friends, all rejected. CodeQL cannot see it because the check lives in another module. Added a containedPath() helper that resolves the path and refuses anything landing outside the content directory: a second lock on a door that was already locked, and a barrier the analysis can follow. Also removed the dead `slug.endsWith('.md')` branches — isValidSlug rejects dots, so they could never be taken. Frontmatter escaping (1 alert, a real bug). The serializer escaped `"` but not `\`, and the parser never unescaped anything. A title containing either character gained a backslash on every save/load cycle: Path C:\Users "quoted" -> Path C:\\Users \"quoted\" -> ... Escaping now covers the backslash first and the parser undoes both. A round trip test covers quotes, backslashes, colons and apostrophes. Two of three ReDoS regexes (2 alerts). The heading pattern had `\s+` next to `(.+)`, which overlap, so the engine tried every split of the whitespace run before failing; it is `[ \t]+` and `(\S.*)` now. The quote author pattern wrapped a lazy group around an optional group — the quadratic case — and is an index split on the first separator now. The third regex, the bold/italic pass, is deliberately left alone. Rewriting it with a negated class removes the backtracking but breaks nesting: `**bold *and italic* here**` renders as `*<em>bold </em>and italic<em> here</em>*`. The input is Markdown from an authenticated admin, never a visitor, so the worst case is an author slowing down their own page. The comment in the code says so. Not addressed: 5 js/insufficient-password-hash alerts. They ask for a slow KDF where the code uses SHA-256/HMAC — correct in general, but the admin password comes from an environment variable and is never stored, so a stronger KDF protects nothing that is not already in plaintext in the environment. 399 unit tests pass (18 new), build and tsc clean. * fix(journal): split the quote author by scanning, not by pattern Cleaning up after myself. #439 replaced the quote author regex `/^(.*?)(?:\s+--\s+(.+))?$/` — a lazy group around an optional one, the quadratic case — with `/\s+--\s+/`, and CodeQL promptly flagged the replacement for the same reason. One reported pattern traded for another. splitQuoteAuthor() scans for the first `--` that has whitespace on both sides. Linear, and it needs no reasoning about the regex engine at all. Behaviour is identical to the original regex, checked case by case against it: separator, no separator, several separators, tabs, wide gaps, `a--b` without spaces, leading and trailing separators, empty string. All nine are covered by tests, plus one asserting it stays fast on a 50k whitespace run. * security(admin): derive the session signing key with scrypt getSigningKey() ran the admin password through a single SHA-256 digest. It is key derivation rather than password storage, so it was never a stored-hash problem — but if the derived key ever leaked, one fast hash makes recovering the password by brute force cheap. CodeQL flags it as js/insufficient-password-hash and, for this particular alert, has a point. scrypt now. Two details that matter: The salt has to be stable. A random salt would produce a different key on every call and invalidate every session; it is derived from AUTH_SECRET, which is deployment-specific. Verified across separate processes: same inputs produce a verifying token, so a restart or redeploy does not log everyone out. The result is cached for the process lifetime. scrypt is deliberately slow and getSigningKey() runs on every admin request — deriving per call would add ~24ms to each one. The cache key is a digest of secret plus password, so a rotation misses the cache and derives again, and no extra plaintext copy of the password is kept around. Measured: first derivation 24ms, subsequent calls 0.12ms. Password change and secret change both invalidate an existing token, checked in separate processes. Note the one-time effect: existing admin sessions are invalidated by the change in derivation, so everyone logs in once more. * security(admin): key the signing-key cache on its inputs, not a digest #441 removed the SHA-256 digest of the admin password from the key derivation and introduced a new one three lines above it, as the cache key. Same rule, same file: CodeQL reported it immediately. The comment justifying it was wrong too. It claimed no second plaintext copy of the password was retained, while building the digest input allocates exactly that in order to hash it. The cache now holds the two input strings and compares them directly. They are the same objects the env and install caches already hold, so nothing extra is retained, and no fast hash of the password exists in memory for the life of the process. Re-verified after the change, in separate processes: a token from one process verifies in another with the same inputs, a changed password or secret rejects it, first derivation 24ms, cached calls 0.001ms. That leaves scrypt as the only place the password is hashed here. The two HMACs further down operate on the derived key and on token data, not on the password; the constant-time comparison in verifyAdminPassword is the previously dismissed one. --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
2026-08-14 16:55:07 +02:00
export default function SettingsEditor({ section }: SettingsEditorProps) {
security: add Trivy container scan to Docker publish workflow (#399) * feat(admin): add backup manager UI with 1-click restore * feat(admin): collapse older backup entries by default * fix(theme): isolate admin layout, instant DOM theme updates, and add Light/Dark mode toggle * feat(admin): replace text controls for Photo Frame and Hero Style with visual preview cards * fix(admin): define missing CSS rules for button system (.btn, .preset-btn) * feat(admin): redesign theme settings with segmented mode toggle, accent color swatches, and custom iOS-style toggle cards * feat(admin): upgrade all settings tabs with visual grid previews, Google SEO snippet preview, and toggle cards * feat(admin): overhaul Pages Builder UX with slide-over drawer, card hover badges, real-time search, and floating save bar * fix(admin): remove leftover dangling syntax snippet in PageBuilder.tsx * fix(admin): add position: relative to subpage-tile so hover overlay is contained inside the tile * style(admin): replace all emojis with clean Leica-style vector SVG icons * fix(types): extend IconProps with SVGProps to allow style prop on Leica SVG icons * feat(admin): add subpage live-preview, privacy analytics, and asset protection settings * fix(typecheck): fix AlbumEntry property access in subpage drawer preview mode * fix(types): fix ImmichAlbumInfo property names thumbnailAssetId and albumName in PageBuilder.tsx * fix(types): add protection and watermark optional properties to AppConfig interface * feat(settings): add toggle for disabling analytics tracking (defaults to enabled) * feat(ux): show status banner when analytics tracking is disabled + add live sync indicator * feat(watermark): render customizable watermark overlay on Lightbox images + rename section to Portfolio Features & Modules * fix(types): import type LightboxWatermark in PhotoGrid.tsx * fix(types): destructure watermark prop in PhotoGrid function signature * feat(seo): add configurable subpage title template and metadata descriptions * feat(seo): add generateMetadata to about page for title template support * feat(proofing): add client proofing, favorites selection, compact URL bitmasking, and export modal * feat(essay): add Photo Essay storytelling mode with RSC markdown parser and fullbleed/pair layouts * feat(subpages): add page enabled toggle to deactivate subpages without deleting them * feat(admin): add visual essay block builder for photo essay storytelling pages * security: add Trivy container scan to Docker publish workflow Scans the built image for CRITICAL/HIGH CVEs on every release and uploads results to the GitHub Security tab. Non-blocking for now (exit-code 0) so releases aren't gated on findings. Also documents the scan and existing Dependabot coverage in the README. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-08-07 11:08:04 +02:00
const router = useRouter();
release: v0.11.0 — journal fixes, admin URLs, design system cleanup (#432) * fix(screenshots): sharp-Typen fuer 0.34 und 0.35 gleichzeitig (#410) sharp 0.35 ist von `export =` auf ESM umgestellt: der Modul-Namespace ist nicht mehr aufrufbar, die Factory sitzt unter .default. Der Type-Check brach damit in scripts/screenshots.ts weg, sobald der Next-Bump (#402) sharp von 0.34.5 auf 0.35.3 mitzieht -- sharp ist hier keine deklarierte Dependency, sondern kommt ueber Next mit. Die Form wird jetzt aus dem installierten Paket abgeleitet statt festgeschrieben, zur Laufzeit wie im Typ. Geprueft mit beiden Versionen: tsc laeuft mit 0.34.5 und mit 0.35.3 fehlerfrei durch. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(deps): bump the nextjs group across 1 directory with 2 updates (#402) Bumps the nextjs group with 2 updates in the / directory: [next](https://github.com/vercel/next.js) and [eslint-config-next](https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next). Updates `next` from 16.2.12 to 16.3.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/compare/v16.2.12...v16.3.0) Updates `eslint-config-next` from 16.2.12 to 16.3.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/commits/v16.3.0/packages/eslint-config-next) --- updated-dependencies: - dependency-name: eslint-config-next dependency-version: 16.3.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: nextjs - dependency-name: next dependency-version: 16.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nextjs ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps-dev): bump prettier from 3.8.3 to 3.9.6 (#405) Bumps [prettier](https://github.com/prettier/prettier) from 3.8.3 to 3.9.6. - [Release notes](https://github.com/prettier/prettier/releases) - [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md) - [Commits](https://github.com/prettier/prettier/compare/3.8.3...3.9.6) --- updated-dependencies: - dependency-name: prettier dependency-version: 3.9.6 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * docs(changelog): Unreleased-Sektion fuer die Bumps nach v0.10.0 (#413) Die Dependency-PRs sind nach dem Release auf dev gelandet, teils auch auf main. Ohne Eintrag waeren sie beim naechsten Release unsichtbar -- inklusive Next 16.3.0, das CVE-2025-13465 mitbringt. Ausserdem im 0.10.0-Abschnitt nachgetragen, dass der Trivy-Scan bis #409 nie gelaufen ist. Der Fix steckt im Tag v0.10.0, fehlte aber in der Aufzaehlung -- und "Images werden bei jedem Publish gescannt" stand im Changelog, waehrend der Job im Action-Setup abbrach. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(gallery): per-album sort order, independent of Immich (#408) (#414) Album order was dictated entirely by Immich: getAlbum() sorted by the album's own asc/desc flag, so a Folio album always mirrored the archive. A curated series has a narrative order that has nothing to do with capture time, and changing the Immich album's sort to fit the website changes it for the archive too. Adds an optional per-album `sort` in gallery.yaml, editable in /admin, defaulting to today's behaviour so every existing config is unchanged: immich (default) | newest | oldest | filename | manual `manual` is a pinned *prefix*: `assetOrder` lists only the photos placed by hand, everything else follows in the album's Immich order. A full permutation of a 2,000-photo album would be ~80 KB of UUIDs in a file that is rewritten and copied to content/.backups/ on every admin save. It also makes drift fall out for free — photos removed in Immich never match, new ones land in the tail rather than being hidden. Sorting is applied after the cache read, not before the cache write, so the LRU keeps one canonical Immich-ordered copy per album. That avoids putting the mode in the cache key, lets a config change take effect without depending on invalidation, and keeps the stale-serving path correct. cache.get() returns the stored object by reference, so withSort() returns a shallow clone with a new array — sorting in place would reorder the shared entry, and under request coalescing every concurrent caller would be sorting the same array. Also fixes a prerequisite bug: /api/admin/albums/[albumId]/assets read album.assets from GET /albums/:id, which Immich 3.x no longer populates (lib/immich.ts:507). The hero picker's "This Album" tab returned nothing and threw outright when the key was absent. It now goes through the client's paginated metadata search, with ?types=all to opt videos in for the reorder editor. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): drop decorative emoji from the sort select labels (#415) An <option> cannot contain markup, so the SVG set in Icons is not reachable there — but a decorative emoji is not a substitute for it. Plain text instead; the album card badge already uses a real icon. The remaining emoji in the admin panel (asset picker tabs, section headings, layout picker options) predate this branch and are left for a separate cleanup. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): replace emoji icons with the shared SVG icon set (#416) The admin panel mixed two icon conventions: inline SVGs from `Icons.tsx` in most components, and decorative emoji in the asset picker and a few PageBuilder labels. Emoji render inconsistently across platforms, ignore the accent colour, and cannot inherit the `.svg-icon` sizing rules. - Icons.tsx: add `IconStar` (filled — it marks a state, not an action) and `IconImage`. - AssetPicker: the three tab labels and the favourite tile badge now use IconFolder / IconStar / IconImage. - PageBuilder: the "Standalone Albums" and "Subpages" headings use the icon set instead of an emoji. - PageBuilder: the layout picker drops its emoji for plain text. An <option> cannot contain markup, so an SVG is impossible there and a decorative glyph is not a substitute. - admin.css: align icon and label in the picker tabs, and swap the favourite badge's text-shadow for drop-shadow, which is what applies to an inline SVG. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): fold PageBuilder's local icons into the shared Icons module (#418) * refactor(admin): fold PageBuilder's local icons into the shared module PageBuilder.tsx carried its own `Icons` object duplicating most of the glyphs already exported by Icons.tsx, with hardcoded sizes and slightly divergent paths. Migrate all 32 call sites to the shared module and delete the local object. Five glyphs had no counterpart and are added to Icons.tsx as 1:1 ports of the local paths: IconX, IconPlus, IconHome, IconCopy, IconImage. The local ExternalLink and Check are dropped rather than ported — both had zero call sites. Two glyphs change shape slightly, which is the point of consolidating: the shared IconCamera includes the viewfinder bump the local copy omitted, and drag handles now use IconGripVertical. IconGripVertical uses the module's square 24x24 viewBox, so `.svg-drag` goes from 12x18 to 18x18 — the old non-square box would letterbox the glyph down to 12x12 and shrink the handle. * fix(admin): resolve icon-module integration after #416 Merging dev brought in #416, which added a second IconImage to Icons.tsx and two <Icons.Camera>/<Icons.Folder> section headers that reference the local Icons object this PR removes. Git merged both cleanly but the result did not type-check. - drop the duplicate IconImage (both copies were byte-identical) - point the two section headers at the imported IconCamera/IconFolder - refresh the SORT_LABELS comment: the icon set is imported now, not declared below --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> * fix(config): allow an empty gallery, guard against a double /api suffix (#421) An empty gallery is now a valid, rendered state instead of a throw: deriveGallery() no longer requires at least one album or subpage, so a deployment with no albums yet renders a bare homepage the owner can fill in via /admin. getConfig() also stops appending /api to an Immich URL that already ends in it, which previously produced .../api/api and broke every upstream request. Includes a restore of the per-album sort test cases, which the branch had lost by being cut before #408/#414. * feat(admin): favicon upload, served from the content volume (#422) Adds a bundled default favicon, an upload widget in admin Settings > General, and a route that serves the icon from the writable content/ volume with a fallback to the bundled default. Raster uploads (PNG/ICO/JPEG) are wrapped in an SVG container; the response carries its own CSP so an uploaded SVG cannot execute script on the origin. The GET route revalidates with an ETag instead of caching immutably, so a newly uploaded icon shows up immediately. Uploads are written via temp file + rename, and a Reset button restores the bundled default. * ci: flag unformatted files in a PR, without blocking it (#424) Prettier is configured as an error rule in eslint.config.mjs but has never run in CI, so part of the tree predates it. A final CI step now diffs against the PR base, runs prettier --list-different over the changed files, and emits a warning annotation per offender plus a job summary. Advisory by design: it never fails the job. Blocking would turn a PR red for merely touching a file that was already unformatted, and normalising the tree in one commit would wreck git blame and conflict with the PRs in flight. Requires fetch-depth: 0, since diffing against the base needs its history. * feat(install): first-run wizard gated by a one-time setup token (#419) Adds /install, a four-step first-run wizard: connect to Immich, optionally pick albums, name the site, finish. It verifies the credentials against the Immich server before writing anything, then writes gallery.yaml, settings.yaml and a content/install.json carrying the Immich credentials and a generated site secret. install.json exists because a running process cannot pick up new env vars — the wizard has to write configuration that takes effect without a restart. getInstallCredentials() merges it under the real environment, so env vars always win and rotation stays a matter of setting one. Both the page and the API routes are gated by a one-time setup token printed to the server log, so a deployment that is reachable before gallery.yaml exists cannot be configured by whoever finds it first. The token is stored in content/.setup-token (0600) rather than a module variable: Next.js bundles the page and each route handler separately, so a module-level token left the page and the API disagreeing inside one process and the wizard stuck on step 1. It is removed once the install completes. The admin password is stored as an scrypt hash using the scheme lib/auth.ts already applies to album passwords; a plaintext ADMIN_PASSWORD env var keeps working. * docs: document the setup wizard, fix the read-only content mount (#425) Quick Start now leads with the /install wizard, with the hand-written YAML route kept alongside it, and a First-Run Setup section covers the setup token, the files the wizard writes, and env-var precedence. Two corrections: both Docker examples mounted content/ as :ro, which silently breaks the wizard, the admin panel and the backup rotation alike — docs/admin-panel.md already said so and the README contradicted it. And nothing documented that content/install.json holds the Immich API key, so a backup of content/ is a backup of credentials. Also adds a Contributors section crediting the people whose work is in the project. * feat(admin): floating save bar pinned to the bottom of the viewport (#426) The save bar was the first, static element inside .admin-main. Since the document itself scrolls, it left the viewport as soon as you scrolled down — editing a subpage section or a settings block far below gave no visible dirty hint and no reachable save button. Replace it with a bottom-pinned floating bar shared by both editors. It only mounts while there is something to act on (unsaved changes, an in-flight save, or a result message), so it never covers content while idle. The success message clears after 5s, which hides the bar again. - new SaveBar component, replacing the duplicated markup in PageBuilder and SettingsEditor - adopt the previously unused .floating-save-bar CSS: slide-in keyframes (carrying translateX(-50%)), dirty border, wrap/gap, mobile variant and a prefers-reduced-motion opt-out; z-index 900 keeps it below modals - .admin-main gains bottom padding so the bar never covers page content - drop the now-unreachable idle hints: the ⌘S hint becomes a button title, the Live Sync note becomes a static line above the settings layout - header "Site" link now bypasses the cache (/?fresh=1), so the preview stays reachable when the bar is hidden Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(admin): themed listbox for the album sort control (#427) The per-album "Photo order" control was a native <select>. Because an <option> cannot contain markup, its choices could not use the admin panel's currentColor SVG set — the reason #415 had to fall back to plain text after dropping the emoji labels. Adds a Listbox component implementing the ARIA combobox/listbox pattern, so options can render a glyph beside their label: - DOM focus stays on the trigger button; the active option is announced through aria-activedescendant, keeping focus management to one element - Keyboard: arrows (clamped at the ends, like a native select), Home/End, Enter/Space to commit, Escape to cancel, Tab commits and moves on, and prefix type-ahead with a repeat-key cycle - Outside dismissal on pointerdown, so a press starting outside closes the popup before the click retargets The sort options now carry an icon each: calendar, arrow-down, arrow-up, an A→Z marker, and the drag glyph for manual — matching the badge the album card already shows. SORT_LABELS stays plain text because the badge feeds it to a title attribute. Closes #417 Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(git): ignore generated design handoff folders * fix(admin): stop the album sort dropdown clipping, and simplify the panel (#428) * fix(admin): render listbox popup in a portal so it escapes modal clipping The sort control's popup was position:absolute inside three clipping ancestors (.album-drawer overflow:hidden > .album-drawer-body overflow-y:auto > .modal-right-column overflow-y:auto), so it was cut off at the bottom of the Edit Album Details modal. z-index could not help: clipping happens before stacking. It also always hung below the trigger, with no flip. Portal the popup to document.body and position it from the trigger's viewport rect, flipping above when there is more room there and capping max-height to the space available so it scrolls internally rather than overflowing. It is dismissed on scroll and resize, since the anchor is only measured on open. The outside-pointerdown handler now also treats the popup as inside; without that the portalled list counts as outside, and a click on an option would close it before the selection commits. * refactor(admin): single-column album details panel The left column spent 1.2fr on a cover thumbnail and three stat rows, two of which (Status, Custom Hero) only restated the form fields opposite them, while the form itself was squeezed into 1.8fr behind a second nested scroller. Stack the drawer in one column instead: cover as a banner, then the form at full width, with the UUID moved into the footer. The body is now the only scroll container, which also removes one of the ancestors that was clipping the sort popup. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> * fix(admin): give the portalled listbox its theme back, lock the page behind modals (#429) Two defects in the album editor. The sort listbox popup painted transparent. Every --admin-* variable is scoped to .admin-layout, and since the popup moved into document.body it sits outside that subtree, so background/border/text all resolved to nothing. It now carries its own copy of the palette in both colour schemes, plus the font it no longer inherits. Scrolling inside a modal also moved the page behind it. No admin modal ever locked body scroll: the overlay covers the page but does not absorb wheel events, so a scroll starting on the backdrop — or continuing past the end of the modal's own scroller — reaches the document. overscroll-behavior cannot cover that case on its own, because it only applies to scroll containers and the backdrop is not one. useScrollLock freezes body while a modal is open and compensates for the width the scrollbar gives up, so nothing shifts underneath. Each lock restores the inline value it found, which makes nesting work without a counter — a picker opened from the drawer restores the drawer's hidden state instead of clearing it. Applied to both drawers and all four picker modals, which share the defect. overscroll-behavior: contain on the scrollers stops the chaining they can handle themselves. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com> * fix(security): allow unsafe-eval in CSP script-src during dev mode * feat(journal): add Journal Studio with split-screen editor, live preview and dedicated routes * fix(build): separate client parser from server journal-service and fix build type errors * fix(journal): Fotos rendern, Layout und Lightbox-Steuerung korrigieren Fünf unabhängige Fehler in der öffentlichen Journal- und Essay-Ansicht: * Foto-Blöcke wurden nie angezeigt. EssayView löst ein Foto über PhotoItem.id auf, und das sind verschlüsselte Tokens — die Blöcke aus dem Markdown tragen aber rohe Asset-UUIDs. Jede Zuordnung lief ins Leere, und nicht auflösbare Blöcke werden still verworfen. Die IDs werden jetzt serverseitig übersetzt; damit verschwinden nebenbei die rohen UUIDs aus dem Client-Payload, die dort laut Projektregel nie auftauchen dürfen. Nicht auflösbare Referenzen werden geloggt. * Überschriften standen weiter links als der Fließtext. Jeder Block hatte einzeln `max-width: 68ch`, und `ch` ist relativ zur Schrift des Elements — die Serif-Überschrift ergab eine breitere Spalte. Ersetzt durch eine gemeinsame, font-unabhängige `--essay-measure`. * Fullbleed-Fotos bluteten nur nach links aus: `.essay-figure` ist `width: 100%`, wodurch die Box überbestimmt ist und der negative rechte Margin verworfen wird. * Foto-Paare stellten beide Bilder gleich breit dar, wodurch ein Hochformat neben einem Querformat doppelt so hoch wurde. Jetzt eine Justified-Reihe: Breite proportional zum Seitenverhältnis, dadurch exakt gleiche Höhen ohne Beschnitt. * Die Lightbox hatte im Journal keine Tastatursteuerung und keine Scroll-Sperre — beides lag in PhotoGrid, also nur im Album-Raster. Verlagert in die Lightbox selbst, der doppelte Handler in PhotoGrid entfernt (sonst wäre pro Pfeildruck zwei Bilder weitergesprungen). Zusätzlich sind Proofing-Herzen und das EXIF-Panel im redaktionellen Modus abschaltbar und im Journal aus: Client-Proofing ist ein Übergabe-Workflow für Alben, keine Funktion einer Reportage. Auf der Übersicht wurde der Untertitel doppelt gerendert, weil extractExcerpt() auf ihn zurückfällt. * feat(admin): eigene URLs für alle Bereiche und überarbeiteter Journal Studio Das Panel war eine einzige Client-Komponente, die ihre Tabs über useState umschaltet: keine Route pro Bereich, kein Deep-Link, kein Zurück-Button, und nach jedem Reload landete man wieder auf "Pages". Auch der Journal-Editor hatte keine eigene URL. Jetzt sieben echte Routen (/admin, /admin/pages, /admin/journal, /admin/journal/<slug>, /admin/settings, /admin/settings/<section>, /admin/analytics). Die Shell mit Auth-Prüfung und Kopfzeile sitzt im Layout und umschließt children — so bleibt die Session-Prüfung über Routenwechsel montiert, statt bei jedem Tab-Wechsel neu zu laufen und den Spinner aufblitzen zu lassen. Unbekannte Settings-Sections fallen auf General zurück. Im selben Zug der Journal Studio, der die Routing-Änderung ohnehin berührt: * Alle Eingabefelder nutzten die Klasse `admin-input`, die in keinem CSS definiert war — sie fielen auf Browser-Defaults zurück. Jetzt gestylt, gescoped, damit der generische Name nicht ins übrige Panel leckt. * Der Split View ist per Divider verschiebbar (Maus, Tastatur, Doppelklick zum Zurücksetzen), Breite in localStorage. * Das Studio bricht aus der 1120px-Spalte aus, die Preview hat Platz. * Die Preview zeigte für jedes Foto fest 3:2 und log damit über das Layout der veröffentlichten Seite; die echten Verhältnisse werden jetzt an den Thumbnails gemessen. * Blöcke mit alten positionsbasierten Foto-Referenzen werden markiert — die lassen sich auf einer eigenständigen Journal-Seite nicht auflösen und verschwanden bisher stillschweigend. * Blocktyp-Chips als gemeinsame Komponente, monochrom und per Icon unterschieden statt in einer eigenen Blau/Lila/Orange-Palette, die sonst nirgends im Panel vorkommt. * Emojis raus, SVG-Icons rein. * fix(admin): Designsystem-Lücken im Panel schließen Eine systematische Suche nach Klassen, die im TSX benutzt, aber in keinem CSS definiert sind, hat vier Stellen mit demselben Muster gefunden: * `admin-btn-secondary` und `admin-btn-danger` existierten nicht. Sämtliche Löschen-Buttons sahen aus wie normale Buttons — keine Warnwirkung. Als `.admin-btn.admin-btn-danger` geschrieben, weil die Varianten mit den Größenklassen kombiniert werden, die weiter unten ihren eigenen Hintergrund setzen. * `page-progress-fill` fehlte: die Balken im Analytics-Panel waren leere Rinnen, der Wert unsichtbar. Ebenso `analytics-empty` und `admin-loading-container`. * `subpage-drawer-section`, `subpage-drawer-title-group` und `input-with-icon` im PageBuilder waren wirkungslos und teils mit Inline-Styles notdürftig kompensiert. * `grid-card-preview` fehlte, wodurch alle Layout-Vorschauen auf Höhe null kollabierten. Nur "Showcase" war sichtbar — und das aus Versehen, weil sein Tile `hero-tile` hieß und damit die `aspect-ratio` einer fremden PageBuilder-Klasse erbte. Umbenannt. Dazu die Theme-Vorschauen, die praktisch identisch aussahen: alle sieben zeigten dieselben drei quadratischen Kacheln, einziger Unterschied war die Hintergrundfarbe. Sie spiegeln jetzt die echten Preset-Daten aus lib/config/theme.ts — Schriftcharakter, Eckradius, Rasterdichte, Passepartout bzw. Schatten. Die Kopfzeile richtet sich an einer gemeinsamen Steuerhöhe aus. Der "Site"-Link war höher als die Buttons daneben: `.admin-btn` hatte keine explizite line-height, und <button> bekommt box-sizing: border-box vom Browser, <a> nicht. Die Statusanzeige setzte weder Schriftfamilie noch -größe und fiel auf den Browser-Default zurück — sie war nie Teil des Designsystems. Jetzt gleiche Höhe und Typografie, Pillenform als Zustandsanzeige, Trenner zur Aktionsgruppe. Das dauerhafte Pulsieren des grünen Punkts entfällt; Animation bleibt den Zuständen vorbehalten, die Aufmerksamkeit brauchen. Restliche Emojis durch SVG-Icons ersetzt. * feat(admin): add scroll-to-top toggle and SVG arrow The back-to-top button was always on and drew its arrow with the ↑ text character. Add a `scrollToTop` setting (General section in the admin panel, defaults to on so existing sites are unaffected) and replace the glyph with a stroked SVG that inherits currentColor across all presets. Scroll handling is now rAF-throttled, and prefers-reduced-motion turns off both the hover lift and the smooth scroll. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * security(journal): escape author HTML instead of filtering it CodeQL flags 26 high-severity alerts on the release PR; the bulk of them point at sanitizeHtml(), a denylist of three regexes whose output goes into dangerouslySetInnerHTML. I reproduced the bypasses before changing anything — all four pass the old filter: <img src=x onerror=alert(1)> unquoted handler, regex wants quotes <img src=x onerror='alert(1)'> single quotes, same reason <svg onload=alert(1)> not a <script> tag javasjavascript:cript:alert(1) one-pass replace, the rest recombines Plus an attribute breakout in the link renderer, which interpolated the URL into href="${url}" unescaped: [x](" onmouseover=alert(1) x=") -> <a href="" onmouseover=alert(1" ...> Replaced with escaping. Every `&<>"'` in author text becomes an entity before any markdown rule runs, so the only tags in the output are the ones renderInlineMarkdown builds itself and a URL cannot leave its attribute. Link schemes are now an allowlist (http, https, mailto, tel, relative, anchor); anything else renders as plain text. The serializer needed decodeHtmlEntities to match: without it a save would write `&lt;` into the Markdown file and the next parse would escape the `&` again, corrupting the text further on every round trip. A test covers parse -> serialize -> parse stability. Two existing tests asserted the old behaviour and were rewritten rather than deleted: one expected the script tag to be *removed* from the output, the other expected the substring "onerror" to be absent. Both now assert the property that matters — that no tag can form — because `onerror` surviving as inert text is fine. Exploitation required admin access either way: journal and essay text comes from the studio or from content/*.md. This removes the weakness, it does not close an open door. * fix(journal): contain file paths, fix frontmatter escaping, defuse two regexes Follow-up to the CodeQL findings on release PR #432. I went through all 23 alerts individually; this addresses the ones that are worth addressing and documents the ones that are not. Path containment (12 alerts, all false positives). Every path built from a slug goes through isValidSlug(), a strict `/^[a-zA-Z0-9_-]+$/` allowlist — verified against `../../etc/passwd`, `foo/../../bar`, `a/b`, `..` and friends, all rejected. CodeQL cannot see it because the check lives in another module. Added a containedPath() helper that resolves the path and refuses anything landing outside the content directory: a second lock on a door that was already locked, and a barrier the analysis can follow. Also removed the dead `slug.endsWith('.md')` branches — isValidSlug rejects dots, so they could never be taken. Frontmatter escaping (1 alert, a real bug). The serializer escaped `"` but not `\`, and the parser never unescaped anything. A title containing either character gained a backslash on every save/load cycle: Path C:\Users "quoted" -> Path C:\\Users \"quoted\" -> ... Escaping now covers the backslash first and the parser undoes both. A round trip test covers quotes, backslashes, colons and apostrophes. Two of three ReDoS regexes (2 alerts). The heading pattern had `\s+` next to `(.+)`, which overlap, so the engine tried every split of the whitespace run before failing; it is `[ \t]+` and `(\S.*)` now. The quote author pattern wrapped a lazy group around an optional group — the quadratic case — and is an index split on the first separator now. The third regex, the bold/italic pass, is deliberately left alone. Rewriting it with a negated class removes the backtracking but breaks nesting: `**bold *and italic* here**` renders as `*<em>bold </em>and italic<em> here</em>*`. The input is Markdown from an authenticated admin, never a visitor, so the worst case is an author slowing down their own page. The comment in the code says so. Not addressed: 5 js/insufficient-password-hash alerts. They ask for a slow KDF where the code uses SHA-256/HMAC — correct in general, but the admin password comes from an environment variable and is never stored, so a stronger KDF protects nothing that is not already in plaintext in the environment. 399 unit tests pass (18 new), build and tsc clean. * fix(journal): split the quote author by scanning, not by pattern Cleaning up after myself. #439 replaced the quote author regex `/^(.*?)(?:\s+--\s+(.+))?$/` — a lazy group around an optional one, the quadratic case — with `/\s+--\s+/`, and CodeQL promptly flagged the replacement for the same reason. One reported pattern traded for another. splitQuoteAuthor() scans for the first `--` that has whitespace on both sides. Linear, and it needs no reasoning about the regex engine at all. Behaviour is identical to the original regex, checked case by case against it: separator, no separator, several separators, tabs, wide gaps, `a--b` without spaces, leading and trailing separators, empty string. All nine are covered by tests, plus one asserting it stays fast on a 50k whitespace run. * security(admin): derive the session signing key with scrypt getSigningKey() ran the admin password through a single SHA-256 digest. It is key derivation rather than password storage, so it was never a stored-hash problem — but if the derived key ever leaked, one fast hash makes recovering the password by brute force cheap. CodeQL flags it as js/insufficient-password-hash and, for this particular alert, has a point. scrypt now. Two details that matter: The salt has to be stable. A random salt would produce a different key on every call and invalidate every session; it is derived from AUTH_SECRET, which is deployment-specific. Verified across separate processes: same inputs produce a verifying token, so a restart or redeploy does not log everyone out. The result is cached for the process lifetime. scrypt is deliberately slow and getSigningKey() runs on every admin request — deriving per call would add ~24ms to each one. The cache key is a digest of secret plus password, so a rotation misses the cache and derives again, and no extra plaintext copy of the password is kept around. Measured: first derivation 24ms, subsequent calls 0.12ms. Password change and secret change both invalidate an existing token, checked in separate processes. Note the one-time effect: existing admin sessions are invalidated by the change in derivation, so everyone logs in once more. * security(admin): key the signing-key cache on its inputs, not a digest #441 removed the SHA-256 digest of the admin password from the key derivation and introduced a new one three lines above it, as the cache key. Same rule, same file: CodeQL reported it immediately. The comment justifying it was wrong too. It claimed no second plaintext copy of the password was retained, while building the digest input allocates exactly that in order to hash it. The cache now holds the two input strings and compares them directly. They are the same objects the env and install caches already hold, so nothing extra is retained, and no fast hash of the password exists in memory for the life of the process. Re-verified after the change, in separate processes: a token from one process verifies in another with the same inputs, a changed password or secret rejects it, first derivation 24ms, cached calls 0.001ms. That leaves scrypt as the only place the password is hashed here. The two HMACs further down operate on the derived key and on token data, not on the password; the constant-time comparison in verifyAdminPassword is the previously dismissed one. --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
2026-08-14 16:55:07 +02:00
// An unknown section in the URL falls back to General instead of an empty panel.
const activeSection = SETTINGS_SECTIONS.some((sec) => sec.id === section)
? (section as string)
: 'general';
const [settings, setSettings] = useState<Settings>({});
const [loading, setLoading] = useState(true);
// Collapsed by default: the four metadata switches are a detail of one
// decision, and showing them permanently is what made the section a wall (#510).
const [metadataOpen, setMetadataOpen] = useState(false);
const [saving, setSaving] = useState(false);
const [dirty, setDirty] = useState(false);
const [saveMessage, setSaveMessage] = useState('');
release: v0.11.0 — journal fixes, admin URLs, design system cleanup (#432) * fix(screenshots): sharp-Typen fuer 0.34 und 0.35 gleichzeitig (#410) sharp 0.35 ist von `export =` auf ESM umgestellt: der Modul-Namespace ist nicht mehr aufrufbar, die Factory sitzt unter .default. Der Type-Check brach damit in scripts/screenshots.ts weg, sobald der Next-Bump (#402) sharp von 0.34.5 auf 0.35.3 mitzieht -- sharp ist hier keine deklarierte Dependency, sondern kommt ueber Next mit. Die Form wird jetzt aus dem installierten Paket abgeleitet statt festgeschrieben, zur Laufzeit wie im Typ. Geprueft mit beiden Versionen: tsc laeuft mit 0.34.5 und mit 0.35.3 fehlerfrei durch. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(deps): bump the nextjs group across 1 directory with 2 updates (#402) Bumps the nextjs group with 2 updates in the / directory: [next](https://github.com/vercel/next.js) and [eslint-config-next](https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next). Updates `next` from 16.2.12 to 16.3.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/compare/v16.2.12...v16.3.0) Updates `eslint-config-next` from 16.2.12 to 16.3.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/commits/v16.3.0/packages/eslint-config-next) --- updated-dependencies: - dependency-name: eslint-config-next dependency-version: 16.3.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: nextjs - dependency-name: next dependency-version: 16.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nextjs ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps-dev): bump prettier from 3.8.3 to 3.9.6 (#405) Bumps [prettier](https://github.com/prettier/prettier) from 3.8.3 to 3.9.6. - [Release notes](https://github.com/prettier/prettier/releases) - [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md) - [Commits](https://github.com/prettier/prettier/compare/3.8.3...3.9.6) --- updated-dependencies: - dependency-name: prettier dependency-version: 3.9.6 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * docs(changelog): Unreleased-Sektion fuer die Bumps nach v0.10.0 (#413) Die Dependency-PRs sind nach dem Release auf dev gelandet, teils auch auf main. Ohne Eintrag waeren sie beim naechsten Release unsichtbar -- inklusive Next 16.3.0, das CVE-2025-13465 mitbringt. Ausserdem im 0.10.0-Abschnitt nachgetragen, dass der Trivy-Scan bis #409 nie gelaufen ist. Der Fix steckt im Tag v0.10.0, fehlte aber in der Aufzaehlung -- und "Images werden bei jedem Publish gescannt" stand im Changelog, waehrend der Job im Action-Setup abbrach. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(gallery): per-album sort order, independent of Immich (#408) (#414) Album order was dictated entirely by Immich: getAlbum() sorted by the album's own asc/desc flag, so a Folio album always mirrored the archive. A curated series has a narrative order that has nothing to do with capture time, and changing the Immich album's sort to fit the website changes it for the archive too. Adds an optional per-album `sort` in gallery.yaml, editable in /admin, defaulting to today's behaviour so every existing config is unchanged: immich (default) | newest | oldest | filename | manual `manual` is a pinned *prefix*: `assetOrder` lists only the photos placed by hand, everything else follows in the album's Immich order. A full permutation of a 2,000-photo album would be ~80 KB of UUIDs in a file that is rewritten and copied to content/.backups/ on every admin save. It also makes drift fall out for free — photos removed in Immich never match, new ones land in the tail rather than being hidden. Sorting is applied after the cache read, not before the cache write, so the LRU keeps one canonical Immich-ordered copy per album. That avoids putting the mode in the cache key, lets a config change take effect without depending on invalidation, and keeps the stale-serving path correct. cache.get() returns the stored object by reference, so withSort() returns a shallow clone with a new array — sorting in place would reorder the shared entry, and under request coalescing every concurrent caller would be sorting the same array. Also fixes a prerequisite bug: /api/admin/albums/[albumId]/assets read album.assets from GET /albums/:id, which Immich 3.x no longer populates (lib/immich.ts:507). The hero picker's "This Album" tab returned nothing and threw outright when the key was absent. It now goes through the client's paginated metadata search, with ?types=all to opt videos in for the reorder editor. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): drop decorative emoji from the sort select labels (#415) An <option> cannot contain markup, so the SVG set in Icons is not reachable there — but a decorative emoji is not a substitute for it. Plain text instead; the album card badge already uses a real icon. The remaining emoji in the admin panel (asset picker tabs, section headings, layout picker options) predate this branch and are left for a separate cleanup. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): replace emoji icons with the shared SVG icon set (#416) The admin panel mixed two icon conventions: inline SVGs from `Icons.tsx` in most components, and decorative emoji in the asset picker and a few PageBuilder labels. Emoji render inconsistently across platforms, ignore the accent colour, and cannot inherit the `.svg-icon` sizing rules. - Icons.tsx: add `IconStar` (filled — it marks a state, not an action) and `IconImage`. - AssetPicker: the three tab labels and the favourite tile badge now use IconFolder / IconStar / IconImage. - PageBuilder: the "Standalone Albums" and "Subpages" headings use the icon set instead of an emoji. - PageBuilder: the layout picker drops its emoji for plain text. An <option> cannot contain markup, so an SVG is impossible there and a decorative glyph is not a substitute. - admin.css: align icon and label in the picker tabs, and swap the favourite badge's text-shadow for drop-shadow, which is what applies to an inline SVG. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): fold PageBuilder's local icons into the shared Icons module (#418) * refactor(admin): fold PageBuilder's local icons into the shared module PageBuilder.tsx carried its own `Icons` object duplicating most of the glyphs already exported by Icons.tsx, with hardcoded sizes and slightly divergent paths. Migrate all 32 call sites to the shared module and delete the local object. Five glyphs had no counterpart and are added to Icons.tsx as 1:1 ports of the local paths: IconX, IconPlus, IconHome, IconCopy, IconImage. The local ExternalLink and Check are dropped rather than ported — both had zero call sites. Two glyphs change shape slightly, which is the point of consolidating: the shared IconCamera includes the viewfinder bump the local copy omitted, and drag handles now use IconGripVertical. IconGripVertical uses the module's square 24x24 viewBox, so `.svg-drag` goes from 12x18 to 18x18 — the old non-square box would letterbox the glyph down to 12x12 and shrink the handle. * fix(admin): resolve icon-module integration after #416 Merging dev brought in #416, which added a second IconImage to Icons.tsx and two <Icons.Camera>/<Icons.Folder> section headers that reference the local Icons object this PR removes. Git merged both cleanly but the result did not type-check. - drop the duplicate IconImage (both copies were byte-identical) - point the two section headers at the imported IconCamera/IconFolder - refresh the SORT_LABELS comment: the icon set is imported now, not declared below --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> * fix(config): allow an empty gallery, guard against a double /api suffix (#421) An empty gallery is now a valid, rendered state instead of a throw: deriveGallery() no longer requires at least one album or subpage, so a deployment with no albums yet renders a bare homepage the owner can fill in via /admin. getConfig() also stops appending /api to an Immich URL that already ends in it, which previously produced .../api/api and broke every upstream request. Includes a restore of the per-album sort test cases, which the branch had lost by being cut before #408/#414. * feat(admin): favicon upload, served from the content volume (#422) Adds a bundled default favicon, an upload widget in admin Settings > General, and a route that serves the icon from the writable content/ volume with a fallback to the bundled default. Raster uploads (PNG/ICO/JPEG) are wrapped in an SVG container; the response carries its own CSP so an uploaded SVG cannot execute script on the origin. The GET route revalidates with an ETag instead of caching immutably, so a newly uploaded icon shows up immediately. Uploads are written via temp file + rename, and a Reset button restores the bundled default. * ci: flag unformatted files in a PR, without blocking it (#424) Prettier is configured as an error rule in eslint.config.mjs but has never run in CI, so part of the tree predates it. A final CI step now diffs against the PR base, runs prettier --list-different over the changed files, and emits a warning annotation per offender plus a job summary. Advisory by design: it never fails the job. Blocking would turn a PR red for merely touching a file that was already unformatted, and normalising the tree in one commit would wreck git blame and conflict with the PRs in flight. Requires fetch-depth: 0, since diffing against the base needs its history. * feat(install): first-run wizard gated by a one-time setup token (#419) Adds /install, a four-step first-run wizard: connect to Immich, optionally pick albums, name the site, finish. It verifies the credentials against the Immich server before writing anything, then writes gallery.yaml, settings.yaml and a content/install.json carrying the Immich credentials and a generated site secret. install.json exists because a running process cannot pick up new env vars — the wizard has to write configuration that takes effect without a restart. getInstallCredentials() merges it under the real environment, so env vars always win and rotation stays a matter of setting one. Both the page and the API routes are gated by a one-time setup token printed to the server log, so a deployment that is reachable before gallery.yaml exists cannot be configured by whoever finds it first. The token is stored in content/.setup-token (0600) rather than a module variable: Next.js bundles the page and each route handler separately, so a module-level token left the page and the API disagreeing inside one process and the wizard stuck on step 1. It is removed once the install completes. The admin password is stored as an scrypt hash using the scheme lib/auth.ts already applies to album passwords; a plaintext ADMIN_PASSWORD env var keeps working. * docs: document the setup wizard, fix the read-only content mount (#425) Quick Start now leads with the /install wizard, with the hand-written YAML route kept alongside it, and a First-Run Setup section covers the setup token, the files the wizard writes, and env-var precedence. Two corrections: both Docker examples mounted content/ as :ro, which silently breaks the wizard, the admin panel and the backup rotation alike — docs/admin-panel.md already said so and the README contradicted it. And nothing documented that content/install.json holds the Immich API key, so a backup of content/ is a backup of credentials. Also adds a Contributors section crediting the people whose work is in the project. * feat(admin): floating save bar pinned to the bottom of the viewport (#426) The save bar was the first, static element inside .admin-main. Since the document itself scrolls, it left the viewport as soon as you scrolled down — editing a subpage section or a settings block far below gave no visible dirty hint and no reachable save button. Replace it with a bottom-pinned floating bar shared by both editors. It only mounts while there is something to act on (unsaved changes, an in-flight save, or a result message), so it never covers content while idle. The success message clears after 5s, which hides the bar again. - new SaveBar component, replacing the duplicated markup in PageBuilder and SettingsEditor - adopt the previously unused .floating-save-bar CSS: slide-in keyframes (carrying translateX(-50%)), dirty border, wrap/gap, mobile variant and a prefers-reduced-motion opt-out; z-index 900 keeps it below modals - .admin-main gains bottom padding so the bar never covers page content - drop the now-unreachable idle hints: the ⌘S hint becomes a button title, the Live Sync note becomes a static line above the settings layout - header "Site" link now bypasses the cache (/?fresh=1), so the preview stays reachable when the bar is hidden Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(admin): themed listbox for the album sort control (#427) The per-album "Photo order" control was a native <select>. Because an <option> cannot contain markup, its choices could not use the admin panel's currentColor SVG set — the reason #415 had to fall back to plain text after dropping the emoji labels. Adds a Listbox component implementing the ARIA combobox/listbox pattern, so options can render a glyph beside their label: - DOM focus stays on the trigger button; the active option is announced through aria-activedescendant, keeping focus management to one element - Keyboard: arrows (clamped at the ends, like a native select), Home/End, Enter/Space to commit, Escape to cancel, Tab commits and moves on, and prefix type-ahead with a repeat-key cycle - Outside dismissal on pointerdown, so a press starting outside closes the popup before the click retargets The sort options now carry an icon each: calendar, arrow-down, arrow-up, an A→Z marker, and the drag glyph for manual — matching the badge the album card already shows. SORT_LABELS stays plain text because the badge feeds it to a title attribute. Closes #417 Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(git): ignore generated design handoff folders * fix(admin): stop the album sort dropdown clipping, and simplify the panel (#428) * fix(admin): render listbox popup in a portal so it escapes modal clipping The sort control's popup was position:absolute inside three clipping ancestors (.album-drawer overflow:hidden > .album-drawer-body overflow-y:auto > .modal-right-column overflow-y:auto), so it was cut off at the bottom of the Edit Album Details modal. z-index could not help: clipping happens before stacking. It also always hung below the trigger, with no flip. Portal the popup to document.body and position it from the trigger's viewport rect, flipping above when there is more room there and capping max-height to the space available so it scrolls internally rather than overflowing. It is dismissed on scroll and resize, since the anchor is only measured on open. The outside-pointerdown handler now also treats the popup as inside; without that the portalled list counts as outside, and a click on an option would close it before the selection commits. * refactor(admin): single-column album details panel The left column spent 1.2fr on a cover thumbnail and three stat rows, two of which (Status, Custom Hero) only restated the form fields opposite them, while the form itself was squeezed into 1.8fr behind a second nested scroller. Stack the drawer in one column instead: cover as a banner, then the form at full width, with the UUID moved into the footer. The body is now the only scroll container, which also removes one of the ancestors that was clipping the sort popup. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> * fix(admin): give the portalled listbox its theme back, lock the page behind modals (#429) Two defects in the album editor. The sort listbox popup painted transparent. Every --admin-* variable is scoped to .admin-layout, and since the popup moved into document.body it sits outside that subtree, so background/border/text all resolved to nothing. It now carries its own copy of the palette in both colour schemes, plus the font it no longer inherits. Scrolling inside a modal also moved the page behind it. No admin modal ever locked body scroll: the overlay covers the page but does not absorb wheel events, so a scroll starting on the backdrop — or continuing past the end of the modal's own scroller — reaches the document. overscroll-behavior cannot cover that case on its own, because it only applies to scroll containers and the backdrop is not one. useScrollLock freezes body while a modal is open and compensates for the width the scrollbar gives up, so nothing shifts underneath. Each lock restores the inline value it found, which makes nesting work without a counter — a picker opened from the drawer restores the drawer's hidden state instead of clearing it. Applied to both drawers and all four picker modals, which share the defect. overscroll-behavior: contain on the scrollers stops the chaining they can handle themselves. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com> * fix(security): allow unsafe-eval in CSP script-src during dev mode * feat(journal): add Journal Studio with split-screen editor, live preview and dedicated routes * fix(build): separate client parser from server journal-service and fix build type errors * fix(journal): Fotos rendern, Layout und Lightbox-Steuerung korrigieren Fünf unabhängige Fehler in der öffentlichen Journal- und Essay-Ansicht: * Foto-Blöcke wurden nie angezeigt. EssayView löst ein Foto über PhotoItem.id auf, und das sind verschlüsselte Tokens — die Blöcke aus dem Markdown tragen aber rohe Asset-UUIDs. Jede Zuordnung lief ins Leere, und nicht auflösbare Blöcke werden still verworfen. Die IDs werden jetzt serverseitig übersetzt; damit verschwinden nebenbei die rohen UUIDs aus dem Client-Payload, die dort laut Projektregel nie auftauchen dürfen. Nicht auflösbare Referenzen werden geloggt. * Überschriften standen weiter links als der Fließtext. Jeder Block hatte einzeln `max-width: 68ch`, und `ch` ist relativ zur Schrift des Elements — die Serif-Überschrift ergab eine breitere Spalte. Ersetzt durch eine gemeinsame, font-unabhängige `--essay-measure`. * Fullbleed-Fotos bluteten nur nach links aus: `.essay-figure` ist `width: 100%`, wodurch die Box überbestimmt ist und der negative rechte Margin verworfen wird. * Foto-Paare stellten beide Bilder gleich breit dar, wodurch ein Hochformat neben einem Querformat doppelt so hoch wurde. Jetzt eine Justified-Reihe: Breite proportional zum Seitenverhältnis, dadurch exakt gleiche Höhen ohne Beschnitt. * Die Lightbox hatte im Journal keine Tastatursteuerung und keine Scroll-Sperre — beides lag in PhotoGrid, also nur im Album-Raster. Verlagert in die Lightbox selbst, der doppelte Handler in PhotoGrid entfernt (sonst wäre pro Pfeildruck zwei Bilder weitergesprungen). Zusätzlich sind Proofing-Herzen und das EXIF-Panel im redaktionellen Modus abschaltbar und im Journal aus: Client-Proofing ist ein Übergabe-Workflow für Alben, keine Funktion einer Reportage. Auf der Übersicht wurde der Untertitel doppelt gerendert, weil extractExcerpt() auf ihn zurückfällt. * feat(admin): eigene URLs für alle Bereiche und überarbeiteter Journal Studio Das Panel war eine einzige Client-Komponente, die ihre Tabs über useState umschaltet: keine Route pro Bereich, kein Deep-Link, kein Zurück-Button, und nach jedem Reload landete man wieder auf "Pages". Auch der Journal-Editor hatte keine eigene URL. Jetzt sieben echte Routen (/admin, /admin/pages, /admin/journal, /admin/journal/<slug>, /admin/settings, /admin/settings/<section>, /admin/analytics). Die Shell mit Auth-Prüfung und Kopfzeile sitzt im Layout und umschließt children — so bleibt die Session-Prüfung über Routenwechsel montiert, statt bei jedem Tab-Wechsel neu zu laufen und den Spinner aufblitzen zu lassen. Unbekannte Settings-Sections fallen auf General zurück. Im selben Zug der Journal Studio, der die Routing-Änderung ohnehin berührt: * Alle Eingabefelder nutzten die Klasse `admin-input`, die in keinem CSS definiert war — sie fielen auf Browser-Defaults zurück. Jetzt gestylt, gescoped, damit der generische Name nicht ins übrige Panel leckt. * Der Split View ist per Divider verschiebbar (Maus, Tastatur, Doppelklick zum Zurücksetzen), Breite in localStorage. * Das Studio bricht aus der 1120px-Spalte aus, die Preview hat Platz. * Die Preview zeigte für jedes Foto fest 3:2 und log damit über das Layout der veröffentlichten Seite; die echten Verhältnisse werden jetzt an den Thumbnails gemessen. * Blöcke mit alten positionsbasierten Foto-Referenzen werden markiert — die lassen sich auf einer eigenständigen Journal-Seite nicht auflösen und verschwanden bisher stillschweigend. * Blocktyp-Chips als gemeinsame Komponente, monochrom und per Icon unterschieden statt in einer eigenen Blau/Lila/Orange-Palette, die sonst nirgends im Panel vorkommt. * Emojis raus, SVG-Icons rein. * fix(admin): Designsystem-Lücken im Panel schließen Eine systematische Suche nach Klassen, die im TSX benutzt, aber in keinem CSS definiert sind, hat vier Stellen mit demselben Muster gefunden: * `admin-btn-secondary` und `admin-btn-danger` existierten nicht. Sämtliche Löschen-Buttons sahen aus wie normale Buttons — keine Warnwirkung. Als `.admin-btn.admin-btn-danger` geschrieben, weil die Varianten mit den Größenklassen kombiniert werden, die weiter unten ihren eigenen Hintergrund setzen. * `page-progress-fill` fehlte: die Balken im Analytics-Panel waren leere Rinnen, der Wert unsichtbar. Ebenso `analytics-empty` und `admin-loading-container`. * `subpage-drawer-section`, `subpage-drawer-title-group` und `input-with-icon` im PageBuilder waren wirkungslos und teils mit Inline-Styles notdürftig kompensiert. * `grid-card-preview` fehlte, wodurch alle Layout-Vorschauen auf Höhe null kollabierten. Nur "Showcase" war sichtbar — und das aus Versehen, weil sein Tile `hero-tile` hieß und damit die `aspect-ratio` einer fremden PageBuilder-Klasse erbte. Umbenannt. Dazu die Theme-Vorschauen, die praktisch identisch aussahen: alle sieben zeigten dieselben drei quadratischen Kacheln, einziger Unterschied war die Hintergrundfarbe. Sie spiegeln jetzt die echten Preset-Daten aus lib/config/theme.ts — Schriftcharakter, Eckradius, Rasterdichte, Passepartout bzw. Schatten. Die Kopfzeile richtet sich an einer gemeinsamen Steuerhöhe aus. Der "Site"-Link war höher als die Buttons daneben: `.admin-btn` hatte keine explizite line-height, und <button> bekommt box-sizing: border-box vom Browser, <a> nicht. Die Statusanzeige setzte weder Schriftfamilie noch -größe und fiel auf den Browser-Default zurück — sie war nie Teil des Designsystems. Jetzt gleiche Höhe und Typografie, Pillenform als Zustandsanzeige, Trenner zur Aktionsgruppe. Das dauerhafte Pulsieren des grünen Punkts entfällt; Animation bleibt den Zuständen vorbehalten, die Aufmerksamkeit brauchen. Restliche Emojis durch SVG-Icons ersetzt. * feat(admin): add scroll-to-top toggle and SVG arrow The back-to-top button was always on and drew its arrow with the ↑ text character. Add a `scrollToTop` setting (General section in the admin panel, defaults to on so existing sites are unaffected) and replace the glyph with a stroked SVG that inherits currentColor across all presets. Scroll handling is now rAF-throttled, and prefers-reduced-motion turns off both the hover lift and the smooth scroll. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * security(journal): escape author HTML instead of filtering it CodeQL flags 26 high-severity alerts on the release PR; the bulk of them point at sanitizeHtml(), a denylist of three regexes whose output goes into dangerouslySetInnerHTML. I reproduced the bypasses before changing anything — all four pass the old filter: <img src=x onerror=alert(1)> unquoted handler, regex wants quotes <img src=x onerror='alert(1)'> single quotes, same reason <svg onload=alert(1)> not a <script> tag javasjavascript:cript:alert(1) one-pass replace, the rest recombines Plus an attribute breakout in the link renderer, which interpolated the URL into href="${url}" unescaped: [x](" onmouseover=alert(1) x=") -> <a href="" onmouseover=alert(1" ...> Replaced with escaping. Every `&<>"'` in author text becomes an entity before any markdown rule runs, so the only tags in the output are the ones renderInlineMarkdown builds itself and a URL cannot leave its attribute. Link schemes are now an allowlist (http, https, mailto, tel, relative, anchor); anything else renders as plain text. The serializer needed decodeHtmlEntities to match: without it a save would write `&lt;` into the Markdown file and the next parse would escape the `&` again, corrupting the text further on every round trip. A test covers parse -> serialize -> parse stability. Two existing tests asserted the old behaviour and were rewritten rather than deleted: one expected the script tag to be *removed* from the output, the other expected the substring "onerror" to be absent. Both now assert the property that matters — that no tag can form — because `onerror` surviving as inert text is fine. Exploitation required admin access either way: journal and essay text comes from the studio or from content/*.md. This removes the weakness, it does not close an open door. * fix(journal): contain file paths, fix frontmatter escaping, defuse two regexes Follow-up to the CodeQL findings on release PR #432. I went through all 23 alerts individually; this addresses the ones that are worth addressing and documents the ones that are not. Path containment (12 alerts, all false positives). Every path built from a slug goes through isValidSlug(), a strict `/^[a-zA-Z0-9_-]+$/` allowlist — verified against `../../etc/passwd`, `foo/../../bar`, `a/b`, `..` and friends, all rejected. CodeQL cannot see it because the check lives in another module. Added a containedPath() helper that resolves the path and refuses anything landing outside the content directory: a second lock on a door that was already locked, and a barrier the analysis can follow. Also removed the dead `slug.endsWith('.md')` branches — isValidSlug rejects dots, so they could never be taken. Frontmatter escaping (1 alert, a real bug). The serializer escaped `"` but not `\`, and the parser never unescaped anything. A title containing either character gained a backslash on every save/load cycle: Path C:\Users "quoted" -> Path C:\\Users \"quoted\" -> ... Escaping now covers the backslash first and the parser undoes both. A round trip test covers quotes, backslashes, colons and apostrophes. Two of three ReDoS regexes (2 alerts). The heading pattern had `\s+` next to `(.+)`, which overlap, so the engine tried every split of the whitespace run before failing; it is `[ \t]+` and `(\S.*)` now. The quote author pattern wrapped a lazy group around an optional group — the quadratic case — and is an index split on the first separator now. The third regex, the bold/italic pass, is deliberately left alone. Rewriting it with a negated class removes the backtracking but breaks nesting: `**bold *and italic* here**` renders as `*<em>bold </em>and italic<em> here</em>*`. The input is Markdown from an authenticated admin, never a visitor, so the worst case is an author slowing down their own page. The comment in the code says so. Not addressed: 5 js/insufficient-password-hash alerts. They ask for a slow KDF where the code uses SHA-256/HMAC — correct in general, but the admin password comes from an environment variable and is never stored, so a stronger KDF protects nothing that is not already in plaintext in the environment. 399 unit tests pass (18 new), build and tsc clean. * fix(journal): split the quote author by scanning, not by pattern Cleaning up after myself. #439 replaced the quote author regex `/^(.*?)(?:\s+--\s+(.+))?$/` — a lazy group around an optional one, the quadratic case — with `/\s+--\s+/`, and CodeQL promptly flagged the replacement for the same reason. One reported pattern traded for another. splitQuoteAuthor() scans for the first `--` that has whitespace on both sides. Linear, and it needs no reasoning about the regex engine at all. Behaviour is identical to the original regex, checked case by case against it: separator, no separator, several separators, tabs, wide gaps, `a--b` without spaces, leading and trailing separators, empty string. All nine are covered by tests, plus one asserting it stays fast on a 50k whitespace run. * security(admin): derive the session signing key with scrypt getSigningKey() ran the admin password through a single SHA-256 digest. It is key derivation rather than password storage, so it was never a stored-hash problem — but if the derived key ever leaked, one fast hash makes recovering the password by brute force cheap. CodeQL flags it as js/insufficient-password-hash and, for this particular alert, has a point. scrypt now. Two details that matter: The salt has to be stable. A random salt would produce a different key on every call and invalidate every session; it is derived from AUTH_SECRET, which is deployment-specific. Verified across separate processes: same inputs produce a verifying token, so a restart or redeploy does not log everyone out. The result is cached for the process lifetime. scrypt is deliberately slow and getSigningKey() runs on every admin request — deriving per call would add ~24ms to each one. The cache key is a digest of secret plus password, so a rotation misses the cache and derives again, and no extra plaintext copy of the password is kept around. Measured: first derivation 24ms, subsequent calls 0.12ms. Password change and secret change both invalidate an existing token, checked in separate processes. Note the one-time effect: existing admin sessions are invalidated by the change in derivation, so everyone logs in once more. * security(admin): key the signing-key cache on its inputs, not a digest #441 removed the SHA-256 digest of the admin password from the key derivation and introduced a new one three lines above it, as the cache key. Same rule, same file: CodeQL reported it immediately. The comment justifying it was wrong too. It claimed no second plaintext copy of the password was retained, while building the digest input allocates exactly that in order to hash it. The cache now holds the two input strings and compares them directly. They are the same objects the env and install caches already hold, so nothing extra is retained, and no fast hash of the password exists in memory for the life of the process. Re-verified after the change, in separate processes: a token from one process verifies in another with the same inputs, a changed password or secret rejects it, first derivation 24ms, cached calls 0.001ms. That leaves scrypt as the only place the password is hashed here. The two HMACs further down operate on the derived key and on token data, not on the password; the constant-time comparison in verifyAdminPassword is the previously dismissed one. --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
2026-08-14 16:55:07 +02:00
security: add Trivy container scan to Docker publish workflow (#399) * feat(admin): add backup manager UI with 1-click restore * feat(admin): collapse older backup entries by default * fix(theme): isolate admin layout, instant DOM theme updates, and add Light/Dark mode toggle * feat(admin): replace text controls for Photo Frame and Hero Style with visual preview cards * fix(admin): define missing CSS rules for button system (.btn, .preset-btn) * feat(admin): redesign theme settings with segmented mode toggle, accent color swatches, and custom iOS-style toggle cards * feat(admin): upgrade all settings tabs with visual grid previews, Google SEO snippet preview, and toggle cards * feat(admin): overhaul Pages Builder UX with slide-over drawer, card hover badges, real-time search, and floating save bar * fix(admin): remove leftover dangling syntax snippet in PageBuilder.tsx * fix(admin): add position: relative to subpage-tile so hover overlay is contained inside the tile * style(admin): replace all emojis with clean Leica-style vector SVG icons * fix(types): extend IconProps with SVGProps to allow style prop on Leica SVG icons * feat(admin): add subpage live-preview, privacy analytics, and asset protection settings * fix(typecheck): fix AlbumEntry property access in subpage drawer preview mode * fix(types): fix ImmichAlbumInfo property names thumbnailAssetId and albumName in PageBuilder.tsx * fix(types): add protection and watermark optional properties to AppConfig interface * feat(settings): add toggle for disabling analytics tracking (defaults to enabled) * feat(ux): show status banner when analytics tracking is disabled + add live sync indicator * feat(watermark): render customizable watermark overlay on Lightbox images + rename section to Portfolio Features & Modules * fix(types): import type LightboxWatermark in PhotoGrid.tsx * fix(types): destructure watermark prop in PhotoGrid function signature * feat(seo): add configurable subpage title template and metadata descriptions * feat(seo): add generateMetadata to about page for title template support * feat(proofing): add client proofing, favorites selection, compact URL bitmasking, and export modal * feat(essay): add Photo Essay storytelling mode with RSC markdown parser and fullbleed/pair layouts * feat(subpages): add page enabled toggle to deactivate subpages without deleting them * feat(admin): add visual essay block builder for photo essay storytelling pages * security: add Trivy container scan to Docker publish workflow Scans the built image for CRITICAL/HIGH CVEs on every release and uploads results to the GitHub Security tab. Non-blocking for now (exit-code 0) so releases aren't gated on findings. Also documents the scan and existing Dependabot coverage in the README. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-08-07 11:08:04 +02:00
const [currentMode, setCurrentMode] = useState<'dark' | 'light'>('dark');
release: v0.11.0 — journal fixes, admin URLs, design system cleanup (#432) * fix(screenshots): sharp-Typen fuer 0.34 und 0.35 gleichzeitig (#410) sharp 0.35 ist von `export =` auf ESM umgestellt: der Modul-Namespace ist nicht mehr aufrufbar, die Factory sitzt unter .default. Der Type-Check brach damit in scripts/screenshots.ts weg, sobald der Next-Bump (#402) sharp von 0.34.5 auf 0.35.3 mitzieht -- sharp ist hier keine deklarierte Dependency, sondern kommt ueber Next mit. Die Form wird jetzt aus dem installierten Paket abgeleitet statt festgeschrieben, zur Laufzeit wie im Typ. Geprueft mit beiden Versionen: tsc laeuft mit 0.34.5 und mit 0.35.3 fehlerfrei durch. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(deps): bump the nextjs group across 1 directory with 2 updates (#402) Bumps the nextjs group with 2 updates in the / directory: [next](https://github.com/vercel/next.js) and [eslint-config-next](https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next). Updates `next` from 16.2.12 to 16.3.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/compare/v16.2.12...v16.3.0) Updates `eslint-config-next` from 16.2.12 to 16.3.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/commits/v16.3.0/packages/eslint-config-next) --- updated-dependencies: - dependency-name: eslint-config-next dependency-version: 16.3.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: nextjs - dependency-name: next dependency-version: 16.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nextjs ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps-dev): bump prettier from 3.8.3 to 3.9.6 (#405) Bumps [prettier](https://github.com/prettier/prettier) from 3.8.3 to 3.9.6. - [Release notes](https://github.com/prettier/prettier/releases) - [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md) - [Commits](https://github.com/prettier/prettier/compare/3.8.3...3.9.6) --- updated-dependencies: - dependency-name: prettier dependency-version: 3.9.6 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * docs(changelog): Unreleased-Sektion fuer die Bumps nach v0.10.0 (#413) Die Dependency-PRs sind nach dem Release auf dev gelandet, teils auch auf main. Ohne Eintrag waeren sie beim naechsten Release unsichtbar -- inklusive Next 16.3.0, das CVE-2025-13465 mitbringt. Ausserdem im 0.10.0-Abschnitt nachgetragen, dass der Trivy-Scan bis #409 nie gelaufen ist. Der Fix steckt im Tag v0.10.0, fehlte aber in der Aufzaehlung -- und "Images werden bei jedem Publish gescannt" stand im Changelog, waehrend der Job im Action-Setup abbrach. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(gallery): per-album sort order, independent of Immich (#408) (#414) Album order was dictated entirely by Immich: getAlbum() sorted by the album's own asc/desc flag, so a Folio album always mirrored the archive. A curated series has a narrative order that has nothing to do with capture time, and changing the Immich album's sort to fit the website changes it for the archive too. Adds an optional per-album `sort` in gallery.yaml, editable in /admin, defaulting to today's behaviour so every existing config is unchanged: immich (default) | newest | oldest | filename | manual `manual` is a pinned *prefix*: `assetOrder` lists only the photos placed by hand, everything else follows in the album's Immich order. A full permutation of a 2,000-photo album would be ~80 KB of UUIDs in a file that is rewritten and copied to content/.backups/ on every admin save. It also makes drift fall out for free — photos removed in Immich never match, new ones land in the tail rather than being hidden. Sorting is applied after the cache read, not before the cache write, so the LRU keeps one canonical Immich-ordered copy per album. That avoids putting the mode in the cache key, lets a config change take effect without depending on invalidation, and keeps the stale-serving path correct. cache.get() returns the stored object by reference, so withSort() returns a shallow clone with a new array — sorting in place would reorder the shared entry, and under request coalescing every concurrent caller would be sorting the same array. Also fixes a prerequisite bug: /api/admin/albums/[albumId]/assets read album.assets from GET /albums/:id, which Immich 3.x no longer populates (lib/immich.ts:507). The hero picker's "This Album" tab returned nothing and threw outright when the key was absent. It now goes through the client's paginated metadata search, with ?types=all to opt videos in for the reorder editor. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): drop decorative emoji from the sort select labels (#415) An <option> cannot contain markup, so the SVG set in Icons is not reachable there — but a decorative emoji is not a substitute for it. Plain text instead; the album card badge already uses a real icon. The remaining emoji in the admin panel (asset picker tabs, section headings, layout picker options) predate this branch and are left for a separate cleanup. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): replace emoji icons with the shared SVG icon set (#416) The admin panel mixed two icon conventions: inline SVGs from `Icons.tsx` in most components, and decorative emoji in the asset picker and a few PageBuilder labels. Emoji render inconsistently across platforms, ignore the accent colour, and cannot inherit the `.svg-icon` sizing rules. - Icons.tsx: add `IconStar` (filled — it marks a state, not an action) and `IconImage`. - AssetPicker: the three tab labels and the favourite tile badge now use IconFolder / IconStar / IconImage. - PageBuilder: the "Standalone Albums" and "Subpages" headings use the icon set instead of an emoji. - PageBuilder: the layout picker drops its emoji for plain text. An <option> cannot contain markup, so an SVG is impossible there and a decorative glyph is not a substitute. - admin.css: align icon and label in the picker tabs, and swap the favourite badge's text-shadow for drop-shadow, which is what applies to an inline SVG. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): fold PageBuilder's local icons into the shared Icons module (#418) * refactor(admin): fold PageBuilder's local icons into the shared module PageBuilder.tsx carried its own `Icons` object duplicating most of the glyphs already exported by Icons.tsx, with hardcoded sizes and slightly divergent paths. Migrate all 32 call sites to the shared module and delete the local object. Five glyphs had no counterpart and are added to Icons.tsx as 1:1 ports of the local paths: IconX, IconPlus, IconHome, IconCopy, IconImage. The local ExternalLink and Check are dropped rather than ported — both had zero call sites. Two glyphs change shape slightly, which is the point of consolidating: the shared IconCamera includes the viewfinder bump the local copy omitted, and drag handles now use IconGripVertical. IconGripVertical uses the module's square 24x24 viewBox, so `.svg-drag` goes from 12x18 to 18x18 — the old non-square box would letterbox the glyph down to 12x12 and shrink the handle. * fix(admin): resolve icon-module integration after #416 Merging dev brought in #416, which added a second IconImage to Icons.tsx and two <Icons.Camera>/<Icons.Folder> section headers that reference the local Icons object this PR removes. Git merged both cleanly but the result did not type-check. - drop the duplicate IconImage (both copies were byte-identical) - point the two section headers at the imported IconCamera/IconFolder - refresh the SORT_LABELS comment: the icon set is imported now, not declared below --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> * fix(config): allow an empty gallery, guard against a double /api suffix (#421) An empty gallery is now a valid, rendered state instead of a throw: deriveGallery() no longer requires at least one album or subpage, so a deployment with no albums yet renders a bare homepage the owner can fill in via /admin. getConfig() also stops appending /api to an Immich URL that already ends in it, which previously produced .../api/api and broke every upstream request. Includes a restore of the per-album sort test cases, which the branch had lost by being cut before #408/#414. * feat(admin): favicon upload, served from the content volume (#422) Adds a bundled default favicon, an upload widget in admin Settings > General, and a route that serves the icon from the writable content/ volume with a fallback to the bundled default. Raster uploads (PNG/ICO/JPEG) are wrapped in an SVG container; the response carries its own CSP so an uploaded SVG cannot execute script on the origin. The GET route revalidates with an ETag instead of caching immutably, so a newly uploaded icon shows up immediately. Uploads are written via temp file + rename, and a Reset button restores the bundled default. * ci: flag unformatted files in a PR, without blocking it (#424) Prettier is configured as an error rule in eslint.config.mjs but has never run in CI, so part of the tree predates it. A final CI step now diffs against the PR base, runs prettier --list-different over the changed files, and emits a warning annotation per offender plus a job summary. Advisory by design: it never fails the job. Blocking would turn a PR red for merely touching a file that was already unformatted, and normalising the tree in one commit would wreck git blame and conflict with the PRs in flight. Requires fetch-depth: 0, since diffing against the base needs its history. * feat(install): first-run wizard gated by a one-time setup token (#419) Adds /install, a four-step first-run wizard: connect to Immich, optionally pick albums, name the site, finish. It verifies the credentials against the Immich server before writing anything, then writes gallery.yaml, settings.yaml and a content/install.json carrying the Immich credentials and a generated site secret. install.json exists because a running process cannot pick up new env vars — the wizard has to write configuration that takes effect without a restart. getInstallCredentials() merges it under the real environment, so env vars always win and rotation stays a matter of setting one. Both the page and the API routes are gated by a one-time setup token printed to the server log, so a deployment that is reachable before gallery.yaml exists cannot be configured by whoever finds it first. The token is stored in content/.setup-token (0600) rather than a module variable: Next.js bundles the page and each route handler separately, so a module-level token left the page and the API disagreeing inside one process and the wizard stuck on step 1. It is removed once the install completes. The admin password is stored as an scrypt hash using the scheme lib/auth.ts already applies to album passwords; a plaintext ADMIN_PASSWORD env var keeps working. * docs: document the setup wizard, fix the read-only content mount (#425) Quick Start now leads with the /install wizard, with the hand-written YAML route kept alongside it, and a First-Run Setup section covers the setup token, the files the wizard writes, and env-var precedence. Two corrections: both Docker examples mounted content/ as :ro, which silently breaks the wizard, the admin panel and the backup rotation alike — docs/admin-panel.md already said so and the README contradicted it. And nothing documented that content/install.json holds the Immich API key, so a backup of content/ is a backup of credentials. Also adds a Contributors section crediting the people whose work is in the project. * feat(admin): floating save bar pinned to the bottom of the viewport (#426) The save bar was the first, static element inside .admin-main. Since the document itself scrolls, it left the viewport as soon as you scrolled down — editing a subpage section or a settings block far below gave no visible dirty hint and no reachable save button. Replace it with a bottom-pinned floating bar shared by both editors. It only mounts while there is something to act on (unsaved changes, an in-flight save, or a result message), so it never covers content while idle. The success message clears after 5s, which hides the bar again. - new SaveBar component, replacing the duplicated markup in PageBuilder and SettingsEditor - adopt the previously unused .floating-save-bar CSS: slide-in keyframes (carrying translateX(-50%)), dirty border, wrap/gap, mobile variant and a prefers-reduced-motion opt-out; z-index 900 keeps it below modals - .admin-main gains bottom padding so the bar never covers page content - drop the now-unreachable idle hints: the ⌘S hint becomes a button title, the Live Sync note becomes a static line above the settings layout - header "Site" link now bypasses the cache (/?fresh=1), so the preview stays reachable when the bar is hidden Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(admin): themed listbox for the album sort control (#427) The per-album "Photo order" control was a native <select>. Because an <option> cannot contain markup, its choices could not use the admin panel's currentColor SVG set — the reason #415 had to fall back to plain text after dropping the emoji labels. Adds a Listbox component implementing the ARIA combobox/listbox pattern, so options can render a glyph beside their label: - DOM focus stays on the trigger button; the active option is announced through aria-activedescendant, keeping focus management to one element - Keyboard: arrows (clamped at the ends, like a native select), Home/End, Enter/Space to commit, Escape to cancel, Tab commits and moves on, and prefix type-ahead with a repeat-key cycle - Outside dismissal on pointerdown, so a press starting outside closes the popup before the click retargets The sort options now carry an icon each: calendar, arrow-down, arrow-up, an A→Z marker, and the drag glyph for manual — matching the badge the album card already shows. SORT_LABELS stays plain text because the badge feeds it to a title attribute. Closes #417 Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(git): ignore generated design handoff folders * fix(admin): stop the album sort dropdown clipping, and simplify the panel (#428) * fix(admin): render listbox popup in a portal so it escapes modal clipping The sort control's popup was position:absolute inside three clipping ancestors (.album-drawer overflow:hidden > .album-drawer-body overflow-y:auto > .modal-right-column overflow-y:auto), so it was cut off at the bottom of the Edit Album Details modal. z-index could not help: clipping happens before stacking. It also always hung below the trigger, with no flip. Portal the popup to document.body and position it from the trigger's viewport rect, flipping above when there is more room there and capping max-height to the space available so it scrolls internally rather than overflowing. It is dismissed on scroll and resize, since the anchor is only measured on open. The outside-pointerdown handler now also treats the popup as inside; without that the portalled list counts as outside, and a click on an option would close it before the selection commits. * refactor(admin): single-column album details panel The left column spent 1.2fr on a cover thumbnail and three stat rows, two of which (Status, Custom Hero) only restated the form fields opposite them, while the form itself was squeezed into 1.8fr behind a second nested scroller. Stack the drawer in one column instead: cover as a banner, then the form at full width, with the UUID moved into the footer. The body is now the only scroll container, which also removes one of the ancestors that was clipping the sort popup. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> * fix(admin): give the portalled listbox its theme back, lock the page behind modals (#429) Two defects in the album editor. The sort listbox popup painted transparent. Every --admin-* variable is scoped to .admin-layout, and since the popup moved into document.body it sits outside that subtree, so background/border/text all resolved to nothing. It now carries its own copy of the palette in both colour schemes, plus the font it no longer inherits. Scrolling inside a modal also moved the page behind it. No admin modal ever locked body scroll: the overlay covers the page but does not absorb wheel events, so a scroll starting on the backdrop — or continuing past the end of the modal's own scroller — reaches the document. overscroll-behavior cannot cover that case on its own, because it only applies to scroll containers and the backdrop is not one. useScrollLock freezes body while a modal is open and compensates for the width the scrollbar gives up, so nothing shifts underneath. Each lock restores the inline value it found, which makes nesting work without a counter — a picker opened from the drawer restores the drawer's hidden state instead of clearing it. Applied to both drawers and all four picker modals, which share the defect. overscroll-behavior: contain on the scrollers stops the chaining they can handle themselves. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com> * fix(security): allow unsafe-eval in CSP script-src during dev mode * feat(journal): add Journal Studio with split-screen editor, live preview and dedicated routes * fix(build): separate client parser from server journal-service and fix build type errors * fix(journal): Fotos rendern, Layout und Lightbox-Steuerung korrigieren Fünf unabhängige Fehler in der öffentlichen Journal- und Essay-Ansicht: * Foto-Blöcke wurden nie angezeigt. EssayView löst ein Foto über PhotoItem.id auf, und das sind verschlüsselte Tokens — die Blöcke aus dem Markdown tragen aber rohe Asset-UUIDs. Jede Zuordnung lief ins Leere, und nicht auflösbare Blöcke werden still verworfen. Die IDs werden jetzt serverseitig übersetzt; damit verschwinden nebenbei die rohen UUIDs aus dem Client-Payload, die dort laut Projektregel nie auftauchen dürfen. Nicht auflösbare Referenzen werden geloggt. * Überschriften standen weiter links als der Fließtext. Jeder Block hatte einzeln `max-width: 68ch`, und `ch` ist relativ zur Schrift des Elements — die Serif-Überschrift ergab eine breitere Spalte. Ersetzt durch eine gemeinsame, font-unabhängige `--essay-measure`. * Fullbleed-Fotos bluteten nur nach links aus: `.essay-figure` ist `width: 100%`, wodurch die Box überbestimmt ist und der negative rechte Margin verworfen wird. * Foto-Paare stellten beide Bilder gleich breit dar, wodurch ein Hochformat neben einem Querformat doppelt so hoch wurde. Jetzt eine Justified-Reihe: Breite proportional zum Seitenverhältnis, dadurch exakt gleiche Höhen ohne Beschnitt. * Die Lightbox hatte im Journal keine Tastatursteuerung und keine Scroll-Sperre — beides lag in PhotoGrid, also nur im Album-Raster. Verlagert in die Lightbox selbst, der doppelte Handler in PhotoGrid entfernt (sonst wäre pro Pfeildruck zwei Bilder weitergesprungen). Zusätzlich sind Proofing-Herzen und das EXIF-Panel im redaktionellen Modus abschaltbar und im Journal aus: Client-Proofing ist ein Übergabe-Workflow für Alben, keine Funktion einer Reportage. Auf der Übersicht wurde der Untertitel doppelt gerendert, weil extractExcerpt() auf ihn zurückfällt. * feat(admin): eigene URLs für alle Bereiche und überarbeiteter Journal Studio Das Panel war eine einzige Client-Komponente, die ihre Tabs über useState umschaltet: keine Route pro Bereich, kein Deep-Link, kein Zurück-Button, und nach jedem Reload landete man wieder auf "Pages". Auch der Journal-Editor hatte keine eigene URL. Jetzt sieben echte Routen (/admin, /admin/pages, /admin/journal, /admin/journal/<slug>, /admin/settings, /admin/settings/<section>, /admin/analytics). Die Shell mit Auth-Prüfung und Kopfzeile sitzt im Layout und umschließt children — so bleibt die Session-Prüfung über Routenwechsel montiert, statt bei jedem Tab-Wechsel neu zu laufen und den Spinner aufblitzen zu lassen. Unbekannte Settings-Sections fallen auf General zurück. Im selben Zug der Journal Studio, der die Routing-Änderung ohnehin berührt: * Alle Eingabefelder nutzten die Klasse `admin-input`, die in keinem CSS definiert war — sie fielen auf Browser-Defaults zurück. Jetzt gestylt, gescoped, damit der generische Name nicht ins übrige Panel leckt. * Der Split View ist per Divider verschiebbar (Maus, Tastatur, Doppelklick zum Zurücksetzen), Breite in localStorage. * Das Studio bricht aus der 1120px-Spalte aus, die Preview hat Platz. * Die Preview zeigte für jedes Foto fest 3:2 und log damit über das Layout der veröffentlichten Seite; die echten Verhältnisse werden jetzt an den Thumbnails gemessen. * Blöcke mit alten positionsbasierten Foto-Referenzen werden markiert — die lassen sich auf einer eigenständigen Journal-Seite nicht auflösen und verschwanden bisher stillschweigend. * Blocktyp-Chips als gemeinsame Komponente, monochrom und per Icon unterschieden statt in einer eigenen Blau/Lila/Orange-Palette, die sonst nirgends im Panel vorkommt. * Emojis raus, SVG-Icons rein. * fix(admin): Designsystem-Lücken im Panel schließen Eine systematische Suche nach Klassen, die im TSX benutzt, aber in keinem CSS definiert sind, hat vier Stellen mit demselben Muster gefunden: * `admin-btn-secondary` und `admin-btn-danger` existierten nicht. Sämtliche Löschen-Buttons sahen aus wie normale Buttons — keine Warnwirkung. Als `.admin-btn.admin-btn-danger` geschrieben, weil die Varianten mit den Größenklassen kombiniert werden, die weiter unten ihren eigenen Hintergrund setzen. * `page-progress-fill` fehlte: die Balken im Analytics-Panel waren leere Rinnen, der Wert unsichtbar. Ebenso `analytics-empty` und `admin-loading-container`. * `subpage-drawer-section`, `subpage-drawer-title-group` und `input-with-icon` im PageBuilder waren wirkungslos und teils mit Inline-Styles notdürftig kompensiert. * `grid-card-preview` fehlte, wodurch alle Layout-Vorschauen auf Höhe null kollabierten. Nur "Showcase" war sichtbar — und das aus Versehen, weil sein Tile `hero-tile` hieß und damit die `aspect-ratio` einer fremden PageBuilder-Klasse erbte. Umbenannt. Dazu die Theme-Vorschauen, die praktisch identisch aussahen: alle sieben zeigten dieselben drei quadratischen Kacheln, einziger Unterschied war die Hintergrundfarbe. Sie spiegeln jetzt die echten Preset-Daten aus lib/config/theme.ts — Schriftcharakter, Eckradius, Rasterdichte, Passepartout bzw. Schatten. Die Kopfzeile richtet sich an einer gemeinsamen Steuerhöhe aus. Der "Site"-Link war höher als die Buttons daneben: `.admin-btn` hatte keine explizite line-height, und <button> bekommt box-sizing: border-box vom Browser, <a> nicht. Die Statusanzeige setzte weder Schriftfamilie noch -größe und fiel auf den Browser-Default zurück — sie war nie Teil des Designsystems. Jetzt gleiche Höhe und Typografie, Pillenform als Zustandsanzeige, Trenner zur Aktionsgruppe. Das dauerhafte Pulsieren des grünen Punkts entfällt; Animation bleibt den Zuständen vorbehalten, die Aufmerksamkeit brauchen. Restliche Emojis durch SVG-Icons ersetzt. * feat(admin): add scroll-to-top toggle and SVG arrow The back-to-top button was always on and drew its arrow with the ↑ text character. Add a `scrollToTop` setting (General section in the admin panel, defaults to on so existing sites are unaffected) and replace the glyph with a stroked SVG that inherits currentColor across all presets. Scroll handling is now rAF-throttled, and prefers-reduced-motion turns off both the hover lift and the smooth scroll. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * security(journal): escape author HTML instead of filtering it CodeQL flags 26 high-severity alerts on the release PR; the bulk of them point at sanitizeHtml(), a denylist of three regexes whose output goes into dangerouslySetInnerHTML. I reproduced the bypasses before changing anything — all four pass the old filter: <img src=x onerror=alert(1)> unquoted handler, regex wants quotes <img src=x onerror='alert(1)'> single quotes, same reason <svg onload=alert(1)> not a <script> tag javasjavascript:cript:alert(1) one-pass replace, the rest recombines Plus an attribute breakout in the link renderer, which interpolated the URL into href="${url}" unescaped: [x](" onmouseover=alert(1) x=") -> <a href="" onmouseover=alert(1" ...> Replaced with escaping. Every `&<>"'` in author text becomes an entity before any markdown rule runs, so the only tags in the output are the ones renderInlineMarkdown builds itself and a URL cannot leave its attribute. Link schemes are now an allowlist (http, https, mailto, tel, relative, anchor); anything else renders as plain text. The serializer needed decodeHtmlEntities to match: without it a save would write `&lt;` into the Markdown file and the next parse would escape the `&` again, corrupting the text further on every round trip. A test covers parse -> serialize -> parse stability. Two existing tests asserted the old behaviour and were rewritten rather than deleted: one expected the script tag to be *removed* from the output, the other expected the substring "onerror" to be absent. Both now assert the property that matters — that no tag can form — because `onerror` surviving as inert text is fine. Exploitation required admin access either way: journal and essay text comes from the studio or from content/*.md. This removes the weakness, it does not close an open door. * fix(journal): contain file paths, fix frontmatter escaping, defuse two regexes Follow-up to the CodeQL findings on release PR #432. I went through all 23 alerts individually; this addresses the ones that are worth addressing and documents the ones that are not. Path containment (12 alerts, all false positives). Every path built from a slug goes through isValidSlug(), a strict `/^[a-zA-Z0-9_-]+$/` allowlist — verified against `../../etc/passwd`, `foo/../../bar`, `a/b`, `..` and friends, all rejected. CodeQL cannot see it because the check lives in another module. Added a containedPath() helper that resolves the path and refuses anything landing outside the content directory: a second lock on a door that was already locked, and a barrier the analysis can follow. Also removed the dead `slug.endsWith('.md')` branches — isValidSlug rejects dots, so they could never be taken. Frontmatter escaping (1 alert, a real bug). The serializer escaped `"` but not `\`, and the parser never unescaped anything. A title containing either character gained a backslash on every save/load cycle: Path C:\Users "quoted" -> Path C:\\Users \"quoted\" -> ... Escaping now covers the backslash first and the parser undoes both. A round trip test covers quotes, backslashes, colons and apostrophes. Two of three ReDoS regexes (2 alerts). The heading pattern had `\s+` next to `(.+)`, which overlap, so the engine tried every split of the whitespace run before failing; it is `[ \t]+` and `(\S.*)` now. The quote author pattern wrapped a lazy group around an optional group — the quadratic case — and is an index split on the first separator now. The third regex, the bold/italic pass, is deliberately left alone. Rewriting it with a negated class removes the backtracking but breaks nesting: `**bold *and italic* here**` renders as `*<em>bold </em>and italic<em> here</em>*`. The input is Markdown from an authenticated admin, never a visitor, so the worst case is an author slowing down their own page. The comment in the code says so. Not addressed: 5 js/insufficient-password-hash alerts. They ask for a slow KDF where the code uses SHA-256/HMAC — correct in general, but the admin password comes from an environment variable and is never stored, so a stronger KDF protects nothing that is not already in plaintext in the environment. 399 unit tests pass (18 new), build and tsc clean. * fix(journal): split the quote author by scanning, not by pattern Cleaning up after myself. #439 replaced the quote author regex `/^(.*?)(?:\s+--\s+(.+))?$/` — a lazy group around an optional one, the quadratic case — with `/\s+--\s+/`, and CodeQL promptly flagged the replacement for the same reason. One reported pattern traded for another. splitQuoteAuthor() scans for the first `--` that has whitespace on both sides. Linear, and it needs no reasoning about the regex engine at all. Behaviour is identical to the original regex, checked case by case against it: separator, no separator, several separators, tabs, wide gaps, `a--b` without spaces, leading and trailing separators, empty string. All nine are covered by tests, plus one asserting it stays fast on a 50k whitespace run. * security(admin): derive the session signing key with scrypt getSigningKey() ran the admin password through a single SHA-256 digest. It is key derivation rather than password storage, so it was never a stored-hash problem — but if the derived key ever leaked, one fast hash makes recovering the password by brute force cheap. CodeQL flags it as js/insufficient-password-hash and, for this particular alert, has a point. scrypt now. Two details that matter: The salt has to be stable. A random salt would produce a different key on every call and invalidate every session; it is derived from AUTH_SECRET, which is deployment-specific. Verified across separate processes: same inputs produce a verifying token, so a restart or redeploy does not log everyone out. The result is cached for the process lifetime. scrypt is deliberately slow and getSigningKey() runs on every admin request — deriving per call would add ~24ms to each one. The cache key is a digest of secret plus password, so a rotation misses the cache and derives again, and no extra plaintext copy of the password is kept around. Measured: first derivation 24ms, subsequent calls 0.12ms. Password change and secret change both invalidate an existing token, checked in separate processes. Note the one-time effect: existing admin sessions are invalidated by the change in derivation, so everyone logs in once more. * security(admin): key the signing-key cache on its inputs, not a digest #441 removed the SHA-256 digest of the admin password from the key derivation and introduced a new one three lines above it, as the cache key. Same rule, same file: CodeQL reported it immediately. The comment justifying it was wrong too. It claimed no second plaintext copy of the password was retained, while building the digest input allocates exactly that in order to hash it. The cache now holds the two input strings and compares them directly. They are the same objects the env and install caches already hold, so nothing extra is retained, and no fast hash of the password exists in memory for the life of the process. Re-verified after the change, in separate processes: a token from one process verifies in another with the same inputs, a changed password or secret rejects it, first derivation 24ms, cached calls 0.001ms. That leaves scrypt as the only place the password is hashed here. The two HMACs further down operate on the derived key and on token data, not on the password; the constant-time comparison in verifyAdminPassword is the previously dismissed one. --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
2026-08-14 16:55:07 +02:00
const [faviconUploading, setFaviconUploading] = useState(false);
const [faviconMessage, setFaviconMessage] = useState('');
// About content state (independent of main settings save)
const [aboutMeta, setAboutMeta] = useState<{
portrait?: string;
name?: string;
location?: string;
gear?: string[];
}>({});
const [aboutBody, setAboutBody] = useState('');
const [aboutLoading, setAboutLoading] = useState(false);
const [aboutSaving, setAboutSaving] = useState(false);
const [aboutDirty, setAboutDirty] = useState(false);
const [aboutMessage, setAboutMessage] = useState('');
const [aboutGearText, setAboutGearText] = useState('');
useEffect(() => {
loadSettings();
security: add Trivy container scan to Docker publish workflow (#399) * feat(admin): add backup manager UI with 1-click restore * feat(admin): collapse older backup entries by default * fix(theme): isolate admin layout, instant DOM theme updates, and add Light/Dark mode toggle * feat(admin): replace text controls for Photo Frame and Hero Style with visual preview cards * fix(admin): define missing CSS rules for button system (.btn, .preset-btn) * feat(admin): redesign theme settings with segmented mode toggle, accent color swatches, and custom iOS-style toggle cards * feat(admin): upgrade all settings tabs with visual grid previews, Google SEO snippet preview, and toggle cards * feat(admin): overhaul Pages Builder UX with slide-over drawer, card hover badges, real-time search, and floating save bar * fix(admin): remove leftover dangling syntax snippet in PageBuilder.tsx * fix(admin): add position: relative to subpage-tile so hover overlay is contained inside the tile * style(admin): replace all emojis with clean Leica-style vector SVG icons * fix(types): extend IconProps with SVGProps to allow style prop on Leica SVG icons * feat(admin): add subpage live-preview, privacy analytics, and asset protection settings * fix(typecheck): fix AlbumEntry property access in subpage drawer preview mode * fix(types): fix ImmichAlbumInfo property names thumbnailAssetId and albumName in PageBuilder.tsx * fix(types): add protection and watermark optional properties to AppConfig interface * feat(settings): add toggle for disabling analytics tracking (defaults to enabled) * feat(ux): show status banner when analytics tracking is disabled + add live sync indicator * feat(watermark): render customizable watermark overlay on Lightbox images + rename section to Portfolio Features & Modules * fix(types): import type LightboxWatermark in PhotoGrid.tsx * fix(types): destructure watermark prop in PhotoGrid function signature * feat(seo): add configurable subpage title template and metadata descriptions * feat(seo): add generateMetadata to about page for title template support * feat(proofing): add client proofing, favorites selection, compact URL bitmasking, and export modal * feat(essay): add Photo Essay storytelling mode with RSC markdown parser and fullbleed/pair layouts * feat(subpages): add page enabled toggle to deactivate subpages without deleting them * feat(admin): add visual essay block builder for photo essay storytelling pages * security: add Trivy container scan to Docker publish workflow Scans the built image for CRITICAL/HIGH CVEs on every release and uploads results to the GitHub Security tab. Non-blocking for now (exit-code 0) so releases aren't gated on findings. Also documents the scan and existing Dependabot coverage in the README. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-08-07 11:08:04 +02:00
if (typeof window !== 'undefined') {
release: v0.11.0 (#459) Ships `dev` as **v0.11.0**. `main` contains nothing that `dev` does not, so this is a clean sync. ## Headline changes since v0.10.0 - **Journal & Journal Studio** — photo essays at `/journal`, split-screen block editor with live preview, drafts, per-entry passwords, cover images - **First-run setup wizard at `/install`** — configure a fresh deployment from the browser; credentials are verified against Immich before anything is written, and the wizard is gated by a one-time token - **About page editor and toggle** in the admin panel - **Per-album photo order** independent of Immich, with a drag & drop editor - **Custom favicon upload** - **Experimental portfolio features** — justified grid, `cover` hero, unlisted subpages, per-album grid overrides, cover focal points, external nav links - **Security** — asset tokens length-capped before decoding (#423), journal author markdown escaped rather than filtered, journal file paths contained, admin session key derived with scrypt (#432), Next.js 16.3.0 for CVE-2025-13465 - **Fixed** — client proofing honours its own configuration again (#454); journal photo rendering (#432) Full detail in [CHANGELOG.md](CHANGELOG.md#0110--2026-08-15). ## Verified `npx tsc --noEmit` clean · `npx vitest run` 435 tests pass · `npm run build` succeeds · lint 0 errors · `prettier --check` clean · local `docker build` of the release tree. ## After merge Tag `v0.11.0` on `main` and publish the release — that triggers `docker-publish.yml`, which pushes the image and moves `latest`. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
2026-08-15 09:09:18 +02:00
const mode =
(document.documentElement.getAttribute('data-theme') as 'dark' | 'light') || 'dark';
security: add Trivy container scan to Docker publish workflow (#399) * feat(admin): add backup manager UI with 1-click restore * feat(admin): collapse older backup entries by default * fix(theme): isolate admin layout, instant DOM theme updates, and add Light/Dark mode toggle * feat(admin): replace text controls for Photo Frame and Hero Style with visual preview cards * fix(admin): define missing CSS rules for button system (.btn, .preset-btn) * feat(admin): redesign theme settings with segmented mode toggle, accent color swatches, and custom iOS-style toggle cards * feat(admin): upgrade all settings tabs with visual grid previews, Google SEO snippet preview, and toggle cards * feat(admin): overhaul Pages Builder UX with slide-over drawer, card hover badges, real-time search, and floating save bar * fix(admin): remove leftover dangling syntax snippet in PageBuilder.tsx * fix(admin): add position: relative to subpage-tile so hover overlay is contained inside the tile * style(admin): replace all emojis with clean Leica-style vector SVG icons * fix(types): extend IconProps with SVGProps to allow style prop on Leica SVG icons * feat(admin): add subpage live-preview, privacy analytics, and asset protection settings * fix(typecheck): fix AlbumEntry property access in subpage drawer preview mode * fix(types): fix ImmichAlbumInfo property names thumbnailAssetId and albumName in PageBuilder.tsx * fix(types): add protection and watermark optional properties to AppConfig interface * feat(settings): add toggle for disabling analytics tracking (defaults to enabled) * feat(ux): show status banner when analytics tracking is disabled + add live sync indicator * feat(watermark): render customizable watermark overlay on Lightbox images + rename section to Portfolio Features & Modules * fix(types): import type LightboxWatermark in PhotoGrid.tsx * fix(types): destructure watermark prop in PhotoGrid function signature * feat(seo): add configurable subpage title template and metadata descriptions * feat(seo): add generateMetadata to about page for title template support * feat(proofing): add client proofing, favorites selection, compact URL bitmasking, and export modal * feat(essay): add Photo Essay storytelling mode with RSC markdown parser and fullbleed/pair layouts * feat(subpages): add page enabled toggle to deactivate subpages without deleting them * feat(admin): add visual essay block builder for photo essay storytelling pages * security: add Trivy container scan to Docker publish workflow Scans the built image for CRITICAL/HIGH CVEs on every release and uploads results to the GitHub Security tab. Non-blocking for now (exit-code 0) so releases aren't gated on findings. Also documents the scan and existing Dependabot coverage in the README. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-08-07 11:08:04 +02:00
setCurrentMode(mode);
}
}, []);
security: add Trivy container scan to Docker publish workflow (#399) * feat(admin): add backup manager UI with 1-click restore * feat(admin): collapse older backup entries by default * fix(theme): isolate admin layout, instant DOM theme updates, and add Light/Dark mode toggle * feat(admin): replace text controls for Photo Frame and Hero Style with visual preview cards * fix(admin): define missing CSS rules for button system (.btn, .preset-btn) * feat(admin): redesign theme settings with segmented mode toggle, accent color swatches, and custom iOS-style toggle cards * feat(admin): upgrade all settings tabs with visual grid previews, Google SEO snippet preview, and toggle cards * feat(admin): overhaul Pages Builder UX with slide-over drawer, card hover badges, real-time search, and floating save bar * fix(admin): remove leftover dangling syntax snippet in PageBuilder.tsx * fix(admin): add position: relative to subpage-tile so hover overlay is contained inside the tile * style(admin): replace all emojis with clean Leica-style vector SVG icons * fix(types): extend IconProps with SVGProps to allow style prop on Leica SVG icons * feat(admin): add subpage live-preview, privacy analytics, and asset protection settings * fix(typecheck): fix AlbumEntry property access in subpage drawer preview mode * fix(types): fix ImmichAlbumInfo property names thumbnailAssetId and albumName in PageBuilder.tsx * fix(types): add protection and watermark optional properties to AppConfig interface * feat(settings): add toggle for disabling analytics tracking (defaults to enabled) * feat(ux): show status banner when analytics tracking is disabled + add live sync indicator * feat(watermark): render customizable watermark overlay on Lightbox images + rename section to Portfolio Features & Modules * fix(types): import type LightboxWatermark in PhotoGrid.tsx * fix(types): destructure watermark prop in PhotoGrid function signature * feat(seo): add configurable subpage title template and metadata descriptions * feat(seo): add generateMetadata to about page for title template support * feat(proofing): add client proofing, favorites selection, compact URL bitmasking, and export modal * feat(essay): add Photo Essay storytelling mode with RSC markdown parser and fullbleed/pair layouts * feat(subpages): add page enabled toggle to deactivate subpages without deleting them * feat(admin): add visual essay block builder for photo essay storytelling pages * security: add Trivy container scan to Docker publish workflow Scans the built image for CRITICAL/HIGH CVEs on every release and uploads results to the GitHub Security tab. Non-blocking for now (exit-code 0) so releases aren't gated on findings. Also documents the scan and existing Dependabot coverage in the README. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-08-07 11:08:04 +02:00
// Sync picked preset & accent color to document element immediately for live feedback
useEffect(() => {
security: add Trivy container scan to Docker publish workflow (#399) * feat(admin): add backup manager UI with 1-click restore * feat(admin): collapse older backup entries by default * fix(theme): isolate admin layout, instant DOM theme updates, and add Light/Dark mode toggle * feat(admin): replace text controls for Photo Frame and Hero Style with visual preview cards * fix(admin): define missing CSS rules for button system (.btn, .preset-btn) * feat(admin): redesign theme settings with segmented mode toggle, accent color swatches, and custom iOS-style toggle cards * feat(admin): upgrade all settings tabs with visual grid previews, Google SEO snippet preview, and toggle cards * feat(admin): overhaul Pages Builder UX with slide-over drawer, card hover badges, real-time search, and floating save bar * fix(admin): remove leftover dangling syntax snippet in PageBuilder.tsx * fix(admin): add position: relative to subpage-tile so hover overlay is contained inside the tile * style(admin): replace all emojis with clean Leica-style vector SVG icons * fix(types): extend IconProps with SVGProps to allow style prop on Leica SVG icons * feat(admin): add subpage live-preview, privacy analytics, and asset protection settings * fix(typecheck): fix AlbumEntry property access in subpage drawer preview mode * fix(types): fix ImmichAlbumInfo property names thumbnailAssetId and albumName in PageBuilder.tsx * fix(types): add protection and watermark optional properties to AppConfig interface * feat(settings): add toggle for disabling analytics tracking (defaults to enabled) * feat(ux): show status banner when analytics tracking is disabled + add live sync indicator * feat(watermark): render customizable watermark overlay on Lightbox images + rename section to Portfolio Features & Modules * fix(types): import type LightboxWatermark in PhotoGrid.tsx * fix(types): destructure watermark prop in PhotoGrid function signature * feat(seo): add configurable subpage title template and metadata descriptions * feat(seo): add generateMetadata to about page for title template support * feat(proofing): add client proofing, favorites selection, compact URL bitmasking, and export modal * feat(essay): add Photo Essay storytelling mode with RSC markdown parser and fullbleed/pair layouts * feat(subpages): add page enabled toggle to deactivate subpages without deleting them * feat(admin): add visual essay block builder for photo essay storytelling pages * security: add Trivy container scan to Docker publish workflow Scans the built image for CRITICAL/HIGH CVEs on every release and uploads results to the GitHub Security tab. Non-blocking for now (exit-code 0) so releases aren't gated on findings. Also documents the scan and existing Dependabot coverage in the README. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-08-07 11:08:04 +02:00
if (typeof document !== 'undefined') {
if (settings.theme?.preset) {
document.documentElement.setAttribute('data-preset', settings.theme.preset);
}
if (settings.theme?.accent) {
document.documentElement.style.setProperty('--accent', settings.theme.accent);
document.documentElement.style.setProperty('--admin-accent', settings.theme.accent);
}
}
}, [settings.theme?.preset, settings.theme?.accent]);
// The About panel has its own route, so load its content when that section opens
useEffect(() => {
if (activeSection === 'about') loadAboutContent();
// eslint-disable-next-line react-hooks/exhaustive-deps
}, [activeSection]);
security: add Trivy container scan to Docker publish workflow (#399) * feat(admin): add backup manager UI with 1-click restore * feat(admin): collapse older backup entries by default * fix(theme): isolate admin layout, instant DOM theme updates, and add Light/Dark mode toggle * feat(admin): replace text controls for Photo Frame and Hero Style with visual preview cards * fix(admin): define missing CSS rules for button system (.btn, .preset-btn) * feat(admin): redesign theme settings with segmented mode toggle, accent color swatches, and custom iOS-style toggle cards * feat(admin): upgrade all settings tabs with visual grid previews, Google SEO snippet preview, and toggle cards * feat(admin): overhaul Pages Builder UX with slide-over drawer, card hover badges, real-time search, and floating save bar * fix(admin): remove leftover dangling syntax snippet in PageBuilder.tsx * fix(admin): add position: relative to subpage-tile so hover overlay is contained inside the tile * style(admin): replace all emojis with clean Leica-style vector SVG icons * fix(types): extend IconProps with SVGProps to allow style prop on Leica SVG icons * feat(admin): add subpage live-preview, privacy analytics, and asset protection settings * fix(typecheck): fix AlbumEntry property access in subpage drawer preview mode * fix(types): fix ImmichAlbumInfo property names thumbnailAssetId and albumName in PageBuilder.tsx * fix(types): add protection and watermark optional properties to AppConfig interface * feat(settings): add toggle for disabling analytics tracking (defaults to enabled) * feat(ux): show status banner when analytics tracking is disabled + add live sync indicator * feat(watermark): render customizable watermark overlay on Lightbox images + rename section to Portfolio Features & Modules * fix(types): import type LightboxWatermark in PhotoGrid.tsx * fix(types): destructure watermark prop in PhotoGrid function signature * feat(seo): add configurable subpage title template and metadata descriptions * feat(seo): add generateMetadata to about page for title template support * feat(proofing): add client proofing, favorites selection, compact URL bitmasking, and export modal * feat(essay): add Photo Essay storytelling mode with RSC markdown parser and fullbleed/pair layouts * feat(subpages): add page enabled toggle to deactivate subpages without deleting them * feat(admin): add visual essay block builder for photo essay storytelling pages * security: add Trivy container scan to Docker publish workflow Scans the built image for CRITICAL/HIGH CVEs on every release and uploads results to the GitHub Security tab. Non-blocking for now (exit-code 0) so releases aren't gated on findings. Also documents the scan and existing Dependabot coverage in the README. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-08-07 11:08:04 +02:00
const toggleMode = (mode: 'dark' | 'light') => {
setCurrentMode(mode);
if (typeof document !== 'undefined') {
document.documentElement.setAttribute('data-theme', mode);
localStorage.setItem('theme', mode);
}
security: add Trivy container scan to Docker publish workflow (#399) * feat(admin): add backup manager UI with 1-click restore * feat(admin): collapse older backup entries by default * fix(theme): isolate admin layout, instant DOM theme updates, and add Light/Dark mode toggle * feat(admin): replace text controls for Photo Frame and Hero Style with visual preview cards * fix(admin): define missing CSS rules for button system (.btn, .preset-btn) * feat(admin): redesign theme settings with segmented mode toggle, accent color swatches, and custom iOS-style toggle cards * feat(admin): upgrade all settings tabs with visual grid previews, Google SEO snippet preview, and toggle cards * feat(admin): overhaul Pages Builder UX with slide-over drawer, card hover badges, real-time search, and floating save bar * fix(admin): remove leftover dangling syntax snippet in PageBuilder.tsx * fix(admin): add position: relative to subpage-tile so hover overlay is contained inside the tile * style(admin): replace all emojis with clean Leica-style vector SVG icons * fix(types): extend IconProps with SVGProps to allow style prop on Leica SVG icons * feat(admin): add subpage live-preview, privacy analytics, and asset protection settings * fix(typecheck): fix AlbumEntry property access in subpage drawer preview mode * fix(types): fix ImmichAlbumInfo property names thumbnailAssetId and albumName in PageBuilder.tsx * fix(types): add protection and watermark optional properties to AppConfig interface * feat(settings): add toggle for disabling analytics tracking (defaults to enabled) * feat(ux): show status banner when analytics tracking is disabled + add live sync indicator * feat(watermark): render customizable watermark overlay on Lightbox images + rename section to Portfolio Features & Modules * fix(types): import type LightboxWatermark in PhotoGrid.tsx * fix(types): destructure watermark prop in PhotoGrid function signature * feat(seo): add configurable subpage title template and metadata descriptions * feat(seo): add generateMetadata to about page for title template support * feat(proofing): add client proofing, favorites selection, compact URL bitmasking, and export modal * feat(essay): add Photo Essay storytelling mode with RSC markdown parser and fullbleed/pair layouts * feat(subpages): add page enabled toggle to deactivate subpages without deleting them * feat(admin): add visual essay block builder for photo essay storytelling pages * security: add Trivy container scan to Docker publish workflow Scans the built image for CRITICAL/HIGH CVEs on every release and uploads results to the GitHub Security tab. Non-blocking for now (exit-code 0) so releases aren't gated on findings. Also documents the scan and existing Dependabot coverage in the README. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-08-07 11:08:04 +02:00
};
// ── Keyboard shortcut: ⌘+S / Ctrl+S ─────────────────────────
const handleSaveRef = useCallback(() => {
if (activeSection === 'about') {
if (aboutDirty && !aboutSaving) saveAboutContent();
return;
}
if (dirty && !saving) {
handleSave();
}
// eslint-disable-next-line react-hooks/exhaustive-deps
}, [
dirty,
saving,
settings,
activeSection,
aboutDirty,
aboutSaving,
aboutMeta,
aboutBody,
aboutGearText,
]);
useEffect(() => {
function handleKeyDown(e: KeyboardEvent) {
if ((e.metaKey || e.ctrlKey) && e.key === 's') {
e.preventDefault();
handleSaveRef();
}
}
window.addEventListener('keydown', handleKeyDown);
return () => window.removeEventListener('keydown', handleKeyDown);
}, [handleSaveRef]);
// ── Unsaved changes guard ────────────────────────────────────
useEffect(() => {
function handleBeforeUnload(e: BeforeUnloadEvent) {
if (dirty) {
e.preventDefault();
e.returnValue = '';
}
}
window.addEventListener('beforeunload', handleBeforeUnload);
return () => window.removeEventListener('beforeunload', handleBeforeUnload);
}, [dirty]);
async function loadSettings() {
setLoading(true);
try {
const res = await fetch('/api/admin/settings');
if (res.ok) {
const { settings: data } = await res.json();
setSettings(data || {});
}
} catch (err) {
console.error('Failed to load settings:', err);
} finally {
setLoading(false);
}
}
/** Write several paths in one state update — used by the metadata master switch. */
function updateMany(entries: Record<string, unknown>) {
setSettings((s) => {
const copy = JSON.parse(JSON.stringify(s));
for (const [path, value] of Object.entries(entries)) {
const parts = path.split('.');
let obj = copy;
for (let i = 0; i < parts.length - 1; i++) {
if (!obj[parts[i]]) obj[parts[i]] = {};
obj = obj[parts[i]];
}
obj[parts[parts.length - 1]] = value;
}
return copy;
});
setDirty(true);
setSaveMessage('');
}
function update(path: string, value: unknown) {
setSettings((s) => {
const copy = JSON.parse(JSON.stringify(s));
const parts = path.split('.');
let obj = copy;
for (let i = 0; i < parts.length - 1; i++) {
if (!obj[parts[i]]) obj[parts[i]] = {};
obj = obj[parts[i]];
}
const key = parts[parts.length - 1];
if (value === '' || value === undefined) {
delete obj[key];
} else {
obj[key] = value;
}
return copy;
});
setDirty(true);
setSaveMessage('');
}
async function handleSave() {
setSaving(true);
setSaveMessage('');
// Clean up empty objects
const cleaned = JSON.parse(JSON.stringify(settings));
for (const key of Object.keys(cleaned)) {
if (typeof cleaned[key] === 'object' && Object.keys(cleaned[key]).length === 0) {
delete cleaned[key];
}
}
try {
const res = await fetch('/api/admin/settings', {
method: 'PUT',
headers: { 'Content-Type': 'application/json' },
body: JSON.stringify({ settings: cleaned }),
});
if (res.ok) {
const data = await res.json();
setDirty(false);
setSaveMessage(data.message || 'Saved!');
security: add Trivy container scan to Docker publish workflow (#399) * feat(admin): add backup manager UI with 1-click restore * feat(admin): collapse older backup entries by default * fix(theme): isolate admin layout, instant DOM theme updates, and add Light/Dark mode toggle * feat(admin): replace text controls for Photo Frame and Hero Style with visual preview cards * fix(admin): define missing CSS rules for button system (.btn, .preset-btn) * feat(admin): redesign theme settings with segmented mode toggle, accent color swatches, and custom iOS-style toggle cards * feat(admin): upgrade all settings tabs with visual grid previews, Google SEO snippet preview, and toggle cards * feat(admin): overhaul Pages Builder UX with slide-over drawer, card hover badges, real-time search, and floating save bar * fix(admin): remove leftover dangling syntax snippet in PageBuilder.tsx * fix(admin): add position: relative to subpage-tile so hover overlay is contained inside the tile * style(admin): replace all emojis with clean Leica-style vector SVG icons * fix(types): extend IconProps with SVGProps to allow style prop on Leica SVG icons * feat(admin): add subpage live-preview, privacy analytics, and asset protection settings * fix(typecheck): fix AlbumEntry property access in subpage drawer preview mode * fix(types): fix ImmichAlbumInfo property names thumbnailAssetId and albumName in PageBuilder.tsx * fix(types): add protection and watermark optional properties to AppConfig interface * feat(settings): add toggle for disabling analytics tracking (defaults to enabled) * feat(ux): show status banner when analytics tracking is disabled + add live sync indicator * feat(watermark): render customizable watermark overlay on Lightbox images + rename section to Portfolio Features & Modules * fix(types): import type LightboxWatermark in PhotoGrid.tsx * fix(types): destructure watermark prop in PhotoGrid function signature * feat(seo): add configurable subpage title template and metadata descriptions * feat(seo): add generateMetadata to about page for title template support * feat(proofing): add client proofing, favorites selection, compact URL bitmasking, and export modal * feat(essay): add Photo Essay storytelling mode with RSC markdown parser and fullbleed/pair layouts * feat(subpages): add page enabled toggle to deactivate subpages without deleting them * feat(admin): add visual essay block builder for photo essay storytelling pages * security: add Trivy container scan to Docker publish workflow Scans the built image for CRITICAL/HIGH CVEs on every release and uploads results to the GitHub Security tab. Non-blocking for now (exit-code 0) so releases aren't gated on findings. Also documents the scan and existing Dependabot coverage in the README. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-08-07 11:08:04 +02:00
router.refresh();
setTimeout(() => setSaveMessage(''), 5000);
} else {
const err = await res.json();
setSaveMessage(`Error: ${err.error}`);
}
} catch {
setSaveMessage('Error: Failed to save');
} finally {
setSaving(false);
}
}
async function loadAboutContent() {
setAboutLoading(true);
try {
const res = await fetch('/api/admin/about');
if (res.ok) {
const data = await res.json();
setAboutMeta(data.meta || {});
setAboutBody(data.body || '');
setAboutGearText(data.meta?.gear?.join('\n') || '');
}
} catch (err) {
console.error('Failed to load about content:', err);
} finally {
setAboutLoading(false);
}
}
async function saveAboutContent() {
setAboutSaving(true);
setAboutMessage('');
const cleanedMeta = { ...aboutMeta };
for (const [k, v] of Object.entries(cleanedMeta)) {
if (v === '' || v === undefined) delete cleanedMeta[k as keyof typeof cleanedMeta];
}
const gearLines = aboutGearText
.split('\n')
.map((s) => s.trim())
.filter(Boolean);
if (gearLines.length > 0) {
cleanedMeta.gear = gearLines;
} else {
delete cleanedMeta.gear;
}
try {
const res = await fetch('/api/admin/about', {
method: 'PUT',
headers: { 'Content-Type': 'application/json' },
body: JSON.stringify({ meta: cleanedMeta, body: aboutBody }),
});
if (res.ok) {
const data = await res.json();
setAboutDirty(false);
setAboutMessage(data.message || 'Saved!');
setTimeout(() => setAboutMessage(''), 4000);
} else {
const err = await res.json();
setAboutMessage(`Error: ${err.error}`);
}
} catch {
setAboutMessage('Error: Failed to save');
} finally {
setAboutSaving(false);
}
}
function updateAboutMeta(key: string, value: unknown) {
setAboutMeta((m) => ({ ...m, [key]: value }));
setAboutDirty(true);
setAboutMessage('');
}
if (loading) {
return (
<div className="admin-loading">
<div className="admin-spinner" />
</div>
);
}
// Resolved the same way the site resolves it, so the switches show what a
// visitor actually sees — including a config that only ever set the older
// `exifOnHover`.
const exif = resolveExifDisplay(settings.exif, settings.exifOnHover);
// The master switch has no key of its own and needs none: "off" is all four
// groups off, a state the site already acts on — with nothing left to show,
// the lightbox withdraws its info button and the `i` key entirely (#506).
const anyMetadata = exif.camera || exif.settings || exif.location || exif.caption;
const metadataSummary =
[
exif.camera && 'Camera & lens',
exif.settings && 'Exposure',
exif.location && 'Location',
exif.caption && 'Description',
]
.filter(Boolean)
.join(' · ') || 'Nothing published — the lightbox hides its info panel';
/** Turning it back on selects everything; the details below narrow it again. */
const toggleMetadata = () =>
updateMany({
'exif.camera': !anyMetadata,
'exif.settings': !anyMetadata,
'exif.location': !anyMetadata,
'exif.caption': !anyMetadata,
});
return (
<div className="settings-editor">
{/* The About panel edits about.md, not settings.yaml, so it drives the bar itself. */}
{activeSection === 'about' ? (
<SaveBar
dirty={aboutDirty}
saving={aboutSaving}
saveMessage={aboutMessage}
onSave={saveAboutContent}
label="Save About"
/>
) : (
<SaveBar
dirty={dirty}
saving={saving}
saveMessage={saveMessage}
onSave={handleSave}
label="Save Settings"
/>
)}
release: v0.11.0 — journal fixes, admin URLs, design system cleanup (#432) * fix(screenshots): sharp-Typen fuer 0.34 und 0.35 gleichzeitig (#410) sharp 0.35 ist von `export =` auf ESM umgestellt: der Modul-Namespace ist nicht mehr aufrufbar, die Factory sitzt unter .default. Der Type-Check brach damit in scripts/screenshots.ts weg, sobald der Next-Bump (#402) sharp von 0.34.5 auf 0.35.3 mitzieht -- sharp ist hier keine deklarierte Dependency, sondern kommt ueber Next mit. Die Form wird jetzt aus dem installierten Paket abgeleitet statt festgeschrieben, zur Laufzeit wie im Typ. Geprueft mit beiden Versionen: tsc laeuft mit 0.34.5 und mit 0.35.3 fehlerfrei durch. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(deps): bump the nextjs group across 1 directory with 2 updates (#402) Bumps the nextjs group with 2 updates in the / directory: [next](https://github.com/vercel/next.js) and [eslint-config-next](https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next). Updates `next` from 16.2.12 to 16.3.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/compare/v16.2.12...v16.3.0) Updates `eslint-config-next` from 16.2.12 to 16.3.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/commits/v16.3.0/packages/eslint-config-next) --- updated-dependencies: - dependency-name: eslint-config-next dependency-version: 16.3.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: nextjs - dependency-name: next dependency-version: 16.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nextjs ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps-dev): bump prettier from 3.8.3 to 3.9.6 (#405) Bumps [prettier](https://github.com/prettier/prettier) from 3.8.3 to 3.9.6. - [Release notes](https://github.com/prettier/prettier/releases) - [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md) - [Commits](https://github.com/prettier/prettier/compare/3.8.3...3.9.6) --- updated-dependencies: - dependency-name: prettier dependency-version: 3.9.6 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * docs(changelog): Unreleased-Sektion fuer die Bumps nach v0.10.0 (#413) Die Dependency-PRs sind nach dem Release auf dev gelandet, teils auch auf main. Ohne Eintrag waeren sie beim naechsten Release unsichtbar -- inklusive Next 16.3.0, das CVE-2025-13465 mitbringt. Ausserdem im 0.10.0-Abschnitt nachgetragen, dass der Trivy-Scan bis #409 nie gelaufen ist. Der Fix steckt im Tag v0.10.0, fehlte aber in der Aufzaehlung -- und "Images werden bei jedem Publish gescannt" stand im Changelog, waehrend der Job im Action-Setup abbrach. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(gallery): per-album sort order, independent of Immich (#408) (#414) Album order was dictated entirely by Immich: getAlbum() sorted by the album's own asc/desc flag, so a Folio album always mirrored the archive. A curated series has a narrative order that has nothing to do with capture time, and changing the Immich album's sort to fit the website changes it for the archive too. Adds an optional per-album `sort` in gallery.yaml, editable in /admin, defaulting to today's behaviour so every existing config is unchanged: immich (default) | newest | oldest | filename | manual `manual` is a pinned *prefix*: `assetOrder` lists only the photos placed by hand, everything else follows in the album's Immich order. A full permutation of a 2,000-photo album would be ~80 KB of UUIDs in a file that is rewritten and copied to content/.backups/ on every admin save. It also makes drift fall out for free — photos removed in Immich never match, new ones land in the tail rather than being hidden. Sorting is applied after the cache read, not before the cache write, so the LRU keeps one canonical Immich-ordered copy per album. That avoids putting the mode in the cache key, lets a config change take effect without depending on invalidation, and keeps the stale-serving path correct. cache.get() returns the stored object by reference, so withSort() returns a shallow clone with a new array — sorting in place would reorder the shared entry, and under request coalescing every concurrent caller would be sorting the same array. Also fixes a prerequisite bug: /api/admin/albums/[albumId]/assets read album.assets from GET /albums/:id, which Immich 3.x no longer populates (lib/immich.ts:507). The hero picker's "This Album" tab returned nothing and threw outright when the key was absent. It now goes through the client's paginated metadata search, with ?types=all to opt videos in for the reorder editor. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): drop decorative emoji from the sort select labels (#415) An <option> cannot contain markup, so the SVG set in Icons is not reachable there — but a decorative emoji is not a substitute for it. Plain text instead; the album card badge already uses a real icon. The remaining emoji in the admin panel (asset picker tabs, section headings, layout picker options) predate this branch and are left for a separate cleanup. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): replace emoji icons with the shared SVG icon set (#416) The admin panel mixed two icon conventions: inline SVGs from `Icons.tsx` in most components, and decorative emoji in the asset picker and a few PageBuilder labels. Emoji render inconsistently across platforms, ignore the accent colour, and cannot inherit the `.svg-icon` sizing rules. - Icons.tsx: add `IconStar` (filled — it marks a state, not an action) and `IconImage`. - AssetPicker: the three tab labels and the favourite tile badge now use IconFolder / IconStar / IconImage. - PageBuilder: the "Standalone Albums" and "Subpages" headings use the icon set instead of an emoji. - PageBuilder: the layout picker drops its emoji for plain text. An <option> cannot contain markup, so an SVG is impossible there and a decorative glyph is not a substitute. - admin.css: align icon and label in the picker tabs, and swap the favourite badge's text-shadow for drop-shadow, which is what applies to an inline SVG. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): fold PageBuilder's local icons into the shared Icons module (#418) * refactor(admin): fold PageBuilder's local icons into the shared module PageBuilder.tsx carried its own `Icons` object duplicating most of the glyphs already exported by Icons.tsx, with hardcoded sizes and slightly divergent paths. Migrate all 32 call sites to the shared module and delete the local object. Five glyphs had no counterpart and are added to Icons.tsx as 1:1 ports of the local paths: IconX, IconPlus, IconHome, IconCopy, IconImage. The local ExternalLink and Check are dropped rather than ported — both had zero call sites. Two glyphs change shape slightly, which is the point of consolidating: the shared IconCamera includes the viewfinder bump the local copy omitted, and drag handles now use IconGripVertical. IconGripVertical uses the module's square 24x24 viewBox, so `.svg-drag` goes from 12x18 to 18x18 — the old non-square box would letterbox the glyph down to 12x12 and shrink the handle. * fix(admin): resolve icon-module integration after #416 Merging dev brought in #416, which added a second IconImage to Icons.tsx and two <Icons.Camera>/<Icons.Folder> section headers that reference the local Icons object this PR removes. Git merged both cleanly but the result did not type-check. - drop the duplicate IconImage (both copies were byte-identical) - point the two section headers at the imported IconCamera/IconFolder - refresh the SORT_LABELS comment: the icon set is imported now, not declared below --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> * fix(config): allow an empty gallery, guard against a double /api suffix (#421) An empty gallery is now a valid, rendered state instead of a throw: deriveGallery() no longer requires at least one album or subpage, so a deployment with no albums yet renders a bare homepage the owner can fill in via /admin. getConfig() also stops appending /api to an Immich URL that already ends in it, which previously produced .../api/api and broke every upstream request. Includes a restore of the per-album sort test cases, which the branch had lost by being cut before #408/#414. * feat(admin): favicon upload, served from the content volume (#422) Adds a bundled default favicon, an upload widget in admin Settings > General, and a route that serves the icon from the writable content/ volume with a fallback to the bundled default. Raster uploads (PNG/ICO/JPEG) are wrapped in an SVG container; the response carries its own CSP so an uploaded SVG cannot execute script on the origin. The GET route revalidates with an ETag instead of caching immutably, so a newly uploaded icon shows up immediately. Uploads are written via temp file + rename, and a Reset button restores the bundled default. * ci: flag unformatted files in a PR, without blocking it (#424) Prettier is configured as an error rule in eslint.config.mjs but has never run in CI, so part of the tree predates it. A final CI step now diffs against the PR base, runs prettier --list-different over the changed files, and emits a warning annotation per offender plus a job summary. Advisory by design: it never fails the job. Blocking would turn a PR red for merely touching a file that was already unformatted, and normalising the tree in one commit would wreck git blame and conflict with the PRs in flight. Requires fetch-depth: 0, since diffing against the base needs its history. * feat(install): first-run wizard gated by a one-time setup token (#419) Adds /install, a four-step first-run wizard: connect to Immich, optionally pick albums, name the site, finish. It verifies the credentials against the Immich server before writing anything, then writes gallery.yaml, settings.yaml and a content/install.json carrying the Immich credentials and a generated site secret. install.json exists because a running process cannot pick up new env vars — the wizard has to write configuration that takes effect without a restart. getInstallCredentials() merges it under the real environment, so env vars always win and rotation stays a matter of setting one. Both the page and the API routes are gated by a one-time setup token printed to the server log, so a deployment that is reachable before gallery.yaml exists cannot be configured by whoever finds it first. The token is stored in content/.setup-token (0600) rather than a module variable: Next.js bundles the page and each route handler separately, so a module-level token left the page and the API disagreeing inside one process and the wizard stuck on step 1. It is removed once the install completes. The admin password is stored as an scrypt hash using the scheme lib/auth.ts already applies to album passwords; a plaintext ADMIN_PASSWORD env var keeps working. * docs: document the setup wizard, fix the read-only content mount (#425) Quick Start now leads with the /install wizard, with the hand-written YAML route kept alongside it, and a First-Run Setup section covers the setup token, the files the wizard writes, and env-var precedence. Two corrections: both Docker examples mounted content/ as :ro, which silently breaks the wizard, the admin panel and the backup rotation alike — docs/admin-panel.md already said so and the README contradicted it. And nothing documented that content/install.json holds the Immich API key, so a backup of content/ is a backup of credentials. Also adds a Contributors section crediting the people whose work is in the project. * feat(admin): floating save bar pinned to the bottom of the viewport (#426) The save bar was the first, static element inside .admin-main. Since the document itself scrolls, it left the viewport as soon as you scrolled down — editing a subpage section or a settings block far below gave no visible dirty hint and no reachable save button. Replace it with a bottom-pinned floating bar shared by both editors. It only mounts while there is something to act on (unsaved changes, an in-flight save, or a result message), so it never covers content while idle. The success message clears after 5s, which hides the bar again. - new SaveBar component, replacing the duplicated markup in PageBuilder and SettingsEditor - adopt the previously unused .floating-save-bar CSS: slide-in keyframes (carrying translateX(-50%)), dirty border, wrap/gap, mobile variant and a prefers-reduced-motion opt-out; z-index 900 keeps it below modals - .admin-main gains bottom padding so the bar never covers page content - drop the now-unreachable idle hints: the ⌘S hint becomes a button title, the Live Sync note becomes a static line above the settings layout - header "Site" link now bypasses the cache (/?fresh=1), so the preview stays reachable when the bar is hidden Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(admin): themed listbox for the album sort control (#427) The per-album "Photo order" control was a native <select>. Because an <option> cannot contain markup, its choices could not use the admin panel's currentColor SVG set — the reason #415 had to fall back to plain text after dropping the emoji labels. Adds a Listbox component implementing the ARIA combobox/listbox pattern, so options can render a glyph beside their label: - DOM focus stays on the trigger button; the active option is announced through aria-activedescendant, keeping focus management to one element - Keyboard: arrows (clamped at the ends, like a native select), Home/End, Enter/Space to commit, Escape to cancel, Tab commits and moves on, and prefix type-ahead with a repeat-key cycle - Outside dismissal on pointerdown, so a press starting outside closes the popup before the click retargets The sort options now carry an icon each: calendar, arrow-down, arrow-up, an A→Z marker, and the drag glyph for manual — matching the badge the album card already shows. SORT_LABELS stays plain text because the badge feeds it to a title attribute. Closes #417 Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(git): ignore generated design handoff folders * fix(admin): stop the album sort dropdown clipping, and simplify the panel (#428) * fix(admin): render listbox popup in a portal so it escapes modal clipping The sort control's popup was position:absolute inside three clipping ancestors (.album-drawer overflow:hidden > .album-drawer-body overflow-y:auto > .modal-right-column overflow-y:auto), so it was cut off at the bottom of the Edit Album Details modal. z-index could not help: clipping happens before stacking. It also always hung below the trigger, with no flip. Portal the popup to document.body and position it from the trigger's viewport rect, flipping above when there is more room there and capping max-height to the space available so it scrolls internally rather than overflowing. It is dismissed on scroll and resize, since the anchor is only measured on open. The outside-pointerdown handler now also treats the popup as inside; without that the portalled list counts as outside, and a click on an option would close it before the selection commits. * refactor(admin): single-column album details panel The left column spent 1.2fr on a cover thumbnail and three stat rows, two of which (Status, Custom Hero) only restated the form fields opposite them, while the form itself was squeezed into 1.8fr behind a second nested scroller. Stack the drawer in one column instead: cover as a banner, then the form at full width, with the UUID moved into the footer. The body is now the only scroll container, which also removes one of the ancestors that was clipping the sort popup. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> * fix(admin): give the portalled listbox its theme back, lock the page behind modals (#429) Two defects in the album editor. The sort listbox popup painted transparent. Every --admin-* variable is scoped to .admin-layout, and since the popup moved into document.body it sits outside that subtree, so background/border/text all resolved to nothing. It now carries its own copy of the palette in both colour schemes, plus the font it no longer inherits. Scrolling inside a modal also moved the page behind it. No admin modal ever locked body scroll: the overlay covers the page but does not absorb wheel events, so a scroll starting on the backdrop — or continuing past the end of the modal's own scroller — reaches the document. overscroll-behavior cannot cover that case on its own, because it only applies to scroll containers and the backdrop is not one. useScrollLock freezes body while a modal is open and compensates for the width the scrollbar gives up, so nothing shifts underneath. Each lock restores the inline value it found, which makes nesting work without a counter — a picker opened from the drawer restores the drawer's hidden state instead of clearing it. Applied to both drawers and all four picker modals, which share the defect. overscroll-behavior: contain on the scrollers stops the chaining they can handle themselves. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com> * fix(security): allow unsafe-eval in CSP script-src during dev mode * feat(journal): add Journal Studio with split-screen editor, live preview and dedicated routes * fix(build): separate client parser from server journal-service and fix build type errors * fix(journal): Fotos rendern, Layout und Lightbox-Steuerung korrigieren Fünf unabhängige Fehler in der öffentlichen Journal- und Essay-Ansicht: * Foto-Blöcke wurden nie angezeigt. EssayView löst ein Foto über PhotoItem.id auf, und das sind verschlüsselte Tokens — die Blöcke aus dem Markdown tragen aber rohe Asset-UUIDs. Jede Zuordnung lief ins Leere, und nicht auflösbare Blöcke werden still verworfen. Die IDs werden jetzt serverseitig übersetzt; damit verschwinden nebenbei die rohen UUIDs aus dem Client-Payload, die dort laut Projektregel nie auftauchen dürfen. Nicht auflösbare Referenzen werden geloggt. * Überschriften standen weiter links als der Fließtext. Jeder Block hatte einzeln `max-width: 68ch`, und `ch` ist relativ zur Schrift des Elements — die Serif-Überschrift ergab eine breitere Spalte. Ersetzt durch eine gemeinsame, font-unabhängige `--essay-measure`. * Fullbleed-Fotos bluteten nur nach links aus: `.essay-figure` ist `width: 100%`, wodurch die Box überbestimmt ist und der negative rechte Margin verworfen wird. * Foto-Paare stellten beide Bilder gleich breit dar, wodurch ein Hochformat neben einem Querformat doppelt so hoch wurde. Jetzt eine Justified-Reihe: Breite proportional zum Seitenverhältnis, dadurch exakt gleiche Höhen ohne Beschnitt. * Die Lightbox hatte im Journal keine Tastatursteuerung und keine Scroll-Sperre — beides lag in PhotoGrid, also nur im Album-Raster. Verlagert in die Lightbox selbst, der doppelte Handler in PhotoGrid entfernt (sonst wäre pro Pfeildruck zwei Bilder weitergesprungen). Zusätzlich sind Proofing-Herzen und das EXIF-Panel im redaktionellen Modus abschaltbar und im Journal aus: Client-Proofing ist ein Übergabe-Workflow für Alben, keine Funktion einer Reportage. Auf der Übersicht wurde der Untertitel doppelt gerendert, weil extractExcerpt() auf ihn zurückfällt. * feat(admin): eigene URLs für alle Bereiche und überarbeiteter Journal Studio Das Panel war eine einzige Client-Komponente, die ihre Tabs über useState umschaltet: keine Route pro Bereich, kein Deep-Link, kein Zurück-Button, und nach jedem Reload landete man wieder auf "Pages". Auch der Journal-Editor hatte keine eigene URL. Jetzt sieben echte Routen (/admin, /admin/pages, /admin/journal, /admin/journal/<slug>, /admin/settings, /admin/settings/<section>, /admin/analytics). Die Shell mit Auth-Prüfung und Kopfzeile sitzt im Layout und umschließt children — so bleibt die Session-Prüfung über Routenwechsel montiert, statt bei jedem Tab-Wechsel neu zu laufen und den Spinner aufblitzen zu lassen. Unbekannte Settings-Sections fallen auf General zurück. Im selben Zug der Journal Studio, der die Routing-Änderung ohnehin berührt: * Alle Eingabefelder nutzten die Klasse `admin-input`, die in keinem CSS definiert war — sie fielen auf Browser-Defaults zurück. Jetzt gestylt, gescoped, damit der generische Name nicht ins übrige Panel leckt. * Der Split View ist per Divider verschiebbar (Maus, Tastatur, Doppelklick zum Zurücksetzen), Breite in localStorage. * Das Studio bricht aus der 1120px-Spalte aus, die Preview hat Platz. * Die Preview zeigte für jedes Foto fest 3:2 und log damit über das Layout der veröffentlichten Seite; die echten Verhältnisse werden jetzt an den Thumbnails gemessen. * Blöcke mit alten positionsbasierten Foto-Referenzen werden markiert — die lassen sich auf einer eigenständigen Journal-Seite nicht auflösen und verschwanden bisher stillschweigend. * Blocktyp-Chips als gemeinsame Komponente, monochrom und per Icon unterschieden statt in einer eigenen Blau/Lila/Orange-Palette, die sonst nirgends im Panel vorkommt. * Emojis raus, SVG-Icons rein. * fix(admin): Designsystem-Lücken im Panel schließen Eine systematische Suche nach Klassen, die im TSX benutzt, aber in keinem CSS definiert sind, hat vier Stellen mit demselben Muster gefunden: * `admin-btn-secondary` und `admin-btn-danger` existierten nicht. Sämtliche Löschen-Buttons sahen aus wie normale Buttons — keine Warnwirkung. Als `.admin-btn.admin-btn-danger` geschrieben, weil die Varianten mit den Größenklassen kombiniert werden, die weiter unten ihren eigenen Hintergrund setzen. * `page-progress-fill` fehlte: die Balken im Analytics-Panel waren leere Rinnen, der Wert unsichtbar. Ebenso `analytics-empty` und `admin-loading-container`. * `subpage-drawer-section`, `subpage-drawer-title-group` und `input-with-icon` im PageBuilder waren wirkungslos und teils mit Inline-Styles notdürftig kompensiert. * `grid-card-preview` fehlte, wodurch alle Layout-Vorschauen auf Höhe null kollabierten. Nur "Showcase" war sichtbar — und das aus Versehen, weil sein Tile `hero-tile` hieß und damit die `aspect-ratio` einer fremden PageBuilder-Klasse erbte. Umbenannt. Dazu die Theme-Vorschauen, die praktisch identisch aussahen: alle sieben zeigten dieselben drei quadratischen Kacheln, einziger Unterschied war die Hintergrundfarbe. Sie spiegeln jetzt die echten Preset-Daten aus lib/config/theme.ts — Schriftcharakter, Eckradius, Rasterdichte, Passepartout bzw. Schatten. Die Kopfzeile richtet sich an einer gemeinsamen Steuerhöhe aus. Der "Site"-Link war höher als die Buttons daneben: `.admin-btn` hatte keine explizite line-height, und <button> bekommt box-sizing: border-box vom Browser, <a> nicht. Die Statusanzeige setzte weder Schriftfamilie noch -größe und fiel auf den Browser-Default zurück — sie war nie Teil des Designsystems. Jetzt gleiche Höhe und Typografie, Pillenform als Zustandsanzeige, Trenner zur Aktionsgruppe. Das dauerhafte Pulsieren des grünen Punkts entfällt; Animation bleibt den Zuständen vorbehalten, die Aufmerksamkeit brauchen. Restliche Emojis durch SVG-Icons ersetzt. * feat(admin): add scroll-to-top toggle and SVG arrow The back-to-top button was always on and drew its arrow with the ↑ text character. Add a `scrollToTop` setting (General section in the admin panel, defaults to on so existing sites are unaffected) and replace the glyph with a stroked SVG that inherits currentColor across all presets. Scroll handling is now rAF-throttled, and prefers-reduced-motion turns off both the hover lift and the smooth scroll. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * security(journal): escape author HTML instead of filtering it CodeQL flags 26 high-severity alerts on the release PR; the bulk of them point at sanitizeHtml(), a denylist of three regexes whose output goes into dangerouslySetInnerHTML. I reproduced the bypasses before changing anything — all four pass the old filter: <img src=x onerror=alert(1)> unquoted handler, regex wants quotes <img src=x onerror='alert(1)'> single quotes, same reason <svg onload=alert(1)> not a <script> tag javasjavascript:cript:alert(1) one-pass replace, the rest recombines Plus an attribute breakout in the link renderer, which interpolated the URL into href="${url}" unescaped: [x](" onmouseover=alert(1) x=") -> <a href="" onmouseover=alert(1" ...> Replaced with escaping. Every `&<>"'` in author text becomes an entity before any markdown rule runs, so the only tags in the output are the ones renderInlineMarkdown builds itself and a URL cannot leave its attribute. Link schemes are now an allowlist (http, https, mailto, tel, relative, anchor); anything else renders as plain text. The serializer needed decodeHtmlEntities to match: without it a save would write `&lt;` into the Markdown file and the next parse would escape the `&` again, corrupting the text further on every round trip. A test covers parse -> serialize -> parse stability. Two existing tests asserted the old behaviour and were rewritten rather than deleted: one expected the script tag to be *removed* from the output, the other expected the substring "onerror" to be absent. Both now assert the property that matters — that no tag can form — because `onerror` surviving as inert text is fine. Exploitation required admin access either way: journal and essay text comes from the studio or from content/*.md. This removes the weakness, it does not close an open door. * fix(journal): contain file paths, fix frontmatter escaping, defuse two regexes Follow-up to the CodeQL findings on release PR #432. I went through all 23 alerts individually; this addresses the ones that are worth addressing and documents the ones that are not. Path containment (12 alerts, all false positives). Every path built from a slug goes through isValidSlug(), a strict `/^[a-zA-Z0-9_-]+$/` allowlist — verified against `../../etc/passwd`, `foo/../../bar`, `a/b`, `..` and friends, all rejected. CodeQL cannot see it because the check lives in another module. Added a containedPath() helper that resolves the path and refuses anything landing outside the content directory: a second lock on a door that was already locked, and a barrier the analysis can follow. Also removed the dead `slug.endsWith('.md')` branches — isValidSlug rejects dots, so they could never be taken. Frontmatter escaping (1 alert, a real bug). The serializer escaped `"` but not `\`, and the parser never unescaped anything. A title containing either character gained a backslash on every save/load cycle: Path C:\Users "quoted" -> Path C:\\Users \"quoted\" -> ... Escaping now covers the backslash first and the parser undoes both. A round trip test covers quotes, backslashes, colons and apostrophes. Two of three ReDoS regexes (2 alerts). The heading pattern had `\s+` next to `(.+)`, which overlap, so the engine tried every split of the whitespace run before failing; it is `[ \t]+` and `(\S.*)` now. The quote author pattern wrapped a lazy group around an optional group — the quadratic case — and is an index split on the first separator now. The third regex, the bold/italic pass, is deliberately left alone. Rewriting it with a negated class removes the backtracking but breaks nesting: `**bold *and italic* here**` renders as `*<em>bold </em>and italic<em> here</em>*`. The input is Markdown from an authenticated admin, never a visitor, so the worst case is an author slowing down their own page. The comment in the code says so. Not addressed: 5 js/insufficient-password-hash alerts. They ask for a slow KDF where the code uses SHA-256/HMAC — correct in general, but the admin password comes from an environment variable and is never stored, so a stronger KDF protects nothing that is not already in plaintext in the environment. 399 unit tests pass (18 new), build and tsc clean. * fix(journal): split the quote author by scanning, not by pattern Cleaning up after myself. #439 replaced the quote author regex `/^(.*?)(?:\s+--\s+(.+))?$/` — a lazy group around an optional one, the quadratic case — with `/\s+--\s+/`, and CodeQL promptly flagged the replacement for the same reason. One reported pattern traded for another. splitQuoteAuthor() scans for the first `--` that has whitespace on both sides. Linear, and it needs no reasoning about the regex engine at all. Behaviour is identical to the original regex, checked case by case against it: separator, no separator, several separators, tabs, wide gaps, `a--b` without spaces, leading and trailing separators, empty string. All nine are covered by tests, plus one asserting it stays fast on a 50k whitespace run. * security(admin): derive the session signing key with scrypt getSigningKey() ran the admin password through a single SHA-256 digest. It is key derivation rather than password storage, so it was never a stored-hash problem — but if the derived key ever leaked, one fast hash makes recovering the password by brute force cheap. CodeQL flags it as js/insufficient-password-hash and, for this particular alert, has a point. scrypt now. Two details that matter: The salt has to be stable. A random salt would produce a different key on every call and invalidate every session; it is derived from AUTH_SECRET, which is deployment-specific. Verified across separate processes: same inputs produce a verifying token, so a restart or redeploy does not log everyone out. The result is cached for the process lifetime. scrypt is deliberately slow and getSigningKey() runs on every admin request — deriving per call would add ~24ms to each one. The cache key is a digest of secret plus password, so a rotation misses the cache and derives again, and no extra plaintext copy of the password is kept around. Measured: first derivation 24ms, subsequent calls 0.12ms. Password change and secret change both invalidate an existing token, checked in separate processes. Note the one-time effect: existing admin sessions are invalidated by the change in derivation, so everyone logs in once more. * security(admin): key the signing-key cache on its inputs, not a digest #441 removed the SHA-256 digest of the admin password from the key derivation and introduced a new one three lines above it, as the cache key. Same rule, same file: CodeQL reported it immediately. The comment justifying it was wrong too. It claimed no second plaintext copy of the password was retained, while building the digest input allocates exactly that in order to hash it. The cache now holds the two input strings and compares them directly. They are the same objects the env and install caches already hold, so nothing extra is retained, and no fast hash of the password exists in memory for the life of the process. Re-verified after the change, in separate processes: a token from one process verifies in another with the same inputs, a changed password or secret rejects it, first derivation 24ms, cached calls 0.001ms. That leaves scrypt as the only place the password is hashed here. The two HMACs further down operate on the derived key and on token data, not on the password; the constant-time comparison in verifyAdminPassword is the previously dismissed one. --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
2026-08-14 16:55:07 +02:00
<p className="settings-live-sync-note">
<Icons.IconRefresh size={13} /> Live Sync (No Docker restart required)
</p>
<div className="settings-layout">
{/* Sidebar */}
<nav className="settings-nav">
release: v0.11.0 — journal fixes, admin URLs, design system cleanup (#432) * fix(screenshots): sharp-Typen fuer 0.34 und 0.35 gleichzeitig (#410) sharp 0.35 ist von `export =` auf ESM umgestellt: der Modul-Namespace ist nicht mehr aufrufbar, die Factory sitzt unter .default. Der Type-Check brach damit in scripts/screenshots.ts weg, sobald der Next-Bump (#402) sharp von 0.34.5 auf 0.35.3 mitzieht -- sharp ist hier keine deklarierte Dependency, sondern kommt ueber Next mit. Die Form wird jetzt aus dem installierten Paket abgeleitet statt festgeschrieben, zur Laufzeit wie im Typ. Geprueft mit beiden Versionen: tsc laeuft mit 0.34.5 und mit 0.35.3 fehlerfrei durch. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(deps): bump the nextjs group across 1 directory with 2 updates (#402) Bumps the nextjs group with 2 updates in the / directory: [next](https://github.com/vercel/next.js) and [eslint-config-next](https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next). Updates `next` from 16.2.12 to 16.3.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/compare/v16.2.12...v16.3.0) Updates `eslint-config-next` from 16.2.12 to 16.3.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/commits/v16.3.0/packages/eslint-config-next) --- updated-dependencies: - dependency-name: eslint-config-next dependency-version: 16.3.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: nextjs - dependency-name: next dependency-version: 16.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nextjs ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps-dev): bump prettier from 3.8.3 to 3.9.6 (#405) Bumps [prettier](https://github.com/prettier/prettier) from 3.8.3 to 3.9.6. - [Release notes](https://github.com/prettier/prettier/releases) - [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md) - [Commits](https://github.com/prettier/prettier/compare/3.8.3...3.9.6) --- updated-dependencies: - dependency-name: prettier dependency-version: 3.9.6 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * docs(changelog): Unreleased-Sektion fuer die Bumps nach v0.10.0 (#413) Die Dependency-PRs sind nach dem Release auf dev gelandet, teils auch auf main. Ohne Eintrag waeren sie beim naechsten Release unsichtbar -- inklusive Next 16.3.0, das CVE-2025-13465 mitbringt. Ausserdem im 0.10.0-Abschnitt nachgetragen, dass der Trivy-Scan bis #409 nie gelaufen ist. Der Fix steckt im Tag v0.10.0, fehlte aber in der Aufzaehlung -- und "Images werden bei jedem Publish gescannt" stand im Changelog, waehrend der Job im Action-Setup abbrach. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(gallery): per-album sort order, independent of Immich (#408) (#414) Album order was dictated entirely by Immich: getAlbum() sorted by the album's own asc/desc flag, so a Folio album always mirrored the archive. A curated series has a narrative order that has nothing to do with capture time, and changing the Immich album's sort to fit the website changes it for the archive too. Adds an optional per-album `sort` in gallery.yaml, editable in /admin, defaulting to today's behaviour so every existing config is unchanged: immich (default) | newest | oldest | filename | manual `manual` is a pinned *prefix*: `assetOrder` lists only the photos placed by hand, everything else follows in the album's Immich order. A full permutation of a 2,000-photo album would be ~80 KB of UUIDs in a file that is rewritten and copied to content/.backups/ on every admin save. It also makes drift fall out for free — photos removed in Immich never match, new ones land in the tail rather than being hidden. Sorting is applied after the cache read, not before the cache write, so the LRU keeps one canonical Immich-ordered copy per album. That avoids putting the mode in the cache key, lets a config change take effect without depending on invalidation, and keeps the stale-serving path correct. cache.get() returns the stored object by reference, so withSort() returns a shallow clone with a new array — sorting in place would reorder the shared entry, and under request coalescing every concurrent caller would be sorting the same array. Also fixes a prerequisite bug: /api/admin/albums/[albumId]/assets read album.assets from GET /albums/:id, which Immich 3.x no longer populates (lib/immich.ts:507). The hero picker's "This Album" tab returned nothing and threw outright when the key was absent. It now goes through the client's paginated metadata search, with ?types=all to opt videos in for the reorder editor. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): drop decorative emoji from the sort select labels (#415) An <option> cannot contain markup, so the SVG set in Icons is not reachable there — but a decorative emoji is not a substitute for it. Plain text instead; the album card badge already uses a real icon. The remaining emoji in the admin panel (asset picker tabs, section headings, layout picker options) predate this branch and are left for a separate cleanup. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): replace emoji icons with the shared SVG icon set (#416) The admin panel mixed two icon conventions: inline SVGs from `Icons.tsx` in most components, and decorative emoji in the asset picker and a few PageBuilder labels. Emoji render inconsistently across platforms, ignore the accent colour, and cannot inherit the `.svg-icon` sizing rules. - Icons.tsx: add `IconStar` (filled — it marks a state, not an action) and `IconImage`. - AssetPicker: the three tab labels and the favourite tile badge now use IconFolder / IconStar / IconImage. - PageBuilder: the "Standalone Albums" and "Subpages" headings use the icon set instead of an emoji. - PageBuilder: the layout picker drops its emoji for plain text. An <option> cannot contain markup, so an SVG is impossible there and a decorative glyph is not a substitute. - admin.css: align icon and label in the picker tabs, and swap the favourite badge's text-shadow for drop-shadow, which is what applies to an inline SVG. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): fold PageBuilder's local icons into the shared Icons module (#418) * refactor(admin): fold PageBuilder's local icons into the shared module PageBuilder.tsx carried its own `Icons` object duplicating most of the glyphs already exported by Icons.tsx, with hardcoded sizes and slightly divergent paths. Migrate all 32 call sites to the shared module and delete the local object. Five glyphs had no counterpart and are added to Icons.tsx as 1:1 ports of the local paths: IconX, IconPlus, IconHome, IconCopy, IconImage. The local ExternalLink and Check are dropped rather than ported — both had zero call sites. Two glyphs change shape slightly, which is the point of consolidating: the shared IconCamera includes the viewfinder bump the local copy omitted, and drag handles now use IconGripVertical. IconGripVertical uses the module's square 24x24 viewBox, so `.svg-drag` goes from 12x18 to 18x18 — the old non-square box would letterbox the glyph down to 12x12 and shrink the handle. * fix(admin): resolve icon-module integration after #416 Merging dev brought in #416, which added a second IconImage to Icons.tsx and two <Icons.Camera>/<Icons.Folder> section headers that reference the local Icons object this PR removes. Git merged both cleanly but the result did not type-check. - drop the duplicate IconImage (both copies were byte-identical) - point the two section headers at the imported IconCamera/IconFolder - refresh the SORT_LABELS comment: the icon set is imported now, not declared below --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> * fix(config): allow an empty gallery, guard against a double /api suffix (#421) An empty gallery is now a valid, rendered state instead of a throw: deriveGallery() no longer requires at least one album or subpage, so a deployment with no albums yet renders a bare homepage the owner can fill in via /admin. getConfig() also stops appending /api to an Immich URL that already ends in it, which previously produced .../api/api and broke every upstream request. Includes a restore of the per-album sort test cases, which the branch had lost by being cut before #408/#414. * feat(admin): favicon upload, served from the content volume (#422) Adds a bundled default favicon, an upload widget in admin Settings > General, and a route that serves the icon from the writable content/ volume with a fallback to the bundled default. Raster uploads (PNG/ICO/JPEG) are wrapped in an SVG container; the response carries its own CSP so an uploaded SVG cannot execute script on the origin. The GET route revalidates with an ETag instead of caching immutably, so a newly uploaded icon shows up immediately. Uploads are written via temp file + rename, and a Reset button restores the bundled default. * ci: flag unformatted files in a PR, without blocking it (#424) Prettier is configured as an error rule in eslint.config.mjs but has never run in CI, so part of the tree predates it. A final CI step now diffs against the PR base, runs prettier --list-different over the changed files, and emits a warning annotation per offender plus a job summary. Advisory by design: it never fails the job. Blocking would turn a PR red for merely touching a file that was already unformatted, and normalising the tree in one commit would wreck git blame and conflict with the PRs in flight. Requires fetch-depth: 0, since diffing against the base needs its history. * feat(install): first-run wizard gated by a one-time setup token (#419) Adds /install, a four-step first-run wizard: connect to Immich, optionally pick albums, name the site, finish. It verifies the credentials against the Immich server before writing anything, then writes gallery.yaml, settings.yaml and a content/install.json carrying the Immich credentials and a generated site secret. install.json exists because a running process cannot pick up new env vars — the wizard has to write configuration that takes effect without a restart. getInstallCredentials() merges it under the real environment, so env vars always win and rotation stays a matter of setting one. Both the page and the API routes are gated by a one-time setup token printed to the server log, so a deployment that is reachable before gallery.yaml exists cannot be configured by whoever finds it first. The token is stored in content/.setup-token (0600) rather than a module variable: Next.js bundles the page and each route handler separately, so a module-level token left the page and the API disagreeing inside one process and the wizard stuck on step 1. It is removed once the install completes. The admin password is stored as an scrypt hash using the scheme lib/auth.ts already applies to album passwords; a plaintext ADMIN_PASSWORD env var keeps working. * docs: document the setup wizard, fix the read-only content mount (#425) Quick Start now leads with the /install wizard, with the hand-written YAML route kept alongside it, and a First-Run Setup section covers the setup token, the files the wizard writes, and env-var precedence. Two corrections: both Docker examples mounted content/ as :ro, which silently breaks the wizard, the admin panel and the backup rotation alike — docs/admin-panel.md already said so and the README contradicted it. And nothing documented that content/install.json holds the Immich API key, so a backup of content/ is a backup of credentials. Also adds a Contributors section crediting the people whose work is in the project. * feat(admin): floating save bar pinned to the bottom of the viewport (#426) The save bar was the first, static element inside .admin-main. Since the document itself scrolls, it left the viewport as soon as you scrolled down — editing a subpage section or a settings block far below gave no visible dirty hint and no reachable save button. Replace it with a bottom-pinned floating bar shared by both editors. It only mounts while there is something to act on (unsaved changes, an in-flight save, or a result message), so it never covers content while idle. The success message clears after 5s, which hides the bar again. - new SaveBar component, replacing the duplicated markup in PageBuilder and SettingsEditor - adopt the previously unused .floating-save-bar CSS: slide-in keyframes (carrying translateX(-50%)), dirty border, wrap/gap, mobile variant and a prefers-reduced-motion opt-out; z-index 900 keeps it below modals - .admin-main gains bottom padding so the bar never covers page content - drop the now-unreachable idle hints: the ⌘S hint becomes a button title, the Live Sync note becomes a static line above the settings layout - header "Site" link now bypasses the cache (/?fresh=1), so the preview stays reachable when the bar is hidden Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(admin): themed listbox for the album sort control (#427) The per-album "Photo order" control was a native <select>. Because an <option> cannot contain markup, its choices could not use the admin panel's currentColor SVG set — the reason #415 had to fall back to plain text after dropping the emoji labels. Adds a Listbox component implementing the ARIA combobox/listbox pattern, so options can render a glyph beside their label: - DOM focus stays on the trigger button; the active option is announced through aria-activedescendant, keeping focus management to one element - Keyboard: arrows (clamped at the ends, like a native select), Home/End, Enter/Space to commit, Escape to cancel, Tab commits and moves on, and prefix type-ahead with a repeat-key cycle - Outside dismissal on pointerdown, so a press starting outside closes the popup before the click retargets The sort options now carry an icon each: calendar, arrow-down, arrow-up, an A→Z marker, and the drag glyph for manual — matching the badge the album card already shows. SORT_LABELS stays plain text because the badge feeds it to a title attribute. Closes #417 Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(git): ignore generated design handoff folders * fix(admin): stop the album sort dropdown clipping, and simplify the panel (#428) * fix(admin): render listbox popup in a portal so it escapes modal clipping The sort control's popup was position:absolute inside three clipping ancestors (.album-drawer overflow:hidden > .album-drawer-body overflow-y:auto > .modal-right-column overflow-y:auto), so it was cut off at the bottom of the Edit Album Details modal. z-index could not help: clipping happens before stacking. It also always hung below the trigger, with no flip. Portal the popup to document.body and position it from the trigger's viewport rect, flipping above when there is more room there and capping max-height to the space available so it scrolls internally rather than overflowing. It is dismissed on scroll and resize, since the anchor is only measured on open. The outside-pointerdown handler now also treats the popup as inside; without that the portalled list counts as outside, and a click on an option would close it before the selection commits. * refactor(admin): single-column album details panel The left column spent 1.2fr on a cover thumbnail and three stat rows, two of which (Status, Custom Hero) only restated the form fields opposite them, while the form itself was squeezed into 1.8fr behind a second nested scroller. Stack the drawer in one column instead: cover as a banner, then the form at full width, with the UUID moved into the footer. The body is now the only scroll container, which also removes one of the ancestors that was clipping the sort popup. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> * fix(admin): give the portalled listbox its theme back, lock the page behind modals (#429) Two defects in the album editor. The sort listbox popup painted transparent. Every --admin-* variable is scoped to .admin-layout, and since the popup moved into document.body it sits outside that subtree, so background/border/text all resolved to nothing. It now carries its own copy of the palette in both colour schemes, plus the font it no longer inherits. Scrolling inside a modal also moved the page behind it. No admin modal ever locked body scroll: the overlay covers the page but does not absorb wheel events, so a scroll starting on the backdrop — or continuing past the end of the modal's own scroller — reaches the document. overscroll-behavior cannot cover that case on its own, because it only applies to scroll containers and the backdrop is not one. useScrollLock freezes body while a modal is open and compensates for the width the scrollbar gives up, so nothing shifts underneath. Each lock restores the inline value it found, which makes nesting work without a counter — a picker opened from the drawer restores the drawer's hidden state instead of clearing it. Applied to both drawers and all four picker modals, which share the defect. overscroll-behavior: contain on the scrollers stops the chaining they can handle themselves. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com> * fix(security): allow unsafe-eval in CSP script-src during dev mode * feat(journal): add Journal Studio with split-screen editor, live preview and dedicated routes * fix(build): separate client parser from server journal-service and fix build type errors * fix(journal): Fotos rendern, Layout und Lightbox-Steuerung korrigieren Fünf unabhängige Fehler in der öffentlichen Journal- und Essay-Ansicht: * Foto-Blöcke wurden nie angezeigt. EssayView löst ein Foto über PhotoItem.id auf, und das sind verschlüsselte Tokens — die Blöcke aus dem Markdown tragen aber rohe Asset-UUIDs. Jede Zuordnung lief ins Leere, und nicht auflösbare Blöcke werden still verworfen. Die IDs werden jetzt serverseitig übersetzt; damit verschwinden nebenbei die rohen UUIDs aus dem Client-Payload, die dort laut Projektregel nie auftauchen dürfen. Nicht auflösbare Referenzen werden geloggt. * Überschriften standen weiter links als der Fließtext. Jeder Block hatte einzeln `max-width: 68ch`, und `ch` ist relativ zur Schrift des Elements — die Serif-Überschrift ergab eine breitere Spalte. Ersetzt durch eine gemeinsame, font-unabhängige `--essay-measure`. * Fullbleed-Fotos bluteten nur nach links aus: `.essay-figure` ist `width: 100%`, wodurch die Box überbestimmt ist und der negative rechte Margin verworfen wird. * Foto-Paare stellten beide Bilder gleich breit dar, wodurch ein Hochformat neben einem Querformat doppelt so hoch wurde. Jetzt eine Justified-Reihe: Breite proportional zum Seitenverhältnis, dadurch exakt gleiche Höhen ohne Beschnitt. * Die Lightbox hatte im Journal keine Tastatursteuerung und keine Scroll-Sperre — beides lag in PhotoGrid, also nur im Album-Raster. Verlagert in die Lightbox selbst, der doppelte Handler in PhotoGrid entfernt (sonst wäre pro Pfeildruck zwei Bilder weitergesprungen). Zusätzlich sind Proofing-Herzen und das EXIF-Panel im redaktionellen Modus abschaltbar und im Journal aus: Client-Proofing ist ein Übergabe-Workflow für Alben, keine Funktion einer Reportage. Auf der Übersicht wurde der Untertitel doppelt gerendert, weil extractExcerpt() auf ihn zurückfällt. * feat(admin): eigene URLs für alle Bereiche und überarbeiteter Journal Studio Das Panel war eine einzige Client-Komponente, die ihre Tabs über useState umschaltet: keine Route pro Bereich, kein Deep-Link, kein Zurück-Button, und nach jedem Reload landete man wieder auf "Pages". Auch der Journal-Editor hatte keine eigene URL. Jetzt sieben echte Routen (/admin, /admin/pages, /admin/journal, /admin/journal/<slug>, /admin/settings, /admin/settings/<section>, /admin/analytics). Die Shell mit Auth-Prüfung und Kopfzeile sitzt im Layout und umschließt children — so bleibt die Session-Prüfung über Routenwechsel montiert, statt bei jedem Tab-Wechsel neu zu laufen und den Spinner aufblitzen zu lassen. Unbekannte Settings-Sections fallen auf General zurück. Im selben Zug der Journal Studio, der die Routing-Änderung ohnehin berührt: * Alle Eingabefelder nutzten die Klasse `admin-input`, die in keinem CSS definiert war — sie fielen auf Browser-Defaults zurück. Jetzt gestylt, gescoped, damit der generische Name nicht ins übrige Panel leckt. * Der Split View ist per Divider verschiebbar (Maus, Tastatur, Doppelklick zum Zurücksetzen), Breite in localStorage. * Das Studio bricht aus der 1120px-Spalte aus, die Preview hat Platz. * Die Preview zeigte für jedes Foto fest 3:2 und log damit über das Layout der veröffentlichten Seite; die echten Verhältnisse werden jetzt an den Thumbnails gemessen. * Blöcke mit alten positionsbasierten Foto-Referenzen werden markiert — die lassen sich auf einer eigenständigen Journal-Seite nicht auflösen und verschwanden bisher stillschweigend. * Blocktyp-Chips als gemeinsame Komponente, monochrom und per Icon unterschieden statt in einer eigenen Blau/Lila/Orange-Palette, die sonst nirgends im Panel vorkommt. * Emojis raus, SVG-Icons rein. * fix(admin): Designsystem-Lücken im Panel schließen Eine systematische Suche nach Klassen, die im TSX benutzt, aber in keinem CSS definiert sind, hat vier Stellen mit demselben Muster gefunden: * `admin-btn-secondary` und `admin-btn-danger` existierten nicht. Sämtliche Löschen-Buttons sahen aus wie normale Buttons — keine Warnwirkung. Als `.admin-btn.admin-btn-danger` geschrieben, weil die Varianten mit den Größenklassen kombiniert werden, die weiter unten ihren eigenen Hintergrund setzen. * `page-progress-fill` fehlte: die Balken im Analytics-Panel waren leere Rinnen, der Wert unsichtbar. Ebenso `analytics-empty` und `admin-loading-container`. * `subpage-drawer-section`, `subpage-drawer-title-group` und `input-with-icon` im PageBuilder waren wirkungslos und teils mit Inline-Styles notdürftig kompensiert. * `grid-card-preview` fehlte, wodurch alle Layout-Vorschauen auf Höhe null kollabierten. Nur "Showcase" war sichtbar — und das aus Versehen, weil sein Tile `hero-tile` hieß und damit die `aspect-ratio` einer fremden PageBuilder-Klasse erbte. Umbenannt. Dazu die Theme-Vorschauen, die praktisch identisch aussahen: alle sieben zeigten dieselben drei quadratischen Kacheln, einziger Unterschied war die Hintergrundfarbe. Sie spiegeln jetzt die echten Preset-Daten aus lib/config/theme.ts — Schriftcharakter, Eckradius, Rasterdichte, Passepartout bzw. Schatten. Die Kopfzeile richtet sich an einer gemeinsamen Steuerhöhe aus. Der "Site"-Link war höher als die Buttons daneben: `.admin-btn` hatte keine explizite line-height, und <button> bekommt box-sizing: border-box vom Browser, <a> nicht. Die Statusanzeige setzte weder Schriftfamilie noch -größe und fiel auf den Browser-Default zurück — sie war nie Teil des Designsystems. Jetzt gleiche Höhe und Typografie, Pillenform als Zustandsanzeige, Trenner zur Aktionsgruppe. Das dauerhafte Pulsieren des grünen Punkts entfällt; Animation bleibt den Zuständen vorbehalten, die Aufmerksamkeit brauchen. Restliche Emojis durch SVG-Icons ersetzt. * feat(admin): add scroll-to-top toggle and SVG arrow The back-to-top button was always on and drew its arrow with the ↑ text character. Add a `scrollToTop` setting (General section in the admin panel, defaults to on so existing sites are unaffected) and replace the glyph with a stroked SVG that inherits currentColor across all presets. Scroll handling is now rAF-throttled, and prefers-reduced-motion turns off both the hover lift and the smooth scroll. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * security(journal): escape author HTML instead of filtering it CodeQL flags 26 high-severity alerts on the release PR; the bulk of them point at sanitizeHtml(), a denylist of three regexes whose output goes into dangerouslySetInnerHTML. I reproduced the bypasses before changing anything — all four pass the old filter: <img src=x onerror=alert(1)> unquoted handler, regex wants quotes <img src=x onerror='alert(1)'> single quotes, same reason <svg onload=alert(1)> not a <script> tag javasjavascript:cript:alert(1) one-pass replace, the rest recombines Plus an attribute breakout in the link renderer, which interpolated the URL into href="${url}" unescaped: [x](" onmouseover=alert(1) x=") -> <a href="" onmouseover=alert(1" ...> Replaced with escaping. Every `&<>"'` in author text becomes an entity before any markdown rule runs, so the only tags in the output are the ones renderInlineMarkdown builds itself and a URL cannot leave its attribute. Link schemes are now an allowlist (http, https, mailto, tel, relative, anchor); anything else renders as plain text. The serializer needed decodeHtmlEntities to match: without it a save would write `&lt;` into the Markdown file and the next parse would escape the `&` again, corrupting the text further on every round trip. A test covers parse -> serialize -> parse stability. Two existing tests asserted the old behaviour and were rewritten rather than deleted: one expected the script tag to be *removed* from the output, the other expected the substring "onerror" to be absent. Both now assert the property that matters — that no tag can form — because `onerror` surviving as inert text is fine. Exploitation required admin access either way: journal and essay text comes from the studio or from content/*.md. This removes the weakness, it does not close an open door. * fix(journal): contain file paths, fix frontmatter escaping, defuse two regexes Follow-up to the CodeQL findings on release PR #432. I went through all 23 alerts individually; this addresses the ones that are worth addressing and documents the ones that are not. Path containment (12 alerts, all false positives). Every path built from a slug goes through isValidSlug(), a strict `/^[a-zA-Z0-9_-]+$/` allowlist — verified against `../../etc/passwd`, `foo/../../bar`, `a/b`, `..` and friends, all rejected. CodeQL cannot see it because the check lives in another module. Added a containedPath() helper that resolves the path and refuses anything landing outside the content directory: a second lock on a door that was already locked, and a barrier the analysis can follow. Also removed the dead `slug.endsWith('.md')` branches — isValidSlug rejects dots, so they could never be taken. Frontmatter escaping (1 alert, a real bug). The serializer escaped `"` but not `\`, and the parser never unescaped anything. A title containing either character gained a backslash on every save/load cycle: Path C:\Users "quoted" -> Path C:\\Users \"quoted\" -> ... Escaping now covers the backslash first and the parser undoes both. A round trip test covers quotes, backslashes, colons and apostrophes. Two of three ReDoS regexes (2 alerts). The heading pattern had `\s+` next to `(.+)`, which overlap, so the engine tried every split of the whitespace run before failing; it is `[ \t]+` and `(\S.*)` now. The quote author pattern wrapped a lazy group around an optional group — the quadratic case — and is an index split on the first separator now. The third regex, the bold/italic pass, is deliberately left alone. Rewriting it with a negated class removes the backtracking but breaks nesting: `**bold *and italic* here**` renders as `*<em>bold </em>and italic<em> here</em>*`. The input is Markdown from an authenticated admin, never a visitor, so the worst case is an author slowing down their own page. The comment in the code says so. Not addressed: 5 js/insufficient-password-hash alerts. They ask for a slow KDF where the code uses SHA-256/HMAC — correct in general, but the admin password comes from an environment variable and is never stored, so a stronger KDF protects nothing that is not already in plaintext in the environment. 399 unit tests pass (18 new), build and tsc clean. * fix(journal): split the quote author by scanning, not by pattern Cleaning up after myself. #439 replaced the quote author regex `/^(.*?)(?:\s+--\s+(.+))?$/` — a lazy group around an optional one, the quadratic case — with `/\s+--\s+/`, and CodeQL promptly flagged the replacement for the same reason. One reported pattern traded for another. splitQuoteAuthor() scans for the first `--` that has whitespace on both sides. Linear, and it needs no reasoning about the regex engine at all. Behaviour is identical to the original regex, checked case by case against it: separator, no separator, several separators, tabs, wide gaps, `a--b` without spaces, leading and trailing separators, empty string. All nine are covered by tests, plus one asserting it stays fast on a 50k whitespace run. * security(admin): derive the session signing key with scrypt getSigningKey() ran the admin password through a single SHA-256 digest. It is key derivation rather than password storage, so it was never a stored-hash problem — but if the derived key ever leaked, one fast hash makes recovering the password by brute force cheap. CodeQL flags it as js/insufficient-password-hash and, for this particular alert, has a point. scrypt now. Two details that matter: The salt has to be stable. A random salt would produce a different key on every call and invalidate every session; it is derived from AUTH_SECRET, which is deployment-specific. Verified across separate processes: same inputs produce a verifying token, so a restart or redeploy does not log everyone out. The result is cached for the process lifetime. scrypt is deliberately slow and getSigningKey() runs on every admin request — deriving per call would add ~24ms to each one. The cache key is a digest of secret plus password, so a rotation misses the cache and derives again, and no extra plaintext copy of the password is kept around. Measured: first derivation 24ms, subsequent calls 0.12ms. Password change and secret change both invalidate an existing token, checked in separate processes. Note the one-time effect: existing admin sessions are invalidated by the change in derivation, so everyone logs in once more. * security(admin): key the signing-key cache on its inputs, not a digest #441 removed the SHA-256 digest of the admin password from the key derivation and introduced a new one three lines above it, as the cache key. Same rule, same file: CodeQL reported it immediately. The comment justifying it was wrong too. It claimed no second plaintext copy of the password was retained, while building the digest input allocates exactly that in order to hash it. The cache now holds the two input strings and compares them directly. They are the same objects the env and install caches already hold, so nothing extra is retained, and no fast hash of the password exists in memory for the life of the process. Re-verified after the change, in separate processes: a token from one process verifies in another with the same inputs, a changed password or secret rejects it, first derivation 24ms, cached calls 0.001ms. That leaves scrypt as the only place the password is hashed here. The two HMACs further down operate on the derived key and on token data, not on the password; the constant-time comparison in verifyAdminPassword is the previously dismissed one. --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
2026-08-14 16:55:07 +02:00
{SETTINGS_SECTIONS.map((sec) => (
<Link
key={sec.id}
release: v0.11.0 — journal fixes, admin URLs, design system cleanup (#432) * fix(screenshots): sharp-Typen fuer 0.34 und 0.35 gleichzeitig (#410) sharp 0.35 ist von `export =` auf ESM umgestellt: der Modul-Namespace ist nicht mehr aufrufbar, die Factory sitzt unter .default. Der Type-Check brach damit in scripts/screenshots.ts weg, sobald der Next-Bump (#402) sharp von 0.34.5 auf 0.35.3 mitzieht -- sharp ist hier keine deklarierte Dependency, sondern kommt ueber Next mit. Die Form wird jetzt aus dem installierten Paket abgeleitet statt festgeschrieben, zur Laufzeit wie im Typ. Geprueft mit beiden Versionen: tsc laeuft mit 0.34.5 und mit 0.35.3 fehlerfrei durch. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(deps): bump the nextjs group across 1 directory with 2 updates (#402) Bumps the nextjs group with 2 updates in the / directory: [next](https://github.com/vercel/next.js) and [eslint-config-next](https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next). Updates `next` from 16.2.12 to 16.3.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/compare/v16.2.12...v16.3.0) Updates `eslint-config-next` from 16.2.12 to 16.3.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/commits/v16.3.0/packages/eslint-config-next) --- updated-dependencies: - dependency-name: eslint-config-next dependency-version: 16.3.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: nextjs - dependency-name: next dependency-version: 16.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nextjs ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps-dev): bump prettier from 3.8.3 to 3.9.6 (#405) Bumps [prettier](https://github.com/prettier/prettier) from 3.8.3 to 3.9.6. - [Release notes](https://github.com/prettier/prettier/releases) - [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md) - [Commits](https://github.com/prettier/prettier/compare/3.8.3...3.9.6) --- updated-dependencies: - dependency-name: prettier dependency-version: 3.9.6 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * docs(changelog): Unreleased-Sektion fuer die Bumps nach v0.10.0 (#413) Die Dependency-PRs sind nach dem Release auf dev gelandet, teils auch auf main. Ohne Eintrag waeren sie beim naechsten Release unsichtbar -- inklusive Next 16.3.0, das CVE-2025-13465 mitbringt. Ausserdem im 0.10.0-Abschnitt nachgetragen, dass der Trivy-Scan bis #409 nie gelaufen ist. Der Fix steckt im Tag v0.10.0, fehlte aber in der Aufzaehlung -- und "Images werden bei jedem Publish gescannt" stand im Changelog, waehrend der Job im Action-Setup abbrach. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(gallery): per-album sort order, independent of Immich (#408) (#414) Album order was dictated entirely by Immich: getAlbum() sorted by the album's own asc/desc flag, so a Folio album always mirrored the archive. A curated series has a narrative order that has nothing to do with capture time, and changing the Immich album's sort to fit the website changes it for the archive too. Adds an optional per-album `sort` in gallery.yaml, editable in /admin, defaulting to today's behaviour so every existing config is unchanged: immich (default) | newest | oldest | filename | manual `manual` is a pinned *prefix*: `assetOrder` lists only the photos placed by hand, everything else follows in the album's Immich order. A full permutation of a 2,000-photo album would be ~80 KB of UUIDs in a file that is rewritten and copied to content/.backups/ on every admin save. It also makes drift fall out for free — photos removed in Immich never match, new ones land in the tail rather than being hidden. Sorting is applied after the cache read, not before the cache write, so the LRU keeps one canonical Immich-ordered copy per album. That avoids putting the mode in the cache key, lets a config change take effect without depending on invalidation, and keeps the stale-serving path correct. cache.get() returns the stored object by reference, so withSort() returns a shallow clone with a new array — sorting in place would reorder the shared entry, and under request coalescing every concurrent caller would be sorting the same array. Also fixes a prerequisite bug: /api/admin/albums/[albumId]/assets read album.assets from GET /albums/:id, which Immich 3.x no longer populates (lib/immich.ts:507). The hero picker's "This Album" tab returned nothing and threw outright when the key was absent. It now goes through the client's paginated metadata search, with ?types=all to opt videos in for the reorder editor. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): drop decorative emoji from the sort select labels (#415) An <option> cannot contain markup, so the SVG set in Icons is not reachable there — but a decorative emoji is not a substitute for it. Plain text instead; the album card badge already uses a real icon. The remaining emoji in the admin panel (asset picker tabs, section headings, layout picker options) predate this branch and are left for a separate cleanup. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): replace emoji icons with the shared SVG icon set (#416) The admin panel mixed two icon conventions: inline SVGs from `Icons.tsx` in most components, and decorative emoji in the asset picker and a few PageBuilder labels. Emoji render inconsistently across platforms, ignore the accent colour, and cannot inherit the `.svg-icon` sizing rules. - Icons.tsx: add `IconStar` (filled — it marks a state, not an action) and `IconImage`. - AssetPicker: the three tab labels and the favourite tile badge now use IconFolder / IconStar / IconImage. - PageBuilder: the "Standalone Albums" and "Subpages" headings use the icon set instead of an emoji. - PageBuilder: the layout picker drops its emoji for plain text. An <option> cannot contain markup, so an SVG is impossible there and a decorative glyph is not a substitute. - admin.css: align icon and label in the picker tabs, and swap the favourite badge's text-shadow for drop-shadow, which is what applies to an inline SVG. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): fold PageBuilder's local icons into the shared Icons module (#418) * refactor(admin): fold PageBuilder's local icons into the shared module PageBuilder.tsx carried its own `Icons` object duplicating most of the glyphs already exported by Icons.tsx, with hardcoded sizes and slightly divergent paths. Migrate all 32 call sites to the shared module and delete the local object. Five glyphs had no counterpart and are added to Icons.tsx as 1:1 ports of the local paths: IconX, IconPlus, IconHome, IconCopy, IconImage. The local ExternalLink and Check are dropped rather than ported — both had zero call sites. Two glyphs change shape slightly, which is the point of consolidating: the shared IconCamera includes the viewfinder bump the local copy omitted, and drag handles now use IconGripVertical. IconGripVertical uses the module's square 24x24 viewBox, so `.svg-drag` goes from 12x18 to 18x18 — the old non-square box would letterbox the glyph down to 12x12 and shrink the handle. * fix(admin): resolve icon-module integration after #416 Merging dev brought in #416, which added a second IconImage to Icons.tsx and two <Icons.Camera>/<Icons.Folder> section headers that reference the local Icons object this PR removes. Git merged both cleanly but the result did not type-check. - drop the duplicate IconImage (both copies were byte-identical) - point the two section headers at the imported IconCamera/IconFolder - refresh the SORT_LABELS comment: the icon set is imported now, not declared below --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> * fix(config): allow an empty gallery, guard against a double /api suffix (#421) An empty gallery is now a valid, rendered state instead of a throw: deriveGallery() no longer requires at least one album or subpage, so a deployment with no albums yet renders a bare homepage the owner can fill in via /admin. getConfig() also stops appending /api to an Immich URL that already ends in it, which previously produced .../api/api and broke every upstream request. Includes a restore of the per-album sort test cases, which the branch had lost by being cut before #408/#414. * feat(admin): favicon upload, served from the content volume (#422) Adds a bundled default favicon, an upload widget in admin Settings > General, and a route that serves the icon from the writable content/ volume with a fallback to the bundled default. Raster uploads (PNG/ICO/JPEG) are wrapped in an SVG container; the response carries its own CSP so an uploaded SVG cannot execute script on the origin. The GET route revalidates with an ETag instead of caching immutably, so a newly uploaded icon shows up immediately. Uploads are written via temp file + rename, and a Reset button restores the bundled default. * ci: flag unformatted files in a PR, without blocking it (#424) Prettier is configured as an error rule in eslint.config.mjs but has never run in CI, so part of the tree predates it. A final CI step now diffs against the PR base, runs prettier --list-different over the changed files, and emits a warning annotation per offender plus a job summary. Advisory by design: it never fails the job. Blocking would turn a PR red for merely touching a file that was already unformatted, and normalising the tree in one commit would wreck git blame and conflict with the PRs in flight. Requires fetch-depth: 0, since diffing against the base needs its history. * feat(install): first-run wizard gated by a one-time setup token (#419) Adds /install, a four-step first-run wizard: connect to Immich, optionally pick albums, name the site, finish. It verifies the credentials against the Immich server before writing anything, then writes gallery.yaml, settings.yaml and a content/install.json carrying the Immich credentials and a generated site secret. install.json exists because a running process cannot pick up new env vars — the wizard has to write configuration that takes effect without a restart. getInstallCredentials() merges it under the real environment, so env vars always win and rotation stays a matter of setting one. Both the page and the API routes are gated by a one-time setup token printed to the server log, so a deployment that is reachable before gallery.yaml exists cannot be configured by whoever finds it first. The token is stored in content/.setup-token (0600) rather than a module variable: Next.js bundles the page and each route handler separately, so a module-level token left the page and the API disagreeing inside one process and the wizard stuck on step 1. It is removed once the install completes. The admin password is stored as an scrypt hash using the scheme lib/auth.ts already applies to album passwords; a plaintext ADMIN_PASSWORD env var keeps working. * docs: document the setup wizard, fix the read-only content mount (#425) Quick Start now leads with the /install wizard, with the hand-written YAML route kept alongside it, and a First-Run Setup section covers the setup token, the files the wizard writes, and env-var precedence. Two corrections: both Docker examples mounted content/ as :ro, which silently breaks the wizard, the admin panel and the backup rotation alike — docs/admin-panel.md already said so and the README contradicted it. And nothing documented that content/install.json holds the Immich API key, so a backup of content/ is a backup of credentials. Also adds a Contributors section crediting the people whose work is in the project. * feat(admin): floating save bar pinned to the bottom of the viewport (#426) The save bar was the first, static element inside .admin-main. Since the document itself scrolls, it left the viewport as soon as you scrolled down — editing a subpage section or a settings block far below gave no visible dirty hint and no reachable save button. Replace it with a bottom-pinned floating bar shared by both editors. It only mounts while there is something to act on (unsaved changes, an in-flight save, or a result message), so it never covers content while idle. The success message clears after 5s, which hides the bar again. - new SaveBar component, replacing the duplicated markup in PageBuilder and SettingsEditor - adopt the previously unused .floating-save-bar CSS: slide-in keyframes (carrying translateX(-50%)), dirty border, wrap/gap, mobile variant and a prefers-reduced-motion opt-out; z-index 900 keeps it below modals - .admin-main gains bottom padding so the bar never covers page content - drop the now-unreachable idle hints: the ⌘S hint becomes a button title, the Live Sync note becomes a static line above the settings layout - header "Site" link now bypasses the cache (/?fresh=1), so the preview stays reachable when the bar is hidden Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(admin): themed listbox for the album sort control (#427) The per-album "Photo order" control was a native <select>. Because an <option> cannot contain markup, its choices could not use the admin panel's currentColor SVG set — the reason #415 had to fall back to plain text after dropping the emoji labels. Adds a Listbox component implementing the ARIA combobox/listbox pattern, so options can render a glyph beside their label: - DOM focus stays on the trigger button; the active option is announced through aria-activedescendant, keeping focus management to one element - Keyboard: arrows (clamped at the ends, like a native select), Home/End, Enter/Space to commit, Escape to cancel, Tab commits and moves on, and prefix type-ahead with a repeat-key cycle - Outside dismissal on pointerdown, so a press starting outside closes the popup before the click retargets The sort options now carry an icon each: calendar, arrow-down, arrow-up, an A→Z marker, and the drag glyph for manual — matching the badge the album card already shows. SORT_LABELS stays plain text because the badge feeds it to a title attribute. Closes #417 Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(git): ignore generated design handoff folders * fix(admin): stop the album sort dropdown clipping, and simplify the panel (#428) * fix(admin): render listbox popup in a portal so it escapes modal clipping The sort control's popup was position:absolute inside three clipping ancestors (.album-drawer overflow:hidden > .album-drawer-body overflow-y:auto > .modal-right-column overflow-y:auto), so it was cut off at the bottom of the Edit Album Details modal. z-index could not help: clipping happens before stacking. It also always hung below the trigger, with no flip. Portal the popup to document.body and position it from the trigger's viewport rect, flipping above when there is more room there and capping max-height to the space available so it scrolls internally rather than overflowing. It is dismissed on scroll and resize, since the anchor is only measured on open. The outside-pointerdown handler now also treats the popup as inside; without that the portalled list counts as outside, and a click on an option would close it before the selection commits. * refactor(admin): single-column album details panel The left column spent 1.2fr on a cover thumbnail and three stat rows, two of which (Status, Custom Hero) only restated the form fields opposite them, while the form itself was squeezed into 1.8fr behind a second nested scroller. Stack the drawer in one column instead: cover as a banner, then the form at full width, with the UUID moved into the footer. The body is now the only scroll container, which also removes one of the ancestors that was clipping the sort popup. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> * fix(admin): give the portalled listbox its theme back, lock the page behind modals (#429) Two defects in the album editor. The sort listbox popup painted transparent. Every --admin-* variable is scoped to .admin-layout, and since the popup moved into document.body it sits outside that subtree, so background/border/text all resolved to nothing. It now carries its own copy of the palette in both colour schemes, plus the font it no longer inherits. Scrolling inside a modal also moved the page behind it. No admin modal ever locked body scroll: the overlay covers the page but does not absorb wheel events, so a scroll starting on the backdrop — or continuing past the end of the modal's own scroller — reaches the document. overscroll-behavior cannot cover that case on its own, because it only applies to scroll containers and the backdrop is not one. useScrollLock freezes body while a modal is open and compensates for the width the scrollbar gives up, so nothing shifts underneath. Each lock restores the inline value it found, which makes nesting work without a counter — a picker opened from the drawer restores the drawer's hidden state instead of clearing it. Applied to both drawers and all four picker modals, which share the defect. overscroll-behavior: contain on the scrollers stops the chaining they can handle themselves. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com> * fix(security): allow unsafe-eval in CSP script-src during dev mode * feat(journal): add Journal Studio with split-screen editor, live preview and dedicated routes * fix(build): separate client parser from server journal-service and fix build type errors * fix(journal): Fotos rendern, Layout und Lightbox-Steuerung korrigieren Fünf unabhängige Fehler in der öffentlichen Journal- und Essay-Ansicht: * Foto-Blöcke wurden nie angezeigt. EssayView löst ein Foto über PhotoItem.id auf, und das sind verschlüsselte Tokens — die Blöcke aus dem Markdown tragen aber rohe Asset-UUIDs. Jede Zuordnung lief ins Leere, und nicht auflösbare Blöcke werden still verworfen. Die IDs werden jetzt serverseitig übersetzt; damit verschwinden nebenbei die rohen UUIDs aus dem Client-Payload, die dort laut Projektregel nie auftauchen dürfen. Nicht auflösbare Referenzen werden geloggt. * Überschriften standen weiter links als der Fließtext. Jeder Block hatte einzeln `max-width: 68ch`, und `ch` ist relativ zur Schrift des Elements — die Serif-Überschrift ergab eine breitere Spalte. Ersetzt durch eine gemeinsame, font-unabhängige `--essay-measure`. * Fullbleed-Fotos bluteten nur nach links aus: `.essay-figure` ist `width: 100%`, wodurch die Box überbestimmt ist und der negative rechte Margin verworfen wird. * Foto-Paare stellten beide Bilder gleich breit dar, wodurch ein Hochformat neben einem Querformat doppelt so hoch wurde. Jetzt eine Justified-Reihe: Breite proportional zum Seitenverhältnis, dadurch exakt gleiche Höhen ohne Beschnitt. * Die Lightbox hatte im Journal keine Tastatursteuerung und keine Scroll-Sperre — beides lag in PhotoGrid, also nur im Album-Raster. Verlagert in die Lightbox selbst, der doppelte Handler in PhotoGrid entfernt (sonst wäre pro Pfeildruck zwei Bilder weitergesprungen). Zusätzlich sind Proofing-Herzen und das EXIF-Panel im redaktionellen Modus abschaltbar und im Journal aus: Client-Proofing ist ein Übergabe-Workflow für Alben, keine Funktion einer Reportage. Auf der Übersicht wurde der Untertitel doppelt gerendert, weil extractExcerpt() auf ihn zurückfällt. * feat(admin): eigene URLs für alle Bereiche und überarbeiteter Journal Studio Das Panel war eine einzige Client-Komponente, die ihre Tabs über useState umschaltet: keine Route pro Bereich, kein Deep-Link, kein Zurück-Button, und nach jedem Reload landete man wieder auf "Pages". Auch der Journal-Editor hatte keine eigene URL. Jetzt sieben echte Routen (/admin, /admin/pages, /admin/journal, /admin/journal/<slug>, /admin/settings, /admin/settings/<section>, /admin/analytics). Die Shell mit Auth-Prüfung und Kopfzeile sitzt im Layout und umschließt children — so bleibt die Session-Prüfung über Routenwechsel montiert, statt bei jedem Tab-Wechsel neu zu laufen und den Spinner aufblitzen zu lassen. Unbekannte Settings-Sections fallen auf General zurück. Im selben Zug der Journal Studio, der die Routing-Änderung ohnehin berührt: * Alle Eingabefelder nutzten die Klasse `admin-input`, die in keinem CSS definiert war — sie fielen auf Browser-Defaults zurück. Jetzt gestylt, gescoped, damit der generische Name nicht ins übrige Panel leckt. * Der Split View ist per Divider verschiebbar (Maus, Tastatur, Doppelklick zum Zurücksetzen), Breite in localStorage. * Das Studio bricht aus der 1120px-Spalte aus, die Preview hat Platz. * Die Preview zeigte für jedes Foto fest 3:2 und log damit über das Layout der veröffentlichten Seite; die echten Verhältnisse werden jetzt an den Thumbnails gemessen. * Blöcke mit alten positionsbasierten Foto-Referenzen werden markiert — die lassen sich auf einer eigenständigen Journal-Seite nicht auflösen und verschwanden bisher stillschweigend. * Blocktyp-Chips als gemeinsame Komponente, monochrom und per Icon unterschieden statt in einer eigenen Blau/Lila/Orange-Palette, die sonst nirgends im Panel vorkommt. * Emojis raus, SVG-Icons rein. * fix(admin): Designsystem-Lücken im Panel schließen Eine systematische Suche nach Klassen, die im TSX benutzt, aber in keinem CSS definiert sind, hat vier Stellen mit demselben Muster gefunden: * `admin-btn-secondary` und `admin-btn-danger` existierten nicht. Sämtliche Löschen-Buttons sahen aus wie normale Buttons — keine Warnwirkung. Als `.admin-btn.admin-btn-danger` geschrieben, weil die Varianten mit den Größenklassen kombiniert werden, die weiter unten ihren eigenen Hintergrund setzen. * `page-progress-fill` fehlte: die Balken im Analytics-Panel waren leere Rinnen, der Wert unsichtbar. Ebenso `analytics-empty` und `admin-loading-container`. * `subpage-drawer-section`, `subpage-drawer-title-group` und `input-with-icon` im PageBuilder waren wirkungslos und teils mit Inline-Styles notdürftig kompensiert. * `grid-card-preview` fehlte, wodurch alle Layout-Vorschauen auf Höhe null kollabierten. Nur "Showcase" war sichtbar — und das aus Versehen, weil sein Tile `hero-tile` hieß und damit die `aspect-ratio` einer fremden PageBuilder-Klasse erbte. Umbenannt. Dazu die Theme-Vorschauen, die praktisch identisch aussahen: alle sieben zeigten dieselben drei quadratischen Kacheln, einziger Unterschied war die Hintergrundfarbe. Sie spiegeln jetzt die echten Preset-Daten aus lib/config/theme.ts — Schriftcharakter, Eckradius, Rasterdichte, Passepartout bzw. Schatten. Die Kopfzeile richtet sich an einer gemeinsamen Steuerhöhe aus. Der "Site"-Link war höher als die Buttons daneben: `.admin-btn` hatte keine explizite line-height, und <button> bekommt box-sizing: border-box vom Browser, <a> nicht. Die Statusanzeige setzte weder Schriftfamilie noch -größe und fiel auf den Browser-Default zurück — sie war nie Teil des Designsystems. Jetzt gleiche Höhe und Typografie, Pillenform als Zustandsanzeige, Trenner zur Aktionsgruppe. Das dauerhafte Pulsieren des grünen Punkts entfällt; Animation bleibt den Zuständen vorbehalten, die Aufmerksamkeit brauchen. Restliche Emojis durch SVG-Icons ersetzt. * feat(admin): add scroll-to-top toggle and SVG arrow The back-to-top button was always on and drew its arrow with the ↑ text character. Add a `scrollToTop` setting (General section in the admin panel, defaults to on so existing sites are unaffected) and replace the glyph with a stroked SVG that inherits currentColor across all presets. Scroll handling is now rAF-throttled, and prefers-reduced-motion turns off both the hover lift and the smooth scroll. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * security(journal): escape author HTML instead of filtering it CodeQL flags 26 high-severity alerts on the release PR; the bulk of them point at sanitizeHtml(), a denylist of three regexes whose output goes into dangerouslySetInnerHTML. I reproduced the bypasses before changing anything — all four pass the old filter: <img src=x onerror=alert(1)> unquoted handler, regex wants quotes <img src=x onerror='alert(1)'> single quotes, same reason <svg onload=alert(1)> not a <script> tag javasjavascript:cript:alert(1) one-pass replace, the rest recombines Plus an attribute breakout in the link renderer, which interpolated the URL into href="${url}" unescaped: [x](" onmouseover=alert(1) x=") -> <a href="" onmouseover=alert(1" ...> Replaced with escaping. Every `&<>"'` in author text becomes an entity before any markdown rule runs, so the only tags in the output are the ones renderInlineMarkdown builds itself and a URL cannot leave its attribute. Link schemes are now an allowlist (http, https, mailto, tel, relative, anchor); anything else renders as plain text. The serializer needed decodeHtmlEntities to match: without it a save would write `&lt;` into the Markdown file and the next parse would escape the `&` again, corrupting the text further on every round trip. A test covers parse -> serialize -> parse stability. Two existing tests asserted the old behaviour and were rewritten rather than deleted: one expected the script tag to be *removed* from the output, the other expected the substring "onerror" to be absent. Both now assert the property that matters — that no tag can form — because `onerror` surviving as inert text is fine. Exploitation required admin access either way: journal and essay text comes from the studio or from content/*.md. This removes the weakness, it does not close an open door. * fix(journal): contain file paths, fix frontmatter escaping, defuse two regexes Follow-up to the CodeQL findings on release PR #432. I went through all 23 alerts individually; this addresses the ones that are worth addressing and documents the ones that are not. Path containment (12 alerts, all false positives). Every path built from a slug goes through isValidSlug(), a strict `/^[a-zA-Z0-9_-]+$/` allowlist — verified against `../../etc/passwd`, `foo/../../bar`, `a/b`, `..` and friends, all rejected. CodeQL cannot see it because the check lives in another module. Added a containedPath() helper that resolves the path and refuses anything landing outside the content directory: a second lock on a door that was already locked, and a barrier the analysis can follow. Also removed the dead `slug.endsWith('.md')` branches — isValidSlug rejects dots, so they could never be taken. Frontmatter escaping (1 alert, a real bug). The serializer escaped `"` but not `\`, and the parser never unescaped anything. A title containing either character gained a backslash on every save/load cycle: Path C:\Users "quoted" -> Path C:\\Users \"quoted\" -> ... Escaping now covers the backslash first and the parser undoes both. A round trip test covers quotes, backslashes, colons and apostrophes. Two of three ReDoS regexes (2 alerts). The heading pattern had `\s+` next to `(.+)`, which overlap, so the engine tried every split of the whitespace run before failing; it is `[ \t]+` and `(\S.*)` now. The quote author pattern wrapped a lazy group around an optional group — the quadratic case — and is an index split on the first separator now. The third regex, the bold/italic pass, is deliberately left alone. Rewriting it with a negated class removes the backtracking but breaks nesting: `**bold *and italic* here**` renders as `*<em>bold </em>and italic<em> here</em>*`. The input is Markdown from an authenticated admin, never a visitor, so the worst case is an author slowing down their own page. The comment in the code says so. Not addressed: 5 js/insufficient-password-hash alerts. They ask for a slow KDF where the code uses SHA-256/HMAC — correct in general, but the admin password comes from an environment variable and is never stored, so a stronger KDF protects nothing that is not already in plaintext in the environment. 399 unit tests pass (18 new), build and tsc clean. * fix(journal): split the quote author by scanning, not by pattern Cleaning up after myself. #439 replaced the quote author regex `/^(.*?)(?:\s+--\s+(.+))?$/` — a lazy group around an optional one, the quadratic case — with `/\s+--\s+/`, and CodeQL promptly flagged the replacement for the same reason. One reported pattern traded for another. splitQuoteAuthor() scans for the first `--` that has whitespace on both sides. Linear, and it needs no reasoning about the regex engine at all. Behaviour is identical to the original regex, checked case by case against it: separator, no separator, several separators, tabs, wide gaps, `a--b` without spaces, leading and trailing separators, empty string. All nine are covered by tests, plus one asserting it stays fast on a 50k whitespace run. * security(admin): derive the session signing key with scrypt getSigningKey() ran the admin password through a single SHA-256 digest. It is key derivation rather than password storage, so it was never a stored-hash problem — but if the derived key ever leaked, one fast hash makes recovering the password by brute force cheap. CodeQL flags it as js/insufficient-password-hash and, for this particular alert, has a point. scrypt now. Two details that matter: The salt has to be stable. A random salt would produce a different key on every call and invalidate every session; it is derived from AUTH_SECRET, which is deployment-specific. Verified across separate processes: same inputs produce a verifying token, so a restart or redeploy does not log everyone out. The result is cached for the process lifetime. scrypt is deliberately slow and getSigningKey() runs on every admin request — deriving per call would add ~24ms to each one. The cache key is a digest of secret plus password, so a rotation misses the cache and derives again, and no extra plaintext copy of the password is kept around. Measured: first derivation 24ms, subsequent calls 0.12ms. Password change and secret change both invalidate an existing token, checked in separate processes. Note the one-time effect: existing admin sessions are invalidated by the change in derivation, so everyone logs in once more. * security(admin): key the signing-key cache on its inputs, not a digest #441 removed the SHA-256 digest of the admin password from the key derivation and introduced a new one three lines above it, as the cache key. Same rule, same file: CodeQL reported it immediately. The comment justifying it was wrong too. It claimed no second plaintext copy of the password was retained, while building the digest input allocates exactly that in order to hash it. The cache now holds the two input strings and compares them directly. They are the same objects the env and install caches already hold, so nothing extra is retained, and no fast hash of the password exists in memory for the life of the process. Re-verified after the change, in separate processes: a token from one process verifies in another with the same inputs, a changed password or secret rejects it, first derivation 24ms, cached calls 0.001ms. That leaves scrypt as the only place the password is hashed here. The two HMACs further down operate on the derived key and on token data, not on the password; the constant-time comparison in verifyAdminPassword is the previously dismissed one. --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
2026-08-14 16:55:07 +02:00
href={`/admin/settings/${sec.id}`}
className={`settings-nav-item ${activeSection === sec.id ? 'active' : ''}`}
>
{sec.label}
release: v0.11.0 — journal fixes, admin URLs, design system cleanup (#432) * fix(screenshots): sharp-Typen fuer 0.34 und 0.35 gleichzeitig (#410) sharp 0.35 ist von `export =` auf ESM umgestellt: der Modul-Namespace ist nicht mehr aufrufbar, die Factory sitzt unter .default. Der Type-Check brach damit in scripts/screenshots.ts weg, sobald der Next-Bump (#402) sharp von 0.34.5 auf 0.35.3 mitzieht -- sharp ist hier keine deklarierte Dependency, sondern kommt ueber Next mit. Die Form wird jetzt aus dem installierten Paket abgeleitet statt festgeschrieben, zur Laufzeit wie im Typ. Geprueft mit beiden Versionen: tsc laeuft mit 0.34.5 und mit 0.35.3 fehlerfrei durch. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(deps): bump the nextjs group across 1 directory with 2 updates (#402) Bumps the nextjs group with 2 updates in the / directory: [next](https://github.com/vercel/next.js) and [eslint-config-next](https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next). Updates `next` from 16.2.12 to 16.3.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/compare/v16.2.12...v16.3.0) Updates `eslint-config-next` from 16.2.12 to 16.3.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/commits/v16.3.0/packages/eslint-config-next) --- updated-dependencies: - dependency-name: eslint-config-next dependency-version: 16.3.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: nextjs - dependency-name: next dependency-version: 16.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nextjs ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps-dev): bump prettier from 3.8.3 to 3.9.6 (#405) Bumps [prettier](https://github.com/prettier/prettier) from 3.8.3 to 3.9.6. - [Release notes](https://github.com/prettier/prettier/releases) - [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md) - [Commits](https://github.com/prettier/prettier/compare/3.8.3...3.9.6) --- updated-dependencies: - dependency-name: prettier dependency-version: 3.9.6 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * docs(changelog): Unreleased-Sektion fuer die Bumps nach v0.10.0 (#413) Die Dependency-PRs sind nach dem Release auf dev gelandet, teils auch auf main. Ohne Eintrag waeren sie beim naechsten Release unsichtbar -- inklusive Next 16.3.0, das CVE-2025-13465 mitbringt. Ausserdem im 0.10.0-Abschnitt nachgetragen, dass der Trivy-Scan bis #409 nie gelaufen ist. Der Fix steckt im Tag v0.10.0, fehlte aber in der Aufzaehlung -- und "Images werden bei jedem Publish gescannt" stand im Changelog, waehrend der Job im Action-Setup abbrach. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(gallery): per-album sort order, independent of Immich (#408) (#414) Album order was dictated entirely by Immich: getAlbum() sorted by the album's own asc/desc flag, so a Folio album always mirrored the archive. A curated series has a narrative order that has nothing to do with capture time, and changing the Immich album's sort to fit the website changes it for the archive too. Adds an optional per-album `sort` in gallery.yaml, editable in /admin, defaulting to today's behaviour so every existing config is unchanged: immich (default) | newest | oldest | filename | manual `manual` is a pinned *prefix*: `assetOrder` lists only the photos placed by hand, everything else follows in the album's Immich order. A full permutation of a 2,000-photo album would be ~80 KB of UUIDs in a file that is rewritten and copied to content/.backups/ on every admin save. It also makes drift fall out for free — photos removed in Immich never match, new ones land in the tail rather than being hidden. Sorting is applied after the cache read, not before the cache write, so the LRU keeps one canonical Immich-ordered copy per album. That avoids putting the mode in the cache key, lets a config change take effect without depending on invalidation, and keeps the stale-serving path correct. cache.get() returns the stored object by reference, so withSort() returns a shallow clone with a new array — sorting in place would reorder the shared entry, and under request coalescing every concurrent caller would be sorting the same array. Also fixes a prerequisite bug: /api/admin/albums/[albumId]/assets read album.assets from GET /albums/:id, which Immich 3.x no longer populates (lib/immich.ts:507). The hero picker's "This Album" tab returned nothing and threw outright when the key was absent. It now goes through the client's paginated metadata search, with ?types=all to opt videos in for the reorder editor. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): drop decorative emoji from the sort select labels (#415) An <option> cannot contain markup, so the SVG set in Icons is not reachable there — but a decorative emoji is not a substitute for it. Plain text instead; the album card badge already uses a real icon. The remaining emoji in the admin panel (asset picker tabs, section headings, layout picker options) predate this branch and are left for a separate cleanup. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): replace emoji icons with the shared SVG icon set (#416) The admin panel mixed two icon conventions: inline SVGs from `Icons.tsx` in most components, and decorative emoji in the asset picker and a few PageBuilder labels. Emoji render inconsistently across platforms, ignore the accent colour, and cannot inherit the `.svg-icon` sizing rules. - Icons.tsx: add `IconStar` (filled — it marks a state, not an action) and `IconImage`. - AssetPicker: the three tab labels and the favourite tile badge now use IconFolder / IconStar / IconImage. - PageBuilder: the "Standalone Albums" and "Subpages" headings use the icon set instead of an emoji. - PageBuilder: the layout picker drops its emoji for plain text. An <option> cannot contain markup, so an SVG is impossible there and a decorative glyph is not a substitute. - admin.css: align icon and label in the picker tabs, and swap the favourite badge's text-shadow for drop-shadow, which is what applies to an inline SVG. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): fold PageBuilder's local icons into the shared Icons module (#418) * refactor(admin): fold PageBuilder's local icons into the shared module PageBuilder.tsx carried its own `Icons` object duplicating most of the glyphs already exported by Icons.tsx, with hardcoded sizes and slightly divergent paths. Migrate all 32 call sites to the shared module and delete the local object. Five glyphs had no counterpart and are added to Icons.tsx as 1:1 ports of the local paths: IconX, IconPlus, IconHome, IconCopy, IconImage. The local ExternalLink and Check are dropped rather than ported — both had zero call sites. Two glyphs change shape slightly, which is the point of consolidating: the shared IconCamera includes the viewfinder bump the local copy omitted, and drag handles now use IconGripVertical. IconGripVertical uses the module's square 24x24 viewBox, so `.svg-drag` goes from 12x18 to 18x18 — the old non-square box would letterbox the glyph down to 12x12 and shrink the handle. * fix(admin): resolve icon-module integration after #416 Merging dev brought in #416, which added a second IconImage to Icons.tsx and two <Icons.Camera>/<Icons.Folder> section headers that reference the local Icons object this PR removes. Git merged both cleanly but the result did not type-check. - drop the duplicate IconImage (both copies were byte-identical) - point the two section headers at the imported IconCamera/IconFolder - refresh the SORT_LABELS comment: the icon set is imported now, not declared below --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> * fix(config): allow an empty gallery, guard against a double /api suffix (#421) An empty gallery is now a valid, rendered state instead of a throw: deriveGallery() no longer requires at least one album or subpage, so a deployment with no albums yet renders a bare homepage the owner can fill in via /admin. getConfig() also stops appending /api to an Immich URL that already ends in it, which previously produced .../api/api and broke every upstream request. Includes a restore of the per-album sort test cases, which the branch had lost by being cut before #408/#414. * feat(admin): favicon upload, served from the content volume (#422) Adds a bundled default favicon, an upload widget in admin Settings > General, and a route that serves the icon from the writable content/ volume with a fallback to the bundled default. Raster uploads (PNG/ICO/JPEG) are wrapped in an SVG container; the response carries its own CSP so an uploaded SVG cannot execute script on the origin. The GET route revalidates with an ETag instead of caching immutably, so a newly uploaded icon shows up immediately. Uploads are written via temp file + rename, and a Reset button restores the bundled default. * ci: flag unformatted files in a PR, without blocking it (#424) Prettier is configured as an error rule in eslint.config.mjs but has never run in CI, so part of the tree predates it. A final CI step now diffs against the PR base, runs prettier --list-different over the changed files, and emits a warning annotation per offender plus a job summary. Advisory by design: it never fails the job. Blocking would turn a PR red for merely touching a file that was already unformatted, and normalising the tree in one commit would wreck git blame and conflict with the PRs in flight. Requires fetch-depth: 0, since diffing against the base needs its history. * feat(install): first-run wizard gated by a one-time setup token (#419) Adds /install, a four-step first-run wizard: connect to Immich, optionally pick albums, name the site, finish. It verifies the credentials against the Immich server before writing anything, then writes gallery.yaml, settings.yaml and a content/install.json carrying the Immich credentials and a generated site secret. install.json exists because a running process cannot pick up new env vars — the wizard has to write configuration that takes effect without a restart. getInstallCredentials() merges it under the real environment, so env vars always win and rotation stays a matter of setting one. Both the page and the API routes are gated by a one-time setup token printed to the server log, so a deployment that is reachable before gallery.yaml exists cannot be configured by whoever finds it first. The token is stored in content/.setup-token (0600) rather than a module variable: Next.js bundles the page and each route handler separately, so a module-level token left the page and the API disagreeing inside one process and the wizard stuck on step 1. It is removed once the install completes. The admin password is stored as an scrypt hash using the scheme lib/auth.ts already applies to album passwords; a plaintext ADMIN_PASSWORD env var keeps working. * docs: document the setup wizard, fix the read-only content mount (#425) Quick Start now leads with the /install wizard, with the hand-written YAML route kept alongside it, and a First-Run Setup section covers the setup token, the files the wizard writes, and env-var precedence. Two corrections: both Docker examples mounted content/ as :ro, which silently breaks the wizard, the admin panel and the backup rotation alike — docs/admin-panel.md already said so and the README contradicted it. And nothing documented that content/install.json holds the Immich API key, so a backup of content/ is a backup of credentials. Also adds a Contributors section crediting the people whose work is in the project. * feat(admin): floating save bar pinned to the bottom of the viewport (#426) The save bar was the first, static element inside .admin-main. Since the document itself scrolls, it left the viewport as soon as you scrolled down — editing a subpage section or a settings block far below gave no visible dirty hint and no reachable save button. Replace it with a bottom-pinned floating bar shared by both editors. It only mounts while there is something to act on (unsaved changes, an in-flight save, or a result message), so it never covers content while idle. The success message clears after 5s, which hides the bar again. - new SaveBar component, replacing the duplicated markup in PageBuilder and SettingsEditor - adopt the previously unused .floating-save-bar CSS: slide-in keyframes (carrying translateX(-50%)), dirty border, wrap/gap, mobile variant and a prefers-reduced-motion opt-out; z-index 900 keeps it below modals - .admin-main gains bottom padding so the bar never covers page content - drop the now-unreachable idle hints: the ⌘S hint becomes a button title, the Live Sync note becomes a static line above the settings layout - header "Site" link now bypasses the cache (/?fresh=1), so the preview stays reachable when the bar is hidden Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(admin): themed listbox for the album sort control (#427) The per-album "Photo order" control was a native <select>. Because an <option> cannot contain markup, its choices could not use the admin panel's currentColor SVG set — the reason #415 had to fall back to plain text after dropping the emoji labels. Adds a Listbox component implementing the ARIA combobox/listbox pattern, so options can render a glyph beside their label: - DOM focus stays on the trigger button; the active option is announced through aria-activedescendant, keeping focus management to one element - Keyboard: arrows (clamped at the ends, like a native select), Home/End, Enter/Space to commit, Escape to cancel, Tab commits and moves on, and prefix type-ahead with a repeat-key cycle - Outside dismissal on pointerdown, so a press starting outside closes the popup before the click retargets The sort options now carry an icon each: calendar, arrow-down, arrow-up, an A→Z marker, and the drag glyph for manual — matching the badge the album card already shows. SORT_LABELS stays plain text because the badge feeds it to a title attribute. Closes #417 Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(git): ignore generated design handoff folders * fix(admin): stop the album sort dropdown clipping, and simplify the panel (#428) * fix(admin): render listbox popup in a portal so it escapes modal clipping The sort control's popup was position:absolute inside three clipping ancestors (.album-drawer overflow:hidden > .album-drawer-body overflow-y:auto > .modal-right-column overflow-y:auto), so it was cut off at the bottom of the Edit Album Details modal. z-index could not help: clipping happens before stacking. It also always hung below the trigger, with no flip. Portal the popup to document.body and position it from the trigger's viewport rect, flipping above when there is more room there and capping max-height to the space available so it scrolls internally rather than overflowing. It is dismissed on scroll and resize, since the anchor is only measured on open. The outside-pointerdown handler now also treats the popup as inside; without that the portalled list counts as outside, and a click on an option would close it before the selection commits. * refactor(admin): single-column album details panel The left column spent 1.2fr on a cover thumbnail and three stat rows, two of which (Status, Custom Hero) only restated the form fields opposite them, while the form itself was squeezed into 1.8fr behind a second nested scroller. Stack the drawer in one column instead: cover as a banner, then the form at full width, with the UUID moved into the footer. The body is now the only scroll container, which also removes one of the ancestors that was clipping the sort popup. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> * fix(admin): give the portalled listbox its theme back, lock the page behind modals (#429) Two defects in the album editor. The sort listbox popup painted transparent. Every --admin-* variable is scoped to .admin-layout, and since the popup moved into document.body it sits outside that subtree, so background/border/text all resolved to nothing. It now carries its own copy of the palette in both colour schemes, plus the font it no longer inherits. Scrolling inside a modal also moved the page behind it. No admin modal ever locked body scroll: the overlay covers the page but does not absorb wheel events, so a scroll starting on the backdrop — or continuing past the end of the modal's own scroller — reaches the document. overscroll-behavior cannot cover that case on its own, because it only applies to scroll containers and the backdrop is not one. useScrollLock freezes body while a modal is open and compensates for the width the scrollbar gives up, so nothing shifts underneath. Each lock restores the inline value it found, which makes nesting work without a counter — a picker opened from the drawer restores the drawer's hidden state instead of clearing it. Applied to both drawers and all four picker modals, which share the defect. overscroll-behavior: contain on the scrollers stops the chaining they can handle themselves. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com> * fix(security): allow unsafe-eval in CSP script-src during dev mode * feat(journal): add Journal Studio with split-screen editor, live preview and dedicated routes * fix(build): separate client parser from server journal-service and fix build type errors * fix(journal): Fotos rendern, Layout und Lightbox-Steuerung korrigieren Fünf unabhängige Fehler in der öffentlichen Journal- und Essay-Ansicht: * Foto-Blöcke wurden nie angezeigt. EssayView löst ein Foto über PhotoItem.id auf, und das sind verschlüsselte Tokens — die Blöcke aus dem Markdown tragen aber rohe Asset-UUIDs. Jede Zuordnung lief ins Leere, und nicht auflösbare Blöcke werden still verworfen. Die IDs werden jetzt serverseitig übersetzt; damit verschwinden nebenbei die rohen UUIDs aus dem Client-Payload, die dort laut Projektregel nie auftauchen dürfen. Nicht auflösbare Referenzen werden geloggt. * Überschriften standen weiter links als der Fließtext. Jeder Block hatte einzeln `max-width: 68ch`, und `ch` ist relativ zur Schrift des Elements — die Serif-Überschrift ergab eine breitere Spalte. Ersetzt durch eine gemeinsame, font-unabhängige `--essay-measure`. * Fullbleed-Fotos bluteten nur nach links aus: `.essay-figure` ist `width: 100%`, wodurch die Box überbestimmt ist und der negative rechte Margin verworfen wird. * Foto-Paare stellten beide Bilder gleich breit dar, wodurch ein Hochformat neben einem Querformat doppelt so hoch wurde. Jetzt eine Justified-Reihe: Breite proportional zum Seitenverhältnis, dadurch exakt gleiche Höhen ohne Beschnitt. * Die Lightbox hatte im Journal keine Tastatursteuerung und keine Scroll-Sperre — beides lag in PhotoGrid, also nur im Album-Raster. Verlagert in die Lightbox selbst, der doppelte Handler in PhotoGrid entfernt (sonst wäre pro Pfeildruck zwei Bilder weitergesprungen). Zusätzlich sind Proofing-Herzen und das EXIF-Panel im redaktionellen Modus abschaltbar und im Journal aus: Client-Proofing ist ein Übergabe-Workflow für Alben, keine Funktion einer Reportage. Auf der Übersicht wurde der Untertitel doppelt gerendert, weil extractExcerpt() auf ihn zurückfällt. * feat(admin): eigene URLs für alle Bereiche und überarbeiteter Journal Studio Das Panel war eine einzige Client-Komponente, die ihre Tabs über useState umschaltet: keine Route pro Bereich, kein Deep-Link, kein Zurück-Button, und nach jedem Reload landete man wieder auf "Pages". Auch der Journal-Editor hatte keine eigene URL. Jetzt sieben echte Routen (/admin, /admin/pages, /admin/journal, /admin/journal/<slug>, /admin/settings, /admin/settings/<section>, /admin/analytics). Die Shell mit Auth-Prüfung und Kopfzeile sitzt im Layout und umschließt children — so bleibt die Session-Prüfung über Routenwechsel montiert, statt bei jedem Tab-Wechsel neu zu laufen und den Spinner aufblitzen zu lassen. Unbekannte Settings-Sections fallen auf General zurück. Im selben Zug der Journal Studio, der die Routing-Änderung ohnehin berührt: * Alle Eingabefelder nutzten die Klasse `admin-input`, die in keinem CSS definiert war — sie fielen auf Browser-Defaults zurück. Jetzt gestylt, gescoped, damit der generische Name nicht ins übrige Panel leckt. * Der Split View ist per Divider verschiebbar (Maus, Tastatur, Doppelklick zum Zurücksetzen), Breite in localStorage. * Das Studio bricht aus der 1120px-Spalte aus, die Preview hat Platz. * Die Preview zeigte für jedes Foto fest 3:2 und log damit über das Layout der veröffentlichten Seite; die echten Verhältnisse werden jetzt an den Thumbnails gemessen. * Blöcke mit alten positionsbasierten Foto-Referenzen werden markiert — die lassen sich auf einer eigenständigen Journal-Seite nicht auflösen und verschwanden bisher stillschweigend. * Blocktyp-Chips als gemeinsame Komponente, monochrom und per Icon unterschieden statt in einer eigenen Blau/Lila/Orange-Palette, die sonst nirgends im Panel vorkommt. * Emojis raus, SVG-Icons rein. * fix(admin): Designsystem-Lücken im Panel schließen Eine systematische Suche nach Klassen, die im TSX benutzt, aber in keinem CSS definiert sind, hat vier Stellen mit demselben Muster gefunden: * `admin-btn-secondary` und `admin-btn-danger` existierten nicht. Sämtliche Löschen-Buttons sahen aus wie normale Buttons — keine Warnwirkung. Als `.admin-btn.admin-btn-danger` geschrieben, weil die Varianten mit den Größenklassen kombiniert werden, die weiter unten ihren eigenen Hintergrund setzen. * `page-progress-fill` fehlte: die Balken im Analytics-Panel waren leere Rinnen, der Wert unsichtbar. Ebenso `analytics-empty` und `admin-loading-container`. * `subpage-drawer-section`, `subpage-drawer-title-group` und `input-with-icon` im PageBuilder waren wirkungslos und teils mit Inline-Styles notdürftig kompensiert. * `grid-card-preview` fehlte, wodurch alle Layout-Vorschauen auf Höhe null kollabierten. Nur "Showcase" war sichtbar — und das aus Versehen, weil sein Tile `hero-tile` hieß und damit die `aspect-ratio` einer fremden PageBuilder-Klasse erbte. Umbenannt. Dazu die Theme-Vorschauen, die praktisch identisch aussahen: alle sieben zeigten dieselben drei quadratischen Kacheln, einziger Unterschied war die Hintergrundfarbe. Sie spiegeln jetzt die echten Preset-Daten aus lib/config/theme.ts — Schriftcharakter, Eckradius, Rasterdichte, Passepartout bzw. Schatten. Die Kopfzeile richtet sich an einer gemeinsamen Steuerhöhe aus. Der "Site"-Link war höher als die Buttons daneben: `.admin-btn` hatte keine explizite line-height, und <button> bekommt box-sizing: border-box vom Browser, <a> nicht. Die Statusanzeige setzte weder Schriftfamilie noch -größe und fiel auf den Browser-Default zurück — sie war nie Teil des Designsystems. Jetzt gleiche Höhe und Typografie, Pillenform als Zustandsanzeige, Trenner zur Aktionsgruppe. Das dauerhafte Pulsieren des grünen Punkts entfällt; Animation bleibt den Zuständen vorbehalten, die Aufmerksamkeit brauchen. Restliche Emojis durch SVG-Icons ersetzt. * feat(admin): add scroll-to-top toggle and SVG arrow The back-to-top button was always on and drew its arrow with the ↑ text character. Add a `scrollToTop` setting (General section in the admin panel, defaults to on so existing sites are unaffected) and replace the glyph with a stroked SVG that inherits currentColor across all presets. Scroll handling is now rAF-throttled, and prefers-reduced-motion turns off both the hover lift and the smooth scroll. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * security(journal): escape author HTML instead of filtering it CodeQL flags 26 high-severity alerts on the release PR; the bulk of them point at sanitizeHtml(), a denylist of three regexes whose output goes into dangerouslySetInnerHTML. I reproduced the bypasses before changing anything — all four pass the old filter: <img src=x onerror=alert(1)> unquoted handler, regex wants quotes <img src=x onerror='alert(1)'> single quotes, same reason <svg onload=alert(1)> not a <script> tag javasjavascript:cript:alert(1) one-pass replace, the rest recombines Plus an attribute breakout in the link renderer, which interpolated the URL into href="${url}" unescaped: [x](" onmouseover=alert(1) x=") -> <a href="" onmouseover=alert(1" ...> Replaced with escaping. Every `&<>"'` in author text becomes an entity before any markdown rule runs, so the only tags in the output are the ones renderInlineMarkdown builds itself and a URL cannot leave its attribute. Link schemes are now an allowlist (http, https, mailto, tel, relative, anchor); anything else renders as plain text. The serializer needed decodeHtmlEntities to match: without it a save would write `&lt;` into the Markdown file and the next parse would escape the `&` again, corrupting the text further on every round trip. A test covers parse -> serialize -> parse stability. Two existing tests asserted the old behaviour and were rewritten rather than deleted: one expected the script tag to be *removed* from the output, the other expected the substring "onerror" to be absent. Both now assert the property that matters — that no tag can form — because `onerror` surviving as inert text is fine. Exploitation required admin access either way: journal and essay text comes from the studio or from content/*.md. This removes the weakness, it does not close an open door. * fix(journal): contain file paths, fix frontmatter escaping, defuse two regexes Follow-up to the CodeQL findings on release PR #432. I went through all 23 alerts individually; this addresses the ones that are worth addressing and documents the ones that are not. Path containment (12 alerts, all false positives). Every path built from a slug goes through isValidSlug(), a strict `/^[a-zA-Z0-9_-]+$/` allowlist — verified against `../../etc/passwd`, `foo/../../bar`, `a/b`, `..` and friends, all rejected. CodeQL cannot see it because the check lives in another module. Added a containedPath() helper that resolves the path and refuses anything landing outside the content directory: a second lock on a door that was already locked, and a barrier the analysis can follow. Also removed the dead `slug.endsWith('.md')` branches — isValidSlug rejects dots, so they could never be taken. Frontmatter escaping (1 alert, a real bug). The serializer escaped `"` but not `\`, and the parser never unescaped anything. A title containing either character gained a backslash on every save/load cycle: Path C:\Users "quoted" -> Path C:\\Users \"quoted\" -> ... Escaping now covers the backslash first and the parser undoes both. A round trip test covers quotes, backslashes, colons and apostrophes. Two of three ReDoS regexes (2 alerts). The heading pattern had `\s+` next to `(.+)`, which overlap, so the engine tried every split of the whitespace run before failing; it is `[ \t]+` and `(\S.*)` now. The quote author pattern wrapped a lazy group around an optional group — the quadratic case — and is an index split on the first separator now. The third regex, the bold/italic pass, is deliberately left alone. Rewriting it with a negated class removes the backtracking but breaks nesting: `**bold *and italic* here**` renders as `*<em>bold </em>and italic<em> here</em>*`. The input is Markdown from an authenticated admin, never a visitor, so the worst case is an author slowing down their own page. The comment in the code says so. Not addressed: 5 js/insufficient-password-hash alerts. They ask for a slow KDF where the code uses SHA-256/HMAC — correct in general, but the admin password comes from an environment variable and is never stored, so a stronger KDF protects nothing that is not already in plaintext in the environment. 399 unit tests pass (18 new), build and tsc clean. * fix(journal): split the quote author by scanning, not by pattern Cleaning up after myself. #439 replaced the quote author regex `/^(.*?)(?:\s+--\s+(.+))?$/` — a lazy group around an optional one, the quadratic case — with `/\s+--\s+/`, and CodeQL promptly flagged the replacement for the same reason. One reported pattern traded for another. splitQuoteAuthor() scans for the first `--` that has whitespace on both sides. Linear, and it needs no reasoning about the regex engine at all. Behaviour is identical to the original regex, checked case by case against it: separator, no separator, several separators, tabs, wide gaps, `a--b` without spaces, leading and trailing separators, empty string. All nine are covered by tests, plus one asserting it stays fast on a 50k whitespace run. * security(admin): derive the session signing key with scrypt getSigningKey() ran the admin password through a single SHA-256 digest. It is key derivation rather than password storage, so it was never a stored-hash problem — but if the derived key ever leaked, one fast hash makes recovering the password by brute force cheap. CodeQL flags it as js/insufficient-password-hash and, for this particular alert, has a point. scrypt now. Two details that matter: The salt has to be stable. A random salt would produce a different key on every call and invalidate every session; it is derived from AUTH_SECRET, which is deployment-specific. Verified across separate processes: same inputs produce a verifying token, so a restart or redeploy does not log everyone out. The result is cached for the process lifetime. scrypt is deliberately slow and getSigningKey() runs on every admin request — deriving per call would add ~24ms to each one. The cache key is a digest of secret plus password, so a rotation misses the cache and derives again, and no extra plaintext copy of the password is kept around. Measured: first derivation 24ms, subsequent calls 0.12ms. Password change and secret change both invalidate an existing token, checked in separate processes. Note the one-time effect: existing admin sessions are invalidated by the change in derivation, so everyone logs in once more. * security(admin): key the signing-key cache on its inputs, not a digest #441 removed the SHA-256 digest of the admin password from the key derivation and introduced a new one three lines above it, as the cache key. Same rule, same file: CodeQL reported it immediately. The comment justifying it was wrong too. It claimed no second plaintext copy of the password was retained, while building the digest input allocates exactly that in order to hash it. The cache now holds the two input strings and compares them directly. They are the same objects the env and install caches already hold, so nothing extra is retained, and no fast hash of the password exists in memory for the life of the process. Re-verified after the change, in separate processes: a token from one process verifies in another with the same inputs, a changed password or secret rejects it, first derivation 24ms, cached calls 0.001ms. That leaves scrypt as the only place the password is hashed here. The two HMACs further down operate on the derived key and on token data, not on the password; the constant-time comparison in verifyAdminPassword is the previously dismissed one. --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
2026-08-14 16:55:07 +02:00
</Link>
))}
</nav>
{/* Content */}
<div className="settings-content">
{activeSection === 'general' && (
<div className="settings-panel">
security: add Trivy container scan to Docker publish workflow (#399) * feat(admin): add backup manager UI with 1-click restore * feat(admin): collapse older backup entries by default * fix(theme): isolate admin layout, instant DOM theme updates, and add Light/Dark mode toggle * feat(admin): replace text controls for Photo Frame and Hero Style with visual preview cards * fix(admin): define missing CSS rules for button system (.btn, .preset-btn) * feat(admin): redesign theme settings with segmented mode toggle, accent color swatches, and custom iOS-style toggle cards * feat(admin): upgrade all settings tabs with visual grid previews, Google SEO snippet preview, and toggle cards * feat(admin): overhaul Pages Builder UX with slide-over drawer, card hover badges, real-time search, and floating save bar * fix(admin): remove leftover dangling syntax snippet in PageBuilder.tsx * fix(admin): add position: relative to subpage-tile so hover overlay is contained inside the tile * style(admin): replace all emojis with clean Leica-style vector SVG icons * fix(types): extend IconProps with SVGProps to allow style prop on Leica SVG icons * feat(admin): add subpage live-preview, privacy analytics, and asset protection settings * fix(typecheck): fix AlbumEntry property access in subpage drawer preview mode * fix(types): fix ImmichAlbumInfo property names thumbnailAssetId and albumName in PageBuilder.tsx * fix(types): add protection and watermark optional properties to AppConfig interface * feat(settings): add toggle for disabling analytics tracking (defaults to enabled) * feat(ux): show status banner when analytics tracking is disabled + add live sync indicator * feat(watermark): render customizable watermark overlay on Lightbox images + rename section to Portfolio Features & Modules * fix(types): import type LightboxWatermark in PhotoGrid.tsx * fix(types): destructure watermark prop in PhotoGrid function signature * feat(seo): add configurable subpage title template and metadata descriptions * feat(seo): add generateMetadata to about page for title template support * feat(proofing): add client proofing, favorites selection, compact URL bitmasking, and export modal * feat(essay): add Photo Essay storytelling mode with RSC markdown parser and fullbleed/pair layouts * feat(subpages): add page enabled toggle to deactivate subpages without deleting them * feat(admin): add visual essay block builder for photo essay storytelling pages * security: add Trivy container scan to Docker publish workflow Scans the built image for CRITICAL/HIGH CVEs on every release and uploads results to the GitHub Security tab. Non-blocking for now (exit-code 0) so releases aren't gated on findings. Also documents the scan and existing Dependabot coverage in the README. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-08-07 11:08:04 +02:00
<div className="settings-section-header">
release: v0.11.0 (#459) Ships `dev` as **v0.11.0**. `main` contains nothing that `dev` does not, so this is a clean sync. ## Headline changes since v0.10.0 - **Journal & Journal Studio** — photo essays at `/journal`, split-screen block editor with live preview, drafts, per-entry passwords, cover images - **First-run setup wizard at `/install`** — configure a fresh deployment from the browser; credentials are verified against Immich before anything is written, and the wizard is gated by a one-time token - **About page editor and toggle** in the admin panel - **Per-album photo order** independent of Immich, with a drag & drop editor - **Custom favicon upload** - **Experimental portfolio features** — justified grid, `cover` hero, unlisted subpages, per-album grid overrides, cover focal points, external nav links - **Security** — asset tokens length-capped before decoding (#423), journal author markdown escaped rather than filtered, journal file paths contained, admin session key derived with scrypt (#432), Next.js 16.3.0 for CVE-2025-13465 - **Fixed** — client proofing honours its own configuration again (#454); journal photo rendering (#432) Full detail in [CHANGELOG.md](CHANGELOG.md#0110--2026-08-15). ## Verified `npx tsc --noEmit` clean · `npx vitest run` 435 tests pass · `npm run build` succeeds · lint 0 errors · `prettier --check` clean · local `docker build` of the release tree. ## After merge Tag `v0.11.0` on `main` and publish the release — that triggers `docker-publish.yml`, which pushes the image and moves `latest`. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
2026-08-15 09:09:18 +02:00
<h3>
<Icons.IconGear size={18} /> General Site Settings
</h3>
<p className="settings-section-sub">
Configure basic site identity, language, and core feature toggles.
</p>
security: add Trivy container scan to Docker publish workflow (#399) * feat(admin): add backup manager UI with 1-click restore * feat(admin): collapse older backup entries by default * fix(theme): isolate admin layout, instant DOM theme updates, and add Light/Dark mode toggle * feat(admin): replace text controls for Photo Frame and Hero Style with visual preview cards * fix(admin): define missing CSS rules for button system (.btn, .preset-btn) * feat(admin): redesign theme settings with segmented mode toggle, accent color swatches, and custom iOS-style toggle cards * feat(admin): upgrade all settings tabs with visual grid previews, Google SEO snippet preview, and toggle cards * feat(admin): overhaul Pages Builder UX with slide-over drawer, card hover badges, real-time search, and floating save bar * fix(admin): remove leftover dangling syntax snippet in PageBuilder.tsx * fix(admin): add position: relative to subpage-tile so hover overlay is contained inside the tile * style(admin): replace all emojis with clean Leica-style vector SVG icons * fix(types): extend IconProps with SVGProps to allow style prop on Leica SVG icons * feat(admin): add subpage live-preview, privacy analytics, and asset protection settings * fix(typecheck): fix AlbumEntry property access in subpage drawer preview mode * fix(types): fix ImmichAlbumInfo property names thumbnailAssetId and albumName in PageBuilder.tsx * fix(types): add protection and watermark optional properties to AppConfig interface * feat(settings): add toggle for disabling analytics tracking (defaults to enabled) * feat(ux): show status banner when analytics tracking is disabled + add live sync indicator * feat(watermark): render customizable watermark overlay on Lightbox images + rename section to Portfolio Features & Modules * fix(types): import type LightboxWatermark in PhotoGrid.tsx * fix(types): destructure watermark prop in PhotoGrid function signature * feat(seo): add configurable subpage title template and metadata descriptions * feat(seo): add generateMetadata to about page for title template support * feat(proofing): add client proofing, favorites selection, compact URL bitmasking, and export modal * feat(essay): add Photo Essay storytelling mode with RSC markdown parser and fullbleed/pair layouts * feat(subpages): add page enabled toggle to deactivate subpages without deleting them * feat(admin): add visual essay block builder for photo essay storytelling pages * security: add Trivy container scan to Docker publish workflow Scans the built image for CRITICAL/HIGH CVEs on every release and uploads results to the GitHub Security tab. Non-blocking for now (exit-code 0) so releases aren't gated on findings. Also documents the scan and existing Dependabot coverage in the README. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-08-07 11:08:04 +02:00
</div>
<div className="admin-field">
<label>Site Title</label>
<input
value={settings.title || ''}
onChange={(e) => update('title', e.target.value)}
placeholder="My Portfolio"
/>
</div>
<div className="admin-field">
<label>Subtitle</label>
<input
value={settings.subtitle || ''}
onChange={(e) => update('subtitle', e.target.value)}
placeholder="A visual journal"
/>
</div>
<div className="admin-field">
<label>Language</label>
<select
value={settings.lang || 'en'}
onChange={(e) => update('lang', e.target.value)}
>
security: add Trivy container scan to Docker publish workflow (#399) * feat(admin): add backup manager UI with 1-click restore * feat(admin): collapse older backup entries by default * fix(theme): isolate admin layout, instant DOM theme updates, and add Light/Dark mode toggle * feat(admin): replace text controls for Photo Frame and Hero Style with visual preview cards * fix(admin): define missing CSS rules for button system (.btn, .preset-btn) * feat(admin): redesign theme settings with segmented mode toggle, accent color swatches, and custom iOS-style toggle cards * feat(admin): upgrade all settings tabs with visual grid previews, Google SEO snippet preview, and toggle cards * feat(admin): overhaul Pages Builder UX with slide-over drawer, card hover badges, real-time search, and floating save bar * fix(admin): remove leftover dangling syntax snippet in PageBuilder.tsx * fix(admin): add position: relative to subpage-tile so hover overlay is contained inside the tile * style(admin): replace all emojis with clean Leica-style vector SVG icons * fix(types): extend IconProps with SVGProps to allow style prop on Leica SVG icons * feat(admin): add subpage live-preview, privacy analytics, and asset protection settings * fix(typecheck): fix AlbumEntry property access in subpage drawer preview mode * fix(types): fix ImmichAlbumInfo property names thumbnailAssetId and albumName in PageBuilder.tsx * fix(types): add protection and watermark optional properties to AppConfig interface * feat(settings): add toggle for disabling analytics tracking (defaults to enabled) * feat(ux): show status banner when analytics tracking is disabled + add live sync indicator * feat(watermark): render customizable watermark overlay on Lightbox images + rename section to Portfolio Features & Modules * fix(types): import type LightboxWatermark in PhotoGrid.tsx * fix(types): destructure watermark prop in PhotoGrid function signature * feat(seo): add configurable subpage title template and metadata descriptions * feat(seo): add generateMetadata to about page for title template support * feat(proofing): add client proofing, favorites selection, compact URL bitmasking, and export modal * feat(essay): add Photo Essay storytelling mode with RSC markdown parser and fullbleed/pair layouts * feat(subpages): add page enabled toggle to deactivate subpages without deleting them * feat(admin): add visual essay block builder for photo essay storytelling pages * security: add Trivy container scan to Docker publish workflow Scans the built image for CRITICAL/HIGH CVEs on every release and uploads results to the GitHub Security tab. Non-blocking for now (exit-code 0) so releases aren't gated on findings. Also documents the scan and existing Dependabot coverage in the README. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-08-07 11:08:04 +02:00
<option value="en">English (US)</option>
<option value="de">Deutsch (DE)</option>
<option value="fr">Français (FR)</option>
<option value="es">Español (ES)</option>
<option value="ja">日本語 (JA)</option>
</select>
<p className="admin-field-hint">
The visitor-facing interface is translated for {SUPPORTED_LOCALES.join(', ')}.
Other languages still set <code>&lt;html lang&gt;</code> and date formatting, but
show the English interface. The admin panel is always English.
</p>
</div>
security: add Trivy container scan to Docker publish workflow (#399) * feat(admin): add backup manager UI with 1-click restore * feat(admin): collapse older backup entries by default * fix(theme): isolate admin layout, instant DOM theme updates, and add Light/Dark mode toggle * feat(admin): replace text controls for Photo Frame and Hero Style with visual preview cards * fix(admin): define missing CSS rules for button system (.btn, .preset-btn) * feat(admin): redesign theme settings with segmented mode toggle, accent color swatches, and custom iOS-style toggle cards * feat(admin): upgrade all settings tabs with visual grid previews, Google SEO snippet preview, and toggle cards * feat(admin): overhaul Pages Builder UX with slide-over drawer, card hover badges, real-time search, and floating save bar * fix(admin): remove leftover dangling syntax snippet in PageBuilder.tsx * fix(admin): add position: relative to subpage-tile so hover overlay is contained inside the tile * style(admin): replace all emojis with clean Leica-style vector SVG icons * fix(types): extend IconProps with SVGProps to allow style prop on Leica SVG icons * feat(admin): add subpage live-preview, privacy analytics, and asset protection settings * fix(typecheck): fix AlbumEntry property access in subpage drawer preview mode * fix(types): fix ImmichAlbumInfo property names thumbnailAssetId and albumName in PageBuilder.tsx * fix(types): add protection and watermark optional properties to AppConfig interface * feat(settings): add toggle for disabling analytics tracking (defaults to enabled) * feat(ux): show status banner when analytics tracking is disabled + add live sync indicator * feat(watermark): render customizable watermark overlay on Lightbox images + rename section to Portfolio Features & Modules * fix(types): import type LightboxWatermark in PhotoGrid.tsx * fix(types): destructure watermark prop in PhotoGrid function signature * feat(seo): add configurable subpage title template and metadata descriptions * feat(seo): add generateMetadata to about page for title template support * feat(proofing): add client proofing, favorites selection, compact URL bitmasking, and export modal * feat(essay): add Photo Essay storytelling mode with RSC markdown parser and fullbleed/pair layouts * feat(subpages): add page enabled toggle to deactivate subpages without deleting them * feat(admin): add visual essay block builder for photo essay storytelling pages * security: add Trivy container scan to Docker publish workflow Scans the built image for CRITICAL/HIGH CVEs on every release and uploads results to the GitHub Security tab. Non-blocking for now (exit-code 0) so releases aren't gated on findings. Also documents the scan and existing Dependabot coverage in the README. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-08-07 11:08:04 +02:00
<div className="settings-section-divider" />
<div className="settings-section-header">
release: v0.11.0 (#459) Ships `dev` as **v0.11.0**. `main` contains nothing that `dev` does not, so this is a clean sync. ## Headline changes since v0.10.0 - **Journal & Journal Studio** — photo essays at `/journal`, split-screen block editor with live preview, drafts, per-entry passwords, cover images - **First-run setup wizard at `/install`** — configure a fresh deployment from the browser; credentials are verified against Immich before anything is written, and the wizard is gated by a one-time token - **About page editor and toggle** in the admin panel - **Per-album photo order** independent of Immich, with a drag & drop editor - **Custom favicon upload** - **Experimental portfolio features** — justified grid, `cover` hero, unlisted subpages, per-album grid overrides, cover focal points, external nav links - **Security** — asset tokens length-capped before decoding (#423), journal author markdown escaped rather than filtered, journal file paths contained, admin session key derived with scrypt (#432), Next.js 16.3.0 for CVE-2025-13465 - **Fixed** — client proofing honours its own configuration again (#454); journal photo rendering (#432) Full detail in [CHANGELOG.md](CHANGELOG.md#0110--2026-08-15). ## Verified `npx tsc --noEmit` clean · `npx vitest run` 435 tests pass · `npm run build` succeeds · lint 0 errors · `prettier --check` clean · local `docker build` of the release tree. ## After merge Tag `v0.11.0` on `main` and publish the release — that triggers `docker-publish.yml`, which pushes the image and moves `latest`. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
2026-08-15 09:09:18 +02:00
<h3>
<Icons.IconSparkles size={18} /> Portfolio Features &amp; Modules
</h3>
<p className="settings-section-sub">
Enable or disable optional portfolio modules, privacy analytics, and map widgets.
</p>
security: add Trivy container scan to Docker publish workflow (#399) * feat(admin): add backup manager UI with 1-click restore * feat(admin): collapse older backup entries by default * fix(theme): isolate admin layout, instant DOM theme updates, and add Light/Dark mode toggle * feat(admin): replace text controls for Photo Frame and Hero Style with visual preview cards * fix(admin): define missing CSS rules for button system (.btn, .preset-btn) * feat(admin): redesign theme settings with segmented mode toggle, accent color swatches, and custom iOS-style toggle cards * feat(admin): upgrade all settings tabs with visual grid previews, Google SEO snippet preview, and toggle cards * feat(admin): overhaul Pages Builder UX with slide-over drawer, card hover badges, real-time search, and floating save bar * fix(admin): remove leftover dangling syntax snippet in PageBuilder.tsx * fix(admin): add position: relative to subpage-tile so hover overlay is contained inside the tile * style(admin): replace all emojis with clean Leica-style vector SVG icons * fix(types): extend IconProps with SVGProps to allow style prop on Leica SVG icons * feat(admin): add subpage live-preview, privacy analytics, and asset protection settings * fix(typecheck): fix AlbumEntry property access in subpage drawer preview mode * fix(types): fix ImmichAlbumInfo property names thumbnailAssetId and albumName in PageBuilder.tsx * fix(types): add protection and watermark optional properties to AppConfig interface * feat(settings): add toggle for disabling analytics tracking (defaults to enabled) * feat(ux): show status banner when analytics tracking is disabled + add live sync indicator * feat(watermark): render customizable watermark overlay on Lightbox images + rename section to Portfolio Features & Modules * fix(types): import type LightboxWatermark in PhotoGrid.tsx * fix(types): destructure watermark prop in PhotoGrid function signature * feat(seo): add configurable subpage title template and metadata descriptions * feat(seo): add generateMetadata to about page for title template support * feat(proofing): add client proofing, favorites selection, compact URL bitmasking, and export modal * feat(essay): add Photo Essay storytelling mode with RSC markdown parser and fullbleed/pair layouts * feat(subpages): add page enabled toggle to deactivate subpages without deleting them * feat(admin): add visual essay block builder for photo essay storytelling pages * security: add Trivy container scan to Docker publish workflow Scans the built image for CRITICAL/HIGH CVEs on every release and uploads results to the GitHub Security tab. Non-blocking for now (exit-code 0) so releases aren't gated on findings. Also documents the scan and existing Dependabot coverage in the README. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-08-07 11:08:04 +02:00
</div>
<FeatureGroup
icon={<Icons.IconFrame size={13} />}
title="Pages &amp; motion"
description="Chrome the visitor sees on every page."
>
<div className="admin-toggle-cards-grid">
<button
type="button"
className={`admin-toggle-card ${settings.about?.enabled !== false ? 'active' : ''}`}
onClick={() => update('about.enabled', settings.about?.enabled === false)}
>
<div className="toggle-card-info">
<span className="toggle-card-title">
<Icons.IconCamera size={16} /> About Page
</span>
<span className="toggle-card-desc">
Show a portrait, bio, and gear section on your portfolio
</span>
</div>
<div
className={`switch-toggle ${settings.about?.enabled !== false ? 'on' : ''}`}
>
<span className="switch-slider" />
</div>
</button>
security: add Trivy container scan to Docker publish workflow (#399) * feat(admin): add backup manager UI with 1-click restore * feat(admin): collapse older backup entries by default * fix(theme): isolate admin layout, instant DOM theme updates, and add Light/Dark mode toggle * feat(admin): replace text controls for Photo Frame and Hero Style with visual preview cards * fix(admin): define missing CSS rules for button system (.btn, .preset-btn) * feat(admin): redesign theme settings with segmented mode toggle, accent color swatches, and custom iOS-style toggle cards * feat(admin): upgrade all settings tabs with visual grid previews, Google SEO snippet preview, and toggle cards * feat(admin): overhaul Pages Builder UX with slide-over drawer, card hover badges, real-time search, and floating save bar * fix(admin): remove leftover dangling syntax snippet in PageBuilder.tsx * fix(admin): add position: relative to subpage-tile so hover overlay is contained inside the tile * style(admin): replace all emojis with clean Leica-style vector SVG icons * fix(types): extend IconProps with SVGProps to allow style prop on Leica SVG icons * feat(admin): add subpage live-preview, privacy analytics, and asset protection settings * fix(typecheck): fix AlbumEntry property access in subpage drawer preview mode * fix(types): fix ImmichAlbumInfo property names thumbnailAssetId and albumName in PageBuilder.tsx * fix(types): add protection and watermark optional properties to AppConfig interface * feat(settings): add toggle for disabling analytics tracking (defaults to enabled) * feat(ux): show status banner when analytics tracking is disabled + add live sync indicator * feat(watermark): render customizable watermark overlay on Lightbox images + rename section to Portfolio Features & Modules * fix(types): import type LightboxWatermark in PhotoGrid.tsx * fix(types): destructure watermark prop in PhotoGrid function signature * feat(seo): add configurable subpage title template and metadata descriptions * feat(seo): add generateMetadata to about page for title template support * feat(proofing): add client proofing, favorites selection, compact URL bitmasking, and export modal * feat(essay): add Photo Essay storytelling mode with RSC markdown parser and fullbleed/pair layouts * feat(subpages): add page enabled toggle to deactivate subpages without deleting them * feat(admin): add visual essay block builder for photo essay storytelling pages * security: add Trivy container scan to Docker publish workflow Scans the built image for CRITICAL/HIGH CVEs on every release and uploads results to the GitHub Security tab. Non-blocking for now (exit-code 0) so releases aren't gated on findings. Also documents the scan and existing Dependabot coverage in the README. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-08-07 11:08:04 +02:00
<button
type="button"
className={`admin-toggle-card ${settings.transitions !== false ? 'active' : ''}`}
onClick={() => update('transitions', settings.transitions === false)}
>
<div className="toggle-card-info">
<span className="toggle-card-title">
<Icons.IconSparkles size={16} /> Smooth Page Transitions
</span>
<span className="toggle-card-desc">
Enable subtle fade-in animations between page navigation
</span>
</div>
<div className={`switch-toggle ${settings.transitions !== false ? 'on' : ''}`}>
<span className="switch-slider" />
</div>
</button>
security: add Trivy container scan to Docker publish workflow (#399) * feat(admin): add backup manager UI with 1-click restore * feat(admin): collapse older backup entries by default * fix(theme): isolate admin layout, instant DOM theme updates, and add Light/Dark mode toggle * feat(admin): replace text controls for Photo Frame and Hero Style with visual preview cards * fix(admin): define missing CSS rules for button system (.btn, .preset-btn) * feat(admin): redesign theme settings with segmented mode toggle, accent color swatches, and custom iOS-style toggle cards * feat(admin): upgrade all settings tabs with visual grid previews, Google SEO snippet preview, and toggle cards * feat(admin): overhaul Pages Builder UX with slide-over drawer, card hover badges, real-time search, and floating save bar * fix(admin): remove leftover dangling syntax snippet in PageBuilder.tsx * fix(admin): add position: relative to subpage-tile so hover overlay is contained inside the tile * style(admin): replace all emojis with clean Leica-style vector SVG icons * fix(types): extend IconProps with SVGProps to allow style prop on Leica SVG icons * feat(admin): add subpage live-preview, privacy analytics, and asset protection settings * fix(typecheck): fix AlbumEntry property access in subpage drawer preview mode * fix(types): fix ImmichAlbumInfo property names thumbnailAssetId and albumName in PageBuilder.tsx * fix(types): add protection and watermark optional properties to AppConfig interface * feat(settings): add toggle for disabling analytics tracking (defaults to enabled) * feat(ux): show status banner when analytics tracking is disabled + add live sync indicator * feat(watermark): render customizable watermark overlay on Lightbox images + rename section to Portfolio Features & Modules * fix(types): import type LightboxWatermark in PhotoGrid.tsx * fix(types): destructure watermark prop in PhotoGrid function signature * feat(seo): add configurable subpage title template and metadata descriptions * feat(seo): add generateMetadata to about page for title template support * feat(proofing): add client proofing, favorites selection, compact URL bitmasking, and export modal * feat(essay): add Photo Essay storytelling mode with RSC markdown parser and fullbleed/pair layouts * feat(subpages): add page enabled toggle to deactivate subpages without deleting them * feat(admin): add visual essay block builder for photo essay storytelling pages * security: add Trivy container scan to Docker publish workflow Scans the built image for CRITICAL/HIGH CVEs on every release and uploads results to the GitHub Security tab. Non-blocking for now (exit-code 0) so releases aren't gated on findings. Also documents the scan and existing Dependabot coverage in the README. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-08-07 11:08:04 +02:00
<button
type="button"
className={`admin-toggle-card ${settings.scrollToTop !== false ? 'active' : ''}`}
onClick={() => update('scrollToTop', settings.scrollToTop === false)}
>
<div className="toggle-card-info">
<span className="toggle-card-title">
<Icons.IconArrowUp size={16} /> Scroll-to-Top Button
</span>
<span className="toggle-card-desc">
Show a floating arrow that returns visitors to the top of long pages
</span>
</div>
<div className={`switch-toggle ${settings.scrollToTop !== false ? 'on' : ''}`}>
<span className="switch-slider" />
</div>
</button>
</div>
</FeatureGroup>
security: add Trivy container scan to Docker publish workflow (#399) * feat(admin): add backup manager UI with 1-click restore * feat(admin): collapse older backup entries by default * fix(theme): isolate admin layout, instant DOM theme updates, and add Light/Dark mode toggle * feat(admin): replace text controls for Photo Frame and Hero Style with visual preview cards * fix(admin): define missing CSS rules for button system (.btn, .preset-btn) * feat(admin): redesign theme settings with segmented mode toggle, accent color swatches, and custom iOS-style toggle cards * feat(admin): upgrade all settings tabs with visual grid previews, Google SEO snippet preview, and toggle cards * feat(admin): overhaul Pages Builder UX with slide-over drawer, card hover badges, real-time search, and floating save bar * fix(admin): remove leftover dangling syntax snippet in PageBuilder.tsx * fix(admin): add position: relative to subpage-tile so hover overlay is contained inside the tile * style(admin): replace all emojis with clean Leica-style vector SVG icons * fix(types): extend IconProps with SVGProps to allow style prop on Leica SVG icons * feat(admin): add subpage live-preview, privacy analytics, and asset protection settings * fix(typecheck): fix AlbumEntry property access in subpage drawer preview mode * fix(types): fix ImmichAlbumInfo property names thumbnailAssetId and albumName in PageBuilder.tsx * fix(types): add protection and watermark optional properties to AppConfig interface * feat(settings): add toggle for disabling analytics tracking (defaults to enabled) * feat(ux): show status banner when analytics tracking is disabled + add live sync indicator * feat(watermark): render customizable watermark overlay on Lightbox images + rename section to Portfolio Features & Modules * fix(types): import type LightboxWatermark in PhotoGrid.tsx * fix(types): destructure watermark prop in PhotoGrid function signature * feat(seo): add configurable subpage title template and metadata descriptions * feat(seo): add generateMetadata to about page for title template support * feat(proofing): add client proofing, favorites selection, compact URL bitmasking, and export modal * feat(essay): add Photo Essay storytelling mode with RSC markdown parser and fullbleed/pair layouts * feat(subpages): add page enabled toggle to deactivate subpages without deleting them * feat(admin): add visual essay block builder for photo essay storytelling pages * security: add Trivy container scan to Docker publish workflow Scans the built image for CRITICAL/HIGH CVEs on every release and uploads results to the GitHub Security tab. Non-blocking for now (exit-code 0) so releases aren't gated on findings. Also documents the scan and existing Dependabot coverage in the README. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-08-07 11:08:04 +02:00
<FeatureGroup
icon={<Icons.IconShieldCheck size={13} />}
title="What each photo reveals"
description="Published to anyone who opens a photo."
chip="visible to visitors"
>
<div className={`metadata-card ${anyMetadata ? 'active' : ''}`}>
<button
type="button"
className="metadata-card-main"
onClick={toggleMetadata}
aria-pressed={anyMetadata}
>
<span className="toggle-card-info">
<span className="toggle-card-title">
<Icons.IconCamera size={16} /> Photo metadata
</span>
<span className="toggle-card-desc">{metadataSummary}</span>
release: v0.11.0 (#459) Ships `dev` as **v0.11.0**. `main` contains nothing that `dev` does not, so this is a clean sync. ## Headline changes since v0.10.0 - **Journal & Journal Studio** — photo essays at `/journal`, split-screen block editor with live preview, drafts, per-entry passwords, cover images - **First-run setup wizard at `/install`** — configure a fresh deployment from the browser; credentials are verified against Immich before anything is written, and the wizard is gated by a one-time token - **About page editor and toggle** in the admin panel - **Per-album photo order** independent of Immich, with a drag & drop editor - **Custom favicon upload** - **Experimental portfolio features** — justified grid, `cover` hero, unlisted subpages, per-album grid overrides, cover focal points, external nav links - **Security** — asset tokens length-capped before decoding (#423), journal author markdown escaped rather than filtered, journal file paths contained, admin session key derived with scrypt (#432), Next.js 16.3.0 for CVE-2025-13465 - **Fixed** — client proofing honours its own configuration again (#454); journal photo rendering (#432) Full detail in [CHANGELOG.md](CHANGELOG.md#0110--2026-08-15). ## Verified `npx tsc --noEmit` clean · `npx vitest run` 435 tests pass · `npm run build` succeeds · lint 0 errors · `prettier --check` clean · local `docker build` of the release tree. ## After merge Tag `v0.11.0` on `main` and publish the release — that triggers `docker-publish.yml`, which pushes the image and moves `latest`. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
2026-08-15 09:09:18 +02:00
</span>
<span className={`switch-toggle ${anyMetadata ? 'on' : ''}`}>
<span className="switch-slider" />
release: v0.11.0 (#459) Ships `dev` as **v0.11.0**. `main` contains nothing that `dev` does not, so this is a clean sync. ## Headline changes since v0.10.0 - **Journal & Journal Studio** — photo essays at `/journal`, split-screen block editor with live preview, drafts, per-entry passwords, cover images - **First-run setup wizard at `/install`** — configure a fresh deployment from the browser; credentials are verified against Immich before anything is written, and the wizard is gated by a one-time token - **About page editor and toggle** in the admin panel - **Per-album photo order** independent of Immich, with a drag & drop editor - **Custom favicon upload** - **Experimental portfolio features** — justified grid, `cover` hero, unlisted subpages, per-album grid overrides, cover focal points, external nav links - **Security** — asset tokens length-capped before decoding (#423), journal author markdown escaped rather than filtered, journal file paths contained, admin session key derived with scrypt (#432), Next.js 16.3.0 for CVE-2025-13465 - **Fixed** — client proofing honours its own configuration again (#454); journal photo rendering (#432) Full detail in [CHANGELOG.md](CHANGELOG.md#0110--2026-08-15). ## Verified `npx tsc --noEmit` clean · `npx vitest run` 435 tests pass · `npm run build` succeeds · lint 0 errors · `prettier --check` clean · local `docker build` of the release tree. ## After merge Tag `v0.11.0` on `main` and publish the release — that triggers `docker-publish.yml`, which pushes the image and moves `latest`. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
2026-08-15 09:09:18 +02:00
</span>
</button>
release: v0.11.0 — journal fixes, admin URLs, design system cleanup (#432) * fix(screenshots): sharp-Typen fuer 0.34 und 0.35 gleichzeitig (#410) sharp 0.35 ist von `export =` auf ESM umgestellt: der Modul-Namespace ist nicht mehr aufrufbar, die Factory sitzt unter .default. Der Type-Check brach damit in scripts/screenshots.ts weg, sobald der Next-Bump (#402) sharp von 0.34.5 auf 0.35.3 mitzieht -- sharp ist hier keine deklarierte Dependency, sondern kommt ueber Next mit. Die Form wird jetzt aus dem installierten Paket abgeleitet statt festgeschrieben, zur Laufzeit wie im Typ. Geprueft mit beiden Versionen: tsc laeuft mit 0.34.5 und mit 0.35.3 fehlerfrei durch. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(deps): bump the nextjs group across 1 directory with 2 updates (#402) Bumps the nextjs group with 2 updates in the / directory: [next](https://github.com/vercel/next.js) and [eslint-config-next](https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next). Updates `next` from 16.2.12 to 16.3.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/compare/v16.2.12...v16.3.0) Updates `eslint-config-next` from 16.2.12 to 16.3.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/commits/v16.3.0/packages/eslint-config-next) --- updated-dependencies: - dependency-name: eslint-config-next dependency-version: 16.3.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: nextjs - dependency-name: next dependency-version: 16.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nextjs ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps-dev): bump prettier from 3.8.3 to 3.9.6 (#405) Bumps [prettier](https://github.com/prettier/prettier) from 3.8.3 to 3.9.6. - [Release notes](https://github.com/prettier/prettier/releases) - [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md) - [Commits](https://github.com/prettier/prettier/compare/3.8.3...3.9.6) --- updated-dependencies: - dependency-name: prettier dependency-version: 3.9.6 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * docs(changelog): Unreleased-Sektion fuer die Bumps nach v0.10.0 (#413) Die Dependency-PRs sind nach dem Release auf dev gelandet, teils auch auf main. Ohne Eintrag waeren sie beim naechsten Release unsichtbar -- inklusive Next 16.3.0, das CVE-2025-13465 mitbringt. Ausserdem im 0.10.0-Abschnitt nachgetragen, dass der Trivy-Scan bis #409 nie gelaufen ist. Der Fix steckt im Tag v0.10.0, fehlte aber in der Aufzaehlung -- und "Images werden bei jedem Publish gescannt" stand im Changelog, waehrend der Job im Action-Setup abbrach. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(gallery): per-album sort order, independent of Immich (#408) (#414) Album order was dictated entirely by Immich: getAlbum() sorted by the album's own asc/desc flag, so a Folio album always mirrored the archive. A curated series has a narrative order that has nothing to do with capture time, and changing the Immich album's sort to fit the website changes it for the archive too. Adds an optional per-album `sort` in gallery.yaml, editable in /admin, defaulting to today's behaviour so every existing config is unchanged: immich (default) | newest | oldest | filename | manual `manual` is a pinned *prefix*: `assetOrder` lists only the photos placed by hand, everything else follows in the album's Immich order. A full permutation of a 2,000-photo album would be ~80 KB of UUIDs in a file that is rewritten and copied to content/.backups/ on every admin save. It also makes drift fall out for free — photos removed in Immich never match, new ones land in the tail rather than being hidden. Sorting is applied after the cache read, not before the cache write, so the LRU keeps one canonical Immich-ordered copy per album. That avoids putting the mode in the cache key, lets a config change take effect without depending on invalidation, and keeps the stale-serving path correct. cache.get() returns the stored object by reference, so withSort() returns a shallow clone with a new array — sorting in place would reorder the shared entry, and under request coalescing every concurrent caller would be sorting the same array. Also fixes a prerequisite bug: /api/admin/albums/[albumId]/assets read album.assets from GET /albums/:id, which Immich 3.x no longer populates (lib/immich.ts:507). The hero picker's "This Album" tab returned nothing and threw outright when the key was absent. It now goes through the client's paginated metadata search, with ?types=all to opt videos in for the reorder editor. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): drop decorative emoji from the sort select labels (#415) An <option> cannot contain markup, so the SVG set in Icons is not reachable there — but a decorative emoji is not a substitute for it. Plain text instead; the album card badge already uses a real icon. The remaining emoji in the admin panel (asset picker tabs, section headings, layout picker options) predate this branch and are left for a separate cleanup. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): replace emoji icons with the shared SVG icon set (#416) The admin panel mixed two icon conventions: inline SVGs from `Icons.tsx` in most components, and decorative emoji in the asset picker and a few PageBuilder labels. Emoji render inconsistently across platforms, ignore the accent colour, and cannot inherit the `.svg-icon` sizing rules. - Icons.tsx: add `IconStar` (filled — it marks a state, not an action) and `IconImage`. - AssetPicker: the three tab labels and the favourite tile badge now use IconFolder / IconStar / IconImage. - PageBuilder: the "Standalone Albums" and "Subpages" headings use the icon set instead of an emoji. - PageBuilder: the layout picker drops its emoji for plain text. An <option> cannot contain markup, so an SVG is impossible there and a decorative glyph is not a substitute. - admin.css: align icon and label in the picker tabs, and swap the favourite badge's text-shadow for drop-shadow, which is what applies to an inline SVG. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): fold PageBuilder's local icons into the shared Icons module (#418) * refactor(admin): fold PageBuilder's local icons into the shared module PageBuilder.tsx carried its own `Icons` object duplicating most of the glyphs already exported by Icons.tsx, with hardcoded sizes and slightly divergent paths. Migrate all 32 call sites to the shared module and delete the local object. Five glyphs had no counterpart and are added to Icons.tsx as 1:1 ports of the local paths: IconX, IconPlus, IconHome, IconCopy, IconImage. The local ExternalLink and Check are dropped rather than ported — both had zero call sites. Two glyphs change shape slightly, which is the point of consolidating: the shared IconCamera includes the viewfinder bump the local copy omitted, and drag handles now use IconGripVertical. IconGripVertical uses the module's square 24x24 viewBox, so `.svg-drag` goes from 12x18 to 18x18 — the old non-square box would letterbox the glyph down to 12x12 and shrink the handle. * fix(admin): resolve icon-module integration after #416 Merging dev brought in #416, which added a second IconImage to Icons.tsx and two <Icons.Camera>/<Icons.Folder> section headers that reference the local Icons object this PR removes. Git merged both cleanly but the result did not type-check. - drop the duplicate IconImage (both copies were byte-identical) - point the two section headers at the imported IconCamera/IconFolder - refresh the SORT_LABELS comment: the icon set is imported now, not declared below --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> * fix(config): allow an empty gallery, guard against a double /api suffix (#421) An empty gallery is now a valid, rendered state instead of a throw: deriveGallery() no longer requires at least one album or subpage, so a deployment with no albums yet renders a bare homepage the owner can fill in via /admin. getConfig() also stops appending /api to an Immich URL that already ends in it, which previously produced .../api/api and broke every upstream request. Includes a restore of the per-album sort test cases, which the branch had lost by being cut before #408/#414. * feat(admin): favicon upload, served from the content volume (#422) Adds a bundled default favicon, an upload widget in admin Settings > General, and a route that serves the icon from the writable content/ volume with a fallback to the bundled default. Raster uploads (PNG/ICO/JPEG) are wrapped in an SVG container; the response carries its own CSP so an uploaded SVG cannot execute script on the origin. The GET route revalidates with an ETag instead of caching immutably, so a newly uploaded icon shows up immediately. Uploads are written via temp file + rename, and a Reset button restores the bundled default. * ci: flag unformatted files in a PR, without blocking it (#424) Prettier is configured as an error rule in eslint.config.mjs but has never run in CI, so part of the tree predates it. A final CI step now diffs against the PR base, runs prettier --list-different over the changed files, and emits a warning annotation per offender plus a job summary. Advisory by design: it never fails the job. Blocking would turn a PR red for merely touching a file that was already unformatted, and normalising the tree in one commit would wreck git blame and conflict with the PRs in flight. Requires fetch-depth: 0, since diffing against the base needs its history. * feat(install): first-run wizard gated by a one-time setup token (#419) Adds /install, a four-step first-run wizard: connect to Immich, optionally pick albums, name the site, finish. It verifies the credentials against the Immich server before writing anything, then writes gallery.yaml, settings.yaml and a content/install.json carrying the Immich credentials and a generated site secret. install.json exists because a running process cannot pick up new env vars — the wizard has to write configuration that takes effect without a restart. getInstallCredentials() merges it under the real environment, so env vars always win and rotation stays a matter of setting one. Both the page and the API routes are gated by a one-time setup token printed to the server log, so a deployment that is reachable before gallery.yaml exists cannot be configured by whoever finds it first. The token is stored in content/.setup-token (0600) rather than a module variable: Next.js bundles the page and each route handler separately, so a module-level token left the page and the API disagreeing inside one process and the wizard stuck on step 1. It is removed once the install completes. The admin password is stored as an scrypt hash using the scheme lib/auth.ts already applies to album passwords; a plaintext ADMIN_PASSWORD env var keeps working. * docs: document the setup wizard, fix the read-only content mount (#425) Quick Start now leads with the /install wizard, with the hand-written YAML route kept alongside it, and a First-Run Setup section covers the setup token, the files the wizard writes, and env-var precedence. Two corrections: both Docker examples mounted content/ as :ro, which silently breaks the wizard, the admin panel and the backup rotation alike — docs/admin-panel.md already said so and the README contradicted it. And nothing documented that content/install.json holds the Immich API key, so a backup of content/ is a backup of credentials. Also adds a Contributors section crediting the people whose work is in the project. * feat(admin): floating save bar pinned to the bottom of the viewport (#426) The save bar was the first, static element inside .admin-main. Since the document itself scrolls, it left the viewport as soon as you scrolled down — editing a subpage section or a settings block far below gave no visible dirty hint and no reachable save button. Replace it with a bottom-pinned floating bar shared by both editors. It only mounts while there is something to act on (unsaved changes, an in-flight save, or a result message), so it never covers content while idle. The success message clears after 5s, which hides the bar again. - new SaveBar component, replacing the duplicated markup in PageBuilder and SettingsEditor - adopt the previously unused .floating-save-bar CSS: slide-in keyframes (carrying translateX(-50%)), dirty border, wrap/gap, mobile variant and a prefers-reduced-motion opt-out; z-index 900 keeps it below modals - .admin-main gains bottom padding so the bar never covers page content - drop the now-unreachable idle hints: the ⌘S hint becomes a button title, the Live Sync note becomes a static line above the settings layout - header "Site" link now bypasses the cache (/?fresh=1), so the preview stays reachable when the bar is hidden Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(admin): themed listbox for the album sort control (#427) The per-album "Photo order" control was a native <select>. Because an <option> cannot contain markup, its choices could not use the admin panel's currentColor SVG set — the reason #415 had to fall back to plain text after dropping the emoji labels. Adds a Listbox component implementing the ARIA combobox/listbox pattern, so options can render a glyph beside their label: - DOM focus stays on the trigger button; the active option is announced through aria-activedescendant, keeping focus management to one element - Keyboard: arrows (clamped at the ends, like a native select), Home/End, Enter/Space to commit, Escape to cancel, Tab commits and moves on, and prefix type-ahead with a repeat-key cycle - Outside dismissal on pointerdown, so a press starting outside closes the popup before the click retargets The sort options now carry an icon each: calendar, arrow-down, arrow-up, an A→Z marker, and the drag glyph for manual — matching the badge the album card already shows. SORT_LABELS stays plain text because the badge feeds it to a title attribute. Closes #417 Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(git): ignore generated design handoff folders * fix(admin): stop the album sort dropdown clipping, and simplify the panel (#428) * fix(admin): render listbox popup in a portal so it escapes modal clipping The sort control's popup was position:absolute inside three clipping ancestors (.album-drawer overflow:hidden > .album-drawer-body overflow-y:auto > .modal-right-column overflow-y:auto), so it was cut off at the bottom of the Edit Album Details modal. z-index could not help: clipping happens before stacking. It also always hung below the trigger, with no flip. Portal the popup to document.body and position it from the trigger's viewport rect, flipping above when there is more room there and capping max-height to the space available so it scrolls internally rather than overflowing. It is dismissed on scroll and resize, since the anchor is only measured on open. The outside-pointerdown handler now also treats the popup as inside; without that the portalled list counts as outside, and a click on an option would close it before the selection commits. * refactor(admin): single-column album details panel The left column spent 1.2fr on a cover thumbnail and three stat rows, two of which (Status, Custom Hero) only restated the form fields opposite them, while the form itself was squeezed into 1.8fr behind a second nested scroller. Stack the drawer in one column instead: cover as a banner, then the form at full width, with the UUID moved into the footer. The body is now the only scroll container, which also removes one of the ancestors that was clipping the sort popup. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> * fix(admin): give the portalled listbox its theme back, lock the page behind modals (#429) Two defects in the album editor. The sort listbox popup painted transparent. Every --admin-* variable is scoped to .admin-layout, and since the popup moved into document.body it sits outside that subtree, so background/border/text all resolved to nothing. It now carries its own copy of the palette in both colour schemes, plus the font it no longer inherits. Scrolling inside a modal also moved the page behind it. No admin modal ever locked body scroll: the overlay covers the page but does not absorb wheel events, so a scroll starting on the backdrop — or continuing past the end of the modal's own scroller — reaches the document. overscroll-behavior cannot cover that case on its own, because it only applies to scroll containers and the backdrop is not one. useScrollLock freezes body while a modal is open and compensates for the width the scrollbar gives up, so nothing shifts underneath. Each lock restores the inline value it found, which makes nesting work without a counter — a picker opened from the drawer restores the drawer's hidden state instead of clearing it. Applied to both drawers and all four picker modals, which share the defect. overscroll-behavior: contain on the scrollers stops the chaining they can handle themselves. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com> * fix(security): allow unsafe-eval in CSP script-src during dev mode * feat(journal): add Journal Studio with split-screen editor, live preview and dedicated routes * fix(build): separate client parser from server journal-service and fix build type errors * fix(journal): Fotos rendern, Layout und Lightbox-Steuerung korrigieren Fünf unabhängige Fehler in der öffentlichen Journal- und Essay-Ansicht: * Foto-Blöcke wurden nie angezeigt. EssayView löst ein Foto über PhotoItem.id auf, und das sind verschlüsselte Tokens — die Blöcke aus dem Markdown tragen aber rohe Asset-UUIDs. Jede Zuordnung lief ins Leere, und nicht auflösbare Blöcke werden still verworfen. Die IDs werden jetzt serverseitig übersetzt; damit verschwinden nebenbei die rohen UUIDs aus dem Client-Payload, die dort laut Projektregel nie auftauchen dürfen. Nicht auflösbare Referenzen werden geloggt. * Überschriften standen weiter links als der Fließtext. Jeder Block hatte einzeln `max-width: 68ch`, und `ch` ist relativ zur Schrift des Elements — die Serif-Überschrift ergab eine breitere Spalte. Ersetzt durch eine gemeinsame, font-unabhängige `--essay-measure`. * Fullbleed-Fotos bluteten nur nach links aus: `.essay-figure` ist `width: 100%`, wodurch die Box überbestimmt ist und der negative rechte Margin verworfen wird. * Foto-Paare stellten beide Bilder gleich breit dar, wodurch ein Hochformat neben einem Querformat doppelt so hoch wurde. Jetzt eine Justified-Reihe: Breite proportional zum Seitenverhältnis, dadurch exakt gleiche Höhen ohne Beschnitt. * Die Lightbox hatte im Journal keine Tastatursteuerung und keine Scroll-Sperre — beides lag in PhotoGrid, also nur im Album-Raster. Verlagert in die Lightbox selbst, der doppelte Handler in PhotoGrid entfernt (sonst wäre pro Pfeildruck zwei Bilder weitergesprungen). Zusätzlich sind Proofing-Herzen und das EXIF-Panel im redaktionellen Modus abschaltbar und im Journal aus: Client-Proofing ist ein Übergabe-Workflow für Alben, keine Funktion einer Reportage. Auf der Übersicht wurde der Untertitel doppelt gerendert, weil extractExcerpt() auf ihn zurückfällt. * feat(admin): eigene URLs für alle Bereiche und überarbeiteter Journal Studio Das Panel war eine einzige Client-Komponente, die ihre Tabs über useState umschaltet: keine Route pro Bereich, kein Deep-Link, kein Zurück-Button, und nach jedem Reload landete man wieder auf "Pages". Auch der Journal-Editor hatte keine eigene URL. Jetzt sieben echte Routen (/admin, /admin/pages, /admin/journal, /admin/journal/<slug>, /admin/settings, /admin/settings/<section>, /admin/analytics). Die Shell mit Auth-Prüfung und Kopfzeile sitzt im Layout und umschließt children — so bleibt die Session-Prüfung über Routenwechsel montiert, statt bei jedem Tab-Wechsel neu zu laufen und den Spinner aufblitzen zu lassen. Unbekannte Settings-Sections fallen auf General zurück. Im selben Zug der Journal Studio, der die Routing-Änderung ohnehin berührt: * Alle Eingabefelder nutzten die Klasse `admin-input`, die in keinem CSS definiert war — sie fielen auf Browser-Defaults zurück. Jetzt gestylt, gescoped, damit der generische Name nicht ins übrige Panel leckt. * Der Split View ist per Divider verschiebbar (Maus, Tastatur, Doppelklick zum Zurücksetzen), Breite in localStorage. * Das Studio bricht aus der 1120px-Spalte aus, die Preview hat Platz. * Die Preview zeigte für jedes Foto fest 3:2 und log damit über das Layout der veröffentlichten Seite; die echten Verhältnisse werden jetzt an den Thumbnails gemessen. * Blöcke mit alten positionsbasierten Foto-Referenzen werden markiert — die lassen sich auf einer eigenständigen Journal-Seite nicht auflösen und verschwanden bisher stillschweigend. * Blocktyp-Chips als gemeinsame Komponente, monochrom und per Icon unterschieden statt in einer eigenen Blau/Lila/Orange-Palette, die sonst nirgends im Panel vorkommt. * Emojis raus, SVG-Icons rein. * fix(admin): Designsystem-Lücken im Panel schließen Eine systematische Suche nach Klassen, die im TSX benutzt, aber in keinem CSS definiert sind, hat vier Stellen mit demselben Muster gefunden: * `admin-btn-secondary` und `admin-btn-danger` existierten nicht. Sämtliche Löschen-Buttons sahen aus wie normale Buttons — keine Warnwirkung. Als `.admin-btn.admin-btn-danger` geschrieben, weil die Varianten mit den Größenklassen kombiniert werden, die weiter unten ihren eigenen Hintergrund setzen. * `page-progress-fill` fehlte: die Balken im Analytics-Panel waren leere Rinnen, der Wert unsichtbar. Ebenso `analytics-empty` und `admin-loading-container`. * `subpage-drawer-section`, `subpage-drawer-title-group` und `input-with-icon` im PageBuilder waren wirkungslos und teils mit Inline-Styles notdürftig kompensiert. * `grid-card-preview` fehlte, wodurch alle Layout-Vorschauen auf Höhe null kollabierten. Nur "Showcase" war sichtbar — und das aus Versehen, weil sein Tile `hero-tile` hieß und damit die `aspect-ratio` einer fremden PageBuilder-Klasse erbte. Umbenannt. Dazu die Theme-Vorschauen, die praktisch identisch aussahen: alle sieben zeigten dieselben drei quadratischen Kacheln, einziger Unterschied war die Hintergrundfarbe. Sie spiegeln jetzt die echten Preset-Daten aus lib/config/theme.ts — Schriftcharakter, Eckradius, Rasterdichte, Passepartout bzw. Schatten. Die Kopfzeile richtet sich an einer gemeinsamen Steuerhöhe aus. Der "Site"-Link war höher als die Buttons daneben: `.admin-btn` hatte keine explizite line-height, und <button> bekommt box-sizing: border-box vom Browser, <a> nicht. Die Statusanzeige setzte weder Schriftfamilie noch -größe und fiel auf den Browser-Default zurück — sie war nie Teil des Designsystems. Jetzt gleiche Höhe und Typografie, Pillenform als Zustandsanzeige, Trenner zur Aktionsgruppe. Das dauerhafte Pulsieren des grünen Punkts entfällt; Animation bleibt den Zuständen vorbehalten, die Aufmerksamkeit brauchen. Restliche Emojis durch SVG-Icons ersetzt. * feat(admin): add scroll-to-top toggle and SVG arrow The back-to-top button was always on and drew its arrow with the ↑ text character. Add a `scrollToTop` setting (General section in the admin panel, defaults to on so existing sites are unaffected) and replace the glyph with a stroked SVG that inherits currentColor across all presets. Scroll handling is now rAF-throttled, and prefers-reduced-motion turns off both the hover lift and the smooth scroll. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * security(journal): escape author HTML instead of filtering it CodeQL flags 26 high-severity alerts on the release PR; the bulk of them point at sanitizeHtml(), a denylist of three regexes whose output goes into dangerouslySetInnerHTML. I reproduced the bypasses before changing anything — all four pass the old filter: <img src=x onerror=alert(1)> unquoted handler, regex wants quotes <img src=x onerror='alert(1)'> single quotes, same reason <svg onload=alert(1)> not a <script> tag javasjavascript:cript:alert(1) one-pass replace, the rest recombines Plus an attribute breakout in the link renderer, which interpolated the URL into href="${url}" unescaped: [x](" onmouseover=alert(1) x=") -> <a href="" onmouseover=alert(1" ...> Replaced with escaping. Every `&<>"'` in author text becomes an entity before any markdown rule runs, so the only tags in the output are the ones renderInlineMarkdown builds itself and a URL cannot leave its attribute. Link schemes are now an allowlist (http, https, mailto, tel, relative, anchor); anything else renders as plain text. The serializer needed decodeHtmlEntities to match: without it a save would write `&lt;` into the Markdown file and the next parse would escape the `&` again, corrupting the text further on every round trip. A test covers parse -> serialize -> parse stability. Two existing tests asserted the old behaviour and were rewritten rather than deleted: one expected the script tag to be *removed* from the output, the other expected the substring "onerror" to be absent. Both now assert the property that matters — that no tag can form — because `onerror` surviving as inert text is fine. Exploitation required admin access either way: journal and essay text comes from the studio or from content/*.md. This removes the weakness, it does not close an open door. * fix(journal): contain file paths, fix frontmatter escaping, defuse two regexes Follow-up to the CodeQL findings on release PR #432. I went through all 23 alerts individually; this addresses the ones that are worth addressing and documents the ones that are not. Path containment (12 alerts, all false positives). Every path built from a slug goes through isValidSlug(), a strict `/^[a-zA-Z0-9_-]+$/` allowlist — verified against `../../etc/passwd`, `foo/../../bar`, `a/b`, `..` and friends, all rejected. CodeQL cannot see it because the check lives in another module. Added a containedPath() helper that resolves the path and refuses anything landing outside the content directory: a second lock on a door that was already locked, and a barrier the analysis can follow. Also removed the dead `slug.endsWith('.md')` branches — isValidSlug rejects dots, so they could never be taken. Frontmatter escaping (1 alert, a real bug). The serializer escaped `"` but not `\`, and the parser never unescaped anything. A title containing either character gained a backslash on every save/load cycle: Path C:\Users "quoted" -> Path C:\\Users \"quoted\" -> ... Escaping now covers the backslash first and the parser undoes both. A round trip test covers quotes, backslashes, colons and apostrophes. Two of three ReDoS regexes (2 alerts). The heading pattern had `\s+` next to `(.+)`, which overlap, so the engine tried every split of the whitespace run before failing; it is `[ \t]+` and `(\S.*)` now. The quote author pattern wrapped a lazy group around an optional group — the quadratic case — and is an index split on the first separator now. The third regex, the bold/italic pass, is deliberately left alone. Rewriting it with a negated class removes the backtracking but breaks nesting: `**bold *and italic* here**` renders as `*<em>bold </em>and italic<em> here</em>*`. The input is Markdown from an authenticated admin, never a visitor, so the worst case is an author slowing down their own page. The comment in the code says so. Not addressed: 5 js/insufficient-password-hash alerts. They ask for a slow KDF where the code uses SHA-256/HMAC — correct in general, but the admin password comes from an environment variable and is never stored, so a stronger KDF protects nothing that is not already in plaintext in the environment. 399 unit tests pass (18 new), build and tsc clean. * fix(journal): split the quote author by scanning, not by pattern Cleaning up after myself. #439 replaced the quote author regex `/^(.*?)(?:\s+--\s+(.+))?$/` — a lazy group around an optional one, the quadratic case — with `/\s+--\s+/`, and CodeQL promptly flagged the replacement for the same reason. One reported pattern traded for another. splitQuoteAuthor() scans for the first `--` that has whitespace on both sides. Linear, and it needs no reasoning about the regex engine at all. Behaviour is identical to the original regex, checked case by case against it: separator, no separator, several separators, tabs, wide gaps, `a--b` without spaces, leading and trailing separators, empty string. All nine are covered by tests, plus one asserting it stays fast on a 50k whitespace run. * security(admin): derive the session signing key with scrypt getSigningKey() ran the admin password through a single SHA-256 digest. It is key derivation rather than password storage, so it was never a stored-hash problem — but if the derived key ever leaked, one fast hash makes recovering the password by brute force cheap. CodeQL flags it as js/insufficient-password-hash and, for this particular alert, has a point. scrypt now. Two details that matter: The salt has to be stable. A random salt would produce a different key on every call and invalidate every session; it is derived from AUTH_SECRET, which is deployment-specific. Verified across separate processes: same inputs produce a verifying token, so a restart or redeploy does not log everyone out. The result is cached for the process lifetime. scrypt is deliberately slow and getSigningKey() runs on every admin request — deriving per call would add ~24ms to each one. The cache key is a digest of secret plus password, so a rotation misses the cache and derives again, and no extra plaintext copy of the password is kept around. Measured: first derivation 24ms, subsequent calls 0.12ms. Password change and secret change both invalidate an existing token, checked in separate processes. Note the one-time effect: existing admin sessions are invalidated by the change in derivation, so everyone logs in once more. * security(admin): key the signing-key cache on its inputs, not a digest #441 removed the SHA-256 digest of the admin password from the key derivation and introduced a new one three lines above it, as the cache key. Same rule, same file: CodeQL reported it immediately. The comment justifying it was wrong too. It claimed no second plaintext copy of the password was retained, while building the digest input allocates exactly that in order to hash it. The cache now holds the two input strings and compares them directly. They are the same objects the env and install caches already hold, so nothing extra is retained, and no fast hash of the password exists in memory for the life of the process. Re-verified after the change, in separate processes: a token from one process verifies in another with the same inputs, a changed password or secret rejects it, first derivation 24ms, cached calls 0.001ms. That leaves scrypt as the only place the password is hashed here. The two HMACs further down operate on the derived key and on token data, not on the password; the constant-time comparison in verifyAdminPassword is the previously dismissed one. --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
2026-08-14 16:55:07 +02:00
<button
type="button"
className="metadata-details-btn"
onClick={() => setMetadataOpen((open) => !open)}
aria-expanded={metadataOpen}
>
Details
<Icons.IconChevronDown
size={13}
className={`metadata-details-chevron${metadataOpen ? ' open' : ''}`}
/>
</button>
security: add Trivy container scan to Docker publish workflow (#399) * feat(admin): add backup manager UI with 1-click restore * feat(admin): collapse older backup entries by default * fix(theme): isolate admin layout, instant DOM theme updates, and add Light/Dark mode toggle * feat(admin): replace text controls for Photo Frame and Hero Style with visual preview cards * fix(admin): define missing CSS rules for button system (.btn, .preset-btn) * feat(admin): redesign theme settings with segmented mode toggle, accent color swatches, and custom iOS-style toggle cards * feat(admin): upgrade all settings tabs with visual grid previews, Google SEO snippet preview, and toggle cards * feat(admin): overhaul Pages Builder UX with slide-over drawer, card hover badges, real-time search, and floating save bar * fix(admin): remove leftover dangling syntax snippet in PageBuilder.tsx * fix(admin): add position: relative to subpage-tile so hover overlay is contained inside the tile * style(admin): replace all emojis with clean Leica-style vector SVG icons * fix(types): extend IconProps with SVGProps to allow style prop on Leica SVG icons * feat(admin): add subpage live-preview, privacy analytics, and asset protection settings * fix(typecheck): fix AlbumEntry property access in subpage drawer preview mode * fix(types): fix ImmichAlbumInfo property names thumbnailAssetId and albumName in PageBuilder.tsx * fix(types): add protection and watermark optional properties to AppConfig interface * feat(settings): add toggle for disabling analytics tracking (defaults to enabled) * feat(ux): show status banner when analytics tracking is disabled + add live sync indicator * feat(watermark): render customizable watermark overlay on Lightbox images + rename section to Portfolio Features & Modules * fix(types): import type LightboxWatermark in PhotoGrid.tsx * fix(types): destructure watermark prop in PhotoGrid function signature * feat(seo): add configurable subpage title template and metadata descriptions * feat(seo): add generateMetadata to about page for title template support * feat(proofing): add client proofing, favorites selection, compact URL bitmasking, and export modal * feat(essay): add Photo Essay storytelling mode with RSC markdown parser and fullbleed/pair layouts * feat(subpages): add page enabled toggle to deactivate subpages without deleting them * feat(admin): add visual essay block builder for photo essay storytelling pages * security: add Trivy container scan to Docker publish workflow Scans the built image for CRITICAL/HIGH CVEs on every release and uploads results to the GitHub Security tab. Non-blocking for now (exit-code 0) so releases aren't gated on findings. Also documents the scan and existing Dependabot coverage in the README. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-08-07 11:08:04 +02:00
{metadataOpen && (
<div className="metadata-details">
<SettingRow
title="Camera &amp; Lens"
description="Body, lens and focal length"
checked={exif.camera}
onToggle={() => update('exif.camera', !exif.camera)}
/>
<SettingRow
title="Exposure Settings"
description="Aperture, shutter speed and ISO"
checked={exif.settings}
onToggle={() => update('exif.settings', !exif.settings)}
/>
<SettingRow
title="Location"
description="City and country from the photo's GPS data"
checked={exif.location}
onToggle={() => update('exif.location', !exif.location)}
/>
<SettingRow
title="Photo Description"
description="The description written in Immich"
checked={exif.caption}
onToggle={() => update('exif.caption', !exif.caption)}
/>
{/* Dependent, not a peer: this only controls the grid overlay, and
the overlay carries camera and lens. With those off it has
nothing to show, which used to leave it switched on and
silently doing nothing (#510). */}
<SettingRow
indented
title="Summary on grid hover"
description="Camera and lens over the photo, not only in the lightbox"
checked={settings.exifOnHover !== false}
disabled={!exif.camera}
hint={exif.camera ? undefined : 'Needs Camera & Lens'}
onToggle={() => update('exifOnHover', settings.exifOnHover === false)}
/>
</div>
)}
</div>
</FeatureGroup>
<FeatureGroup
icon={<Icons.IconHeart size={13} />}
title="What visitors can do"
description="Optional pages and interactions."
>
<div className="admin-toggle-cards-grid">
<button
type="button"
className={`admin-toggle-card ${settings.map === true ? 'active' : ''}`}
onClick={() => update('map', !settings.map)}
release: v0.11.0 (#459) Ships `dev` as **v0.11.0**. `main` contains nothing that `dev` does not, so this is a clean sync. ## Headline changes since v0.10.0 - **Journal & Journal Studio** — photo essays at `/journal`, split-screen block editor with live preview, drafts, per-entry passwords, cover images - **First-run setup wizard at `/install`** — configure a fresh deployment from the browser; credentials are verified against Immich before anything is written, and the wizard is gated by a one-time token - **About page editor and toggle** in the admin panel - **Per-album photo order** independent of Immich, with a drag & drop editor - **Custom favicon upload** - **Experimental portfolio features** — justified grid, `cover` hero, unlisted subpages, per-album grid overrides, cover focal points, external nav links - **Security** — asset tokens length-capped before decoding (#423), journal author markdown escaped rather than filtered, journal file paths contained, admin session key derived with scrypt (#432), Next.js 16.3.0 for CVE-2025-13465 - **Fixed** — client proofing honours its own configuration again (#454); journal photo rendering (#432) Full detail in [CHANGELOG.md](CHANGELOG.md#0110--2026-08-15). ## Verified `npx tsc --noEmit` clean · `npx vitest run` 435 tests pass · `npm run build` succeeds · lint 0 errors · `prettier --check` clean · local `docker build` of the release tree. ## After merge Tag `v0.11.0` on `main` and publish the release — that triggers `docker-publish.yml`, which pushes the image and moves `latest`. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
2026-08-15 09:09:18 +02:00
>
<div className="toggle-card-info">
<span className="toggle-card-title">
<Icons.IconMap size={16} /> Interactive GPS Map
</span>
<span className="toggle-card-desc">
Enable /map view showing photo locations on a world map
</span>
</div>
<div className={`switch-toggle ${settings.map === true ? 'on' : ''}`}>
<span className="switch-slider" />
</div>
</button>
<button
type="button"
className={`admin-toggle-card ${settings.proofing?.enabled !== false ? 'active' : ''}`}
onClick={() => update('proofing.enabled', settings.proofing?.enabled === false)}
>
<div className="toggle-card-info">
<span className="toggle-card-title">
<Icons.IconHeart size={16} /> Client Proofing &amp; Favorites
</span>
<span className="toggle-card-desc">
Allow visitors &amp; clients to heart, filter, and export favorite photo
selections
</span>
</div>
<div
className={`switch-toggle ${settings.proofing?.enabled !== false ? 'on' : ''}`}
>
<span className="switch-slider" />
</div>
</button>
</div>
</FeatureGroup>
<FeatureGroup
icon={<Icons.IconBarChart size={13} />}
title="Measurement"
description="Cookieless and self-hosted — nothing leaves your server."
>
<div className="admin-toggle-cards-grid">
<button
type="button"
className={`admin-toggle-card ${settings.analytics !== false ? 'active' : ''}`}
onClick={() => update('analytics', settings.analytics === false)}
>
<div className="toggle-card-info">
<span className="toggle-card-title">
<Icons.IconBarChart size={16} /> Analytics Tracking
</span>
<span className="toggle-card-desc">
Collect anonymous privacy-friendly visit statistics
</span>
</div>
<div className={`switch-toggle ${settings.analytics !== false ? 'on' : ''}`}>
<span className="switch-slider" />
</div>
</button>
</div>
</FeatureGroup>
release: v0.11.0 — journal fixes, admin URLs, design system cleanup (#432) * fix(screenshots): sharp-Typen fuer 0.34 und 0.35 gleichzeitig (#410) sharp 0.35 ist von `export =` auf ESM umgestellt: der Modul-Namespace ist nicht mehr aufrufbar, die Factory sitzt unter .default. Der Type-Check brach damit in scripts/screenshots.ts weg, sobald der Next-Bump (#402) sharp von 0.34.5 auf 0.35.3 mitzieht -- sharp ist hier keine deklarierte Dependency, sondern kommt ueber Next mit. Die Form wird jetzt aus dem installierten Paket abgeleitet statt festgeschrieben, zur Laufzeit wie im Typ. Geprueft mit beiden Versionen: tsc laeuft mit 0.34.5 und mit 0.35.3 fehlerfrei durch. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(deps): bump the nextjs group across 1 directory with 2 updates (#402) Bumps the nextjs group with 2 updates in the / directory: [next](https://github.com/vercel/next.js) and [eslint-config-next](https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next). Updates `next` from 16.2.12 to 16.3.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/compare/v16.2.12...v16.3.0) Updates `eslint-config-next` from 16.2.12 to 16.3.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/commits/v16.3.0/packages/eslint-config-next) --- updated-dependencies: - dependency-name: eslint-config-next dependency-version: 16.3.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: nextjs - dependency-name: next dependency-version: 16.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nextjs ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps-dev): bump prettier from 3.8.3 to 3.9.6 (#405) Bumps [prettier](https://github.com/prettier/prettier) from 3.8.3 to 3.9.6. - [Release notes](https://github.com/prettier/prettier/releases) - [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md) - [Commits](https://github.com/prettier/prettier/compare/3.8.3...3.9.6) --- updated-dependencies: - dependency-name: prettier dependency-version: 3.9.6 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * docs(changelog): Unreleased-Sektion fuer die Bumps nach v0.10.0 (#413) Die Dependency-PRs sind nach dem Release auf dev gelandet, teils auch auf main. Ohne Eintrag waeren sie beim naechsten Release unsichtbar -- inklusive Next 16.3.0, das CVE-2025-13465 mitbringt. Ausserdem im 0.10.0-Abschnitt nachgetragen, dass der Trivy-Scan bis #409 nie gelaufen ist. Der Fix steckt im Tag v0.10.0, fehlte aber in der Aufzaehlung -- und "Images werden bei jedem Publish gescannt" stand im Changelog, waehrend der Job im Action-Setup abbrach. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(gallery): per-album sort order, independent of Immich (#408) (#414) Album order was dictated entirely by Immich: getAlbum() sorted by the album's own asc/desc flag, so a Folio album always mirrored the archive. A curated series has a narrative order that has nothing to do with capture time, and changing the Immich album's sort to fit the website changes it for the archive too. Adds an optional per-album `sort` in gallery.yaml, editable in /admin, defaulting to today's behaviour so every existing config is unchanged: immich (default) | newest | oldest | filename | manual `manual` is a pinned *prefix*: `assetOrder` lists only the photos placed by hand, everything else follows in the album's Immich order. A full permutation of a 2,000-photo album would be ~80 KB of UUIDs in a file that is rewritten and copied to content/.backups/ on every admin save. It also makes drift fall out for free — photos removed in Immich never match, new ones land in the tail rather than being hidden. Sorting is applied after the cache read, not before the cache write, so the LRU keeps one canonical Immich-ordered copy per album. That avoids putting the mode in the cache key, lets a config change take effect without depending on invalidation, and keeps the stale-serving path correct. cache.get() returns the stored object by reference, so withSort() returns a shallow clone with a new array — sorting in place would reorder the shared entry, and under request coalescing every concurrent caller would be sorting the same array. Also fixes a prerequisite bug: /api/admin/albums/[albumId]/assets read album.assets from GET /albums/:id, which Immich 3.x no longer populates (lib/immich.ts:507). The hero picker's "This Album" tab returned nothing and threw outright when the key was absent. It now goes through the client's paginated metadata search, with ?types=all to opt videos in for the reorder editor. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): drop decorative emoji from the sort select labels (#415) An <option> cannot contain markup, so the SVG set in Icons is not reachable there — but a decorative emoji is not a substitute for it. Plain text instead; the album card badge already uses a real icon. The remaining emoji in the admin panel (asset picker tabs, section headings, layout picker options) predate this branch and are left for a separate cleanup. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): replace emoji icons with the shared SVG icon set (#416) The admin panel mixed two icon conventions: inline SVGs from `Icons.tsx` in most components, and decorative emoji in the asset picker and a few PageBuilder labels. Emoji render inconsistently across platforms, ignore the accent colour, and cannot inherit the `.svg-icon` sizing rules. - Icons.tsx: add `IconStar` (filled — it marks a state, not an action) and `IconImage`. - AssetPicker: the three tab labels and the favourite tile badge now use IconFolder / IconStar / IconImage. - PageBuilder: the "Standalone Albums" and "Subpages" headings use the icon set instead of an emoji. - PageBuilder: the layout picker drops its emoji for plain text. An <option> cannot contain markup, so an SVG is impossible there and a decorative glyph is not a substitute. - admin.css: align icon and label in the picker tabs, and swap the favourite badge's text-shadow for drop-shadow, which is what applies to an inline SVG. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): fold PageBuilder's local icons into the shared Icons module (#418) * refactor(admin): fold PageBuilder's local icons into the shared module PageBuilder.tsx carried its own `Icons` object duplicating most of the glyphs already exported by Icons.tsx, with hardcoded sizes and slightly divergent paths. Migrate all 32 call sites to the shared module and delete the local object. Five glyphs had no counterpart and are added to Icons.tsx as 1:1 ports of the local paths: IconX, IconPlus, IconHome, IconCopy, IconImage. The local ExternalLink and Check are dropped rather than ported — both had zero call sites. Two glyphs change shape slightly, which is the point of consolidating: the shared IconCamera includes the viewfinder bump the local copy omitted, and drag handles now use IconGripVertical. IconGripVertical uses the module's square 24x24 viewBox, so `.svg-drag` goes from 12x18 to 18x18 — the old non-square box would letterbox the glyph down to 12x12 and shrink the handle. * fix(admin): resolve icon-module integration after #416 Merging dev brought in #416, which added a second IconImage to Icons.tsx and two <Icons.Camera>/<Icons.Folder> section headers that reference the local Icons object this PR removes. Git merged both cleanly but the result did not type-check. - drop the duplicate IconImage (both copies were byte-identical) - point the two section headers at the imported IconCamera/IconFolder - refresh the SORT_LABELS comment: the icon set is imported now, not declared below --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> * fix(config): allow an empty gallery, guard against a double /api suffix (#421) An empty gallery is now a valid, rendered state instead of a throw: deriveGallery() no longer requires at least one album or subpage, so a deployment with no albums yet renders a bare homepage the owner can fill in via /admin. getConfig() also stops appending /api to an Immich URL that already ends in it, which previously produced .../api/api and broke every upstream request. Includes a restore of the per-album sort test cases, which the branch had lost by being cut before #408/#414. * feat(admin): favicon upload, served from the content volume (#422) Adds a bundled default favicon, an upload widget in admin Settings > General, and a route that serves the icon from the writable content/ volume with a fallback to the bundled default. Raster uploads (PNG/ICO/JPEG) are wrapped in an SVG container; the response carries its own CSP so an uploaded SVG cannot execute script on the origin. The GET route revalidates with an ETag instead of caching immutably, so a newly uploaded icon shows up immediately. Uploads are written via temp file + rename, and a Reset button restores the bundled default. * ci: flag unformatted files in a PR, without blocking it (#424) Prettier is configured as an error rule in eslint.config.mjs but has never run in CI, so part of the tree predates it. A final CI step now diffs against the PR base, runs prettier --list-different over the changed files, and emits a warning annotation per offender plus a job summary. Advisory by design: it never fails the job. Blocking would turn a PR red for merely touching a file that was already unformatted, and normalising the tree in one commit would wreck git blame and conflict with the PRs in flight. Requires fetch-depth: 0, since diffing against the base needs its history. * feat(install): first-run wizard gated by a one-time setup token (#419) Adds /install, a four-step first-run wizard: connect to Immich, optionally pick albums, name the site, finish. It verifies the credentials against the Immich server before writing anything, then writes gallery.yaml, settings.yaml and a content/install.json carrying the Immich credentials and a generated site secret. install.json exists because a running process cannot pick up new env vars — the wizard has to write configuration that takes effect without a restart. getInstallCredentials() merges it under the real environment, so env vars always win and rotation stays a matter of setting one. Both the page and the API routes are gated by a one-time setup token printed to the server log, so a deployment that is reachable before gallery.yaml exists cannot be configured by whoever finds it first. The token is stored in content/.setup-token (0600) rather than a module variable: Next.js bundles the page and each route handler separately, so a module-level token left the page and the API disagreeing inside one process and the wizard stuck on step 1. It is removed once the install completes. The admin password is stored as an scrypt hash using the scheme lib/auth.ts already applies to album passwords; a plaintext ADMIN_PASSWORD env var keeps working. * docs: document the setup wizard, fix the read-only content mount (#425) Quick Start now leads with the /install wizard, with the hand-written YAML route kept alongside it, and a First-Run Setup section covers the setup token, the files the wizard writes, and env-var precedence. Two corrections: both Docker examples mounted content/ as :ro, which silently breaks the wizard, the admin panel and the backup rotation alike — docs/admin-panel.md already said so and the README contradicted it. And nothing documented that content/install.json holds the Immich API key, so a backup of content/ is a backup of credentials. Also adds a Contributors section crediting the people whose work is in the project. * feat(admin): floating save bar pinned to the bottom of the viewport (#426) The save bar was the first, static element inside .admin-main. Since the document itself scrolls, it left the viewport as soon as you scrolled down — editing a subpage section or a settings block far below gave no visible dirty hint and no reachable save button. Replace it with a bottom-pinned floating bar shared by both editors. It only mounts while there is something to act on (unsaved changes, an in-flight save, or a result message), so it never covers content while idle. The success message clears after 5s, which hides the bar again. - new SaveBar component, replacing the duplicated markup in PageBuilder and SettingsEditor - adopt the previously unused .floating-save-bar CSS: slide-in keyframes (carrying translateX(-50%)), dirty border, wrap/gap, mobile variant and a prefers-reduced-motion opt-out; z-index 900 keeps it below modals - .admin-main gains bottom padding so the bar never covers page content - drop the now-unreachable idle hints: the ⌘S hint becomes a button title, the Live Sync note becomes a static line above the settings layout - header "Site" link now bypasses the cache (/?fresh=1), so the preview stays reachable when the bar is hidden Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(admin): themed listbox for the album sort control (#427) The per-album "Photo order" control was a native <select>. Because an <option> cannot contain markup, its choices could not use the admin panel's currentColor SVG set — the reason #415 had to fall back to plain text after dropping the emoji labels. Adds a Listbox component implementing the ARIA combobox/listbox pattern, so options can render a glyph beside their label: - DOM focus stays on the trigger button; the active option is announced through aria-activedescendant, keeping focus management to one element - Keyboard: arrows (clamped at the ends, like a native select), Home/End, Enter/Space to commit, Escape to cancel, Tab commits and moves on, and prefix type-ahead with a repeat-key cycle - Outside dismissal on pointerdown, so a press starting outside closes the popup before the click retargets The sort options now carry an icon each: calendar, arrow-down, arrow-up, an A→Z marker, and the drag glyph for manual — matching the badge the album card already shows. SORT_LABELS stays plain text because the badge feeds it to a title attribute. Closes #417 Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(git): ignore generated design handoff folders * fix(admin): stop the album sort dropdown clipping, and simplify the panel (#428) * fix(admin): render listbox popup in a portal so it escapes modal clipping The sort control's popup was position:absolute inside three clipping ancestors (.album-drawer overflow:hidden > .album-drawer-body overflow-y:auto > .modal-right-column overflow-y:auto), so it was cut off at the bottom of the Edit Album Details modal. z-index could not help: clipping happens before stacking. It also always hung below the trigger, with no flip. Portal the popup to document.body and position it from the trigger's viewport rect, flipping above when there is more room there and capping max-height to the space available so it scrolls internally rather than overflowing. It is dismissed on scroll and resize, since the anchor is only measured on open. The outside-pointerdown handler now also treats the popup as inside; without that the portalled list counts as outside, and a click on an option would close it before the selection commits. * refactor(admin): single-column album details panel The left column spent 1.2fr on a cover thumbnail and three stat rows, two of which (Status, Custom Hero) only restated the form fields opposite them, while the form itself was squeezed into 1.8fr behind a second nested scroller. Stack the drawer in one column instead: cover as a banner, then the form at full width, with the UUID moved into the footer. The body is now the only scroll container, which also removes one of the ancestors that was clipping the sort popup. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> * fix(admin): give the portalled listbox its theme back, lock the page behind modals (#429) Two defects in the album editor. The sort listbox popup painted transparent. Every --admin-* variable is scoped to .admin-layout, and since the popup moved into document.body it sits outside that subtree, so background/border/text all resolved to nothing. It now carries its own copy of the palette in both colour schemes, plus the font it no longer inherits. Scrolling inside a modal also moved the page behind it. No admin modal ever locked body scroll: the overlay covers the page but does not absorb wheel events, so a scroll starting on the backdrop — or continuing past the end of the modal's own scroller — reaches the document. overscroll-behavior cannot cover that case on its own, because it only applies to scroll containers and the backdrop is not one. useScrollLock freezes body while a modal is open and compensates for the width the scrollbar gives up, so nothing shifts underneath. Each lock restores the inline value it found, which makes nesting work without a counter — a picker opened from the drawer restores the drawer's hidden state instead of clearing it. Applied to both drawers and all four picker modals, which share the defect. overscroll-behavior: contain on the scrollers stops the chaining they can handle themselves. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com> * fix(security): allow unsafe-eval in CSP script-src during dev mode * feat(journal): add Journal Studio with split-screen editor, live preview and dedicated routes * fix(build): separate client parser from server journal-service and fix build type errors * fix(journal): Fotos rendern, Layout und Lightbox-Steuerung korrigieren Fünf unabhängige Fehler in der öffentlichen Journal- und Essay-Ansicht: * Foto-Blöcke wurden nie angezeigt. EssayView löst ein Foto über PhotoItem.id auf, und das sind verschlüsselte Tokens — die Blöcke aus dem Markdown tragen aber rohe Asset-UUIDs. Jede Zuordnung lief ins Leere, und nicht auflösbare Blöcke werden still verworfen. Die IDs werden jetzt serverseitig übersetzt; damit verschwinden nebenbei die rohen UUIDs aus dem Client-Payload, die dort laut Projektregel nie auftauchen dürfen. Nicht auflösbare Referenzen werden geloggt. * Überschriften standen weiter links als der Fließtext. Jeder Block hatte einzeln `max-width: 68ch`, und `ch` ist relativ zur Schrift des Elements — die Serif-Überschrift ergab eine breitere Spalte. Ersetzt durch eine gemeinsame, font-unabhängige `--essay-measure`. * Fullbleed-Fotos bluteten nur nach links aus: `.essay-figure` ist `width: 100%`, wodurch die Box überbestimmt ist und der negative rechte Margin verworfen wird. * Foto-Paare stellten beide Bilder gleich breit dar, wodurch ein Hochformat neben einem Querformat doppelt so hoch wurde. Jetzt eine Justified-Reihe: Breite proportional zum Seitenverhältnis, dadurch exakt gleiche Höhen ohne Beschnitt. * Die Lightbox hatte im Journal keine Tastatursteuerung und keine Scroll-Sperre — beides lag in PhotoGrid, also nur im Album-Raster. Verlagert in die Lightbox selbst, der doppelte Handler in PhotoGrid entfernt (sonst wäre pro Pfeildruck zwei Bilder weitergesprungen). Zusätzlich sind Proofing-Herzen und das EXIF-Panel im redaktionellen Modus abschaltbar und im Journal aus: Client-Proofing ist ein Übergabe-Workflow für Alben, keine Funktion einer Reportage. Auf der Übersicht wurde der Untertitel doppelt gerendert, weil extractExcerpt() auf ihn zurückfällt. * feat(admin): eigene URLs für alle Bereiche und überarbeiteter Journal Studio Das Panel war eine einzige Client-Komponente, die ihre Tabs über useState umschaltet: keine Route pro Bereich, kein Deep-Link, kein Zurück-Button, und nach jedem Reload landete man wieder auf "Pages". Auch der Journal-Editor hatte keine eigene URL. Jetzt sieben echte Routen (/admin, /admin/pages, /admin/journal, /admin/journal/<slug>, /admin/settings, /admin/settings/<section>, /admin/analytics). Die Shell mit Auth-Prüfung und Kopfzeile sitzt im Layout und umschließt children — so bleibt die Session-Prüfung über Routenwechsel montiert, statt bei jedem Tab-Wechsel neu zu laufen und den Spinner aufblitzen zu lassen. Unbekannte Settings-Sections fallen auf General zurück. Im selben Zug der Journal Studio, der die Routing-Änderung ohnehin berührt: * Alle Eingabefelder nutzten die Klasse `admin-input`, die in keinem CSS definiert war — sie fielen auf Browser-Defaults zurück. Jetzt gestylt, gescoped, damit der generische Name nicht ins übrige Panel leckt. * Der Split View ist per Divider verschiebbar (Maus, Tastatur, Doppelklick zum Zurücksetzen), Breite in localStorage. * Das Studio bricht aus der 1120px-Spalte aus, die Preview hat Platz. * Die Preview zeigte für jedes Foto fest 3:2 und log damit über das Layout der veröffentlichten Seite; die echten Verhältnisse werden jetzt an den Thumbnails gemessen. * Blöcke mit alten positionsbasierten Foto-Referenzen werden markiert — die lassen sich auf einer eigenständigen Journal-Seite nicht auflösen und verschwanden bisher stillschweigend. * Blocktyp-Chips als gemeinsame Komponente, monochrom und per Icon unterschieden statt in einer eigenen Blau/Lila/Orange-Palette, die sonst nirgends im Panel vorkommt. * Emojis raus, SVG-Icons rein. * fix(admin): Designsystem-Lücken im Panel schließen Eine systematische Suche nach Klassen, die im TSX benutzt, aber in keinem CSS definiert sind, hat vier Stellen mit demselben Muster gefunden: * `admin-btn-secondary` und `admin-btn-danger` existierten nicht. Sämtliche Löschen-Buttons sahen aus wie normale Buttons — keine Warnwirkung. Als `.admin-btn.admin-btn-danger` geschrieben, weil die Varianten mit den Größenklassen kombiniert werden, die weiter unten ihren eigenen Hintergrund setzen. * `page-progress-fill` fehlte: die Balken im Analytics-Panel waren leere Rinnen, der Wert unsichtbar. Ebenso `analytics-empty` und `admin-loading-container`. * `subpage-drawer-section`, `subpage-drawer-title-group` und `input-with-icon` im PageBuilder waren wirkungslos und teils mit Inline-Styles notdürftig kompensiert. * `grid-card-preview` fehlte, wodurch alle Layout-Vorschauen auf Höhe null kollabierten. Nur "Showcase" war sichtbar — und das aus Versehen, weil sein Tile `hero-tile` hieß und damit die `aspect-ratio` einer fremden PageBuilder-Klasse erbte. Umbenannt. Dazu die Theme-Vorschauen, die praktisch identisch aussahen: alle sieben zeigten dieselben drei quadratischen Kacheln, einziger Unterschied war die Hintergrundfarbe. Sie spiegeln jetzt die echten Preset-Daten aus lib/config/theme.ts — Schriftcharakter, Eckradius, Rasterdichte, Passepartout bzw. Schatten. Die Kopfzeile richtet sich an einer gemeinsamen Steuerhöhe aus. Der "Site"-Link war höher als die Buttons daneben: `.admin-btn` hatte keine explizite line-height, und <button> bekommt box-sizing: border-box vom Browser, <a> nicht. Die Statusanzeige setzte weder Schriftfamilie noch -größe und fiel auf den Browser-Default zurück — sie war nie Teil des Designsystems. Jetzt gleiche Höhe und Typografie, Pillenform als Zustandsanzeige, Trenner zur Aktionsgruppe. Das dauerhafte Pulsieren des grünen Punkts entfällt; Animation bleibt den Zuständen vorbehalten, die Aufmerksamkeit brauchen. Restliche Emojis durch SVG-Icons ersetzt. * feat(admin): add scroll-to-top toggle and SVG arrow The back-to-top button was always on and drew its arrow with the ↑ text character. Add a `scrollToTop` setting (General section in the admin panel, defaults to on so existing sites are unaffected) and replace the glyph with a stroked SVG that inherits currentColor across all presets. Scroll handling is now rAF-throttled, and prefers-reduced-motion turns off both the hover lift and the smooth scroll. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * security(journal): escape author HTML instead of filtering it CodeQL flags 26 high-severity alerts on the release PR; the bulk of them point at sanitizeHtml(), a denylist of three regexes whose output goes into dangerouslySetInnerHTML. I reproduced the bypasses before changing anything — all four pass the old filter: <img src=x onerror=alert(1)> unquoted handler, regex wants quotes <img src=x onerror='alert(1)'> single quotes, same reason <svg onload=alert(1)> not a <script> tag javasjavascript:cript:alert(1) one-pass replace, the rest recombines Plus an attribute breakout in the link renderer, which interpolated the URL into href="${url}" unescaped: [x](" onmouseover=alert(1) x=") -> <a href="" onmouseover=alert(1" ...> Replaced with escaping. Every `&<>"'` in author text becomes an entity before any markdown rule runs, so the only tags in the output are the ones renderInlineMarkdown builds itself and a URL cannot leave its attribute. Link schemes are now an allowlist (http, https, mailto, tel, relative, anchor); anything else renders as plain text. The serializer needed decodeHtmlEntities to match: without it a save would write `&lt;` into the Markdown file and the next parse would escape the `&` again, corrupting the text further on every round trip. A test covers parse -> serialize -> parse stability. Two existing tests asserted the old behaviour and were rewritten rather than deleted: one expected the script tag to be *removed* from the output, the other expected the substring "onerror" to be absent. Both now assert the property that matters — that no tag can form — because `onerror` surviving as inert text is fine. Exploitation required admin access either way: journal and essay text comes from the studio or from content/*.md. This removes the weakness, it does not close an open door. * fix(journal): contain file paths, fix frontmatter escaping, defuse two regexes Follow-up to the CodeQL findings on release PR #432. I went through all 23 alerts individually; this addresses the ones that are worth addressing and documents the ones that are not. Path containment (12 alerts, all false positives). Every path built from a slug goes through isValidSlug(), a strict `/^[a-zA-Z0-9_-]+$/` allowlist — verified against `../../etc/passwd`, `foo/../../bar`, `a/b`, `..` and friends, all rejected. CodeQL cannot see it because the check lives in another module. Added a containedPath() helper that resolves the path and refuses anything landing outside the content directory: a second lock on a door that was already locked, and a barrier the analysis can follow. Also removed the dead `slug.endsWith('.md')` branches — isValidSlug rejects dots, so they could never be taken. Frontmatter escaping (1 alert, a real bug). The serializer escaped `"` but not `\`, and the parser never unescaped anything. A title containing either character gained a backslash on every save/load cycle: Path C:\Users "quoted" -> Path C:\\Users \"quoted\" -> ... Escaping now covers the backslash first and the parser undoes both. A round trip test covers quotes, backslashes, colons and apostrophes. Two of three ReDoS regexes (2 alerts). The heading pattern had `\s+` next to `(.+)`, which overlap, so the engine tried every split of the whitespace run before failing; it is `[ \t]+` and `(\S.*)` now. The quote author pattern wrapped a lazy group around an optional group — the quadratic case — and is an index split on the first separator now. The third regex, the bold/italic pass, is deliberately left alone. Rewriting it with a negated class removes the backtracking but breaks nesting: `**bold *and italic* here**` renders as `*<em>bold </em>and italic<em> here</em>*`. The input is Markdown from an authenticated admin, never a visitor, so the worst case is an author slowing down their own page. The comment in the code says so. Not addressed: 5 js/insufficient-password-hash alerts. They ask for a slow KDF where the code uses SHA-256/HMAC — correct in general, but the admin password comes from an environment variable and is never stored, so a stronger KDF protects nothing that is not already in plaintext in the environment. 399 unit tests pass (18 new), build and tsc clean. * fix(journal): split the quote author by scanning, not by pattern Cleaning up after myself. #439 replaced the quote author regex `/^(.*?)(?:\s+--\s+(.+))?$/` — a lazy group around an optional one, the quadratic case — with `/\s+--\s+/`, and CodeQL promptly flagged the replacement for the same reason. One reported pattern traded for another. splitQuoteAuthor() scans for the first `--` that has whitespace on both sides. Linear, and it needs no reasoning about the regex engine at all. Behaviour is identical to the original regex, checked case by case against it: separator, no separator, several separators, tabs, wide gaps, `a--b` without spaces, leading and trailing separators, empty string. All nine are covered by tests, plus one asserting it stays fast on a 50k whitespace run. * security(admin): derive the session signing key with scrypt getSigningKey() ran the admin password through a single SHA-256 digest. It is key derivation rather than password storage, so it was never a stored-hash problem — but if the derived key ever leaked, one fast hash makes recovering the password by brute force cheap. CodeQL flags it as js/insufficient-password-hash and, for this particular alert, has a point. scrypt now. Two details that matter: The salt has to be stable. A random salt would produce a different key on every call and invalidate every session; it is derived from AUTH_SECRET, which is deployment-specific. Verified across separate processes: same inputs produce a verifying token, so a restart or redeploy does not log everyone out. The result is cached for the process lifetime. scrypt is deliberately slow and getSigningKey() runs on every admin request — deriving per call would add ~24ms to each one. The cache key is a digest of secret plus password, so a rotation misses the cache and derives again, and no extra plaintext copy of the password is kept around. Measured: first derivation 24ms, subsequent calls 0.12ms. Password change and secret change both invalidate an existing token, checked in separate processes. Note the one-time effect: existing admin sessions are invalidated by the change in derivation, so everyone logs in once more. * security(admin): key the signing-key cache on its inputs, not a digest #441 removed the SHA-256 digest of the admin password from the key derivation and introduced a new one three lines above it, as the cache key. Same rule, same file: CodeQL reported it immediately. The comment justifying it was wrong too. It claimed no second plaintext copy of the password was retained, while building the digest input allocates exactly that in order to hash it. The cache now holds the two input strings and compares them directly. They are the same objects the env and install caches already hold, so nothing extra is retained, and no fast hash of the password exists in memory for the life of the process. Re-verified after the change, in separate processes: a token from one process verifies in another with the same inputs, a changed password or secret rejects it, first derivation 24ms, cached calls 0.001ms. That leaves scrypt as the only place the password is hashed here. The two HMACs further down operate on the derived key and on token data, not on the password; the constant-time comparison in verifyAdminPassword is the previously dismissed one. --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
2026-08-14 16:55:07 +02:00
<div className="admin-field favicon-field">
<label>Favicon</label>
<div className="favicon-row">
<input
type="file"
accept=".svg,.png,.ico,.jpg,.jpeg"
disabled={faviconUploading}
onChange={async (e) => {
const file = e.target.files?.[0];
if (!file) return;
setFaviconMessage('');
setFaviconUploading(true);
const form = new FormData();
form.append('file', file);
try {
release: v0.11.0 (#459) Ships `dev` as **v0.11.0**. `main` contains nothing that `dev` does not, so this is a clean sync. ## Headline changes since v0.10.0 - **Journal & Journal Studio** — photo essays at `/journal`, split-screen block editor with live preview, drafts, per-entry passwords, cover images - **First-run setup wizard at `/install`** — configure a fresh deployment from the browser; credentials are verified against Immich before anything is written, and the wizard is gated by a one-time token - **About page editor and toggle** in the admin panel - **Per-album photo order** independent of Immich, with a drag & drop editor - **Custom favicon upload** - **Experimental portfolio features** — justified grid, `cover` hero, unlisted subpages, per-album grid overrides, cover focal points, external nav links - **Security** — asset tokens length-capped before decoding (#423), journal author markdown escaped rather than filtered, journal file paths contained, admin session key derived with scrypt (#432), Next.js 16.3.0 for CVE-2025-13465 - **Fixed** — client proofing honours its own configuration again (#454); journal photo rendering (#432) Full detail in [CHANGELOG.md](CHANGELOG.md#0110--2026-08-15). ## Verified `npx tsc --noEmit` clean · `npx vitest run` 435 tests pass · `npm run build` succeeds · lint 0 errors · `prettier --check` clean · local `docker build` of the release tree. ## After merge Tag `v0.11.0` on `main` and publish the release — that triggers `docker-publish.yml`, which pushes the image and moves `latest`. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
2026-08-15 09:09:18 +02:00
const res = await fetch('/api/admin/favicon', {
method: 'PUT',
body: form,
});
release: v0.11.0 — journal fixes, admin URLs, design system cleanup (#432) * fix(screenshots): sharp-Typen fuer 0.34 und 0.35 gleichzeitig (#410) sharp 0.35 ist von `export =` auf ESM umgestellt: der Modul-Namespace ist nicht mehr aufrufbar, die Factory sitzt unter .default. Der Type-Check brach damit in scripts/screenshots.ts weg, sobald der Next-Bump (#402) sharp von 0.34.5 auf 0.35.3 mitzieht -- sharp ist hier keine deklarierte Dependency, sondern kommt ueber Next mit. Die Form wird jetzt aus dem installierten Paket abgeleitet statt festgeschrieben, zur Laufzeit wie im Typ. Geprueft mit beiden Versionen: tsc laeuft mit 0.34.5 und mit 0.35.3 fehlerfrei durch. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(deps): bump the nextjs group across 1 directory with 2 updates (#402) Bumps the nextjs group with 2 updates in the / directory: [next](https://github.com/vercel/next.js) and [eslint-config-next](https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next). Updates `next` from 16.2.12 to 16.3.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/compare/v16.2.12...v16.3.0) Updates `eslint-config-next` from 16.2.12 to 16.3.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/commits/v16.3.0/packages/eslint-config-next) --- updated-dependencies: - dependency-name: eslint-config-next dependency-version: 16.3.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: nextjs - dependency-name: next dependency-version: 16.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nextjs ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps-dev): bump prettier from 3.8.3 to 3.9.6 (#405) Bumps [prettier](https://github.com/prettier/prettier) from 3.8.3 to 3.9.6. - [Release notes](https://github.com/prettier/prettier/releases) - [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md) - [Commits](https://github.com/prettier/prettier/compare/3.8.3...3.9.6) --- updated-dependencies: - dependency-name: prettier dependency-version: 3.9.6 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * docs(changelog): Unreleased-Sektion fuer die Bumps nach v0.10.0 (#413) Die Dependency-PRs sind nach dem Release auf dev gelandet, teils auch auf main. Ohne Eintrag waeren sie beim naechsten Release unsichtbar -- inklusive Next 16.3.0, das CVE-2025-13465 mitbringt. Ausserdem im 0.10.0-Abschnitt nachgetragen, dass der Trivy-Scan bis #409 nie gelaufen ist. Der Fix steckt im Tag v0.10.0, fehlte aber in der Aufzaehlung -- und "Images werden bei jedem Publish gescannt" stand im Changelog, waehrend der Job im Action-Setup abbrach. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(gallery): per-album sort order, independent of Immich (#408) (#414) Album order was dictated entirely by Immich: getAlbum() sorted by the album's own asc/desc flag, so a Folio album always mirrored the archive. A curated series has a narrative order that has nothing to do with capture time, and changing the Immich album's sort to fit the website changes it for the archive too. Adds an optional per-album `sort` in gallery.yaml, editable in /admin, defaulting to today's behaviour so every existing config is unchanged: immich (default) | newest | oldest | filename | manual `manual` is a pinned *prefix*: `assetOrder` lists only the photos placed by hand, everything else follows in the album's Immich order. A full permutation of a 2,000-photo album would be ~80 KB of UUIDs in a file that is rewritten and copied to content/.backups/ on every admin save. It also makes drift fall out for free — photos removed in Immich never match, new ones land in the tail rather than being hidden. Sorting is applied after the cache read, not before the cache write, so the LRU keeps one canonical Immich-ordered copy per album. That avoids putting the mode in the cache key, lets a config change take effect without depending on invalidation, and keeps the stale-serving path correct. cache.get() returns the stored object by reference, so withSort() returns a shallow clone with a new array — sorting in place would reorder the shared entry, and under request coalescing every concurrent caller would be sorting the same array. Also fixes a prerequisite bug: /api/admin/albums/[albumId]/assets read album.assets from GET /albums/:id, which Immich 3.x no longer populates (lib/immich.ts:507). The hero picker's "This Album" tab returned nothing and threw outright when the key was absent. It now goes through the client's paginated metadata search, with ?types=all to opt videos in for the reorder editor. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): drop decorative emoji from the sort select labels (#415) An <option> cannot contain markup, so the SVG set in Icons is not reachable there — but a decorative emoji is not a substitute for it. Plain text instead; the album card badge already uses a real icon. The remaining emoji in the admin panel (asset picker tabs, section headings, layout picker options) predate this branch and are left for a separate cleanup. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): replace emoji icons with the shared SVG icon set (#416) The admin panel mixed two icon conventions: inline SVGs from `Icons.tsx` in most components, and decorative emoji in the asset picker and a few PageBuilder labels. Emoji render inconsistently across platforms, ignore the accent colour, and cannot inherit the `.svg-icon` sizing rules. - Icons.tsx: add `IconStar` (filled — it marks a state, not an action) and `IconImage`. - AssetPicker: the three tab labels and the favourite tile badge now use IconFolder / IconStar / IconImage. - PageBuilder: the "Standalone Albums" and "Subpages" headings use the icon set instead of an emoji. - PageBuilder: the layout picker drops its emoji for plain text. An <option> cannot contain markup, so an SVG is impossible there and a decorative glyph is not a substitute. - admin.css: align icon and label in the picker tabs, and swap the favourite badge's text-shadow for drop-shadow, which is what applies to an inline SVG. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): fold PageBuilder's local icons into the shared Icons module (#418) * refactor(admin): fold PageBuilder's local icons into the shared module PageBuilder.tsx carried its own `Icons` object duplicating most of the glyphs already exported by Icons.tsx, with hardcoded sizes and slightly divergent paths. Migrate all 32 call sites to the shared module and delete the local object. Five glyphs had no counterpart and are added to Icons.tsx as 1:1 ports of the local paths: IconX, IconPlus, IconHome, IconCopy, IconImage. The local ExternalLink and Check are dropped rather than ported — both had zero call sites. Two glyphs change shape slightly, which is the point of consolidating: the shared IconCamera includes the viewfinder bump the local copy omitted, and drag handles now use IconGripVertical. IconGripVertical uses the module's square 24x24 viewBox, so `.svg-drag` goes from 12x18 to 18x18 — the old non-square box would letterbox the glyph down to 12x12 and shrink the handle. * fix(admin): resolve icon-module integration after #416 Merging dev brought in #416, which added a second IconImage to Icons.tsx and two <Icons.Camera>/<Icons.Folder> section headers that reference the local Icons object this PR removes. Git merged both cleanly but the result did not type-check. - drop the duplicate IconImage (both copies were byte-identical) - point the two section headers at the imported IconCamera/IconFolder - refresh the SORT_LABELS comment: the icon set is imported now, not declared below --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> * fix(config): allow an empty gallery, guard against a double /api suffix (#421) An empty gallery is now a valid, rendered state instead of a throw: deriveGallery() no longer requires at least one album or subpage, so a deployment with no albums yet renders a bare homepage the owner can fill in via /admin. getConfig() also stops appending /api to an Immich URL that already ends in it, which previously produced .../api/api and broke every upstream request. Includes a restore of the per-album sort test cases, which the branch had lost by being cut before #408/#414. * feat(admin): favicon upload, served from the content volume (#422) Adds a bundled default favicon, an upload widget in admin Settings > General, and a route that serves the icon from the writable content/ volume with a fallback to the bundled default. Raster uploads (PNG/ICO/JPEG) are wrapped in an SVG container; the response carries its own CSP so an uploaded SVG cannot execute script on the origin. The GET route revalidates with an ETag instead of caching immutably, so a newly uploaded icon shows up immediately. Uploads are written via temp file + rename, and a Reset button restores the bundled default. * ci: flag unformatted files in a PR, without blocking it (#424) Prettier is configured as an error rule in eslint.config.mjs but has never run in CI, so part of the tree predates it. A final CI step now diffs against the PR base, runs prettier --list-different over the changed files, and emits a warning annotation per offender plus a job summary. Advisory by design: it never fails the job. Blocking would turn a PR red for merely touching a file that was already unformatted, and normalising the tree in one commit would wreck git blame and conflict with the PRs in flight. Requires fetch-depth: 0, since diffing against the base needs its history. * feat(install): first-run wizard gated by a one-time setup token (#419) Adds /install, a four-step first-run wizard: connect to Immich, optionally pick albums, name the site, finish. It verifies the credentials against the Immich server before writing anything, then writes gallery.yaml, settings.yaml and a content/install.json carrying the Immich credentials and a generated site secret. install.json exists because a running process cannot pick up new env vars — the wizard has to write configuration that takes effect without a restart. getInstallCredentials() merges it under the real environment, so env vars always win and rotation stays a matter of setting one. Both the page and the API routes are gated by a one-time setup token printed to the server log, so a deployment that is reachable before gallery.yaml exists cannot be configured by whoever finds it first. The token is stored in content/.setup-token (0600) rather than a module variable: Next.js bundles the page and each route handler separately, so a module-level token left the page and the API disagreeing inside one process and the wizard stuck on step 1. It is removed once the install completes. The admin password is stored as an scrypt hash using the scheme lib/auth.ts already applies to album passwords; a plaintext ADMIN_PASSWORD env var keeps working. * docs: document the setup wizard, fix the read-only content mount (#425) Quick Start now leads with the /install wizard, with the hand-written YAML route kept alongside it, and a First-Run Setup section covers the setup token, the files the wizard writes, and env-var precedence. Two corrections: both Docker examples mounted content/ as :ro, which silently breaks the wizard, the admin panel and the backup rotation alike — docs/admin-panel.md already said so and the README contradicted it. And nothing documented that content/install.json holds the Immich API key, so a backup of content/ is a backup of credentials. Also adds a Contributors section crediting the people whose work is in the project. * feat(admin): floating save bar pinned to the bottom of the viewport (#426) The save bar was the first, static element inside .admin-main. Since the document itself scrolls, it left the viewport as soon as you scrolled down — editing a subpage section or a settings block far below gave no visible dirty hint and no reachable save button. Replace it with a bottom-pinned floating bar shared by both editors. It only mounts while there is something to act on (unsaved changes, an in-flight save, or a result message), so it never covers content while idle. The success message clears after 5s, which hides the bar again. - new SaveBar component, replacing the duplicated markup in PageBuilder and SettingsEditor - adopt the previously unused .floating-save-bar CSS: slide-in keyframes (carrying translateX(-50%)), dirty border, wrap/gap, mobile variant and a prefers-reduced-motion opt-out; z-index 900 keeps it below modals - .admin-main gains bottom padding so the bar never covers page content - drop the now-unreachable idle hints: the ⌘S hint becomes a button title, the Live Sync note becomes a static line above the settings layout - header "Site" link now bypasses the cache (/?fresh=1), so the preview stays reachable when the bar is hidden Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(admin): themed listbox for the album sort control (#427) The per-album "Photo order" control was a native <select>. Because an <option> cannot contain markup, its choices could not use the admin panel's currentColor SVG set — the reason #415 had to fall back to plain text after dropping the emoji labels. Adds a Listbox component implementing the ARIA combobox/listbox pattern, so options can render a glyph beside their label: - DOM focus stays on the trigger button; the active option is announced through aria-activedescendant, keeping focus management to one element - Keyboard: arrows (clamped at the ends, like a native select), Home/End, Enter/Space to commit, Escape to cancel, Tab commits and moves on, and prefix type-ahead with a repeat-key cycle - Outside dismissal on pointerdown, so a press starting outside closes the popup before the click retargets The sort options now carry an icon each: calendar, arrow-down, arrow-up, an A→Z marker, and the drag glyph for manual — matching the badge the album card already shows. SORT_LABELS stays plain text because the badge feeds it to a title attribute. Closes #417 Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(git): ignore generated design handoff folders * fix(admin): stop the album sort dropdown clipping, and simplify the panel (#428) * fix(admin): render listbox popup in a portal so it escapes modal clipping The sort control's popup was position:absolute inside three clipping ancestors (.album-drawer overflow:hidden > .album-drawer-body overflow-y:auto > .modal-right-column overflow-y:auto), so it was cut off at the bottom of the Edit Album Details modal. z-index could not help: clipping happens before stacking. It also always hung below the trigger, with no flip. Portal the popup to document.body and position it from the trigger's viewport rect, flipping above when there is more room there and capping max-height to the space available so it scrolls internally rather than overflowing. It is dismissed on scroll and resize, since the anchor is only measured on open. The outside-pointerdown handler now also treats the popup as inside; without that the portalled list counts as outside, and a click on an option would close it before the selection commits. * refactor(admin): single-column album details panel The left column spent 1.2fr on a cover thumbnail and three stat rows, two of which (Status, Custom Hero) only restated the form fields opposite them, while the form itself was squeezed into 1.8fr behind a second nested scroller. Stack the drawer in one column instead: cover as a banner, then the form at full width, with the UUID moved into the footer. The body is now the only scroll container, which also removes one of the ancestors that was clipping the sort popup. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> * fix(admin): give the portalled listbox its theme back, lock the page behind modals (#429) Two defects in the album editor. The sort listbox popup painted transparent. Every --admin-* variable is scoped to .admin-layout, and since the popup moved into document.body it sits outside that subtree, so background/border/text all resolved to nothing. It now carries its own copy of the palette in both colour schemes, plus the font it no longer inherits. Scrolling inside a modal also moved the page behind it. No admin modal ever locked body scroll: the overlay covers the page but does not absorb wheel events, so a scroll starting on the backdrop — or continuing past the end of the modal's own scroller — reaches the document. overscroll-behavior cannot cover that case on its own, because it only applies to scroll containers and the backdrop is not one. useScrollLock freezes body while a modal is open and compensates for the width the scrollbar gives up, so nothing shifts underneath. Each lock restores the inline value it found, which makes nesting work without a counter — a picker opened from the drawer restores the drawer's hidden state instead of clearing it. Applied to both drawers and all four picker modals, which share the defect. overscroll-behavior: contain on the scrollers stops the chaining they can handle themselves. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com> * fix(security): allow unsafe-eval in CSP script-src during dev mode * feat(journal): add Journal Studio with split-screen editor, live preview and dedicated routes * fix(build): separate client parser from server journal-service and fix build type errors * fix(journal): Fotos rendern, Layout und Lightbox-Steuerung korrigieren Fünf unabhängige Fehler in der öffentlichen Journal- und Essay-Ansicht: * Foto-Blöcke wurden nie angezeigt. EssayView löst ein Foto über PhotoItem.id auf, und das sind verschlüsselte Tokens — die Blöcke aus dem Markdown tragen aber rohe Asset-UUIDs. Jede Zuordnung lief ins Leere, und nicht auflösbare Blöcke werden still verworfen. Die IDs werden jetzt serverseitig übersetzt; damit verschwinden nebenbei die rohen UUIDs aus dem Client-Payload, die dort laut Projektregel nie auftauchen dürfen. Nicht auflösbare Referenzen werden geloggt. * Überschriften standen weiter links als der Fließtext. Jeder Block hatte einzeln `max-width: 68ch`, und `ch` ist relativ zur Schrift des Elements — die Serif-Überschrift ergab eine breitere Spalte. Ersetzt durch eine gemeinsame, font-unabhängige `--essay-measure`. * Fullbleed-Fotos bluteten nur nach links aus: `.essay-figure` ist `width: 100%`, wodurch die Box überbestimmt ist und der negative rechte Margin verworfen wird. * Foto-Paare stellten beide Bilder gleich breit dar, wodurch ein Hochformat neben einem Querformat doppelt so hoch wurde. Jetzt eine Justified-Reihe: Breite proportional zum Seitenverhältnis, dadurch exakt gleiche Höhen ohne Beschnitt. * Die Lightbox hatte im Journal keine Tastatursteuerung und keine Scroll-Sperre — beides lag in PhotoGrid, also nur im Album-Raster. Verlagert in die Lightbox selbst, der doppelte Handler in PhotoGrid entfernt (sonst wäre pro Pfeildruck zwei Bilder weitergesprungen). Zusätzlich sind Proofing-Herzen und das EXIF-Panel im redaktionellen Modus abschaltbar und im Journal aus: Client-Proofing ist ein Übergabe-Workflow für Alben, keine Funktion einer Reportage. Auf der Übersicht wurde der Untertitel doppelt gerendert, weil extractExcerpt() auf ihn zurückfällt. * feat(admin): eigene URLs für alle Bereiche und überarbeiteter Journal Studio Das Panel war eine einzige Client-Komponente, die ihre Tabs über useState umschaltet: keine Route pro Bereich, kein Deep-Link, kein Zurück-Button, und nach jedem Reload landete man wieder auf "Pages". Auch der Journal-Editor hatte keine eigene URL. Jetzt sieben echte Routen (/admin, /admin/pages, /admin/journal, /admin/journal/<slug>, /admin/settings, /admin/settings/<section>, /admin/analytics). Die Shell mit Auth-Prüfung und Kopfzeile sitzt im Layout und umschließt children — so bleibt die Session-Prüfung über Routenwechsel montiert, statt bei jedem Tab-Wechsel neu zu laufen und den Spinner aufblitzen zu lassen. Unbekannte Settings-Sections fallen auf General zurück. Im selben Zug der Journal Studio, der die Routing-Änderung ohnehin berührt: * Alle Eingabefelder nutzten die Klasse `admin-input`, die in keinem CSS definiert war — sie fielen auf Browser-Defaults zurück. Jetzt gestylt, gescoped, damit der generische Name nicht ins übrige Panel leckt. * Der Split View ist per Divider verschiebbar (Maus, Tastatur, Doppelklick zum Zurücksetzen), Breite in localStorage. * Das Studio bricht aus der 1120px-Spalte aus, die Preview hat Platz. * Die Preview zeigte für jedes Foto fest 3:2 und log damit über das Layout der veröffentlichten Seite; die echten Verhältnisse werden jetzt an den Thumbnails gemessen. * Blöcke mit alten positionsbasierten Foto-Referenzen werden markiert — die lassen sich auf einer eigenständigen Journal-Seite nicht auflösen und verschwanden bisher stillschweigend. * Blocktyp-Chips als gemeinsame Komponente, monochrom und per Icon unterschieden statt in einer eigenen Blau/Lila/Orange-Palette, die sonst nirgends im Panel vorkommt. * Emojis raus, SVG-Icons rein. * fix(admin): Designsystem-Lücken im Panel schließen Eine systematische Suche nach Klassen, die im TSX benutzt, aber in keinem CSS definiert sind, hat vier Stellen mit demselben Muster gefunden: * `admin-btn-secondary` und `admin-btn-danger` existierten nicht. Sämtliche Löschen-Buttons sahen aus wie normale Buttons — keine Warnwirkung. Als `.admin-btn.admin-btn-danger` geschrieben, weil die Varianten mit den Größenklassen kombiniert werden, die weiter unten ihren eigenen Hintergrund setzen. * `page-progress-fill` fehlte: die Balken im Analytics-Panel waren leere Rinnen, der Wert unsichtbar. Ebenso `analytics-empty` und `admin-loading-container`. * `subpage-drawer-section`, `subpage-drawer-title-group` und `input-with-icon` im PageBuilder waren wirkungslos und teils mit Inline-Styles notdürftig kompensiert. * `grid-card-preview` fehlte, wodurch alle Layout-Vorschauen auf Höhe null kollabierten. Nur "Showcase" war sichtbar — und das aus Versehen, weil sein Tile `hero-tile` hieß und damit die `aspect-ratio` einer fremden PageBuilder-Klasse erbte. Umbenannt. Dazu die Theme-Vorschauen, die praktisch identisch aussahen: alle sieben zeigten dieselben drei quadratischen Kacheln, einziger Unterschied war die Hintergrundfarbe. Sie spiegeln jetzt die echten Preset-Daten aus lib/config/theme.ts — Schriftcharakter, Eckradius, Rasterdichte, Passepartout bzw. Schatten. Die Kopfzeile richtet sich an einer gemeinsamen Steuerhöhe aus. Der "Site"-Link war höher als die Buttons daneben: `.admin-btn` hatte keine explizite line-height, und <button> bekommt box-sizing: border-box vom Browser, <a> nicht. Die Statusanzeige setzte weder Schriftfamilie noch -größe und fiel auf den Browser-Default zurück — sie war nie Teil des Designsystems. Jetzt gleiche Höhe und Typografie, Pillenform als Zustandsanzeige, Trenner zur Aktionsgruppe. Das dauerhafte Pulsieren des grünen Punkts entfällt; Animation bleibt den Zuständen vorbehalten, die Aufmerksamkeit brauchen. Restliche Emojis durch SVG-Icons ersetzt. * feat(admin): add scroll-to-top toggle and SVG arrow The back-to-top button was always on and drew its arrow with the ↑ text character. Add a `scrollToTop` setting (General section in the admin panel, defaults to on so existing sites are unaffected) and replace the glyph with a stroked SVG that inherits currentColor across all presets. Scroll handling is now rAF-throttled, and prefers-reduced-motion turns off both the hover lift and the smooth scroll. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * security(journal): escape author HTML instead of filtering it CodeQL flags 26 high-severity alerts on the release PR; the bulk of them point at sanitizeHtml(), a denylist of three regexes whose output goes into dangerouslySetInnerHTML. I reproduced the bypasses before changing anything — all four pass the old filter: <img src=x onerror=alert(1)> unquoted handler, regex wants quotes <img src=x onerror='alert(1)'> single quotes, same reason <svg onload=alert(1)> not a <script> tag javasjavascript:cript:alert(1) one-pass replace, the rest recombines Plus an attribute breakout in the link renderer, which interpolated the URL into href="${url}" unescaped: [x](" onmouseover=alert(1) x=") -> <a href="" onmouseover=alert(1" ...> Replaced with escaping. Every `&<>"'` in author text becomes an entity before any markdown rule runs, so the only tags in the output are the ones renderInlineMarkdown builds itself and a URL cannot leave its attribute. Link schemes are now an allowlist (http, https, mailto, tel, relative, anchor); anything else renders as plain text. The serializer needed decodeHtmlEntities to match: without it a save would write `&lt;` into the Markdown file and the next parse would escape the `&` again, corrupting the text further on every round trip. A test covers parse -> serialize -> parse stability. Two existing tests asserted the old behaviour and were rewritten rather than deleted: one expected the script tag to be *removed* from the output, the other expected the substring "onerror" to be absent. Both now assert the property that matters — that no tag can form — because `onerror` surviving as inert text is fine. Exploitation required admin access either way: journal and essay text comes from the studio or from content/*.md. This removes the weakness, it does not close an open door. * fix(journal): contain file paths, fix frontmatter escaping, defuse two regexes Follow-up to the CodeQL findings on release PR #432. I went through all 23 alerts individually; this addresses the ones that are worth addressing and documents the ones that are not. Path containment (12 alerts, all false positives). Every path built from a slug goes through isValidSlug(), a strict `/^[a-zA-Z0-9_-]+$/` allowlist — verified against `../../etc/passwd`, `foo/../../bar`, `a/b`, `..` and friends, all rejected. CodeQL cannot see it because the check lives in another module. Added a containedPath() helper that resolves the path and refuses anything landing outside the content directory: a second lock on a door that was already locked, and a barrier the analysis can follow. Also removed the dead `slug.endsWith('.md')` branches — isValidSlug rejects dots, so they could never be taken. Frontmatter escaping (1 alert, a real bug). The serializer escaped `"` but not `\`, and the parser never unescaped anything. A title containing either character gained a backslash on every save/load cycle: Path C:\Users "quoted" -> Path C:\\Users \"quoted\" -> ... Escaping now covers the backslash first and the parser undoes both. A round trip test covers quotes, backslashes, colons and apostrophes. Two of three ReDoS regexes (2 alerts). The heading pattern had `\s+` next to `(.+)`, which overlap, so the engine tried every split of the whitespace run before failing; it is `[ \t]+` and `(\S.*)` now. The quote author pattern wrapped a lazy group around an optional group — the quadratic case — and is an index split on the first separator now. The third regex, the bold/italic pass, is deliberately left alone. Rewriting it with a negated class removes the backtracking but breaks nesting: `**bold *and italic* here**` renders as `*<em>bold </em>and italic<em> here</em>*`. The input is Markdown from an authenticated admin, never a visitor, so the worst case is an author slowing down their own page. The comment in the code says so. Not addressed: 5 js/insufficient-password-hash alerts. They ask for a slow KDF where the code uses SHA-256/HMAC — correct in general, but the admin password comes from an environment variable and is never stored, so a stronger KDF protects nothing that is not already in plaintext in the environment. 399 unit tests pass (18 new), build and tsc clean. * fix(journal): split the quote author by scanning, not by pattern Cleaning up after myself. #439 replaced the quote author regex `/^(.*?)(?:\s+--\s+(.+))?$/` — a lazy group around an optional one, the quadratic case — with `/\s+--\s+/`, and CodeQL promptly flagged the replacement for the same reason. One reported pattern traded for another. splitQuoteAuthor() scans for the first `--` that has whitespace on both sides. Linear, and it needs no reasoning about the regex engine at all. Behaviour is identical to the original regex, checked case by case against it: separator, no separator, several separators, tabs, wide gaps, `a--b` without spaces, leading and trailing separators, empty string. All nine are covered by tests, plus one asserting it stays fast on a 50k whitespace run. * security(admin): derive the session signing key with scrypt getSigningKey() ran the admin password through a single SHA-256 digest. It is key derivation rather than password storage, so it was never a stored-hash problem — but if the derived key ever leaked, one fast hash makes recovering the password by brute force cheap. CodeQL flags it as js/insufficient-password-hash and, for this particular alert, has a point. scrypt now. Two details that matter: The salt has to be stable. A random salt would produce a different key on every call and invalidate every session; it is derived from AUTH_SECRET, which is deployment-specific. Verified across separate processes: same inputs produce a verifying token, so a restart or redeploy does not log everyone out. The result is cached for the process lifetime. scrypt is deliberately slow and getSigningKey() runs on every admin request — deriving per call would add ~24ms to each one. The cache key is a digest of secret plus password, so a rotation misses the cache and derives again, and no extra plaintext copy of the password is kept around. Measured: first derivation 24ms, subsequent calls 0.12ms. Password change and secret change both invalidate an existing token, checked in separate processes. Note the one-time effect: existing admin sessions are invalidated by the change in derivation, so everyone logs in once more. * security(admin): key the signing-key cache on its inputs, not a digest #441 removed the SHA-256 digest of the admin password from the key derivation and introduced a new one three lines above it, as the cache key. Same rule, same file: CodeQL reported it immediately. The comment justifying it was wrong too. It claimed no second plaintext copy of the password was retained, while building the digest input allocates exactly that in order to hash it. The cache now holds the two input strings and compares them directly. They are the same objects the env and install caches already hold, so nothing extra is retained, and no fast hash of the password exists in memory for the life of the process. Re-verified after the change, in separate processes: a token from one process verifies in another with the same inputs, a changed password or secret rejects it, first derivation 24ms, cached calls 0.001ms. That leaves scrypt as the only place the password is hashed here. The two HMACs further down operate on the derived key and on token data, not on the password; the constant-time comparison in verifyAdminPassword is the previously dismissed one. --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
2026-08-14 16:55:07 +02:00
const data = await res.json();
setFaviconMessage(res.ok ? data.message : `Error: ${data.error}`);
} catch {
setFaviconMessage('Error: Upload failed');
} finally {
setFaviconUploading(false);
e.target.value = '';
}
}}
/>
<button
type="button"
className="admin-btn"
disabled={faviconUploading}
onClick={async () => {
setFaviconMessage('');
setFaviconUploading(true);
try {
const res = await fetch('/api/admin/favicon', { method: 'DELETE' });
const data = await res.json();
setFaviconMessage(res.ok ? data.message : `Error: ${data.error}`);
} catch {
setFaviconMessage('Error: Reset failed');
} finally {
setFaviconUploading(false);
}
}}
>
Reset
</button>
{faviconUploading && <div className="admin-spinner" />}
</div>
{faviconMessage && (
release: v0.11.0 (#459) Ships `dev` as **v0.11.0**. `main` contains nothing that `dev` does not, so this is a clean sync. ## Headline changes since v0.10.0 - **Journal & Journal Studio** — photo essays at `/journal`, split-screen block editor with live preview, drafts, per-entry passwords, cover images - **First-run setup wizard at `/install`** — configure a fresh deployment from the browser; credentials are verified against Immich before anything is written, and the wizard is gated by a one-time token - **About page editor and toggle** in the admin panel - **Per-album photo order** independent of Immich, with a drag & drop editor - **Custom favicon upload** - **Experimental portfolio features** — justified grid, `cover` hero, unlisted subpages, per-album grid overrides, cover focal points, external nav links - **Security** — asset tokens length-capped before decoding (#423), journal author markdown escaped rather than filtered, journal file paths contained, admin session key derived with scrypt (#432), Next.js 16.3.0 for CVE-2025-13465 - **Fixed** — client proofing honours its own configuration again (#454); journal photo rendering (#432) Full detail in [CHANGELOG.md](CHANGELOG.md#0110--2026-08-15). ## Verified `npx tsc --noEmit` clean · `npx vitest run` 435 tests pass · `npm run build` succeeds · lint 0 errors · `prettier --check` clean · local `docker build` of the release tree. ## After merge Tag `v0.11.0` on `main` and publish the release — that triggers `docker-publish.yml`, which pushes the image and moves `latest`. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
2026-08-15 09:09:18 +02:00
<p
className={`save-message ${faviconMessage.startsWith('Error') ? 'error' : 'success'}`}
>
release: v0.11.0 — journal fixes, admin URLs, design system cleanup (#432) * fix(screenshots): sharp-Typen fuer 0.34 und 0.35 gleichzeitig (#410) sharp 0.35 ist von `export =` auf ESM umgestellt: der Modul-Namespace ist nicht mehr aufrufbar, die Factory sitzt unter .default. Der Type-Check brach damit in scripts/screenshots.ts weg, sobald der Next-Bump (#402) sharp von 0.34.5 auf 0.35.3 mitzieht -- sharp ist hier keine deklarierte Dependency, sondern kommt ueber Next mit. Die Form wird jetzt aus dem installierten Paket abgeleitet statt festgeschrieben, zur Laufzeit wie im Typ. Geprueft mit beiden Versionen: tsc laeuft mit 0.34.5 und mit 0.35.3 fehlerfrei durch. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(deps): bump the nextjs group across 1 directory with 2 updates (#402) Bumps the nextjs group with 2 updates in the / directory: [next](https://github.com/vercel/next.js) and [eslint-config-next](https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next). Updates `next` from 16.2.12 to 16.3.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/compare/v16.2.12...v16.3.0) Updates `eslint-config-next` from 16.2.12 to 16.3.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/commits/v16.3.0/packages/eslint-config-next) --- updated-dependencies: - dependency-name: eslint-config-next dependency-version: 16.3.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: nextjs - dependency-name: next dependency-version: 16.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nextjs ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps-dev): bump prettier from 3.8.3 to 3.9.6 (#405) Bumps [prettier](https://github.com/prettier/prettier) from 3.8.3 to 3.9.6. - [Release notes](https://github.com/prettier/prettier/releases) - [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md) - [Commits](https://github.com/prettier/prettier/compare/3.8.3...3.9.6) --- updated-dependencies: - dependency-name: prettier dependency-version: 3.9.6 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * docs(changelog): Unreleased-Sektion fuer die Bumps nach v0.10.0 (#413) Die Dependency-PRs sind nach dem Release auf dev gelandet, teils auch auf main. Ohne Eintrag waeren sie beim naechsten Release unsichtbar -- inklusive Next 16.3.0, das CVE-2025-13465 mitbringt. Ausserdem im 0.10.0-Abschnitt nachgetragen, dass der Trivy-Scan bis #409 nie gelaufen ist. Der Fix steckt im Tag v0.10.0, fehlte aber in der Aufzaehlung -- und "Images werden bei jedem Publish gescannt" stand im Changelog, waehrend der Job im Action-Setup abbrach. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(gallery): per-album sort order, independent of Immich (#408) (#414) Album order was dictated entirely by Immich: getAlbum() sorted by the album's own asc/desc flag, so a Folio album always mirrored the archive. A curated series has a narrative order that has nothing to do with capture time, and changing the Immich album's sort to fit the website changes it for the archive too. Adds an optional per-album `sort` in gallery.yaml, editable in /admin, defaulting to today's behaviour so every existing config is unchanged: immich (default) | newest | oldest | filename | manual `manual` is a pinned *prefix*: `assetOrder` lists only the photos placed by hand, everything else follows in the album's Immich order. A full permutation of a 2,000-photo album would be ~80 KB of UUIDs in a file that is rewritten and copied to content/.backups/ on every admin save. It also makes drift fall out for free — photos removed in Immich never match, new ones land in the tail rather than being hidden. Sorting is applied after the cache read, not before the cache write, so the LRU keeps one canonical Immich-ordered copy per album. That avoids putting the mode in the cache key, lets a config change take effect without depending on invalidation, and keeps the stale-serving path correct. cache.get() returns the stored object by reference, so withSort() returns a shallow clone with a new array — sorting in place would reorder the shared entry, and under request coalescing every concurrent caller would be sorting the same array. Also fixes a prerequisite bug: /api/admin/albums/[albumId]/assets read album.assets from GET /albums/:id, which Immich 3.x no longer populates (lib/immich.ts:507). The hero picker's "This Album" tab returned nothing and threw outright when the key was absent. It now goes through the client's paginated metadata search, with ?types=all to opt videos in for the reorder editor. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): drop decorative emoji from the sort select labels (#415) An <option> cannot contain markup, so the SVG set in Icons is not reachable there — but a decorative emoji is not a substitute for it. Plain text instead; the album card badge already uses a real icon. The remaining emoji in the admin panel (asset picker tabs, section headings, layout picker options) predate this branch and are left for a separate cleanup. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): replace emoji icons with the shared SVG icon set (#416) The admin panel mixed two icon conventions: inline SVGs from `Icons.tsx` in most components, and decorative emoji in the asset picker and a few PageBuilder labels. Emoji render inconsistently across platforms, ignore the accent colour, and cannot inherit the `.svg-icon` sizing rules. - Icons.tsx: add `IconStar` (filled — it marks a state, not an action) and `IconImage`. - AssetPicker: the three tab labels and the favourite tile badge now use IconFolder / IconStar / IconImage. - PageBuilder: the "Standalone Albums" and "Subpages" headings use the icon set instead of an emoji. - PageBuilder: the layout picker drops its emoji for plain text. An <option> cannot contain markup, so an SVG is impossible there and a decorative glyph is not a substitute. - admin.css: align icon and label in the picker tabs, and swap the favourite badge's text-shadow for drop-shadow, which is what applies to an inline SVG. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): fold PageBuilder's local icons into the shared Icons module (#418) * refactor(admin): fold PageBuilder's local icons into the shared module PageBuilder.tsx carried its own `Icons` object duplicating most of the glyphs already exported by Icons.tsx, with hardcoded sizes and slightly divergent paths. Migrate all 32 call sites to the shared module and delete the local object. Five glyphs had no counterpart and are added to Icons.tsx as 1:1 ports of the local paths: IconX, IconPlus, IconHome, IconCopy, IconImage. The local ExternalLink and Check are dropped rather than ported — both had zero call sites. Two glyphs change shape slightly, which is the point of consolidating: the shared IconCamera includes the viewfinder bump the local copy omitted, and drag handles now use IconGripVertical. IconGripVertical uses the module's square 24x24 viewBox, so `.svg-drag` goes from 12x18 to 18x18 — the old non-square box would letterbox the glyph down to 12x12 and shrink the handle. * fix(admin): resolve icon-module integration after #416 Merging dev brought in #416, which added a second IconImage to Icons.tsx and two <Icons.Camera>/<Icons.Folder> section headers that reference the local Icons object this PR removes. Git merged both cleanly but the result did not type-check. - drop the duplicate IconImage (both copies were byte-identical) - point the two section headers at the imported IconCamera/IconFolder - refresh the SORT_LABELS comment: the icon set is imported now, not declared below --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> * fix(config): allow an empty gallery, guard against a double /api suffix (#421) An empty gallery is now a valid, rendered state instead of a throw: deriveGallery() no longer requires at least one album or subpage, so a deployment with no albums yet renders a bare homepage the owner can fill in via /admin. getConfig() also stops appending /api to an Immich URL that already ends in it, which previously produced .../api/api and broke every upstream request. Includes a restore of the per-album sort test cases, which the branch had lost by being cut before #408/#414. * feat(admin): favicon upload, served from the content volume (#422) Adds a bundled default favicon, an upload widget in admin Settings > General, and a route that serves the icon from the writable content/ volume with a fallback to the bundled default. Raster uploads (PNG/ICO/JPEG) are wrapped in an SVG container; the response carries its own CSP so an uploaded SVG cannot execute script on the origin. The GET route revalidates with an ETag instead of caching immutably, so a newly uploaded icon shows up immediately. Uploads are written via temp file + rename, and a Reset button restores the bundled default. * ci: flag unformatted files in a PR, without blocking it (#424) Prettier is configured as an error rule in eslint.config.mjs but has never run in CI, so part of the tree predates it. A final CI step now diffs against the PR base, runs prettier --list-different over the changed files, and emits a warning annotation per offender plus a job summary. Advisory by design: it never fails the job. Blocking would turn a PR red for merely touching a file that was already unformatted, and normalising the tree in one commit would wreck git blame and conflict with the PRs in flight. Requires fetch-depth: 0, since diffing against the base needs its history. * feat(install): first-run wizard gated by a one-time setup token (#419) Adds /install, a four-step first-run wizard: connect to Immich, optionally pick albums, name the site, finish. It verifies the credentials against the Immich server before writing anything, then writes gallery.yaml, settings.yaml and a content/install.json carrying the Immich credentials and a generated site secret. install.json exists because a running process cannot pick up new env vars — the wizard has to write configuration that takes effect without a restart. getInstallCredentials() merges it under the real environment, so env vars always win and rotation stays a matter of setting one. Both the page and the API routes are gated by a one-time setup token printed to the server log, so a deployment that is reachable before gallery.yaml exists cannot be configured by whoever finds it first. The token is stored in content/.setup-token (0600) rather than a module variable: Next.js bundles the page and each route handler separately, so a module-level token left the page and the API disagreeing inside one process and the wizard stuck on step 1. It is removed once the install completes. The admin password is stored as an scrypt hash using the scheme lib/auth.ts already applies to album passwords; a plaintext ADMIN_PASSWORD env var keeps working. * docs: document the setup wizard, fix the read-only content mount (#425) Quick Start now leads with the /install wizard, with the hand-written YAML route kept alongside it, and a First-Run Setup section covers the setup token, the files the wizard writes, and env-var precedence. Two corrections: both Docker examples mounted content/ as :ro, which silently breaks the wizard, the admin panel and the backup rotation alike — docs/admin-panel.md already said so and the README contradicted it. And nothing documented that content/install.json holds the Immich API key, so a backup of content/ is a backup of credentials. Also adds a Contributors section crediting the people whose work is in the project. * feat(admin): floating save bar pinned to the bottom of the viewport (#426) The save bar was the first, static element inside .admin-main. Since the document itself scrolls, it left the viewport as soon as you scrolled down — editing a subpage section or a settings block far below gave no visible dirty hint and no reachable save button. Replace it with a bottom-pinned floating bar shared by both editors. It only mounts while there is something to act on (unsaved changes, an in-flight save, or a result message), so it never covers content while idle. The success message clears after 5s, which hides the bar again. - new SaveBar component, replacing the duplicated markup in PageBuilder and SettingsEditor - adopt the previously unused .floating-save-bar CSS: slide-in keyframes (carrying translateX(-50%)), dirty border, wrap/gap, mobile variant and a prefers-reduced-motion opt-out; z-index 900 keeps it below modals - .admin-main gains bottom padding so the bar never covers page content - drop the now-unreachable idle hints: the ⌘S hint becomes a button title, the Live Sync note becomes a static line above the settings layout - header "Site" link now bypasses the cache (/?fresh=1), so the preview stays reachable when the bar is hidden Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(admin): themed listbox for the album sort control (#427) The per-album "Photo order" control was a native <select>. Because an <option> cannot contain markup, its choices could not use the admin panel's currentColor SVG set — the reason #415 had to fall back to plain text after dropping the emoji labels. Adds a Listbox component implementing the ARIA combobox/listbox pattern, so options can render a glyph beside their label: - DOM focus stays on the trigger button; the active option is announced through aria-activedescendant, keeping focus management to one element - Keyboard: arrows (clamped at the ends, like a native select), Home/End, Enter/Space to commit, Escape to cancel, Tab commits and moves on, and prefix type-ahead with a repeat-key cycle - Outside dismissal on pointerdown, so a press starting outside closes the popup before the click retargets The sort options now carry an icon each: calendar, arrow-down, arrow-up, an A→Z marker, and the drag glyph for manual — matching the badge the album card already shows. SORT_LABELS stays plain text because the badge feeds it to a title attribute. Closes #417 Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(git): ignore generated design handoff folders * fix(admin): stop the album sort dropdown clipping, and simplify the panel (#428) * fix(admin): render listbox popup in a portal so it escapes modal clipping The sort control's popup was position:absolute inside three clipping ancestors (.album-drawer overflow:hidden > .album-drawer-body overflow-y:auto > .modal-right-column overflow-y:auto), so it was cut off at the bottom of the Edit Album Details modal. z-index could not help: clipping happens before stacking. It also always hung below the trigger, with no flip. Portal the popup to document.body and position it from the trigger's viewport rect, flipping above when there is more room there and capping max-height to the space available so it scrolls internally rather than overflowing. It is dismissed on scroll and resize, since the anchor is only measured on open. The outside-pointerdown handler now also treats the popup as inside; without that the portalled list counts as outside, and a click on an option would close it before the selection commits. * refactor(admin): single-column album details panel The left column spent 1.2fr on a cover thumbnail and three stat rows, two of which (Status, Custom Hero) only restated the form fields opposite them, while the form itself was squeezed into 1.8fr behind a second nested scroller. Stack the drawer in one column instead: cover as a banner, then the form at full width, with the UUID moved into the footer. The body is now the only scroll container, which also removes one of the ancestors that was clipping the sort popup. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> * fix(admin): give the portalled listbox its theme back, lock the page behind modals (#429) Two defects in the album editor. The sort listbox popup painted transparent. Every --admin-* variable is scoped to .admin-layout, and since the popup moved into document.body it sits outside that subtree, so background/border/text all resolved to nothing. It now carries its own copy of the palette in both colour schemes, plus the font it no longer inherits. Scrolling inside a modal also moved the page behind it. No admin modal ever locked body scroll: the overlay covers the page but does not absorb wheel events, so a scroll starting on the backdrop — or continuing past the end of the modal's own scroller — reaches the document. overscroll-behavior cannot cover that case on its own, because it only applies to scroll containers and the backdrop is not one. useScrollLock freezes body while a modal is open and compensates for the width the scrollbar gives up, so nothing shifts underneath. Each lock restores the inline value it found, which makes nesting work without a counter — a picker opened from the drawer restores the drawer's hidden state instead of clearing it. Applied to both drawers and all four picker modals, which share the defect. overscroll-behavior: contain on the scrollers stops the chaining they can handle themselves. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com> * fix(security): allow unsafe-eval in CSP script-src during dev mode * feat(journal): add Journal Studio with split-screen editor, live preview and dedicated routes * fix(build): separate client parser from server journal-service and fix build type errors * fix(journal): Fotos rendern, Layout und Lightbox-Steuerung korrigieren Fünf unabhängige Fehler in der öffentlichen Journal- und Essay-Ansicht: * Foto-Blöcke wurden nie angezeigt. EssayView löst ein Foto über PhotoItem.id auf, und das sind verschlüsselte Tokens — die Blöcke aus dem Markdown tragen aber rohe Asset-UUIDs. Jede Zuordnung lief ins Leere, und nicht auflösbare Blöcke werden still verworfen. Die IDs werden jetzt serverseitig übersetzt; damit verschwinden nebenbei die rohen UUIDs aus dem Client-Payload, die dort laut Projektregel nie auftauchen dürfen. Nicht auflösbare Referenzen werden geloggt. * Überschriften standen weiter links als der Fließtext. Jeder Block hatte einzeln `max-width: 68ch`, und `ch` ist relativ zur Schrift des Elements — die Serif-Überschrift ergab eine breitere Spalte. Ersetzt durch eine gemeinsame, font-unabhängige `--essay-measure`. * Fullbleed-Fotos bluteten nur nach links aus: `.essay-figure` ist `width: 100%`, wodurch die Box überbestimmt ist und der negative rechte Margin verworfen wird. * Foto-Paare stellten beide Bilder gleich breit dar, wodurch ein Hochformat neben einem Querformat doppelt so hoch wurde. Jetzt eine Justified-Reihe: Breite proportional zum Seitenverhältnis, dadurch exakt gleiche Höhen ohne Beschnitt. * Die Lightbox hatte im Journal keine Tastatursteuerung und keine Scroll-Sperre — beides lag in PhotoGrid, also nur im Album-Raster. Verlagert in die Lightbox selbst, der doppelte Handler in PhotoGrid entfernt (sonst wäre pro Pfeildruck zwei Bilder weitergesprungen). Zusätzlich sind Proofing-Herzen und das EXIF-Panel im redaktionellen Modus abschaltbar und im Journal aus: Client-Proofing ist ein Übergabe-Workflow für Alben, keine Funktion einer Reportage. Auf der Übersicht wurde der Untertitel doppelt gerendert, weil extractExcerpt() auf ihn zurückfällt. * feat(admin): eigene URLs für alle Bereiche und überarbeiteter Journal Studio Das Panel war eine einzige Client-Komponente, die ihre Tabs über useState umschaltet: keine Route pro Bereich, kein Deep-Link, kein Zurück-Button, und nach jedem Reload landete man wieder auf "Pages". Auch der Journal-Editor hatte keine eigene URL. Jetzt sieben echte Routen (/admin, /admin/pages, /admin/journal, /admin/journal/<slug>, /admin/settings, /admin/settings/<section>, /admin/analytics). Die Shell mit Auth-Prüfung und Kopfzeile sitzt im Layout und umschließt children — so bleibt die Session-Prüfung über Routenwechsel montiert, statt bei jedem Tab-Wechsel neu zu laufen und den Spinner aufblitzen zu lassen. Unbekannte Settings-Sections fallen auf General zurück. Im selben Zug der Journal Studio, der die Routing-Änderung ohnehin berührt: * Alle Eingabefelder nutzten die Klasse `admin-input`, die in keinem CSS definiert war — sie fielen auf Browser-Defaults zurück. Jetzt gestylt, gescoped, damit der generische Name nicht ins übrige Panel leckt. * Der Split View ist per Divider verschiebbar (Maus, Tastatur, Doppelklick zum Zurücksetzen), Breite in localStorage. * Das Studio bricht aus der 1120px-Spalte aus, die Preview hat Platz. * Die Preview zeigte für jedes Foto fest 3:2 und log damit über das Layout der veröffentlichten Seite; die echten Verhältnisse werden jetzt an den Thumbnails gemessen. * Blöcke mit alten positionsbasierten Foto-Referenzen werden markiert — die lassen sich auf einer eigenständigen Journal-Seite nicht auflösen und verschwanden bisher stillschweigend. * Blocktyp-Chips als gemeinsame Komponente, monochrom und per Icon unterschieden statt in einer eigenen Blau/Lila/Orange-Palette, die sonst nirgends im Panel vorkommt. * Emojis raus, SVG-Icons rein. * fix(admin): Designsystem-Lücken im Panel schließen Eine systematische Suche nach Klassen, die im TSX benutzt, aber in keinem CSS definiert sind, hat vier Stellen mit demselben Muster gefunden: * `admin-btn-secondary` und `admin-btn-danger` existierten nicht. Sämtliche Löschen-Buttons sahen aus wie normale Buttons — keine Warnwirkung. Als `.admin-btn.admin-btn-danger` geschrieben, weil die Varianten mit den Größenklassen kombiniert werden, die weiter unten ihren eigenen Hintergrund setzen. * `page-progress-fill` fehlte: die Balken im Analytics-Panel waren leere Rinnen, der Wert unsichtbar. Ebenso `analytics-empty` und `admin-loading-container`. * `subpage-drawer-section`, `subpage-drawer-title-group` und `input-with-icon` im PageBuilder waren wirkungslos und teils mit Inline-Styles notdürftig kompensiert. * `grid-card-preview` fehlte, wodurch alle Layout-Vorschauen auf Höhe null kollabierten. Nur "Showcase" war sichtbar — und das aus Versehen, weil sein Tile `hero-tile` hieß und damit die `aspect-ratio` einer fremden PageBuilder-Klasse erbte. Umbenannt. Dazu die Theme-Vorschauen, die praktisch identisch aussahen: alle sieben zeigten dieselben drei quadratischen Kacheln, einziger Unterschied war die Hintergrundfarbe. Sie spiegeln jetzt die echten Preset-Daten aus lib/config/theme.ts — Schriftcharakter, Eckradius, Rasterdichte, Passepartout bzw. Schatten. Die Kopfzeile richtet sich an einer gemeinsamen Steuerhöhe aus. Der "Site"-Link war höher als die Buttons daneben: `.admin-btn` hatte keine explizite line-height, und <button> bekommt box-sizing: border-box vom Browser, <a> nicht. Die Statusanzeige setzte weder Schriftfamilie noch -größe und fiel auf den Browser-Default zurück — sie war nie Teil des Designsystems. Jetzt gleiche Höhe und Typografie, Pillenform als Zustandsanzeige, Trenner zur Aktionsgruppe. Das dauerhafte Pulsieren des grünen Punkts entfällt; Animation bleibt den Zuständen vorbehalten, die Aufmerksamkeit brauchen. Restliche Emojis durch SVG-Icons ersetzt. * feat(admin): add scroll-to-top toggle and SVG arrow The back-to-top button was always on and drew its arrow with the ↑ text character. Add a `scrollToTop` setting (General section in the admin panel, defaults to on so existing sites are unaffected) and replace the glyph with a stroked SVG that inherits currentColor across all presets. Scroll handling is now rAF-throttled, and prefers-reduced-motion turns off both the hover lift and the smooth scroll. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * security(journal): escape author HTML instead of filtering it CodeQL flags 26 high-severity alerts on the release PR; the bulk of them point at sanitizeHtml(), a denylist of three regexes whose output goes into dangerouslySetInnerHTML. I reproduced the bypasses before changing anything — all four pass the old filter: <img src=x onerror=alert(1)> unquoted handler, regex wants quotes <img src=x onerror='alert(1)'> single quotes, same reason <svg onload=alert(1)> not a <script> tag javasjavascript:cript:alert(1) one-pass replace, the rest recombines Plus an attribute breakout in the link renderer, which interpolated the URL into href="${url}" unescaped: [x](" onmouseover=alert(1) x=") -> <a href="" onmouseover=alert(1" ...> Replaced with escaping. Every `&<>"'` in author text becomes an entity before any markdown rule runs, so the only tags in the output are the ones renderInlineMarkdown builds itself and a URL cannot leave its attribute. Link schemes are now an allowlist (http, https, mailto, tel, relative, anchor); anything else renders as plain text. The serializer needed decodeHtmlEntities to match: without it a save would write `&lt;` into the Markdown file and the next parse would escape the `&` again, corrupting the text further on every round trip. A test covers parse -> serialize -> parse stability. Two existing tests asserted the old behaviour and were rewritten rather than deleted: one expected the script tag to be *removed* from the output, the other expected the substring "onerror" to be absent. Both now assert the property that matters — that no tag can form — because `onerror` surviving as inert text is fine. Exploitation required admin access either way: journal and essay text comes from the studio or from content/*.md. This removes the weakness, it does not close an open door. * fix(journal): contain file paths, fix frontmatter escaping, defuse two regexes Follow-up to the CodeQL findings on release PR #432. I went through all 23 alerts individually; this addresses the ones that are worth addressing and documents the ones that are not. Path containment (12 alerts, all false positives). Every path built from a slug goes through isValidSlug(), a strict `/^[a-zA-Z0-9_-]+$/` allowlist — verified against `../../etc/passwd`, `foo/../../bar`, `a/b`, `..` and friends, all rejected. CodeQL cannot see it because the check lives in another module. Added a containedPath() helper that resolves the path and refuses anything landing outside the content directory: a second lock on a door that was already locked, and a barrier the analysis can follow. Also removed the dead `slug.endsWith('.md')` branches — isValidSlug rejects dots, so they could never be taken. Frontmatter escaping (1 alert, a real bug). The serializer escaped `"` but not `\`, and the parser never unescaped anything. A title containing either character gained a backslash on every save/load cycle: Path C:\Users "quoted" -> Path C:\\Users \"quoted\" -> ... Escaping now covers the backslash first and the parser undoes both. A round trip test covers quotes, backslashes, colons and apostrophes. Two of three ReDoS regexes (2 alerts). The heading pattern had `\s+` next to `(.+)`, which overlap, so the engine tried every split of the whitespace run before failing; it is `[ \t]+` and `(\S.*)` now. The quote author pattern wrapped a lazy group around an optional group — the quadratic case — and is an index split on the first separator now. The third regex, the bold/italic pass, is deliberately left alone. Rewriting it with a negated class removes the backtracking but breaks nesting: `**bold *and italic* here**` renders as `*<em>bold </em>and italic<em> here</em>*`. The input is Markdown from an authenticated admin, never a visitor, so the worst case is an author slowing down their own page. The comment in the code says so. Not addressed: 5 js/insufficient-password-hash alerts. They ask for a slow KDF where the code uses SHA-256/HMAC — correct in general, but the admin password comes from an environment variable and is never stored, so a stronger KDF protects nothing that is not already in plaintext in the environment. 399 unit tests pass (18 new), build and tsc clean. * fix(journal): split the quote author by scanning, not by pattern Cleaning up after myself. #439 replaced the quote author regex `/^(.*?)(?:\s+--\s+(.+))?$/` — a lazy group around an optional one, the quadratic case — with `/\s+--\s+/`, and CodeQL promptly flagged the replacement for the same reason. One reported pattern traded for another. splitQuoteAuthor() scans for the first `--` that has whitespace on both sides. Linear, and it needs no reasoning about the regex engine at all. Behaviour is identical to the original regex, checked case by case against it: separator, no separator, several separators, tabs, wide gaps, `a--b` without spaces, leading and trailing separators, empty string. All nine are covered by tests, plus one asserting it stays fast on a 50k whitespace run. * security(admin): derive the session signing key with scrypt getSigningKey() ran the admin password through a single SHA-256 digest. It is key derivation rather than password storage, so it was never a stored-hash problem — but if the derived key ever leaked, one fast hash makes recovering the password by brute force cheap. CodeQL flags it as js/insufficient-password-hash and, for this particular alert, has a point. scrypt now. Two details that matter: The salt has to be stable. A random salt would produce a different key on every call and invalidate every session; it is derived from AUTH_SECRET, which is deployment-specific. Verified across separate processes: same inputs produce a verifying token, so a restart or redeploy does not log everyone out. The result is cached for the process lifetime. scrypt is deliberately slow and getSigningKey() runs on every admin request — deriving per call would add ~24ms to each one. The cache key is a digest of secret plus password, so a rotation misses the cache and derives again, and no extra plaintext copy of the password is kept around. Measured: first derivation 24ms, subsequent calls 0.12ms. Password change and secret change both invalidate an existing token, checked in separate processes. Note the one-time effect: existing admin sessions are invalidated by the change in derivation, so everyone logs in once more. * security(admin): key the signing-key cache on its inputs, not a digest #441 removed the SHA-256 digest of the admin password from the key derivation and introduced a new one three lines above it, as the cache key. Same rule, same file: CodeQL reported it immediately. The comment justifying it was wrong too. It claimed no second plaintext copy of the password was retained, while building the digest input allocates exactly that in order to hash it. The cache now holds the two input strings and compares them directly. They are the same objects the env and install caches already hold, so nothing extra is retained, and no fast hash of the password exists in memory for the life of the process. Re-verified after the change, in separate processes: a token from one process verifies in another with the same inputs, a changed password or secret rejects it, first derivation 24ms, cached calls 0.001ms. That leaves scrypt as the only place the password is hashed here. The two HMACs further down operate on the derived key and on token data, not on the password; the constant-time comparison in verifyAdminPassword is the previously dismissed one. --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
2026-08-14 16:55:07 +02:00
{faviconMessage}
</p>
)}
<span className="admin-field-hint">
SVG, PNG, ICO, or JPEG — max 512 kB. Stored in the content volume. Reset restores
the bundled default.
</span>
</div>
</div>
)}
{activeSection === 'theme' && (
security: add Trivy container scan to Docker publish workflow (#399) * feat(admin): add backup manager UI with 1-click restore * feat(admin): collapse older backup entries by default * fix(theme): isolate admin layout, instant DOM theme updates, and add Light/Dark mode toggle * feat(admin): replace text controls for Photo Frame and Hero Style with visual preview cards * fix(admin): define missing CSS rules for button system (.btn, .preset-btn) * feat(admin): redesign theme settings with segmented mode toggle, accent color swatches, and custom iOS-style toggle cards * feat(admin): upgrade all settings tabs with visual grid previews, Google SEO snippet preview, and toggle cards * feat(admin): overhaul Pages Builder UX with slide-over drawer, card hover badges, real-time search, and floating save bar * fix(admin): remove leftover dangling syntax snippet in PageBuilder.tsx * fix(admin): add position: relative to subpage-tile so hover overlay is contained inside the tile * style(admin): replace all emojis with clean Leica-style vector SVG icons * fix(types): extend IconProps with SVGProps to allow style prop on Leica SVG icons * feat(admin): add subpage live-preview, privacy analytics, and asset protection settings * fix(typecheck): fix AlbumEntry property access in subpage drawer preview mode * fix(types): fix ImmichAlbumInfo property names thumbnailAssetId and albumName in PageBuilder.tsx * fix(types): add protection and watermark optional properties to AppConfig interface * feat(settings): add toggle for disabling analytics tracking (defaults to enabled) * feat(ux): show status banner when analytics tracking is disabled + add live sync indicator * feat(watermark): render customizable watermark overlay on Lightbox images + rename section to Portfolio Features & Modules * fix(types): import type LightboxWatermark in PhotoGrid.tsx * fix(types): destructure watermark prop in PhotoGrid function signature * feat(seo): add configurable subpage title template and metadata descriptions * feat(seo): add generateMetadata to about page for title template support * feat(proofing): add client proofing, favorites selection, compact URL bitmasking, and export modal * feat(essay): add Photo Essay storytelling mode with RSC markdown parser and fullbleed/pair layouts * feat(subpages): add page enabled toggle to deactivate subpages without deleting them * feat(admin): add visual essay block builder for photo essay storytelling pages * security: add Trivy container scan to Docker publish workflow Scans the built image for CRITICAL/HIGH CVEs on every release and uploads results to the GitHub Security tab. Non-blocking for now (exit-code 0) so releases aren't gated on findings. Also documents the scan and existing Dependabot coverage in the README. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-08-07 11:08:04 +02:00
<div className="settings-panel theme-settings-panel">
<div className="settings-section-header">
release: v0.11.0 (#459) Ships `dev` as **v0.11.0**. `main` contains nothing that `dev` does not, so this is a clean sync. ## Headline changes since v0.10.0 - **Journal & Journal Studio** — photo essays at `/journal`, split-screen block editor with live preview, drafts, per-entry passwords, cover images - **First-run setup wizard at `/install`** — configure a fresh deployment from the browser; credentials are verified against Immich before anything is written, and the wizard is gated by a one-time token - **About page editor and toggle** in the admin panel - **Per-album photo order** independent of Immich, with a drag & drop editor - **Custom favicon upload** - **Experimental portfolio features** — justified grid, `cover` hero, unlisted subpages, per-album grid overrides, cover focal points, external nav links - **Security** — asset tokens length-capped before decoding (#423), journal author markdown escaped rather than filtered, journal file paths contained, admin session key derived with scrypt (#432), Next.js 16.3.0 for CVE-2025-13465 - **Fixed** — client proofing honours its own configuration again (#454); journal photo rendering (#432) Full detail in [CHANGELOG.md](CHANGELOG.md#0110--2026-08-15). ## Verified `npx tsc --noEmit` clean · `npx vitest run` 435 tests pass · `npm run build` succeeds · lint 0 errors · `prettier --check` clean · local `docker build` of the release tree. ## After merge Tag `v0.11.0` on `main` and publish the release — that triggers `docker-publish.yml`, which pushes the image and moves `latest`. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
2026-08-15 09:09:18 +02:00
<h3>
<Icons.IconPalette size={18} /> Theme Presets &amp; Color Mode
</h3>
<p className="settings-section-sub">
Choose a typography preset and preview in Light or Dark mode.
</p>
security: add Trivy container scan to Docker publish workflow (#399) * feat(admin): add backup manager UI with 1-click restore * feat(admin): collapse older backup entries by default * fix(theme): isolate admin layout, instant DOM theme updates, and add Light/Dark mode toggle * feat(admin): replace text controls for Photo Frame and Hero Style with visual preview cards * fix(admin): define missing CSS rules for button system (.btn, .preset-btn) * feat(admin): redesign theme settings with segmented mode toggle, accent color swatches, and custom iOS-style toggle cards * feat(admin): upgrade all settings tabs with visual grid previews, Google SEO snippet preview, and toggle cards * feat(admin): overhaul Pages Builder UX with slide-over drawer, card hover badges, real-time search, and floating save bar * fix(admin): remove leftover dangling syntax snippet in PageBuilder.tsx * fix(admin): add position: relative to subpage-tile so hover overlay is contained inside the tile * style(admin): replace all emojis with clean Leica-style vector SVG icons * fix(types): extend IconProps with SVGProps to allow style prop on Leica SVG icons * feat(admin): add subpage live-preview, privacy analytics, and asset protection settings * fix(typecheck): fix AlbumEntry property access in subpage drawer preview mode * fix(types): fix ImmichAlbumInfo property names thumbnailAssetId and albumName in PageBuilder.tsx * fix(types): add protection and watermark optional properties to AppConfig interface * feat(settings): add toggle for disabling analytics tracking (defaults to enabled) * feat(ux): show status banner when analytics tracking is disabled + add live sync indicator * feat(watermark): render customizable watermark overlay on Lightbox images + rename section to Portfolio Features & Modules * fix(types): import type LightboxWatermark in PhotoGrid.tsx * fix(types): destructure watermark prop in PhotoGrid function signature * feat(seo): add configurable subpage title template and metadata descriptions * feat(seo): add generateMetadata to about page for title template support * feat(proofing): add client proofing, favorites selection, compact URL bitmasking, and export modal * feat(essay): add Photo Essay storytelling mode with RSC markdown parser and fullbleed/pair layouts * feat(subpages): add page enabled toggle to deactivate subpages without deleting them * feat(admin): add visual essay block builder for photo essay storytelling pages * security: add Trivy container scan to Docker publish workflow Scans the built image for CRITICAL/HIGH CVEs on every release and uploads results to the GitHub Security tab. Non-blocking for now (exit-code 0) so releases aren't gated on findings. Also documents the scan and existing Dependabot coverage in the README. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-08-07 11:08:04 +02:00
</div>
<div className="admin-field">
<label>Visitor Default Mode</label>
<select
value={settings.mode || 'dark'}
onChange={(e) => update('mode', e.target.value)}
>
<option value="dark">Dark</option>
<option value="light">Light</option>
<option value="auto">Follow the visitor's system</option>
</select>
<p className="admin-field-hint">
What a first-time visitor sees. The light/dark toggle in the site header still
lets them choose, and their choice is remembered on their device. The preview
below is your own, and does not change this.
</p>
</div>
<div className="admin-field">
<label>Preset</label>
<div className="preset-card-grid">
{PRESETS.map((p) => {
release: v0.11.0 — journal fixes, admin URLs, design system cleanup (#432) * fix(screenshots): sharp-Typen fuer 0.34 und 0.35 gleichzeitig (#410) sharp 0.35 ist von `export =` auf ESM umgestellt: der Modul-Namespace ist nicht mehr aufrufbar, die Factory sitzt unter .default. Der Type-Check brach damit in scripts/screenshots.ts weg, sobald der Next-Bump (#402) sharp von 0.34.5 auf 0.35.3 mitzieht -- sharp ist hier keine deklarierte Dependency, sondern kommt ueber Next mit. Die Form wird jetzt aus dem installierten Paket abgeleitet statt festgeschrieben, zur Laufzeit wie im Typ. Geprueft mit beiden Versionen: tsc laeuft mit 0.34.5 und mit 0.35.3 fehlerfrei durch. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(deps): bump the nextjs group across 1 directory with 2 updates (#402) Bumps the nextjs group with 2 updates in the / directory: [next](https://github.com/vercel/next.js) and [eslint-config-next](https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next). Updates `next` from 16.2.12 to 16.3.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/compare/v16.2.12...v16.3.0) Updates `eslint-config-next` from 16.2.12 to 16.3.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/commits/v16.3.0/packages/eslint-config-next) --- updated-dependencies: - dependency-name: eslint-config-next dependency-version: 16.3.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: nextjs - dependency-name: next dependency-version: 16.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nextjs ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps-dev): bump prettier from 3.8.3 to 3.9.6 (#405) Bumps [prettier](https://github.com/prettier/prettier) from 3.8.3 to 3.9.6. - [Release notes](https://github.com/prettier/prettier/releases) - [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md) - [Commits](https://github.com/prettier/prettier/compare/3.8.3...3.9.6) --- updated-dependencies: - dependency-name: prettier dependency-version: 3.9.6 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * docs(changelog): Unreleased-Sektion fuer die Bumps nach v0.10.0 (#413) Die Dependency-PRs sind nach dem Release auf dev gelandet, teils auch auf main. Ohne Eintrag waeren sie beim naechsten Release unsichtbar -- inklusive Next 16.3.0, das CVE-2025-13465 mitbringt. Ausserdem im 0.10.0-Abschnitt nachgetragen, dass der Trivy-Scan bis #409 nie gelaufen ist. Der Fix steckt im Tag v0.10.0, fehlte aber in der Aufzaehlung -- und "Images werden bei jedem Publish gescannt" stand im Changelog, waehrend der Job im Action-Setup abbrach. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(gallery): per-album sort order, independent of Immich (#408) (#414) Album order was dictated entirely by Immich: getAlbum() sorted by the album's own asc/desc flag, so a Folio album always mirrored the archive. A curated series has a narrative order that has nothing to do with capture time, and changing the Immich album's sort to fit the website changes it for the archive too. Adds an optional per-album `sort` in gallery.yaml, editable in /admin, defaulting to today's behaviour so every existing config is unchanged: immich (default) | newest | oldest | filename | manual `manual` is a pinned *prefix*: `assetOrder` lists only the photos placed by hand, everything else follows in the album's Immich order. A full permutation of a 2,000-photo album would be ~80 KB of UUIDs in a file that is rewritten and copied to content/.backups/ on every admin save. It also makes drift fall out for free — photos removed in Immich never match, new ones land in the tail rather than being hidden. Sorting is applied after the cache read, not before the cache write, so the LRU keeps one canonical Immich-ordered copy per album. That avoids putting the mode in the cache key, lets a config change take effect without depending on invalidation, and keeps the stale-serving path correct. cache.get() returns the stored object by reference, so withSort() returns a shallow clone with a new array — sorting in place would reorder the shared entry, and under request coalescing every concurrent caller would be sorting the same array. Also fixes a prerequisite bug: /api/admin/albums/[albumId]/assets read album.assets from GET /albums/:id, which Immich 3.x no longer populates (lib/immich.ts:507). The hero picker's "This Album" tab returned nothing and threw outright when the key was absent. It now goes through the client's paginated metadata search, with ?types=all to opt videos in for the reorder editor. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): drop decorative emoji from the sort select labels (#415) An <option> cannot contain markup, so the SVG set in Icons is not reachable there — but a decorative emoji is not a substitute for it. Plain text instead; the album card badge already uses a real icon. The remaining emoji in the admin panel (asset picker tabs, section headings, layout picker options) predate this branch and are left for a separate cleanup. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): replace emoji icons with the shared SVG icon set (#416) The admin panel mixed two icon conventions: inline SVGs from `Icons.tsx` in most components, and decorative emoji in the asset picker and a few PageBuilder labels. Emoji render inconsistently across platforms, ignore the accent colour, and cannot inherit the `.svg-icon` sizing rules. - Icons.tsx: add `IconStar` (filled — it marks a state, not an action) and `IconImage`. - AssetPicker: the three tab labels and the favourite tile badge now use IconFolder / IconStar / IconImage. - PageBuilder: the "Standalone Albums" and "Subpages" headings use the icon set instead of an emoji. - PageBuilder: the layout picker drops its emoji for plain text. An <option> cannot contain markup, so an SVG is impossible there and a decorative glyph is not a substitute. - admin.css: align icon and label in the picker tabs, and swap the favourite badge's text-shadow for drop-shadow, which is what applies to an inline SVG. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): fold PageBuilder's local icons into the shared Icons module (#418) * refactor(admin): fold PageBuilder's local icons into the shared module PageBuilder.tsx carried its own `Icons` object duplicating most of the glyphs already exported by Icons.tsx, with hardcoded sizes and slightly divergent paths. Migrate all 32 call sites to the shared module and delete the local object. Five glyphs had no counterpart and are added to Icons.tsx as 1:1 ports of the local paths: IconX, IconPlus, IconHome, IconCopy, IconImage. The local ExternalLink and Check are dropped rather than ported — both had zero call sites. Two glyphs change shape slightly, which is the point of consolidating: the shared IconCamera includes the viewfinder bump the local copy omitted, and drag handles now use IconGripVertical. IconGripVertical uses the module's square 24x24 viewBox, so `.svg-drag` goes from 12x18 to 18x18 — the old non-square box would letterbox the glyph down to 12x12 and shrink the handle. * fix(admin): resolve icon-module integration after #416 Merging dev brought in #416, which added a second IconImage to Icons.tsx and two <Icons.Camera>/<Icons.Folder> section headers that reference the local Icons object this PR removes. Git merged both cleanly but the result did not type-check. - drop the duplicate IconImage (both copies were byte-identical) - point the two section headers at the imported IconCamera/IconFolder - refresh the SORT_LABELS comment: the icon set is imported now, not declared below --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> * fix(config): allow an empty gallery, guard against a double /api suffix (#421) An empty gallery is now a valid, rendered state instead of a throw: deriveGallery() no longer requires at least one album or subpage, so a deployment with no albums yet renders a bare homepage the owner can fill in via /admin. getConfig() also stops appending /api to an Immich URL that already ends in it, which previously produced .../api/api and broke every upstream request. Includes a restore of the per-album sort test cases, which the branch had lost by being cut before #408/#414. * feat(admin): favicon upload, served from the content volume (#422) Adds a bundled default favicon, an upload widget in admin Settings > General, and a route that serves the icon from the writable content/ volume with a fallback to the bundled default. Raster uploads (PNG/ICO/JPEG) are wrapped in an SVG container; the response carries its own CSP so an uploaded SVG cannot execute script on the origin. The GET route revalidates with an ETag instead of caching immutably, so a newly uploaded icon shows up immediately. Uploads are written via temp file + rename, and a Reset button restores the bundled default. * ci: flag unformatted files in a PR, without blocking it (#424) Prettier is configured as an error rule in eslint.config.mjs but has never run in CI, so part of the tree predates it. A final CI step now diffs against the PR base, runs prettier --list-different over the changed files, and emits a warning annotation per offender plus a job summary. Advisory by design: it never fails the job. Blocking would turn a PR red for merely touching a file that was already unformatted, and normalising the tree in one commit would wreck git blame and conflict with the PRs in flight. Requires fetch-depth: 0, since diffing against the base needs its history. * feat(install): first-run wizard gated by a one-time setup token (#419) Adds /install, a four-step first-run wizard: connect to Immich, optionally pick albums, name the site, finish. It verifies the credentials against the Immich server before writing anything, then writes gallery.yaml, settings.yaml and a content/install.json carrying the Immich credentials and a generated site secret. install.json exists because a running process cannot pick up new env vars — the wizard has to write configuration that takes effect without a restart. getInstallCredentials() merges it under the real environment, so env vars always win and rotation stays a matter of setting one. Both the page and the API routes are gated by a one-time setup token printed to the server log, so a deployment that is reachable before gallery.yaml exists cannot be configured by whoever finds it first. The token is stored in content/.setup-token (0600) rather than a module variable: Next.js bundles the page and each route handler separately, so a module-level token left the page and the API disagreeing inside one process and the wizard stuck on step 1. It is removed once the install completes. The admin password is stored as an scrypt hash using the scheme lib/auth.ts already applies to album passwords; a plaintext ADMIN_PASSWORD env var keeps working. * docs: document the setup wizard, fix the read-only content mount (#425) Quick Start now leads with the /install wizard, with the hand-written YAML route kept alongside it, and a First-Run Setup section covers the setup token, the files the wizard writes, and env-var precedence. Two corrections: both Docker examples mounted content/ as :ro, which silently breaks the wizard, the admin panel and the backup rotation alike — docs/admin-panel.md already said so and the README contradicted it. And nothing documented that content/install.json holds the Immich API key, so a backup of content/ is a backup of credentials. Also adds a Contributors section crediting the people whose work is in the project. * feat(admin): floating save bar pinned to the bottom of the viewport (#426) The save bar was the first, static element inside .admin-main. Since the document itself scrolls, it left the viewport as soon as you scrolled down — editing a subpage section or a settings block far below gave no visible dirty hint and no reachable save button. Replace it with a bottom-pinned floating bar shared by both editors. It only mounts while there is something to act on (unsaved changes, an in-flight save, or a result message), so it never covers content while idle. The success message clears after 5s, which hides the bar again. - new SaveBar component, replacing the duplicated markup in PageBuilder and SettingsEditor - adopt the previously unused .floating-save-bar CSS: slide-in keyframes (carrying translateX(-50%)), dirty border, wrap/gap, mobile variant and a prefers-reduced-motion opt-out; z-index 900 keeps it below modals - .admin-main gains bottom padding so the bar never covers page content - drop the now-unreachable idle hints: the ⌘S hint becomes a button title, the Live Sync note becomes a static line above the settings layout - header "Site" link now bypasses the cache (/?fresh=1), so the preview stays reachable when the bar is hidden Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(admin): themed listbox for the album sort control (#427) The per-album "Photo order" control was a native <select>. Because an <option> cannot contain markup, its choices could not use the admin panel's currentColor SVG set — the reason #415 had to fall back to plain text after dropping the emoji labels. Adds a Listbox component implementing the ARIA combobox/listbox pattern, so options can render a glyph beside their label: - DOM focus stays on the trigger button; the active option is announced through aria-activedescendant, keeping focus management to one element - Keyboard: arrows (clamped at the ends, like a native select), Home/End, Enter/Space to commit, Escape to cancel, Tab commits and moves on, and prefix type-ahead with a repeat-key cycle - Outside dismissal on pointerdown, so a press starting outside closes the popup before the click retargets The sort options now carry an icon each: calendar, arrow-down, arrow-up, an A→Z marker, and the drag glyph for manual — matching the badge the album card already shows. SORT_LABELS stays plain text because the badge feeds it to a title attribute. Closes #417 Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(git): ignore generated design handoff folders * fix(admin): stop the album sort dropdown clipping, and simplify the panel (#428) * fix(admin): render listbox popup in a portal so it escapes modal clipping The sort control's popup was position:absolute inside three clipping ancestors (.album-drawer overflow:hidden > .album-drawer-body overflow-y:auto > .modal-right-column overflow-y:auto), so it was cut off at the bottom of the Edit Album Details modal. z-index could not help: clipping happens before stacking. It also always hung below the trigger, with no flip. Portal the popup to document.body and position it from the trigger's viewport rect, flipping above when there is more room there and capping max-height to the space available so it scrolls internally rather than overflowing. It is dismissed on scroll and resize, since the anchor is only measured on open. The outside-pointerdown handler now also treats the popup as inside; without that the portalled list counts as outside, and a click on an option would close it before the selection commits. * refactor(admin): single-column album details panel The left column spent 1.2fr on a cover thumbnail and three stat rows, two of which (Status, Custom Hero) only restated the form fields opposite them, while the form itself was squeezed into 1.8fr behind a second nested scroller. Stack the drawer in one column instead: cover as a banner, then the form at full width, with the UUID moved into the footer. The body is now the only scroll container, which also removes one of the ancestors that was clipping the sort popup. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> * fix(admin): give the portalled listbox its theme back, lock the page behind modals (#429) Two defects in the album editor. The sort listbox popup painted transparent. Every --admin-* variable is scoped to .admin-layout, and since the popup moved into document.body it sits outside that subtree, so background/border/text all resolved to nothing. It now carries its own copy of the palette in both colour schemes, plus the font it no longer inherits. Scrolling inside a modal also moved the page behind it. No admin modal ever locked body scroll: the overlay covers the page but does not absorb wheel events, so a scroll starting on the backdrop — or continuing past the end of the modal's own scroller — reaches the document. overscroll-behavior cannot cover that case on its own, because it only applies to scroll containers and the backdrop is not one. useScrollLock freezes body while a modal is open and compensates for the width the scrollbar gives up, so nothing shifts underneath. Each lock restores the inline value it found, which makes nesting work without a counter — a picker opened from the drawer restores the drawer's hidden state instead of clearing it. Applied to both drawers and all four picker modals, which share the defect. overscroll-behavior: contain on the scrollers stops the chaining they can handle themselves. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com> * fix(security): allow unsafe-eval in CSP script-src during dev mode * feat(journal): add Journal Studio with split-screen editor, live preview and dedicated routes * fix(build): separate client parser from server journal-service and fix build type errors * fix(journal): Fotos rendern, Layout und Lightbox-Steuerung korrigieren Fünf unabhängige Fehler in der öffentlichen Journal- und Essay-Ansicht: * Foto-Blöcke wurden nie angezeigt. EssayView löst ein Foto über PhotoItem.id auf, und das sind verschlüsselte Tokens — die Blöcke aus dem Markdown tragen aber rohe Asset-UUIDs. Jede Zuordnung lief ins Leere, und nicht auflösbare Blöcke werden still verworfen. Die IDs werden jetzt serverseitig übersetzt; damit verschwinden nebenbei die rohen UUIDs aus dem Client-Payload, die dort laut Projektregel nie auftauchen dürfen. Nicht auflösbare Referenzen werden geloggt. * Überschriften standen weiter links als der Fließtext. Jeder Block hatte einzeln `max-width: 68ch`, und `ch` ist relativ zur Schrift des Elements — die Serif-Überschrift ergab eine breitere Spalte. Ersetzt durch eine gemeinsame, font-unabhängige `--essay-measure`. * Fullbleed-Fotos bluteten nur nach links aus: `.essay-figure` ist `width: 100%`, wodurch die Box überbestimmt ist und der negative rechte Margin verworfen wird. * Foto-Paare stellten beide Bilder gleich breit dar, wodurch ein Hochformat neben einem Querformat doppelt so hoch wurde. Jetzt eine Justified-Reihe: Breite proportional zum Seitenverhältnis, dadurch exakt gleiche Höhen ohne Beschnitt. * Die Lightbox hatte im Journal keine Tastatursteuerung und keine Scroll-Sperre — beides lag in PhotoGrid, also nur im Album-Raster. Verlagert in die Lightbox selbst, der doppelte Handler in PhotoGrid entfernt (sonst wäre pro Pfeildruck zwei Bilder weitergesprungen). Zusätzlich sind Proofing-Herzen und das EXIF-Panel im redaktionellen Modus abschaltbar und im Journal aus: Client-Proofing ist ein Übergabe-Workflow für Alben, keine Funktion einer Reportage. Auf der Übersicht wurde der Untertitel doppelt gerendert, weil extractExcerpt() auf ihn zurückfällt. * feat(admin): eigene URLs für alle Bereiche und überarbeiteter Journal Studio Das Panel war eine einzige Client-Komponente, die ihre Tabs über useState umschaltet: keine Route pro Bereich, kein Deep-Link, kein Zurück-Button, und nach jedem Reload landete man wieder auf "Pages". Auch der Journal-Editor hatte keine eigene URL. Jetzt sieben echte Routen (/admin, /admin/pages, /admin/journal, /admin/journal/<slug>, /admin/settings, /admin/settings/<section>, /admin/analytics). Die Shell mit Auth-Prüfung und Kopfzeile sitzt im Layout und umschließt children — so bleibt die Session-Prüfung über Routenwechsel montiert, statt bei jedem Tab-Wechsel neu zu laufen und den Spinner aufblitzen zu lassen. Unbekannte Settings-Sections fallen auf General zurück. Im selben Zug der Journal Studio, der die Routing-Änderung ohnehin berührt: * Alle Eingabefelder nutzten die Klasse `admin-input`, die in keinem CSS definiert war — sie fielen auf Browser-Defaults zurück. Jetzt gestylt, gescoped, damit der generische Name nicht ins übrige Panel leckt. * Der Split View ist per Divider verschiebbar (Maus, Tastatur, Doppelklick zum Zurücksetzen), Breite in localStorage. * Das Studio bricht aus der 1120px-Spalte aus, die Preview hat Platz. * Die Preview zeigte für jedes Foto fest 3:2 und log damit über das Layout der veröffentlichten Seite; die echten Verhältnisse werden jetzt an den Thumbnails gemessen. * Blöcke mit alten positionsbasierten Foto-Referenzen werden markiert — die lassen sich auf einer eigenständigen Journal-Seite nicht auflösen und verschwanden bisher stillschweigend. * Blocktyp-Chips als gemeinsame Komponente, monochrom und per Icon unterschieden statt in einer eigenen Blau/Lila/Orange-Palette, die sonst nirgends im Panel vorkommt. * Emojis raus, SVG-Icons rein. * fix(admin): Designsystem-Lücken im Panel schließen Eine systematische Suche nach Klassen, die im TSX benutzt, aber in keinem CSS definiert sind, hat vier Stellen mit demselben Muster gefunden: * `admin-btn-secondary` und `admin-btn-danger` existierten nicht. Sämtliche Löschen-Buttons sahen aus wie normale Buttons — keine Warnwirkung. Als `.admin-btn.admin-btn-danger` geschrieben, weil die Varianten mit den Größenklassen kombiniert werden, die weiter unten ihren eigenen Hintergrund setzen. * `page-progress-fill` fehlte: die Balken im Analytics-Panel waren leere Rinnen, der Wert unsichtbar. Ebenso `analytics-empty` und `admin-loading-container`. * `subpage-drawer-section`, `subpage-drawer-title-group` und `input-with-icon` im PageBuilder waren wirkungslos und teils mit Inline-Styles notdürftig kompensiert. * `grid-card-preview` fehlte, wodurch alle Layout-Vorschauen auf Höhe null kollabierten. Nur "Showcase" war sichtbar — und das aus Versehen, weil sein Tile `hero-tile` hieß und damit die `aspect-ratio` einer fremden PageBuilder-Klasse erbte. Umbenannt. Dazu die Theme-Vorschauen, die praktisch identisch aussahen: alle sieben zeigten dieselben drei quadratischen Kacheln, einziger Unterschied war die Hintergrundfarbe. Sie spiegeln jetzt die echten Preset-Daten aus lib/config/theme.ts — Schriftcharakter, Eckradius, Rasterdichte, Passepartout bzw. Schatten. Die Kopfzeile richtet sich an einer gemeinsamen Steuerhöhe aus. Der "Site"-Link war höher als die Buttons daneben: `.admin-btn` hatte keine explizite line-height, und <button> bekommt box-sizing: border-box vom Browser, <a> nicht. Die Statusanzeige setzte weder Schriftfamilie noch -größe und fiel auf den Browser-Default zurück — sie war nie Teil des Designsystems. Jetzt gleiche Höhe und Typografie, Pillenform als Zustandsanzeige, Trenner zur Aktionsgruppe. Das dauerhafte Pulsieren des grünen Punkts entfällt; Animation bleibt den Zuständen vorbehalten, die Aufmerksamkeit brauchen. Restliche Emojis durch SVG-Icons ersetzt. * feat(admin): add scroll-to-top toggle and SVG arrow The back-to-top button was always on and drew its arrow with the ↑ text character. Add a `scrollToTop` setting (General section in the admin panel, defaults to on so existing sites are unaffected) and replace the glyph with a stroked SVG that inherits currentColor across all presets. Scroll handling is now rAF-throttled, and prefers-reduced-motion turns off both the hover lift and the smooth scroll. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * security(journal): escape author HTML instead of filtering it CodeQL flags 26 high-severity alerts on the release PR; the bulk of them point at sanitizeHtml(), a denylist of three regexes whose output goes into dangerouslySetInnerHTML. I reproduced the bypasses before changing anything — all four pass the old filter: <img src=x onerror=alert(1)> unquoted handler, regex wants quotes <img src=x onerror='alert(1)'> single quotes, same reason <svg onload=alert(1)> not a <script> tag javasjavascript:cript:alert(1) one-pass replace, the rest recombines Plus an attribute breakout in the link renderer, which interpolated the URL into href="${url}" unescaped: [x](" onmouseover=alert(1) x=") -> <a href="" onmouseover=alert(1" ...> Replaced with escaping. Every `&<>"'` in author text becomes an entity before any markdown rule runs, so the only tags in the output are the ones renderInlineMarkdown builds itself and a URL cannot leave its attribute. Link schemes are now an allowlist (http, https, mailto, tel, relative, anchor); anything else renders as plain text. The serializer needed decodeHtmlEntities to match: without it a save would write `&lt;` into the Markdown file and the next parse would escape the `&` again, corrupting the text further on every round trip. A test covers parse -> serialize -> parse stability. Two existing tests asserted the old behaviour and were rewritten rather than deleted: one expected the script tag to be *removed* from the output, the other expected the substring "onerror" to be absent. Both now assert the property that matters — that no tag can form — because `onerror` surviving as inert text is fine. Exploitation required admin access either way: journal and essay text comes from the studio or from content/*.md. This removes the weakness, it does not close an open door. * fix(journal): contain file paths, fix frontmatter escaping, defuse two regexes Follow-up to the CodeQL findings on release PR #432. I went through all 23 alerts individually; this addresses the ones that are worth addressing and documents the ones that are not. Path containment (12 alerts, all false positives). Every path built from a slug goes through isValidSlug(), a strict `/^[a-zA-Z0-9_-]+$/` allowlist — verified against `../../etc/passwd`, `foo/../../bar`, `a/b`, `..` and friends, all rejected. CodeQL cannot see it because the check lives in another module. Added a containedPath() helper that resolves the path and refuses anything landing outside the content directory: a second lock on a door that was already locked, and a barrier the analysis can follow. Also removed the dead `slug.endsWith('.md')` branches — isValidSlug rejects dots, so they could never be taken. Frontmatter escaping (1 alert, a real bug). The serializer escaped `"` but not `\`, and the parser never unescaped anything. A title containing either character gained a backslash on every save/load cycle: Path C:\Users "quoted" -> Path C:\\Users \"quoted\" -> ... Escaping now covers the backslash first and the parser undoes both. A round trip test covers quotes, backslashes, colons and apostrophes. Two of three ReDoS regexes (2 alerts). The heading pattern had `\s+` next to `(.+)`, which overlap, so the engine tried every split of the whitespace run before failing; it is `[ \t]+` and `(\S.*)` now. The quote author pattern wrapped a lazy group around an optional group — the quadratic case — and is an index split on the first separator now. The third regex, the bold/italic pass, is deliberately left alone. Rewriting it with a negated class removes the backtracking but breaks nesting: `**bold *and italic* here**` renders as `*<em>bold </em>and italic<em> here</em>*`. The input is Markdown from an authenticated admin, never a visitor, so the worst case is an author slowing down their own page. The comment in the code says so. Not addressed: 5 js/insufficient-password-hash alerts. They ask for a slow KDF where the code uses SHA-256/HMAC — correct in general, but the admin password comes from an environment variable and is never stored, so a stronger KDF protects nothing that is not already in plaintext in the environment. 399 unit tests pass (18 new), build and tsc clean. * fix(journal): split the quote author by scanning, not by pattern Cleaning up after myself. #439 replaced the quote author regex `/^(.*?)(?:\s+--\s+(.+))?$/` — a lazy group around an optional one, the quadratic case — with `/\s+--\s+/`, and CodeQL promptly flagged the replacement for the same reason. One reported pattern traded for another. splitQuoteAuthor() scans for the first `--` that has whitespace on both sides. Linear, and it needs no reasoning about the regex engine at all. Behaviour is identical to the original regex, checked case by case against it: separator, no separator, several separators, tabs, wide gaps, `a--b` without spaces, leading and trailing separators, empty string. All nine are covered by tests, plus one asserting it stays fast on a 50k whitespace run. * security(admin): derive the session signing key with scrypt getSigningKey() ran the admin password through a single SHA-256 digest. It is key derivation rather than password storage, so it was never a stored-hash problem — but if the derived key ever leaked, one fast hash makes recovering the password by brute force cheap. CodeQL flags it as js/insufficient-password-hash and, for this particular alert, has a point. scrypt now. Two details that matter: The salt has to be stable. A random salt would produce a different key on every call and invalidate every session; it is derived from AUTH_SECRET, which is deployment-specific. Verified across separate processes: same inputs produce a verifying token, so a restart or redeploy does not log everyone out. The result is cached for the process lifetime. scrypt is deliberately slow and getSigningKey() runs on every admin request — deriving per call would add ~24ms to each one. The cache key is a digest of secret plus password, so a rotation misses the cache and derives again, and no extra plaintext copy of the password is kept around. Measured: first derivation 24ms, subsequent calls 0.12ms. Password change and secret change both invalidate an existing token, checked in separate processes. Note the one-time effect: existing admin sessions are invalidated by the change in derivation, so everyone logs in once more. * security(admin): key the signing-key cache on its inputs, not a digest #441 removed the SHA-256 digest of the admin password from the key derivation and introduced a new one three lines above it, as the cache key. Same rule, same file: CodeQL reported it immediately. The comment justifying it was wrong too. It claimed no second plaintext copy of the password was retained, while building the digest input allocates exactly that in order to hash it. The cache now holds the two input strings and compares them directly. They are the same objects the env and install caches already hold, so nothing extra is retained, and no fast hash of the password exists in memory for the life of the process. Re-verified after the change, in separate processes: a token from one process verifies in another with the same inputs, a changed password or secret rejects it, first derivation 24ms, cached calls 0.001ms. That leaves scrypt as the only place the password is hashed here. The two HMACs further down operate on the derived key and on token data, not on the password; the constant-time comparison in verifyAdminPassword is the previously dismissed one. --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
2026-08-14 16:55:07 +02:00
const info = THEME_INFO[p] || {
label: p,
desc: '',
bg: '#fff',
tile: '#eee',
accent: '#333',
font: 'System',
type: 'sans' as const,
radius: 0,
frame: 'none' as const,
gap: 4,
};
release: v0.11.0 (#459) Ships `dev` as **v0.11.0**. `main` contains nothing that `dev` does not, so this is a clean sync. ## Headline changes since v0.10.0 - **Journal & Journal Studio** — photo essays at `/journal`, split-screen block editor with live preview, drafts, per-entry passwords, cover images - **First-run setup wizard at `/install`** — configure a fresh deployment from the browser; credentials are verified against Immich before anything is written, and the wizard is gated by a one-time token - **About page editor and toggle** in the admin panel - **Per-album photo order** independent of Immich, with a drag & drop editor - **Custom favicon upload** - **Experimental portfolio features** — justified grid, `cover` hero, unlisted subpages, per-album grid overrides, cover focal points, external nav links - **Security** — asset tokens length-capped before decoding (#423), journal author markdown escaped rather than filtered, journal file paths contained, admin session key derived with scrypt (#432), Next.js 16.3.0 for CVE-2025-13465 - **Fixed** — client proofing honours its own configuration again (#454); journal photo rendering (#432) Full detail in [CHANGELOG.md](CHANGELOG.md#0110--2026-08-15). ## Verified `npx tsc --noEmit` clean · `npx vitest run` 435 tests pass · `npm run build` succeeds · lint 0 errors · `prettier --check` clean · local `docker build` of the release tree. ## After merge Tag `v0.11.0` on `main` and publish the release — that triggers `docker-publish.yml`, which pushes the image and moves `latest`. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
2026-08-15 09:09:18 +02:00
const isActive = (settings.theme?.preset || DEFAULT_PRESET) === p;
return (
<button
key={p}
type="button"
release: v0.11.0 — journal fixes, admin URLs, design system cleanup (#432) * fix(screenshots): sharp-Typen fuer 0.34 und 0.35 gleichzeitig (#410) sharp 0.35 ist von `export =` auf ESM umgestellt: der Modul-Namespace ist nicht mehr aufrufbar, die Factory sitzt unter .default. Der Type-Check brach damit in scripts/screenshots.ts weg, sobald der Next-Bump (#402) sharp von 0.34.5 auf 0.35.3 mitzieht -- sharp ist hier keine deklarierte Dependency, sondern kommt ueber Next mit. Die Form wird jetzt aus dem installierten Paket abgeleitet statt festgeschrieben, zur Laufzeit wie im Typ. Geprueft mit beiden Versionen: tsc laeuft mit 0.34.5 und mit 0.35.3 fehlerfrei durch. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(deps): bump the nextjs group across 1 directory with 2 updates (#402) Bumps the nextjs group with 2 updates in the / directory: [next](https://github.com/vercel/next.js) and [eslint-config-next](https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next). Updates `next` from 16.2.12 to 16.3.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/compare/v16.2.12...v16.3.0) Updates `eslint-config-next` from 16.2.12 to 16.3.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/commits/v16.3.0/packages/eslint-config-next) --- updated-dependencies: - dependency-name: eslint-config-next dependency-version: 16.3.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: nextjs - dependency-name: next dependency-version: 16.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nextjs ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps-dev): bump prettier from 3.8.3 to 3.9.6 (#405) Bumps [prettier](https://github.com/prettier/prettier) from 3.8.3 to 3.9.6. - [Release notes](https://github.com/prettier/prettier/releases) - [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md) - [Commits](https://github.com/prettier/prettier/compare/3.8.3...3.9.6) --- updated-dependencies: - dependency-name: prettier dependency-version: 3.9.6 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * docs(changelog): Unreleased-Sektion fuer die Bumps nach v0.10.0 (#413) Die Dependency-PRs sind nach dem Release auf dev gelandet, teils auch auf main. Ohne Eintrag waeren sie beim naechsten Release unsichtbar -- inklusive Next 16.3.0, das CVE-2025-13465 mitbringt. Ausserdem im 0.10.0-Abschnitt nachgetragen, dass der Trivy-Scan bis #409 nie gelaufen ist. Der Fix steckt im Tag v0.10.0, fehlte aber in der Aufzaehlung -- und "Images werden bei jedem Publish gescannt" stand im Changelog, waehrend der Job im Action-Setup abbrach. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(gallery): per-album sort order, independent of Immich (#408) (#414) Album order was dictated entirely by Immich: getAlbum() sorted by the album's own asc/desc flag, so a Folio album always mirrored the archive. A curated series has a narrative order that has nothing to do with capture time, and changing the Immich album's sort to fit the website changes it for the archive too. Adds an optional per-album `sort` in gallery.yaml, editable in /admin, defaulting to today's behaviour so every existing config is unchanged: immich (default) | newest | oldest | filename | manual `manual` is a pinned *prefix*: `assetOrder` lists only the photos placed by hand, everything else follows in the album's Immich order. A full permutation of a 2,000-photo album would be ~80 KB of UUIDs in a file that is rewritten and copied to content/.backups/ on every admin save. It also makes drift fall out for free — photos removed in Immich never match, new ones land in the tail rather than being hidden. Sorting is applied after the cache read, not before the cache write, so the LRU keeps one canonical Immich-ordered copy per album. That avoids putting the mode in the cache key, lets a config change take effect without depending on invalidation, and keeps the stale-serving path correct. cache.get() returns the stored object by reference, so withSort() returns a shallow clone with a new array — sorting in place would reorder the shared entry, and under request coalescing every concurrent caller would be sorting the same array. Also fixes a prerequisite bug: /api/admin/albums/[albumId]/assets read album.assets from GET /albums/:id, which Immich 3.x no longer populates (lib/immich.ts:507). The hero picker's "This Album" tab returned nothing and threw outright when the key was absent. It now goes through the client's paginated metadata search, with ?types=all to opt videos in for the reorder editor. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): drop decorative emoji from the sort select labels (#415) An <option> cannot contain markup, so the SVG set in Icons is not reachable there — but a decorative emoji is not a substitute for it. Plain text instead; the album card badge already uses a real icon. The remaining emoji in the admin panel (asset picker tabs, section headings, layout picker options) predate this branch and are left for a separate cleanup. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): replace emoji icons with the shared SVG icon set (#416) The admin panel mixed two icon conventions: inline SVGs from `Icons.tsx` in most components, and decorative emoji in the asset picker and a few PageBuilder labels. Emoji render inconsistently across platforms, ignore the accent colour, and cannot inherit the `.svg-icon` sizing rules. - Icons.tsx: add `IconStar` (filled — it marks a state, not an action) and `IconImage`. - AssetPicker: the three tab labels and the favourite tile badge now use IconFolder / IconStar / IconImage. - PageBuilder: the "Standalone Albums" and "Subpages" headings use the icon set instead of an emoji. - PageBuilder: the layout picker drops its emoji for plain text. An <option> cannot contain markup, so an SVG is impossible there and a decorative glyph is not a substitute. - admin.css: align icon and label in the picker tabs, and swap the favourite badge's text-shadow for drop-shadow, which is what applies to an inline SVG. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): fold PageBuilder's local icons into the shared Icons module (#418) * refactor(admin): fold PageBuilder's local icons into the shared module PageBuilder.tsx carried its own `Icons` object duplicating most of the glyphs already exported by Icons.tsx, with hardcoded sizes and slightly divergent paths. Migrate all 32 call sites to the shared module and delete the local object. Five glyphs had no counterpart and are added to Icons.tsx as 1:1 ports of the local paths: IconX, IconPlus, IconHome, IconCopy, IconImage. The local ExternalLink and Check are dropped rather than ported — both had zero call sites. Two glyphs change shape slightly, which is the point of consolidating: the shared IconCamera includes the viewfinder bump the local copy omitted, and drag handles now use IconGripVertical. IconGripVertical uses the module's square 24x24 viewBox, so `.svg-drag` goes from 12x18 to 18x18 — the old non-square box would letterbox the glyph down to 12x12 and shrink the handle. * fix(admin): resolve icon-module integration after #416 Merging dev brought in #416, which added a second IconImage to Icons.tsx and two <Icons.Camera>/<Icons.Folder> section headers that reference the local Icons object this PR removes. Git merged both cleanly but the result did not type-check. - drop the duplicate IconImage (both copies were byte-identical) - point the two section headers at the imported IconCamera/IconFolder - refresh the SORT_LABELS comment: the icon set is imported now, not declared below --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> * fix(config): allow an empty gallery, guard against a double /api suffix (#421) An empty gallery is now a valid, rendered state instead of a throw: deriveGallery() no longer requires at least one album or subpage, so a deployment with no albums yet renders a bare homepage the owner can fill in via /admin. getConfig() also stops appending /api to an Immich URL that already ends in it, which previously produced .../api/api and broke every upstream request. Includes a restore of the per-album sort test cases, which the branch had lost by being cut before #408/#414. * feat(admin): favicon upload, served from the content volume (#422) Adds a bundled default favicon, an upload widget in admin Settings > General, and a route that serves the icon from the writable content/ volume with a fallback to the bundled default. Raster uploads (PNG/ICO/JPEG) are wrapped in an SVG container; the response carries its own CSP so an uploaded SVG cannot execute script on the origin. The GET route revalidates with an ETag instead of caching immutably, so a newly uploaded icon shows up immediately. Uploads are written via temp file + rename, and a Reset button restores the bundled default. * ci: flag unformatted files in a PR, without blocking it (#424) Prettier is configured as an error rule in eslint.config.mjs but has never run in CI, so part of the tree predates it. A final CI step now diffs against the PR base, runs prettier --list-different over the changed files, and emits a warning annotation per offender plus a job summary. Advisory by design: it never fails the job. Blocking would turn a PR red for merely touching a file that was already unformatted, and normalising the tree in one commit would wreck git blame and conflict with the PRs in flight. Requires fetch-depth: 0, since diffing against the base needs its history. * feat(install): first-run wizard gated by a one-time setup token (#419) Adds /install, a four-step first-run wizard: connect to Immich, optionally pick albums, name the site, finish. It verifies the credentials against the Immich server before writing anything, then writes gallery.yaml, settings.yaml and a content/install.json carrying the Immich credentials and a generated site secret. install.json exists because a running process cannot pick up new env vars — the wizard has to write configuration that takes effect without a restart. getInstallCredentials() merges it under the real environment, so env vars always win and rotation stays a matter of setting one. Both the page and the API routes are gated by a one-time setup token printed to the server log, so a deployment that is reachable before gallery.yaml exists cannot be configured by whoever finds it first. The token is stored in content/.setup-token (0600) rather than a module variable: Next.js bundles the page and each route handler separately, so a module-level token left the page and the API disagreeing inside one process and the wizard stuck on step 1. It is removed once the install completes. The admin password is stored as an scrypt hash using the scheme lib/auth.ts already applies to album passwords; a plaintext ADMIN_PASSWORD env var keeps working. * docs: document the setup wizard, fix the read-only content mount (#425) Quick Start now leads with the /install wizard, with the hand-written YAML route kept alongside it, and a First-Run Setup section covers the setup token, the files the wizard writes, and env-var precedence. Two corrections: both Docker examples mounted content/ as :ro, which silently breaks the wizard, the admin panel and the backup rotation alike — docs/admin-panel.md already said so and the README contradicted it. And nothing documented that content/install.json holds the Immich API key, so a backup of content/ is a backup of credentials. Also adds a Contributors section crediting the people whose work is in the project. * feat(admin): floating save bar pinned to the bottom of the viewport (#426) The save bar was the first, static element inside .admin-main. Since the document itself scrolls, it left the viewport as soon as you scrolled down — editing a subpage section or a settings block far below gave no visible dirty hint and no reachable save button. Replace it with a bottom-pinned floating bar shared by both editors. It only mounts while there is something to act on (unsaved changes, an in-flight save, or a result message), so it never covers content while idle. The success message clears after 5s, which hides the bar again. - new SaveBar component, replacing the duplicated markup in PageBuilder and SettingsEditor - adopt the previously unused .floating-save-bar CSS: slide-in keyframes (carrying translateX(-50%)), dirty border, wrap/gap, mobile variant and a prefers-reduced-motion opt-out; z-index 900 keeps it below modals - .admin-main gains bottom padding so the bar never covers page content - drop the now-unreachable idle hints: the ⌘S hint becomes a button title, the Live Sync note becomes a static line above the settings layout - header "Site" link now bypasses the cache (/?fresh=1), so the preview stays reachable when the bar is hidden Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(admin): themed listbox for the album sort control (#427) The per-album "Photo order" control was a native <select>. Because an <option> cannot contain markup, its choices could not use the admin panel's currentColor SVG set — the reason #415 had to fall back to plain text after dropping the emoji labels. Adds a Listbox component implementing the ARIA combobox/listbox pattern, so options can render a glyph beside their label: - DOM focus stays on the trigger button; the active option is announced through aria-activedescendant, keeping focus management to one element - Keyboard: arrows (clamped at the ends, like a native select), Home/End, Enter/Space to commit, Escape to cancel, Tab commits and moves on, and prefix type-ahead with a repeat-key cycle - Outside dismissal on pointerdown, so a press starting outside closes the popup before the click retargets The sort options now carry an icon each: calendar, arrow-down, arrow-up, an A→Z marker, and the drag glyph for manual — matching the badge the album card already shows. SORT_LABELS stays plain text because the badge feeds it to a title attribute. Closes #417 Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(git): ignore generated design handoff folders * fix(admin): stop the album sort dropdown clipping, and simplify the panel (#428) * fix(admin): render listbox popup in a portal so it escapes modal clipping The sort control's popup was position:absolute inside three clipping ancestors (.album-drawer overflow:hidden > .album-drawer-body overflow-y:auto > .modal-right-column overflow-y:auto), so it was cut off at the bottom of the Edit Album Details modal. z-index could not help: clipping happens before stacking. It also always hung below the trigger, with no flip. Portal the popup to document.body and position it from the trigger's viewport rect, flipping above when there is more room there and capping max-height to the space available so it scrolls internally rather than overflowing. It is dismissed on scroll and resize, since the anchor is only measured on open. The outside-pointerdown handler now also treats the popup as inside; without that the portalled list counts as outside, and a click on an option would close it before the selection commits. * refactor(admin): single-column album details panel The left column spent 1.2fr on a cover thumbnail and three stat rows, two of which (Status, Custom Hero) only restated the form fields opposite them, while the form itself was squeezed into 1.8fr behind a second nested scroller. Stack the drawer in one column instead: cover as a banner, then the form at full width, with the UUID moved into the footer. The body is now the only scroll container, which also removes one of the ancestors that was clipping the sort popup. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> * fix(admin): give the portalled listbox its theme back, lock the page behind modals (#429) Two defects in the album editor. The sort listbox popup painted transparent. Every --admin-* variable is scoped to .admin-layout, and since the popup moved into document.body it sits outside that subtree, so background/border/text all resolved to nothing. It now carries its own copy of the palette in both colour schemes, plus the font it no longer inherits. Scrolling inside a modal also moved the page behind it. No admin modal ever locked body scroll: the overlay covers the page but does not absorb wheel events, so a scroll starting on the backdrop — or continuing past the end of the modal's own scroller — reaches the document. overscroll-behavior cannot cover that case on its own, because it only applies to scroll containers and the backdrop is not one. useScrollLock freezes body while a modal is open and compensates for the width the scrollbar gives up, so nothing shifts underneath. Each lock restores the inline value it found, which makes nesting work without a counter — a picker opened from the drawer restores the drawer's hidden state instead of clearing it. Applied to both drawers and all four picker modals, which share the defect. overscroll-behavior: contain on the scrollers stops the chaining they can handle themselves. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com> * fix(security): allow unsafe-eval in CSP script-src during dev mode * feat(journal): add Journal Studio with split-screen editor, live preview and dedicated routes * fix(build): separate client parser from server journal-service and fix build type errors * fix(journal): Fotos rendern, Layout und Lightbox-Steuerung korrigieren Fünf unabhängige Fehler in der öffentlichen Journal- und Essay-Ansicht: * Foto-Blöcke wurden nie angezeigt. EssayView löst ein Foto über PhotoItem.id auf, und das sind verschlüsselte Tokens — die Blöcke aus dem Markdown tragen aber rohe Asset-UUIDs. Jede Zuordnung lief ins Leere, und nicht auflösbare Blöcke werden still verworfen. Die IDs werden jetzt serverseitig übersetzt; damit verschwinden nebenbei die rohen UUIDs aus dem Client-Payload, die dort laut Projektregel nie auftauchen dürfen. Nicht auflösbare Referenzen werden geloggt. * Überschriften standen weiter links als der Fließtext. Jeder Block hatte einzeln `max-width: 68ch`, und `ch` ist relativ zur Schrift des Elements — die Serif-Überschrift ergab eine breitere Spalte. Ersetzt durch eine gemeinsame, font-unabhängige `--essay-measure`. * Fullbleed-Fotos bluteten nur nach links aus: `.essay-figure` ist `width: 100%`, wodurch die Box überbestimmt ist und der negative rechte Margin verworfen wird. * Foto-Paare stellten beide Bilder gleich breit dar, wodurch ein Hochformat neben einem Querformat doppelt so hoch wurde. Jetzt eine Justified-Reihe: Breite proportional zum Seitenverhältnis, dadurch exakt gleiche Höhen ohne Beschnitt. * Die Lightbox hatte im Journal keine Tastatursteuerung und keine Scroll-Sperre — beides lag in PhotoGrid, also nur im Album-Raster. Verlagert in die Lightbox selbst, der doppelte Handler in PhotoGrid entfernt (sonst wäre pro Pfeildruck zwei Bilder weitergesprungen). Zusätzlich sind Proofing-Herzen und das EXIF-Panel im redaktionellen Modus abschaltbar und im Journal aus: Client-Proofing ist ein Übergabe-Workflow für Alben, keine Funktion einer Reportage. Auf der Übersicht wurde der Untertitel doppelt gerendert, weil extractExcerpt() auf ihn zurückfällt. * feat(admin): eigene URLs für alle Bereiche und überarbeiteter Journal Studio Das Panel war eine einzige Client-Komponente, die ihre Tabs über useState umschaltet: keine Route pro Bereich, kein Deep-Link, kein Zurück-Button, und nach jedem Reload landete man wieder auf "Pages". Auch der Journal-Editor hatte keine eigene URL. Jetzt sieben echte Routen (/admin, /admin/pages, /admin/journal, /admin/journal/<slug>, /admin/settings, /admin/settings/<section>, /admin/analytics). Die Shell mit Auth-Prüfung und Kopfzeile sitzt im Layout und umschließt children — so bleibt die Session-Prüfung über Routenwechsel montiert, statt bei jedem Tab-Wechsel neu zu laufen und den Spinner aufblitzen zu lassen. Unbekannte Settings-Sections fallen auf General zurück. Im selben Zug der Journal Studio, der die Routing-Änderung ohnehin berührt: * Alle Eingabefelder nutzten die Klasse `admin-input`, die in keinem CSS definiert war — sie fielen auf Browser-Defaults zurück. Jetzt gestylt, gescoped, damit der generische Name nicht ins übrige Panel leckt. * Der Split View ist per Divider verschiebbar (Maus, Tastatur, Doppelklick zum Zurücksetzen), Breite in localStorage. * Das Studio bricht aus der 1120px-Spalte aus, die Preview hat Platz. * Die Preview zeigte für jedes Foto fest 3:2 und log damit über das Layout der veröffentlichten Seite; die echten Verhältnisse werden jetzt an den Thumbnails gemessen. * Blöcke mit alten positionsbasierten Foto-Referenzen werden markiert — die lassen sich auf einer eigenständigen Journal-Seite nicht auflösen und verschwanden bisher stillschweigend. * Blocktyp-Chips als gemeinsame Komponente, monochrom und per Icon unterschieden statt in einer eigenen Blau/Lila/Orange-Palette, die sonst nirgends im Panel vorkommt. * Emojis raus, SVG-Icons rein. * fix(admin): Designsystem-Lücken im Panel schließen Eine systematische Suche nach Klassen, die im TSX benutzt, aber in keinem CSS definiert sind, hat vier Stellen mit demselben Muster gefunden: * `admin-btn-secondary` und `admin-btn-danger` existierten nicht. Sämtliche Löschen-Buttons sahen aus wie normale Buttons — keine Warnwirkung. Als `.admin-btn.admin-btn-danger` geschrieben, weil die Varianten mit den Größenklassen kombiniert werden, die weiter unten ihren eigenen Hintergrund setzen. * `page-progress-fill` fehlte: die Balken im Analytics-Panel waren leere Rinnen, der Wert unsichtbar. Ebenso `analytics-empty` und `admin-loading-container`. * `subpage-drawer-section`, `subpage-drawer-title-group` und `input-with-icon` im PageBuilder waren wirkungslos und teils mit Inline-Styles notdürftig kompensiert. * `grid-card-preview` fehlte, wodurch alle Layout-Vorschauen auf Höhe null kollabierten. Nur "Showcase" war sichtbar — und das aus Versehen, weil sein Tile `hero-tile` hieß und damit die `aspect-ratio` einer fremden PageBuilder-Klasse erbte. Umbenannt. Dazu die Theme-Vorschauen, die praktisch identisch aussahen: alle sieben zeigten dieselben drei quadratischen Kacheln, einziger Unterschied war die Hintergrundfarbe. Sie spiegeln jetzt die echten Preset-Daten aus lib/config/theme.ts — Schriftcharakter, Eckradius, Rasterdichte, Passepartout bzw. Schatten. Die Kopfzeile richtet sich an einer gemeinsamen Steuerhöhe aus. Der "Site"-Link war höher als die Buttons daneben: `.admin-btn` hatte keine explizite line-height, und <button> bekommt box-sizing: border-box vom Browser, <a> nicht. Die Statusanzeige setzte weder Schriftfamilie noch -größe und fiel auf den Browser-Default zurück — sie war nie Teil des Designsystems. Jetzt gleiche Höhe und Typografie, Pillenform als Zustandsanzeige, Trenner zur Aktionsgruppe. Das dauerhafte Pulsieren des grünen Punkts entfällt; Animation bleibt den Zuständen vorbehalten, die Aufmerksamkeit brauchen. Restliche Emojis durch SVG-Icons ersetzt. * feat(admin): add scroll-to-top toggle and SVG arrow The back-to-top button was always on and drew its arrow with the ↑ text character. Add a `scrollToTop` setting (General section in the admin panel, defaults to on so existing sites are unaffected) and replace the glyph with a stroked SVG that inherits currentColor across all presets. Scroll handling is now rAF-throttled, and prefers-reduced-motion turns off both the hover lift and the smooth scroll. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * security(journal): escape author HTML instead of filtering it CodeQL flags 26 high-severity alerts on the release PR; the bulk of them point at sanitizeHtml(), a denylist of three regexes whose output goes into dangerouslySetInnerHTML. I reproduced the bypasses before changing anything — all four pass the old filter: <img src=x onerror=alert(1)> unquoted handler, regex wants quotes <img src=x onerror='alert(1)'> single quotes, same reason <svg onload=alert(1)> not a <script> tag javasjavascript:cript:alert(1) one-pass replace, the rest recombines Plus an attribute breakout in the link renderer, which interpolated the URL into href="${url}" unescaped: [x](" onmouseover=alert(1) x=") -> <a href="" onmouseover=alert(1" ...> Replaced with escaping. Every `&<>"'` in author text becomes an entity before any markdown rule runs, so the only tags in the output are the ones renderInlineMarkdown builds itself and a URL cannot leave its attribute. Link schemes are now an allowlist (http, https, mailto, tel, relative, anchor); anything else renders as plain text. The serializer needed decodeHtmlEntities to match: without it a save would write `&lt;` into the Markdown file and the next parse would escape the `&` again, corrupting the text further on every round trip. A test covers parse -> serialize -> parse stability. Two existing tests asserted the old behaviour and were rewritten rather than deleted: one expected the script tag to be *removed* from the output, the other expected the substring "onerror" to be absent. Both now assert the property that matters — that no tag can form — because `onerror` surviving as inert text is fine. Exploitation required admin access either way: journal and essay text comes from the studio or from content/*.md. This removes the weakness, it does not close an open door. * fix(journal): contain file paths, fix frontmatter escaping, defuse two regexes Follow-up to the CodeQL findings on release PR #432. I went through all 23 alerts individually; this addresses the ones that are worth addressing and documents the ones that are not. Path containment (12 alerts, all false positives). Every path built from a slug goes through isValidSlug(), a strict `/^[a-zA-Z0-9_-]+$/` allowlist — verified against `../../etc/passwd`, `foo/../../bar`, `a/b`, `..` and friends, all rejected. CodeQL cannot see it because the check lives in another module. Added a containedPath() helper that resolves the path and refuses anything landing outside the content directory: a second lock on a door that was already locked, and a barrier the analysis can follow. Also removed the dead `slug.endsWith('.md')` branches — isValidSlug rejects dots, so they could never be taken. Frontmatter escaping (1 alert, a real bug). The serializer escaped `"` but not `\`, and the parser never unescaped anything. A title containing either character gained a backslash on every save/load cycle: Path C:\Users "quoted" -> Path C:\\Users \"quoted\" -> ... Escaping now covers the backslash first and the parser undoes both. A round trip test covers quotes, backslashes, colons and apostrophes. Two of three ReDoS regexes (2 alerts). The heading pattern had `\s+` next to `(.+)`, which overlap, so the engine tried every split of the whitespace run before failing; it is `[ \t]+` and `(\S.*)` now. The quote author pattern wrapped a lazy group around an optional group — the quadratic case — and is an index split on the first separator now. The third regex, the bold/italic pass, is deliberately left alone. Rewriting it with a negated class removes the backtracking but breaks nesting: `**bold *and italic* here**` renders as `*<em>bold </em>and italic<em> here</em>*`. The input is Markdown from an authenticated admin, never a visitor, so the worst case is an author slowing down their own page. The comment in the code says so. Not addressed: 5 js/insufficient-password-hash alerts. They ask for a slow KDF where the code uses SHA-256/HMAC — correct in general, but the admin password comes from an environment variable and is never stored, so a stronger KDF protects nothing that is not already in plaintext in the environment. 399 unit tests pass (18 new), build and tsc clean. * fix(journal): split the quote author by scanning, not by pattern Cleaning up after myself. #439 replaced the quote author regex `/^(.*?)(?:\s+--\s+(.+))?$/` — a lazy group around an optional one, the quadratic case — with `/\s+--\s+/`, and CodeQL promptly flagged the replacement for the same reason. One reported pattern traded for another. splitQuoteAuthor() scans for the first `--` that has whitespace on both sides. Linear, and it needs no reasoning about the regex engine at all. Behaviour is identical to the original regex, checked case by case against it: separator, no separator, several separators, tabs, wide gaps, `a--b` without spaces, leading and trailing separators, empty string. All nine are covered by tests, plus one asserting it stays fast on a 50k whitespace run. * security(admin): derive the session signing key with scrypt getSigningKey() ran the admin password through a single SHA-256 digest. It is key derivation rather than password storage, so it was never a stored-hash problem — but if the derived key ever leaked, one fast hash makes recovering the password by brute force cheap. CodeQL flags it as js/insufficient-password-hash and, for this particular alert, has a point. scrypt now. Two details that matter: The salt has to be stable. A random salt would produce a different key on every call and invalidate every session; it is derived from AUTH_SECRET, which is deployment-specific. Verified across separate processes: same inputs produce a verifying token, so a restart or redeploy does not log everyone out. The result is cached for the process lifetime. scrypt is deliberately slow and getSigningKey() runs on every admin request — deriving per call would add ~24ms to each one. The cache key is a digest of secret plus password, so a rotation misses the cache and derives again, and no extra plaintext copy of the password is kept around. Measured: first derivation 24ms, subsequent calls 0.12ms. Password change and secret change both invalidate an existing token, checked in separate processes. Note the one-time effect: existing admin sessions are invalidated by the change in derivation, so everyone logs in once more. * security(admin): key the signing-key cache on its inputs, not a digest #441 removed the SHA-256 digest of the admin password from the key derivation and introduced a new one three lines above it, as the cache key. Same rule, same file: CodeQL reported it immediately. The comment justifying it was wrong too. It claimed no second plaintext copy of the password was retained, while building the digest input allocates exactly that in order to hash it. The cache now holds the two input strings and compares them directly. They are the same objects the env and install caches already hold, so nothing extra is retained, and no fast hash of the password exists in memory for the life of the process. Re-verified after the change, in separate processes: a token from one process verifies in another with the same inputs, a changed password or secret rejects it, first derivation 24ms, cached calls 0.001ms. That leaves scrypt as the only place the password is hashed here. The two HMACs further down operate on the derived key and on token data, not on the password; the constant-time comparison in verifyAdminPassword is the previously dismissed one. --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
2026-08-14 16:55:07 +02:00
className={`preset-card theme-preset-card ${isActive ? 'active' : ''}`}
onClick={() => update('theme.preset', p)}
release: v0.11.0 — journal fixes, admin URLs, design system cleanup (#432) * fix(screenshots): sharp-Typen fuer 0.34 und 0.35 gleichzeitig (#410) sharp 0.35 ist von `export =` auf ESM umgestellt: der Modul-Namespace ist nicht mehr aufrufbar, die Factory sitzt unter .default. Der Type-Check brach damit in scripts/screenshots.ts weg, sobald der Next-Bump (#402) sharp von 0.34.5 auf 0.35.3 mitzieht -- sharp ist hier keine deklarierte Dependency, sondern kommt ueber Next mit. Die Form wird jetzt aus dem installierten Paket abgeleitet statt festgeschrieben, zur Laufzeit wie im Typ. Geprueft mit beiden Versionen: tsc laeuft mit 0.34.5 und mit 0.35.3 fehlerfrei durch. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(deps): bump the nextjs group across 1 directory with 2 updates (#402) Bumps the nextjs group with 2 updates in the / directory: [next](https://github.com/vercel/next.js) and [eslint-config-next](https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next). Updates `next` from 16.2.12 to 16.3.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/compare/v16.2.12...v16.3.0) Updates `eslint-config-next` from 16.2.12 to 16.3.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/commits/v16.3.0/packages/eslint-config-next) --- updated-dependencies: - dependency-name: eslint-config-next dependency-version: 16.3.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: nextjs - dependency-name: next dependency-version: 16.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nextjs ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps-dev): bump prettier from 3.8.3 to 3.9.6 (#405) Bumps [prettier](https://github.com/prettier/prettier) from 3.8.3 to 3.9.6. - [Release notes](https://github.com/prettier/prettier/releases) - [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md) - [Commits](https://github.com/prettier/prettier/compare/3.8.3...3.9.6) --- updated-dependencies: - dependency-name: prettier dependency-version: 3.9.6 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * docs(changelog): Unreleased-Sektion fuer die Bumps nach v0.10.0 (#413) Die Dependency-PRs sind nach dem Release auf dev gelandet, teils auch auf main. Ohne Eintrag waeren sie beim naechsten Release unsichtbar -- inklusive Next 16.3.0, das CVE-2025-13465 mitbringt. Ausserdem im 0.10.0-Abschnitt nachgetragen, dass der Trivy-Scan bis #409 nie gelaufen ist. Der Fix steckt im Tag v0.10.0, fehlte aber in der Aufzaehlung -- und "Images werden bei jedem Publish gescannt" stand im Changelog, waehrend der Job im Action-Setup abbrach. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(gallery): per-album sort order, independent of Immich (#408) (#414) Album order was dictated entirely by Immich: getAlbum() sorted by the album's own asc/desc flag, so a Folio album always mirrored the archive. A curated series has a narrative order that has nothing to do with capture time, and changing the Immich album's sort to fit the website changes it for the archive too. Adds an optional per-album `sort` in gallery.yaml, editable in /admin, defaulting to today's behaviour so every existing config is unchanged: immich (default) | newest | oldest | filename | manual `manual` is a pinned *prefix*: `assetOrder` lists only the photos placed by hand, everything else follows in the album's Immich order. A full permutation of a 2,000-photo album would be ~80 KB of UUIDs in a file that is rewritten and copied to content/.backups/ on every admin save. It also makes drift fall out for free — photos removed in Immich never match, new ones land in the tail rather than being hidden. Sorting is applied after the cache read, not before the cache write, so the LRU keeps one canonical Immich-ordered copy per album. That avoids putting the mode in the cache key, lets a config change take effect without depending on invalidation, and keeps the stale-serving path correct. cache.get() returns the stored object by reference, so withSort() returns a shallow clone with a new array — sorting in place would reorder the shared entry, and under request coalescing every concurrent caller would be sorting the same array. Also fixes a prerequisite bug: /api/admin/albums/[albumId]/assets read album.assets from GET /albums/:id, which Immich 3.x no longer populates (lib/immich.ts:507). The hero picker's "This Album" tab returned nothing and threw outright when the key was absent. It now goes through the client's paginated metadata search, with ?types=all to opt videos in for the reorder editor. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): drop decorative emoji from the sort select labels (#415) An <option> cannot contain markup, so the SVG set in Icons is not reachable there — but a decorative emoji is not a substitute for it. Plain text instead; the album card badge already uses a real icon. The remaining emoji in the admin panel (asset picker tabs, section headings, layout picker options) predate this branch and are left for a separate cleanup. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): replace emoji icons with the shared SVG icon set (#416) The admin panel mixed two icon conventions: inline SVGs from `Icons.tsx` in most components, and decorative emoji in the asset picker and a few PageBuilder labels. Emoji render inconsistently across platforms, ignore the accent colour, and cannot inherit the `.svg-icon` sizing rules. - Icons.tsx: add `IconStar` (filled — it marks a state, not an action) and `IconImage`. - AssetPicker: the three tab labels and the favourite tile badge now use IconFolder / IconStar / IconImage. - PageBuilder: the "Standalone Albums" and "Subpages" headings use the icon set instead of an emoji. - PageBuilder: the layout picker drops its emoji for plain text. An <option> cannot contain markup, so an SVG is impossible there and a decorative glyph is not a substitute. - admin.css: align icon and label in the picker tabs, and swap the favourite badge's text-shadow for drop-shadow, which is what applies to an inline SVG. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): fold PageBuilder's local icons into the shared Icons module (#418) * refactor(admin): fold PageBuilder's local icons into the shared module PageBuilder.tsx carried its own `Icons` object duplicating most of the glyphs already exported by Icons.tsx, with hardcoded sizes and slightly divergent paths. Migrate all 32 call sites to the shared module and delete the local object. Five glyphs had no counterpart and are added to Icons.tsx as 1:1 ports of the local paths: IconX, IconPlus, IconHome, IconCopy, IconImage. The local ExternalLink and Check are dropped rather than ported — both had zero call sites. Two glyphs change shape slightly, which is the point of consolidating: the shared IconCamera includes the viewfinder bump the local copy omitted, and drag handles now use IconGripVertical. IconGripVertical uses the module's square 24x24 viewBox, so `.svg-drag` goes from 12x18 to 18x18 — the old non-square box would letterbox the glyph down to 12x12 and shrink the handle. * fix(admin): resolve icon-module integration after #416 Merging dev brought in #416, which added a second IconImage to Icons.tsx and two <Icons.Camera>/<Icons.Folder> section headers that reference the local Icons object this PR removes. Git merged both cleanly but the result did not type-check. - drop the duplicate IconImage (both copies were byte-identical) - point the two section headers at the imported IconCamera/IconFolder - refresh the SORT_LABELS comment: the icon set is imported now, not declared below --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> * fix(config): allow an empty gallery, guard against a double /api suffix (#421) An empty gallery is now a valid, rendered state instead of a throw: deriveGallery() no longer requires at least one album or subpage, so a deployment with no albums yet renders a bare homepage the owner can fill in via /admin. getConfig() also stops appending /api to an Immich URL that already ends in it, which previously produced .../api/api and broke every upstream request. Includes a restore of the per-album sort test cases, which the branch had lost by being cut before #408/#414. * feat(admin): favicon upload, served from the content volume (#422) Adds a bundled default favicon, an upload widget in admin Settings > General, and a route that serves the icon from the writable content/ volume with a fallback to the bundled default. Raster uploads (PNG/ICO/JPEG) are wrapped in an SVG container; the response carries its own CSP so an uploaded SVG cannot execute script on the origin. The GET route revalidates with an ETag instead of caching immutably, so a newly uploaded icon shows up immediately. Uploads are written via temp file + rename, and a Reset button restores the bundled default. * ci: flag unformatted files in a PR, without blocking it (#424) Prettier is configured as an error rule in eslint.config.mjs but has never run in CI, so part of the tree predates it. A final CI step now diffs against the PR base, runs prettier --list-different over the changed files, and emits a warning annotation per offender plus a job summary. Advisory by design: it never fails the job. Blocking would turn a PR red for merely touching a file that was already unformatted, and normalising the tree in one commit would wreck git blame and conflict with the PRs in flight. Requires fetch-depth: 0, since diffing against the base needs its history. * feat(install): first-run wizard gated by a one-time setup token (#419) Adds /install, a four-step first-run wizard: connect to Immich, optionally pick albums, name the site, finish. It verifies the credentials against the Immich server before writing anything, then writes gallery.yaml, settings.yaml and a content/install.json carrying the Immich credentials and a generated site secret. install.json exists because a running process cannot pick up new env vars — the wizard has to write configuration that takes effect without a restart. getInstallCredentials() merges it under the real environment, so env vars always win and rotation stays a matter of setting one. Both the page and the API routes are gated by a one-time setup token printed to the server log, so a deployment that is reachable before gallery.yaml exists cannot be configured by whoever finds it first. The token is stored in content/.setup-token (0600) rather than a module variable: Next.js bundles the page and each route handler separately, so a module-level token left the page and the API disagreeing inside one process and the wizard stuck on step 1. It is removed once the install completes. The admin password is stored as an scrypt hash using the scheme lib/auth.ts already applies to album passwords; a plaintext ADMIN_PASSWORD env var keeps working. * docs: document the setup wizard, fix the read-only content mount (#425) Quick Start now leads with the /install wizard, with the hand-written YAML route kept alongside it, and a First-Run Setup section covers the setup token, the files the wizard writes, and env-var precedence. Two corrections: both Docker examples mounted content/ as :ro, which silently breaks the wizard, the admin panel and the backup rotation alike — docs/admin-panel.md already said so and the README contradicted it. And nothing documented that content/install.json holds the Immich API key, so a backup of content/ is a backup of credentials. Also adds a Contributors section crediting the people whose work is in the project. * feat(admin): floating save bar pinned to the bottom of the viewport (#426) The save bar was the first, static element inside .admin-main. Since the document itself scrolls, it left the viewport as soon as you scrolled down — editing a subpage section or a settings block far below gave no visible dirty hint and no reachable save button. Replace it with a bottom-pinned floating bar shared by both editors. It only mounts while there is something to act on (unsaved changes, an in-flight save, or a result message), so it never covers content while idle. The success message clears after 5s, which hides the bar again. - new SaveBar component, replacing the duplicated markup in PageBuilder and SettingsEditor - adopt the previously unused .floating-save-bar CSS: slide-in keyframes (carrying translateX(-50%)), dirty border, wrap/gap, mobile variant and a prefers-reduced-motion opt-out; z-index 900 keeps it below modals - .admin-main gains bottom padding so the bar never covers page content - drop the now-unreachable idle hints: the ⌘S hint becomes a button title, the Live Sync note becomes a static line above the settings layout - header "Site" link now bypasses the cache (/?fresh=1), so the preview stays reachable when the bar is hidden Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(admin): themed listbox for the album sort control (#427) The per-album "Photo order" control was a native <select>. Because an <option> cannot contain markup, its choices could not use the admin panel's currentColor SVG set — the reason #415 had to fall back to plain text after dropping the emoji labels. Adds a Listbox component implementing the ARIA combobox/listbox pattern, so options can render a glyph beside their label: - DOM focus stays on the trigger button; the active option is announced through aria-activedescendant, keeping focus management to one element - Keyboard: arrows (clamped at the ends, like a native select), Home/End, Enter/Space to commit, Escape to cancel, Tab commits and moves on, and prefix type-ahead with a repeat-key cycle - Outside dismissal on pointerdown, so a press starting outside closes the popup before the click retargets The sort options now carry an icon each: calendar, arrow-down, arrow-up, an A→Z marker, and the drag glyph for manual — matching the badge the album card already shows. SORT_LABELS stays plain text because the badge feeds it to a title attribute. Closes #417 Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(git): ignore generated design handoff folders * fix(admin): stop the album sort dropdown clipping, and simplify the panel (#428) * fix(admin): render listbox popup in a portal so it escapes modal clipping The sort control's popup was position:absolute inside three clipping ancestors (.album-drawer overflow:hidden > .album-drawer-body overflow-y:auto > .modal-right-column overflow-y:auto), so it was cut off at the bottom of the Edit Album Details modal. z-index could not help: clipping happens before stacking. It also always hung below the trigger, with no flip. Portal the popup to document.body and position it from the trigger's viewport rect, flipping above when there is more room there and capping max-height to the space available so it scrolls internally rather than overflowing. It is dismissed on scroll and resize, since the anchor is only measured on open. The outside-pointerdown handler now also treats the popup as inside; without that the portalled list counts as outside, and a click on an option would close it before the selection commits. * refactor(admin): single-column album details panel The left column spent 1.2fr on a cover thumbnail and three stat rows, two of which (Status, Custom Hero) only restated the form fields opposite them, while the form itself was squeezed into 1.8fr behind a second nested scroller. Stack the drawer in one column instead: cover as a banner, then the form at full width, with the UUID moved into the footer. The body is now the only scroll container, which also removes one of the ancestors that was clipping the sort popup. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> * fix(admin): give the portalled listbox its theme back, lock the page behind modals (#429) Two defects in the album editor. The sort listbox popup painted transparent. Every --admin-* variable is scoped to .admin-layout, and since the popup moved into document.body it sits outside that subtree, so background/border/text all resolved to nothing. It now carries its own copy of the palette in both colour schemes, plus the font it no longer inherits. Scrolling inside a modal also moved the page behind it. No admin modal ever locked body scroll: the overlay covers the page but does not absorb wheel events, so a scroll starting on the backdrop — or continuing past the end of the modal's own scroller — reaches the document. overscroll-behavior cannot cover that case on its own, because it only applies to scroll containers and the backdrop is not one. useScrollLock freezes body while a modal is open and compensates for the width the scrollbar gives up, so nothing shifts underneath. Each lock restores the inline value it found, which makes nesting work without a counter — a picker opened from the drawer restores the drawer's hidden state instead of clearing it. Applied to both drawers and all four picker modals, which share the defect. overscroll-behavior: contain on the scrollers stops the chaining they can handle themselves. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com> * fix(security): allow unsafe-eval in CSP script-src during dev mode * feat(journal): add Journal Studio with split-screen editor, live preview and dedicated routes * fix(build): separate client parser from server journal-service and fix build type errors * fix(journal): Fotos rendern, Layout und Lightbox-Steuerung korrigieren Fünf unabhängige Fehler in der öffentlichen Journal- und Essay-Ansicht: * Foto-Blöcke wurden nie angezeigt. EssayView löst ein Foto über PhotoItem.id auf, und das sind verschlüsselte Tokens — die Blöcke aus dem Markdown tragen aber rohe Asset-UUIDs. Jede Zuordnung lief ins Leere, und nicht auflösbare Blöcke werden still verworfen. Die IDs werden jetzt serverseitig übersetzt; damit verschwinden nebenbei die rohen UUIDs aus dem Client-Payload, die dort laut Projektregel nie auftauchen dürfen. Nicht auflösbare Referenzen werden geloggt. * Überschriften standen weiter links als der Fließtext. Jeder Block hatte einzeln `max-width: 68ch`, und `ch` ist relativ zur Schrift des Elements — die Serif-Überschrift ergab eine breitere Spalte. Ersetzt durch eine gemeinsame, font-unabhängige `--essay-measure`. * Fullbleed-Fotos bluteten nur nach links aus: `.essay-figure` ist `width: 100%`, wodurch die Box überbestimmt ist und der negative rechte Margin verworfen wird. * Foto-Paare stellten beide Bilder gleich breit dar, wodurch ein Hochformat neben einem Querformat doppelt so hoch wurde. Jetzt eine Justified-Reihe: Breite proportional zum Seitenverhältnis, dadurch exakt gleiche Höhen ohne Beschnitt. * Die Lightbox hatte im Journal keine Tastatursteuerung und keine Scroll-Sperre — beides lag in PhotoGrid, also nur im Album-Raster. Verlagert in die Lightbox selbst, der doppelte Handler in PhotoGrid entfernt (sonst wäre pro Pfeildruck zwei Bilder weitergesprungen). Zusätzlich sind Proofing-Herzen und das EXIF-Panel im redaktionellen Modus abschaltbar und im Journal aus: Client-Proofing ist ein Übergabe-Workflow für Alben, keine Funktion einer Reportage. Auf der Übersicht wurde der Untertitel doppelt gerendert, weil extractExcerpt() auf ihn zurückfällt. * feat(admin): eigene URLs für alle Bereiche und überarbeiteter Journal Studio Das Panel war eine einzige Client-Komponente, die ihre Tabs über useState umschaltet: keine Route pro Bereich, kein Deep-Link, kein Zurück-Button, und nach jedem Reload landete man wieder auf "Pages". Auch der Journal-Editor hatte keine eigene URL. Jetzt sieben echte Routen (/admin, /admin/pages, /admin/journal, /admin/journal/<slug>, /admin/settings, /admin/settings/<section>, /admin/analytics). Die Shell mit Auth-Prüfung und Kopfzeile sitzt im Layout und umschließt children — so bleibt die Session-Prüfung über Routenwechsel montiert, statt bei jedem Tab-Wechsel neu zu laufen und den Spinner aufblitzen zu lassen. Unbekannte Settings-Sections fallen auf General zurück. Im selben Zug der Journal Studio, der die Routing-Änderung ohnehin berührt: * Alle Eingabefelder nutzten die Klasse `admin-input`, die in keinem CSS definiert war — sie fielen auf Browser-Defaults zurück. Jetzt gestylt, gescoped, damit der generische Name nicht ins übrige Panel leckt. * Der Split View ist per Divider verschiebbar (Maus, Tastatur, Doppelklick zum Zurücksetzen), Breite in localStorage. * Das Studio bricht aus der 1120px-Spalte aus, die Preview hat Platz. * Die Preview zeigte für jedes Foto fest 3:2 und log damit über das Layout der veröffentlichten Seite; die echten Verhältnisse werden jetzt an den Thumbnails gemessen. * Blöcke mit alten positionsbasierten Foto-Referenzen werden markiert — die lassen sich auf einer eigenständigen Journal-Seite nicht auflösen und verschwanden bisher stillschweigend. * Blocktyp-Chips als gemeinsame Komponente, monochrom und per Icon unterschieden statt in einer eigenen Blau/Lila/Orange-Palette, die sonst nirgends im Panel vorkommt. * Emojis raus, SVG-Icons rein. * fix(admin): Designsystem-Lücken im Panel schließen Eine systematische Suche nach Klassen, die im TSX benutzt, aber in keinem CSS definiert sind, hat vier Stellen mit demselben Muster gefunden: * `admin-btn-secondary` und `admin-btn-danger` existierten nicht. Sämtliche Löschen-Buttons sahen aus wie normale Buttons — keine Warnwirkung. Als `.admin-btn.admin-btn-danger` geschrieben, weil die Varianten mit den Größenklassen kombiniert werden, die weiter unten ihren eigenen Hintergrund setzen. * `page-progress-fill` fehlte: die Balken im Analytics-Panel waren leere Rinnen, der Wert unsichtbar. Ebenso `analytics-empty` und `admin-loading-container`. * `subpage-drawer-section`, `subpage-drawer-title-group` und `input-with-icon` im PageBuilder waren wirkungslos und teils mit Inline-Styles notdürftig kompensiert. * `grid-card-preview` fehlte, wodurch alle Layout-Vorschauen auf Höhe null kollabierten. Nur "Showcase" war sichtbar — und das aus Versehen, weil sein Tile `hero-tile` hieß und damit die `aspect-ratio` einer fremden PageBuilder-Klasse erbte. Umbenannt. Dazu die Theme-Vorschauen, die praktisch identisch aussahen: alle sieben zeigten dieselben drei quadratischen Kacheln, einziger Unterschied war die Hintergrundfarbe. Sie spiegeln jetzt die echten Preset-Daten aus lib/config/theme.ts — Schriftcharakter, Eckradius, Rasterdichte, Passepartout bzw. Schatten. Die Kopfzeile richtet sich an einer gemeinsamen Steuerhöhe aus. Der "Site"-Link war höher als die Buttons daneben: `.admin-btn` hatte keine explizite line-height, und <button> bekommt box-sizing: border-box vom Browser, <a> nicht. Die Statusanzeige setzte weder Schriftfamilie noch -größe und fiel auf den Browser-Default zurück — sie war nie Teil des Designsystems. Jetzt gleiche Höhe und Typografie, Pillenform als Zustandsanzeige, Trenner zur Aktionsgruppe. Das dauerhafte Pulsieren des grünen Punkts entfällt; Animation bleibt den Zuständen vorbehalten, die Aufmerksamkeit brauchen. Restliche Emojis durch SVG-Icons ersetzt. * feat(admin): add scroll-to-top toggle and SVG arrow The back-to-top button was always on and drew its arrow with the ↑ text character. Add a `scrollToTop` setting (General section in the admin panel, defaults to on so existing sites are unaffected) and replace the glyph with a stroked SVG that inherits currentColor across all presets. Scroll handling is now rAF-throttled, and prefers-reduced-motion turns off both the hover lift and the smooth scroll. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * security(journal): escape author HTML instead of filtering it CodeQL flags 26 high-severity alerts on the release PR; the bulk of them point at sanitizeHtml(), a denylist of three regexes whose output goes into dangerouslySetInnerHTML. I reproduced the bypasses before changing anything — all four pass the old filter: <img src=x onerror=alert(1)> unquoted handler, regex wants quotes <img src=x onerror='alert(1)'> single quotes, same reason <svg onload=alert(1)> not a <script> tag javasjavascript:cript:alert(1) one-pass replace, the rest recombines Plus an attribute breakout in the link renderer, which interpolated the URL into href="${url}" unescaped: [x](" onmouseover=alert(1) x=") -> <a href="" onmouseover=alert(1" ...> Replaced with escaping. Every `&<>"'` in author text becomes an entity before any markdown rule runs, so the only tags in the output are the ones renderInlineMarkdown builds itself and a URL cannot leave its attribute. Link schemes are now an allowlist (http, https, mailto, tel, relative, anchor); anything else renders as plain text. The serializer needed decodeHtmlEntities to match: without it a save would write `&lt;` into the Markdown file and the next parse would escape the `&` again, corrupting the text further on every round trip. A test covers parse -> serialize -> parse stability. Two existing tests asserted the old behaviour and were rewritten rather than deleted: one expected the script tag to be *removed* from the output, the other expected the substring "onerror" to be absent. Both now assert the property that matters — that no tag can form — because `onerror` surviving as inert text is fine. Exploitation required admin access either way: journal and essay text comes from the studio or from content/*.md. This removes the weakness, it does not close an open door. * fix(journal): contain file paths, fix frontmatter escaping, defuse two regexes Follow-up to the CodeQL findings on release PR #432. I went through all 23 alerts individually; this addresses the ones that are worth addressing and documents the ones that are not. Path containment (12 alerts, all false positives). Every path built from a slug goes through isValidSlug(), a strict `/^[a-zA-Z0-9_-]+$/` allowlist — verified against `../../etc/passwd`, `foo/../../bar`, `a/b`, `..` and friends, all rejected. CodeQL cannot see it because the check lives in another module. Added a containedPath() helper that resolves the path and refuses anything landing outside the content directory: a second lock on a door that was already locked, and a barrier the analysis can follow. Also removed the dead `slug.endsWith('.md')` branches — isValidSlug rejects dots, so they could never be taken. Frontmatter escaping (1 alert, a real bug). The serializer escaped `"` but not `\`, and the parser never unescaped anything. A title containing either character gained a backslash on every save/load cycle: Path C:\Users "quoted" -> Path C:\\Users \"quoted\" -> ... Escaping now covers the backslash first and the parser undoes both. A round trip test covers quotes, backslashes, colons and apostrophes. Two of three ReDoS regexes (2 alerts). The heading pattern had `\s+` next to `(.+)`, which overlap, so the engine tried every split of the whitespace run before failing; it is `[ \t]+` and `(\S.*)` now. The quote author pattern wrapped a lazy group around an optional group — the quadratic case — and is an index split on the first separator now. The third regex, the bold/italic pass, is deliberately left alone. Rewriting it with a negated class removes the backtracking but breaks nesting: `**bold *and italic* here**` renders as `*<em>bold </em>and italic<em> here</em>*`. The input is Markdown from an authenticated admin, never a visitor, so the worst case is an author slowing down their own page. The comment in the code says so. Not addressed: 5 js/insufficient-password-hash alerts. They ask for a slow KDF where the code uses SHA-256/HMAC — correct in general, but the admin password comes from an environment variable and is never stored, so a stronger KDF protects nothing that is not already in plaintext in the environment. 399 unit tests pass (18 new), build and tsc clean. * fix(journal): split the quote author by scanning, not by pattern Cleaning up after myself. #439 replaced the quote author regex `/^(.*?)(?:\s+--\s+(.+))?$/` — a lazy group around an optional one, the quadratic case — with `/\s+--\s+/`, and CodeQL promptly flagged the replacement for the same reason. One reported pattern traded for another. splitQuoteAuthor() scans for the first `--` that has whitespace on both sides. Linear, and it needs no reasoning about the regex engine at all. Behaviour is identical to the original regex, checked case by case against it: separator, no separator, several separators, tabs, wide gaps, `a--b` without spaces, leading and trailing separators, empty string. All nine are covered by tests, plus one asserting it stays fast on a 50k whitespace run. * security(admin): derive the session signing key with scrypt getSigningKey() ran the admin password through a single SHA-256 digest. It is key derivation rather than password storage, so it was never a stored-hash problem — but if the derived key ever leaked, one fast hash makes recovering the password by brute force cheap. CodeQL flags it as js/insufficient-password-hash and, for this particular alert, has a point. scrypt now. Two details that matter: The salt has to be stable. A random salt would produce a different key on every call and invalidate every session; it is derived from AUTH_SECRET, which is deployment-specific. Verified across separate processes: same inputs produce a verifying token, so a restart or redeploy does not log everyone out. The result is cached for the process lifetime. scrypt is deliberately slow and getSigningKey() runs on every admin request — deriving per call would add ~24ms to each one. The cache key is a digest of secret plus password, so a rotation misses the cache and derives again, and no extra plaintext copy of the password is kept around. Measured: first derivation 24ms, subsequent calls 0.12ms. Password change and secret change both invalidate an existing token, checked in separate processes. Note the one-time effect: existing admin sessions are invalidated by the change in derivation, so everyone logs in once more. * security(admin): key the signing-key cache on its inputs, not a digest #441 removed the SHA-256 digest of the admin password from the key derivation and introduced a new one three lines above it, as the cache key. Same rule, same file: CodeQL reported it immediately. The comment justifying it was wrong too. It claimed no second plaintext copy of the password was retained, while building the digest input allocates exactly that in order to hash it. The cache now holds the two input strings and compares them directly. They are the same objects the env and install caches already hold, so nothing extra is retained, and no fast hash of the password exists in memory for the life of the process. Re-verified after the change, in separate processes: a token from one process verifies in another with the same inputs, a changed password or secret rejects it, first derivation 24ms, cached calls 0.001ms. That leaves scrypt as the only place the password is hashed here. The two HMACs further down operate on the derived key and on token data, not on the password; the constant-time comparison in verifyAdminPassword is the previously dismissed one. --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
2026-08-14 16:55:07 +02:00
style={
{
'--preset-accent': info.accent,
'--preset-bg': info.bg,
'--preset-tile': info.tile,
'--preset-radius': `${info.radius}px`,
'--preset-gap': `${info.gap}px`,
} as React.CSSProperties
}
>
release: v0.11.0 — journal fixes, admin URLs, design system cleanup (#432) * fix(screenshots): sharp-Typen fuer 0.34 und 0.35 gleichzeitig (#410) sharp 0.35 ist von `export =` auf ESM umgestellt: der Modul-Namespace ist nicht mehr aufrufbar, die Factory sitzt unter .default. Der Type-Check brach damit in scripts/screenshots.ts weg, sobald der Next-Bump (#402) sharp von 0.34.5 auf 0.35.3 mitzieht -- sharp ist hier keine deklarierte Dependency, sondern kommt ueber Next mit. Die Form wird jetzt aus dem installierten Paket abgeleitet statt festgeschrieben, zur Laufzeit wie im Typ. Geprueft mit beiden Versionen: tsc laeuft mit 0.34.5 und mit 0.35.3 fehlerfrei durch. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(deps): bump the nextjs group across 1 directory with 2 updates (#402) Bumps the nextjs group with 2 updates in the / directory: [next](https://github.com/vercel/next.js) and [eslint-config-next](https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next). Updates `next` from 16.2.12 to 16.3.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/compare/v16.2.12...v16.3.0) Updates `eslint-config-next` from 16.2.12 to 16.3.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/commits/v16.3.0/packages/eslint-config-next) --- updated-dependencies: - dependency-name: eslint-config-next dependency-version: 16.3.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: nextjs - dependency-name: next dependency-version: 16.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nextjs ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps-dev): bump prettier from 3.8.3 to 3.9.6 (#405) Bumps [prettier](https://github.com/prettier/prettier) from 3.8.3 to 3.9.6. - [Release notes](https://github.com/prettier/prettier/releases) - [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md) - [Commits](https://github.com/prettier/prettier/compare/3.8.3...3.9.6) --- updated-dependencies: - dependency-name: prettier dependency-version: 3.9.6 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * docs(changelog): Unreleased-Sektion fuer die Bumps nach v0.10.0 (#413) Die Dependency-PRs sind nach dem Release auf dev gelandet, teils auch auf main. Ohne Eintrag waeren sie beim naechsten Release unsichtbar -- inklusive Next 16.3.0, das CVE-2025-13465 mitbringt. Ausserdem im 0.10.0-Abschnitt nachgetragen, dass der Trivy-Scan bis #409 nie gelaufen ist. Der Fix steckt im Tag v0.10.0, fehlte aber in der Aufzaehlung -- und "Images werden bei jedem Publish gescannt" stand im Changelog, waehrend der Job im Action-Setup abbrach. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(gallery): per-album sort order, independent of Immich (#408) (#414) Album order was dictated entirely by Immich: getAlbum() sorted by the album's own asc/desc flag, so a Folio album always mirrored the archive. A curated series has a narrative order that has nothing to do with capture time, and changing the Immich album's sort to fit the website changes it for the archive too. Adds an optional per-album `sort` in gallery.yaml, editable in /admin, defaulting to today's behaviour so every existing config is unchanged: immich (default) | newest | oldest | filename | manual `manual` is a pinned *prefix*: `assetOrder` lists only the photos placed by hand, everything else follows in the album's Immich order. A full permutation of a 2,000-photo album would be ~80 KB of UUIDs in a file that is rewritten and copied to content/.backups/ on every admin save. It also makes drift fall out for free — photos removed in Immich never match, new ones land in the tail rather than being hidden. Sorting is applied after the cache read, not before the cache write, so the LRU keeps one canonical Immich-ordered copy per album. That avoids putting the mode in the cache key, lets a config change take effect without depending on invalidation, and keeps the stale-serving path correct. cache.get() returns the stored object by reference, so withSort() returns a shallow clone with a new array — sorting in place would reorder the shared entry, and under request coalescing every concurrent caller would be sorting the same array. Also fixes a prerequisite bug: /api/admin/albums/[albumId]/assets read album.assets from GET /albums/:id, which Immich 3.x no longer populates (lib/immich.ts:507). The hero picker's "This Album" tab returned nothing and threw outright when the key was absent. It now goes through the client's paginated metadata search, with ?types=all to opt videos in for the reorder editor. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): drop decorative emoji from the sort select labels (#415) An <option> cannot contain markup, so the SVG set in Icons is not reachable there — but a decorative emoji is not a substitute for it. Plain text instead; the album card badge already uses a real icon. The remaining emoji in the admin panel (asset picker tabs, section headings, layout picker options) predate this branch and are left for a separate cleanup. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): replace emoji icons with the shared SVG icon set (#416) The admin panel mixed two icon conventions: inline SVGs from `Icons.tsx` in most components, and decorative emoji in the asset picker and a few PageBuilder labels. Emoji render inconsistently across platforms, ignore the accent colour, and cannot inherit the `.svg-icon` sizing rules. - Icons.tsx: add `IconStar` (filled — it marks a state, not an action) and `IconImage`. - AssetPicker: the three tab labels and the favourite tile badge now use IconFolder / IconStar / IconImage. - PageBuilder: the "Standalone Albums" and "Subpages" headings use the icon set instead of an emoji. - PageBuilder: the layout picker drops its emoji for plain text. An <option> cannot contain markup, so an SVG is impossible there and a decorative glyph is not a substitute. - admin.css: align icon and label in the picker tabs, and swap the favourite badge's text-shadow for drop-shadow, which is what applies to an inline SVG. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): fold PageBuilder's local icons into the shared Icons module (#418) * refactor(admin): fold PageBuilder's local icons into the shared module PageBuilder.tsx carried its own `Icons` object duplicating most of the glyphs already exported by Icons.tsx, with hardcoded sizes and slightly divergent paths. Migrate all 32 call sites to the shared module and delete the local object. Five glyphs had no counterpart and are added to Icons.tsx as 1:1 ports of the local paths: IconX, IconPlus, IconHome, IconCopy, IconImage. The local ExternalLink and Check are dropped rather than ported — both had zero call sites. Two glyphs change shape slightly, which is the point of consolidating: the shared IconCamera includes the viewfinder bump the local copy omitted, and drag handles now use IconGripVertical. IconGripVertical uses the module's square 24x24 viewBox, so `.svg-drag` goes from 12x18 to 18x18 — the old non-square box would letterbox the glyph down to 12x12 and shrink the handle. * fix(admin): resolve icon-module integration after #416 Merging dev brought in #416, which added a second IconImage to Icons.tsx and two <Icons.Camera>/<Icons.Folder> section headers that reference the local Icons object this PR removes. Git merged both cleanly but the result did not type-check. - drop the duplicate IconImage (both copies were byte-identical) - point the two section headers at the imported IconCamera/IconFolder - refresh the SORT_LABELS comment: the icon set is imported now, not declared below --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> * fix(config): allow an empty gallery, guard against a double /api suffix (#421) An empty gallery is now a valid, rendered state instead of a throw: deriveGallery() no longer requires at least one album or subpage, so a deployment with no albums yet renders a bare homepage the owner can fill in via /admin. getConfig() also stops appending /api to an Immich URL that already ends in it, which previously produced .../api/api and broke every upstream request. Includes a restore of the per-album sort test cases, which the branch had lost by being cut before #408/#414. * feat(admin): favicon upload, served from the content volume (#422) Adds a bundled default favicon, an upload widget in admin Settings > General, and a route that serves the icon from the writable content/ volume with a fallback to the bundled default. Raster uploads (PNG/ICO/JPEG) are wrapped in an SVG container; the response carries its own CSP so an uploaded SVG cannot execute script on the origin. The GET route revalidates with an ETag instead of caching immutably, so a newly uploaded icon shows up immediately. Uploads are written via temp file + rename, and a Reset button restores the bundled default. * ci: flag unformatted files in a PR, without blocking it (#424) Prettier is configured as an error rule in eslint.config.mjs but has never run in CI, so part of the tree predates it. A final CI step now diffs against the PR base, runs prettier --list-different over the changed files, and emits a warning annotation per offender plus a job summary. Advisory by design: it never fails the job. Blocking would turn a PR red for merely touching a file that was already unformatted, and normalising the tree in one commit would wreck git blame and conflict with the PRs in flight. Requires fetch-depth: 0, since diffing against the base needs its history. * feat(install): first-run wizard gated by a one-time setup token (#419) Adds /install, a four-step first-run wizard: connect to Immich, optionally pick albums, name the site, finish. It verifies the credentials against the Immich server before writing anything, then writes gallery.yaml, settings.yaml and a content/install.json carrying the Immich credentials and a generated site secret. install.json exists because a running process cannot pick up new env vars — the wizard has to write configuration that takes effect without a restart. getInstallCredentials() merges it under the real environment, so env vars always win and rotation stays a matter of setting one. Both the page and the API routes are gated by a one-time setup token printed to the server log, so a deployment that is reachable before gallery.yaml exists cannot be configured by whoever finds it first. The token is stored in content/.setup-token (0600) rather than a module variable: Next.js bundles the page and each route handler separately, so a module-level token left the page and the API disagreeing inside one process and the wizard stuck on step 1. It is removed once the install completes. The admin password is stored as an scrypt hash using the scheme lib/auth.ts already applies to album passwords; a plaintext ADMIN_PASSWORD env var keeps working. * docs: document the setup wizard, fix the read-only content mount (#425) Quick Start now leads with the /install wizard, with the hand-written YAML route kept alongside it, and a First-Run Setup section covers the setup token, the files the wizard writes, and env-var precedence. Two corrections: both Docker examples mounted content/ as :ro, which silently breaks the wizard, the admin panel and the backup rotation alike — docs/admin-panel.md already said so and the README contradicted it. And nothing documented that content/install.json holds the Immich API key, so a backup of content/ is a backup of credentials. Also adds a Contributors section crediting the people whose work is in the project. * feat(admin): floating save bar pinned to the bottom of the viewport (#426) The save bar was the first, static element inside .admin-main. Since the document itself scrolls, it left the viewport as soon as you scrolled down — editing a subpage section or a settings block far below gave no visible dirty hint and no reachable save button. Replace it with a bottom-pinned floating bar shared by both editors. It only mounts while there is something to act on (unsaved changes, an in-flight save, or a result message), so it never covers content while idle. The success message clears after 5s, which hides the bar again. - new SaveBar component, replacing the duplicated markup in PageBuilder and SettingsEditor - adopt the previously unused .floating-save-bar CSS: slide-in keyframes (carrying translateX(-50%)), dirty border, wrap/gap, mobile variant and a prefers-reduced-motion opt-out; z-index 900 keeps it below modals - .admin-main gains bottom padding so the bar never covers page content - drop the now-unreachable idle hints: the ⌘S hint becomes a button title, the Live Sync note becomes a static line above the settings layout - header "Site" link now bypasses the cache (/?fresh=1), so the preview stays reachable when the bar is hidden Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(admin): themed listbox for the album sort control (#427) The per-album "Photo order" control was a native <select>. Because an <option> cannot contain markup, its choices could not use the admin panel's currentColor SVG set — the reason #415 had to fall back to plain text after dropping the emoji labels. Adds a Listbox component implementing the ARIA combobox/listbox pattern, so options can render a glyph beside their label: - DOM focus stays on the trigger button; the active option is announced through aria-activedescendant, keeping focus management to one element - Keyboard: arrows (clamped at the ends, like a native select), Home/End, Enter/Space to commit, Escape to cancel, Tab commits and moves on, and prefix type-ahead with a repeat-key cycle - Outside dismissal on pointerdown, so a press starting outside closes the popup before the click retargets The sort options now carry an icon each: calendar, arrow-down, arrow-up, an A→Z marker, and the drag glyph for manual — matching the badge the album card already shows. SORT_LABELS stays plain text because the badge feeds it to a title attribute. Closes #417 Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(git): ignore generated design handoff folders * fix(admin): stop the album sort dropdown clipping, and simplify the panel (#428) * fix(admin): render listbox popup in a portal so it escapes modal clipping The sort control's popup was position:absolute inside three clipping ancestors (.album-drawer overflow:hidden > .album-drawer-body overflow-y:auto > .modal-right-column overflow-y:auto), so it was cut off at the bottom of the Edit Album Details modal. z-index could not help: clipping happens before stacking. It also always hung below the trigger, with no flip. Portal the popup to document.body and position it from the trigger's viewport rect, flipping above when there is more room there and capping max-height to the space available so it scrolls internally rather than overflowing. It is dismissed on scroll and resize, since the anchor is only measured on open. The outside-pointerdown handler now also treats the popup as inside; without that the portalled list counts as outside, and a click on an option would close it before the selection commits. * refactor(admin): single-column album details panel The left column spent 1.2fr on a cover thumbnail and three stat rows, two of which (Status, Custom Hero) only restated the form fields opposite them, while the form itself was squeezed into 1.8fr behind a second nested scroller. Stack the drawer in one column instead: cover as a banner, then the form at full width, with the UUID moved into the footer. The body is now the only scroll container, which also removes one of the ancestors that was clipping the sort popup. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> * fix(admin): give the portalled listbox its theme back, lock the page behind modals (#429) Two defects in the album editor. The sort listbox popup painted transparent. Every --admin-* variable is scoped to .admin-layout, and since the popup moved into document.body it sits outside that subtree, so background/border/text all resolved to nothing. It now carries its own copy of the palette in both colour schemes, plus the font it no longer inherits. Scrolling inside a modal also moved the page behind it. No admin modal ever locked body scroll: the overlay covers the page but does not absorb wheel events, so a scroll starting on the backdrop — or continuing past the end of the modal's own scroller — reaches the document. overscroll-behavior cannot cover that case on its own, because it only applies to scroll containers and the backdrop is not one. useScrollLock freezes body while a modal is open and compensates for the width the scrollbar gives up, so nothing shifts underneath. Each lock restores the inline value it found, which makes nesting work without a counter — a picker opened from the drawer restores the drawer's hidden state instead of clearing it. Applied to both drawers and all four picker modals, which share the defect. overscroll-behavior: contain on the scrollers stops the chaining they can handle themselves. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com> * fix(security): allow unsafe-eval in CSP script-src during dev mode * feat(journal): add Journal Studio with split-screen editor, live preview and dedicated routes * fix(build): separate client parser from server journal-service and fix build type errors * fix(journal): Fotos rendern, Layout und Lightbox-Steuerung korrigieren Fünf unabhängige Fehler in der öffentlichen Journal- und Essay-Ansicht: * Foto-Blöcke wurden nie angezeigt. EssayView löst ein Foto über PhotoItem.id auf, und das sind verschlüsselte Tokens — die Blöcke aus dem Markdown tragen aber rohe Asset-UUIDs. Jede Zuordnung lief ins Leere, und nicht auflösbare Blöcke werden still verworfen. Die IDs werden jetzt serverseitig übersetzt; damit verschwinden nebenbei die rohen UUIDs aus dem Client-Payload, die dort laut Projektregel nie auftauchen dürfen. Nicht auflösbare Referenzen werden geloggt. * Überschriften standen weiter links als der Fließtext. Jeder Block hatte einzeln `max-width: 68ch`, und `ch` ist relativ zur Schrift des Elements — die Serif-Überschrift ergab eine breitere Spalte. Ersetzt durch eine gemeinsame, font-unabhängige `--essay-measure`. * Fullbleed-Fotos bluteten nur nach links aus: `.essay-figure` ist `width: 100%`, wodurch die Box überbestimmt ist und der negative rechte Margin verworfen wird. * Foto-Paare stellten beide Bilder gleich breit dar, wodurch ein Hochformat neben einem Querformat doppelt so hoch wurde. Jetzt eine Justified-Reihe: Breite proportional zum Seitenverhältnis, dadurch exakt gleiche Höhen ohne Beschnitt. * Die Lightbox hatte im Journal keine Tastatursteuerung und keine Scroll-Sperre — beides lag in PhotoGrid, also nur im Album-Raster. Verlagert in die Lightbox selbst, der doppelte Handler in PhotoGrid entfernt (sonst wäre pro Pfeildruck zwei Bilder weitergesprungen). Zusätzlich sind Proofing-Herzen und das EXIF-Panel im redaktionellen Modus abschaltbar und im Journal aus: Client-Proofing ist ein Übergabe-Workflow für Alben, keine Funktion einer Reportage. Auf der Übersicht wurde der Untertitel doppelt gerendert, weil extractExcerpt() auf ihn zurückfällt. * feat(admin): eigene URLs für alle Bereiche und überarbeiteter Journal Studio Das Panel war eine einzige Client-Komponente, die ihre Tabs über useState umschaltet: keine Route pro Bereich, kein Deep-Link, kein Zurück-Button, und nach jedem Reload landete man wieder auf "Pages". Auch der Journal-Editor hatte keine eigene URL. Jetzt sieben echte Routen (/admin, /admin/pages, /admin/journal, /admin/journal/<slug>, /admin/settings, /admin/settings/<section>, /admin/analytics). Die Shell mit Auth-Prüfung und Kopfzeile sitzt im Layout und umschließt children — so bleibt die Session-Prüfung über Routenwechsel montiert, statt bei jedem Tab-Wechsel neu zu laufen und den Spinner aufblitzen zu lassen. Unbekannte Settings-Sections fallen auf General zurück. Im selben Zug der Journal Studio, der die Routing-Änderung ohnehin berührt: * Alle Eingabefelder nutzten die Klasse `admin-input`, die in keinem CSS definiert war — sie fielen auf Browser-Defaults zurück. Jetzt gestylt, gescoped, damit der generische Name nicht ins übrige Panel leckt. * Der Split View ist per Divider verschiebbar (Maus, Tastatur, Doppelklick zum Zurücksetzen), Breite in localStorage. * Das Studio bricht aus der 1120px-Spalte aus, die Preview hat Platz. * Die Preview zeigte für jedes Foto fest 3:2 und log damit über das Layout der veröffentlichten Seite; die echten Verhältnisse werden jetzt an den Thumbnails gemessen. * Blöcke mit alten positionsbasierten Foto-Referenzen werden markiert — die lassen sich auf einer eigenständigen Journal-Seite nicht auflösen und verschwanden bisher stillschweigend. * Blocktyp-Chips als gemeinsame Komponente, monochrom und per Icon unterschieden statt in einer eigenen Blau/Lila/Orange-Palette, die sonst nirgends im Panel vorkommt. * Emojis raus, SVG-Icons rein. * fix(admin): Designsystem-Lücken im Panel schließen Eine systematische Suche nach Klassen, die im TSX benutzt, aber in keinem CSS definiert sind, hat vier Stellen mit demselben Muster gefunden: * `admin-btn-secondary` und `admin-btn-danger` existierten nicht. Sämtliche Löschen-Buttons sahen aus wie normale Buttons — keine Warnwirkung. Als `.admin-btn.admin-btn-danger` geschrieben, weil die Varianten mit den Größenklassen kombiniert werden, die weiter unten ihren eigenen Hintergrund setzen. * `page-progress-fill` fehlte: die Balken im Analytics-Panel waren leere Rinnen, der Wert unsichtbar. Ebenso `analytics-empty` und `admin-loading-container`. * `subpage-drawer-section`, `subpage-drawer-title-group` und `input-with-icon` im PageBuilder waren wirkungslos und teils mit Inline-Styles notdürftig kompensiert. * `grid-card-preview` fehlte, wodurch alle Layout-Vorschauen auf Höhe null kollabierten. Nur "Showcase" war sichtbar — und das aus Versehen, weil sein Tile `hero-tile` hieß und damit die `aspect-ratio` einer fremden PageBuilder-Klasse erbte. Umbenannt. Dazu die Theme-Vorschauen, die praktisch identisch aussahen: alle sieben zeigten dieselben drei quadratischen Kacheln, einziger Unterschied war die Hintergrundfarbe. Sie spiegeln jetzt die echten Preset-Daten aus lib/config/theme.ts — Schriftcharakter, Eckradius, Rasterdichte, Passepartout bzw. Schatten. Die Kopfzeile richtet sich an einer gemeinsamen Steuerhöhe aus. Der "Site"-Link war höher als die Buttons daneben: `.admin-btn` hatte keine explizite line-height, und <button> bekommt box-sizing: border-box vom Browser, <a> nicht. Die Statusanzeige setzte weder Schriftfamilie noch -größe und fiel auf den Browser-Default zurück — sie war nie Teil des Designsystems. Jetzt gleiche Höhe und Typografie, Pillenform als Zustandsanzeige, Trenner zur Aktionsgruppe. Das dauerhafte Pulsieren des grünen Punkts entfällt; Animation bleibt den Zuständen vorbehalten, die Aufmerksamkeit brauchen. Restliche Emojis durch SVG-Icons ersetzt. * feat(admin): add scroll-to-top toggle and SVG arrow The back-to-top button was always on and drew its arrow with the ↑ text character. Add a `scrollToTop` setting (General section in the admin panel, defaults to on so existing sites are unaffected) and replace the glyph with a stroked SVG that inherits currentColor across all presets. Scroll handling is now rAF-throttled, and prefers-reduced-motion turns off both the hover lift and the smooth scroll. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * security(journal): escape author HTML instead of filtering it CodeQL flags 26 high-severity alerts on the release PR; the bulk of them point at sanitizeHtml(), a denylist of three regexes whose output goes into dangerouslySetInnerHTML. I reproduced the bypasses before changing anything — all four pass the old filter: <img src=x onerror=alert(1)> unquoted handler, regex wants quotes <img src=x onerror='alert(1)'> single quotes, same reason <svg onload=alert(1)> not a <script> tag javasjavascript:cript:alert(1) one-pass replace, the rest recombines Plus an attribute breakout in the link renderer, which interpolated the URL into href="${url}" unescaped: [x](" onmouseover=alert(1) x=") -> <a href="" onmouseover=alert(1" ...> Replaced with escaping. Every `&<>"'` in author text becomes an entity before any markdown rule runs, so the only tags in the output are the ones renderInlineMarkdown builds itself and a URL cannot leave its attribute. Link schemes are now an allowlist (http, https, mailto, tel, relative, anchor); anything else renders as plain text. The serializer needed decodeHtmlEntities to match: without it a save would write `&lt;` into the Markdown file and the next parse would escape the `&` again, corrupting the text further on every round trip. A test covers parse -> serialize -> parse stability. Two existing tests asserted the old behaviour and were rewritten rather than deleted: one expected the script tag to be *removed* from the output, the other expected the substring "onerror" to be absent. Both now assert the property that matters — that no tag can form — because `onerror` surviving as inert text is fine. Exploitation required admin access either way: journal and essay text comes from the studio or from content/*.md. This removes the weakness, it does not close an open door. * fix(journal): contain file paths, fix frontmatter escaping, defuse two regexes Follow-up to the CodeQL findings on release PR #432. I went through all 23 alerts individually; this addresses the ones that are worth addressing and documents the ones that are not. Path containment (12 alerts, all false positives). Every path built from a slug goes through isValidSlug(), a strict `/^[a-zA-Z0-9_-]+$/` allowlist — verified against `../../etc/passwd`, `foo/../../bar`, `a/b`, `..` and friends, all rejected. CodeQL cannot see it because the check lives in another module. Added a containedPath() helper that resolves the path and refuses anything landing outside the content directory: a second lock on a door that was already locked, and a barrier the analysis can follow. Also removed the dead `slug.endsWith('.md')` branches — isValidSlug rejects dots, so they could never be taken. Frontmatter escaping (1 alert, a real bug). The serializer escaped `"` but not `\`, and the parser never unescaped anything. A title containing either character gained a backslash on every save/load cycle: Path C:\Users "quoted" -> Path C:\\Users \"quoted\" -> ... Escaping now covers the backslash first and the parser undoes both. A round trip test covers quotes, backslashes, colons and apostrophes. Two of three ReDoS regexes (2 alerts). The heading pattern had `\s+` next to `(.+)`, which overlap, so the engine tried every split of the whitespace run before failing; it is `[ \t]+` and `(\S.*)` now. The quote author pattern wrapped a lazy group around an optional group — the quadratic case — and is an index split on the first separator now. The third regex, the bold/italic pass, is deliberately left alone. Rewriting it with a negated class removes the backtracking but breaks nesting: `**bold *and italic* here**` renders as `*<em>bold </em>and italic<em> here</em>*`. The input is Markdown from an authenticated admin, never a visitor, so the worst case is an author slowing down their own page. The comment in the code says so. Not addressed: 5 js/insufficient-password-hash alerts. They ask for a slow KDF where the code uses SHA-256/HMAC — correct in general, but the admin password comes from an environment variable and is never stored, so a stronger KDF protects nothing that is not already in plaintext in the environment. 399 unit tests pass (18 new), build and tsc clean. * fix(journal): split the quote author by scanning, not by pattern Cleaning up after myself. #439 replaced the quote author regex `/^(.*?)(?:\s+--\s+(.+))?$/` — a lazy group around an optional one, the quadratic case — with `/\s+--\s+/`, and CodeQL promptly flagged the replacement for the same reason. One reported pattern traded for another. splitQuoteAuthor() scans for the first `--` that has whitespace on both sides. Linear, and it needs no reasoning about the regex engine at all. Behaviour is identical to the original regex, checked case by case against it: separator, no separator, several separators, tabs, wide gaps, `a--b` without spaces, leading and trailing separators, empty string. All nine are covered by tests, plus one asserting it stays fast on a 50k whitespace run. * security(admin): derive the session signing key with scrypt getSigningKey() ran the admin password through a single SHA-256 digest. It is key derivation rather than password storage, so it was never a stored-hash problem — but if the derived key ever leaked, one fast hash makes recovering the password by brute force cheap. CodeQL flags it as js/insufficient-password-hash and, for this particular alert, has a point. scrypt now. Two details that matter: The salt has to be stable. A random salt would produce a different key on every call and invalidate every session; it is derived from AUTH_SECRET, which is deployment-specific. Verified across separate processes: same inputs produce a verifying token, so a restart or redeploy does not log everyone out. The result is cached for the process lifetime. scrypt is deliberately slow and getSigningKey() runs on every admin request — deriving per call would add ~24ms to each one. The cache key is a digest of secret plus password, so a rotation misses the cache and derives again, and no extra plaintext copy of the password is kept around. Measured: first derivation 24ms, subsequent calls 0.12ms. Password change and secret change both invalidate an existing token, checked in separate processes. Note the one-time effect: existing admin sessions are invalidated by the change in derivation, so everyone logs in once more. * security(admin): key the signing-key cache on its inputs, not a digest #441 removed the SHA-256 digest of the admin password from the key derivation and introduced a new one three lines above it, as the cache key. Same rule, same file: CodeQL reported it immediately. The comment justifying it was wrong too. It claimed no second plaintext copy of the password was retained, while building the digest input allocates exactly that in order to hash it. The cache now holds the two input strings and compares them directly. They are the same objects the env and install caches already hold, so nothing extra is retained, and no fast hash of the password exists in memory for the life of the process. Re-verified after the change, in separate processes: a token from one process verifies in another with the same inputs, a changed password or secret rejects it, first derivation 24ms, cached calls 0.001ms. That leaves scrypt as the only place the password is hashed here. The two HMACs further down operate on the derived key and on token data, not on the password; the constant-time comparison in verifyAdminPassword is the previously dismissed one. --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
2026-08-14 16:55:07 +02:00
<div className="preset-card-preview" data-frame={info.frame}>
<div className="mini-header">
release: v0.11.0 — journal fixes, admin URLs, design system cleanup (#432) * fix(screenshots): sharp-Typen fuer 0.34 und 0.35 gleichzeitig (#410) sharp 0.35 ist von `export =` auf ESM umgestellt: der Modul-Namespace ist nicht mehr aufrufbar, die Factory sitzt unter .default. Der Type-Check brach damit in scripts/screenshots.ts weg, sobald der Next-Bump (#402) sharp von 0.34.5 auf 0.35.3 mitzieht -- sharp ist hier keine deklarierte Dependency, sondern kommt ueber Next mit. Die Form wird jetzt aus dem installierten Paket abgeleitet statt festgeschrieben, zur Laufzeit wie im Typ. Geprueft mit beiden Versionen: tsc laeuft mit 0.34.5 und mit 0.35.3 fehlerfrei durch. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(deps): bump the nextjs group across 1 directory with 2 updates (#402) Bumps the nextjs group with 2 updates in the / directory: [next](https://github.com/vercel/next.js) and [eslint-config-next](https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next). Updates `next` from 16.2.12 to 16.3.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/compare/v16.2.12...v16.3.0) Updates `eslint-config-next` from 16.2.12 to 16.3.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/commits/v16.3.0/packages/eslint-config-next) --- updated-dependencies: - dependency-name: eslint-config-next dependency-version: 16.3.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: nextjs - dependency-name: next dependency-version: 16.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nextjs ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps-dev): bump prettier from 3.8.3 to 3.9.6 (#405) Bumps [prettier](https://github.com/prettier/prettier) from 3.8.3 to 3.9.6. - [Release notes](https://github.com/prettier/prettier/releases) - [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md) - [Commits](https://github.com/prettier/prettier/compare/3.8.3...3.9.6) --- updated-dependencies: - dependency-name: prettier dependency-version: 3.9.6 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * docs(changelog): Unreleased-Sektion fuer die Bumps nach v0.10.0 (#413) Die Dependency-PRs sind nach dem Release auf dev gelandet, teils auch auf main. Ohne Eintrag waeren sie beim naechsten Release unsichtbar -- inklusive Next 16.3.0, das CVE-2025-13465 mitbringt. Ausserdem im 0.10.0-Abschnitt nachgetragen, dass der Trivy-Scan bis #409 nie gelaufen ist. Der Fix steckt im Tag v0.10.0, fehlte aber in der Aufzaehlung -- und "Images werden bei jedem Publish gescannt" stand im Changelog, waehrend der Job im Action-Setup abbrach. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(gallery): per-album sort order, independent of Immich (#408) (#414) Album order was dictated entirely by Immich: getAlbum() sorted by the album's own asc/desc flag, so a Folio album always mirrored the archive. A curated series has a narrative order that has nothing to do with capture time, and changing the Immich album's sort to fit the website changes it for the archive too. Adds an optional per-album `sort` in gallery.yaml, editable in /admin, defaulting to today's behaviour so every existing config is unchanged: immich (default) | newest | oldest | filename | manual `manual` is a pinned *prefix*: `assetOrder` lists only the photos placed by hand, everything else follows in the album's Immich order. A full permutation of a 2,000-photo album would be ~80 KB of UUIDs in a file that is rewritten and copied to content/.backups/ on every admin save. It also makes drift fall out for free — photos removed in Immich never match, new ones land in the tail rather than being hidden. Sorting is applied after the cache read, not before the cache write, so the LRU keeps one canonical Immich-ordered copy per album. That avoids putting the mode in the cache key, lets a config change take effect without depending on invalidation, and keeps the stale-serving path correct. cache.get() returns the stored object by reference, so withSort() returns a shallow clone with a new array — sorting in place would reorder the shared entry, and under request coalescing every concurrent caller would be sorting the same array. Also fixes a prerequisite bug: /api/admin/albums/[albumId]/assets read album.assets from GET /albums/:id, which Immich 3.x no longer populates (lib/immich.ts:507). The hero picker's "This Album" tab returned nothing and threw outright when the key was absent. It now goes through the client's paginated metadata search, with ?types=all to opt videos in for the reorder editor. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): drop decorative emoji from the sort select labels (#415) An <option> cannot contain markup, so the SVG set in Icons is not reachable there — but a decorative emoji is not a substitute for it. Plain text instead; the album card badge already uses a real icon. The remaining emoji in the admin panel (asset picker tabs, section headings, layout picker options) predate this branch and are left for a separate cleanup. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): replace emoji icons with the shared SVG icon set (#416) The admin panel mixed two icon conventions: inline SVGs from `Icons.tsx` in most components, and decorative emoji in the asset picker and a few PageBuilder labels. Emoji render inconsistently across platforms, ignore the accent colour, and cannot inherit the `.svg-icon` sizing rules. - Icons.tsx: add `IconStar` (filled — it marks a state, not an action) and `IconImage`. - AssetPicker: the three tab labels and the favourite tile badge now use IconFolder / IconStar / IconImage. - PageBuilder: the "Standalone Albums" and "Subpages" headings use the icon set instead of an emoji. - PageBuilder: the layout picker drops its emoji for plain text. An <option> cannot contain markup, so an SVG is impossible there and a decorative glyph is not a substitute. - admin.css: align icon and label in the picker tabs, and swap the favourite badge's text-shadow for drop-shadow, which is what applies to an inline SVG. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): fold PageBuilder's local icons into the shared Icons module (#418) * refactor(admin): fold PageBuilder's local icons into the shared module PageBuilder.tsx carried its own `Icons` object duplicating most of the glyphs already exported by Icons.tsx, with hardcoded sizes and slightly divergent paths. Migrate all 32 call sites to the shared module and delete the local object. Five glyphs had no counterpart and are added to Icons.tsx as 1:1 ports of the local paths: IconX, IconPlus, IconHome, IconCopy, IconImage. The local ExternalLink and Check are dropped rather than ported — both had zero call sites. Two glyphs change shape slightly, which is the point of consolidating: the shared IconCamera includes the viewfinder bump the local copy omitted, and drag handles now use IconGripVertical. IconGripVertical uses the module's square 24x24 viewBox, so `.svg-drag` goes from 12x18 to 18x18 — the old non-square box would letterbox the glyph down to 12x12 and shrink the handle. * fix(admin): resolve icon-module integration after #416 Merging dev brought in #416, which added a second IconImage to Icons.tsx and two <Icons.Camera>/<Icons.Folder> section headers that reference the local Icons object this PR removes. Git merged both cleanly but the result did not type-check. - drop the duplicate IconImage (both copies were byte-identical) - point the two section headers at the imported IconCamera/IconFolder - refresh the SORT_LABELS comment: the icon set is imported now, not declared below --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> * fix(config): allow an empty gallery, guard against a double /api suffix (#421) An empty gallery is now a valid, rendered state instead of a throw: deriveGallery() no longer requires at least one album or subpage, so a deployment with no albums yet renders a bare homepage the owner can fill in via /admin. getConfig() also stops appending /api to an Immich URL that already ends in it, which previously produced .../api/api and broke every upstream request. Includes a restore of the per-album sort test cases, which the branch had lost by being cut before #408/#414. * feat(admin): favicon upload, served from the content volume (#422) Adds a bundled default favicon, an upload widget in admin Settings > General, and a route that serves the icon from the writable content/ volume with a fallback to the bundled default. Raster uploads (PNG/ICO/JPEG) are wrapped in an SVG container; the response carries its own CSP so an uploaded SVG cannot execute script on the origin. The GET route revalidates with an ETag instead of caching immutably, so a newly uploaded icon shows up immediately. Uploads are written via temp file + rename, and a Reset button restores the bundled default. * ci: flag unformatted files in a PR, without blocking it (#424) Prettier is configured as an error rule in eslint.config.mjs but has never run in CI, so part of the tree predates it. A final CI step now diffs against the PR base, runs prettier --list-different over the changed files, and emits a warning annotation per offender plus a job summary. Advisory by design: it never fails the job. Blocking would turn a PR red for merely touching a file that was already unformatted, and normalising the tree in one commit would wreck git blame and conflict with the PRs in flight. Requires fetch-depth: 0, since diffing against the base needs its history. * feat(install): first-run wizard gated by a one-time setup token (#419) Adds /install, a four-step first-run wizard: connect to Immich, optionally pick albums, name the site, finish. It verifies the credentials against the Immich server before writing anything, then writes gallery.yaml, settings.yaml and a content/install.json carrying the Immich credentials and a generated site secret. install.json exists because a running process cannot pick up new env vars — the wizard has to write configuration that takes effect without a restart. getInstallCredentials() merges it under the real environment, so env vars always win and rotation stays a matter of setting one. Both the page and the API routes are gated by a one-time setup token printed to the server log, so a deployment that is reachable before gallery.yaml exists cannot be configured by whoever finds it first. The token is stored in content/.setup-token (0600) rather than a module variable: Next.js bundles the page and each route handler separately, so a module-level token left the page and the API disagreeing inside one process and the wizard stuck on step 1. It is removed once the install completes. The admin password is stored as an scrypt hash using the scheme lib/auth.ts already applies to album passwords; a plaintext ADMIN_PASSWORD env var keeps working. * docs: document the setup wizard, fix the read-only content mount (#425) Quick Start now leads with the /install wizard, with the hand-written YAML route kept alongside it, and a First-Run Setup section covers the setup token, the files the wizard writes, and env-var precedence. Two corrections: both Docker examples mounted content/ as :ro, which silently breaks the wizard, the admin panel and the backup rotation alike — docs/admin-panel.md already said so and the README contradicted it. And nothing documented that content/install.json holds the Immich API key, so a backup of content/ is a backup of credentials. Also adds a Contributors section crediting the people whose work is in the project. * feat(admin): floating save bar pinned to the bottom of the viewport (#426) The save bar was the first, static element inside .admin-main. Since the document itself scrolls, it left the viewport as soon as you scrolled down — editing a subpage section or a settings block far below gave no visible dirty hint and no reachable save button. Replace it with a bottom-pinned floating bar shared by both editors. It only mounts while there is something to act on (unsaved changes, an in-flight save, or a result message), so it never covers content while idle. The success message clears after 5s, which hides the bar again. - new SaveBar component, replacing the duplicated markup in PageBuilder and SettingsEditor - adopt the previously unused .floating-save-bar CSS: slide-in keyframes (carrying translateX(-50%)), dirty border, wrap/gap, mobile variant and a prefers-reduced-motion opt-out; z-index 900 keeps it below modals - .admin-main gains bottom padding so the bar never covers page content - drop the now-unreachable idle hints: the ⌘S hint becomes a button title, the Live Sync note becomes a static line above the settings layout - header "Site" link now bypasses the cache (/?fresh=1), so the preview stays reachable when the bar is hidden Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(admin): themed listbox for the album sort control (#427) The per-album "Photo order" control was a native <select>. Because an <option> cannot contain markup, its choices could not use the admin panel's currentColor SVG set — the reason #415 had to fall back to plain text after dropping the emoji labels. Adds a Listbox component implementing the ARIA combobox/listbox pattern, so options can render a glyph beside their label: - DOM focus stays on the trigger button; the active option is announced through aria-activedescendant, keeping focus management to one element - Keyboard: arrows (clamped at the ends, like a native select), Home/End, Enter/Space to commit, Escape to cancel, Tab commits and moves on, and prefix type-ahead with a repeat-key cycle - Outside dismissal on pointerdown, so a press starting outside closes the popup before the click retargets The sort options now carry an icon each: calendar, arrow-down, arrow-up, an A→Z marker, and the drag glyph for manual — matching the badge the album card already shows. SORT_LABELS stays plain text because the badge feeds it to a title attribute. Closes #417 Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(git): ignore generated design handoff folders * fix(admin): stop the album sort dropdown clipping, and simplify the panel (#428) * fix(admin): render listbox popup in a portal so it escapes modal clipping The sort control's popup was position:absolute inside three clipping ancestors (.album-drawer overflow:hidden > .album-drawer-body overflow-y:auto > .modal-right-column overflow-y:auto), so it was cut off at the bottom of the Edit Album Details modal. z-index could not help: clipping happens before stacking. It also always hung below the trigger, with no flip. Portal the popup to document.body and position it from the trigger's viewport rect, flipping above when there is more room there and capping max-height to the space available so it scrolls internally rather than overflowing. It is dismissed on scroll and resize, since the anchor is only measured on open. The outside-pointerdown handler now also treats the popup as inside; without that the portalled list counts as outside, and a click on an option would close it before the selection commits. * refactor(admin): single-column album details panel The left column spent 1.2fr on a cover thumbnail and three stat rows, two of which (Status, Custom Hero) only restated the form fields opposite them, while the form itself was squeezed into 1.8fr behind a second nested scroller. Stack the drawer in one column instead: cover as a banner, then the form at full width, with the UUID moved into the footer. The body is now the only scroll container, which also removes one of the ancestors that was clipping the sort popup. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> * fix(admin): give the portalled listbox its theme back, lock the page behind modals (#429) Two defects in the album editor. The sort listbox popup painted transparent. Every --admin-* variable is scoped to .admin-layout, and since the popup moved into document.body it sits outside that subtree, so background/border/text all resolved to nothing. It now carries its own copy of the palette in both colour schemes, plus the font it no longer inherits. Scrolling inside a modal also moved the page behind it. No admin modal ever locked body scroll: the overlay covers the page but does not absorb wheel events, so a scroll starting on the backdrop — or continuing past the end of the modal's own scroller — reaches the document. overscroll-behavior cannot cover that case on its own, because it only applies to scroll containers and the backdrop is not one. useScrollLock freezes body while a modal is open and compensates for the width the scrollbar gives up, so nothing shifts underneath. Each lock restores the inline value it found, which makes nesting work without a counter — a picker opened from the drawer restores the drawer's hidden state instead of clearing it. Applied to both drawers and all four picker modals, which share the defect. overscroll-behavior: contain on the scrollers stops the chaining they can handle themselves. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com> * fix(security): allow unsafe-eval in CSP script-src during dev mode * feat(journal): add Journal Studio with split-screen editor, live preview and dedicated routes * fix(build): separate client parser from server journal-service and fix build type errors * fix(journal): Fotos rendern, Layout und Lightbox-Steuerung korrigieren Fünf unabhängige Fehler in der öffentlichen Journal- und Essay-Ansicht: * Foto-Blöcke wurden nie angezeigt. EssayView löst ein Foto über PhotoItem.id auf, und das sind verschlüsselte Tokens — die Blöcke aus dem Markdown tragen aber rohe Asset-UUIDs. Jede Zuordnung lief ins Leere, und nicht auflösbare Blöcke werden still verworfen. Die IDs werden jetzt serverseitig übersetzt; damit verschwinden nebenbei die rohen UUIDs aus dem Client-Payload, die dort laut Projektregel nie auftauchen dürfen. Nicht auflösbare Referenzen werden geloggt. * Überschriften standen weiter links als der Fließtext. Jeder Block hatte einzeln `max-width: 68ch`, und `ch` ist relativ zur Schrift des Elements — die Serif-Überschrift ergab eine breitere Spalte. Ersetzt durch eine gemeinsame, font-unabhängige `--essay-measure`. * Fullbleed-Fotos bluteten nur nach links aus: `.essay-figure` ist `width: 100%`, wodurch die Box überbestimmt ist und der negative rechte Margin verworfen wird. * Foto-Paare stellten beide Bilder gleich breit dar, wodurch ein Hochformat neben einem Querformat doppelt so hoch wurde. Jetzt eine Justified-Reihe: Breite proportional zum Seitenverhältnis, dadurch exakt gleiche Höhen ohne Beschnitt. * Die Lightbox hatte im Journal keine Tastatursteuerung und keine Scroll-Sperre — beides lag in PhotoGrid, also nur im Album-Raster. Verlagert in die Lightbox selbst, der doppelte Handler in PhotoGrid entfernt (sonst wäre pro Pfeildruck zwei Bilder weitergesprungen). Zusätzlich sind Proofing-Herzen und das EXIF-Panel im redaktionellen Modus abschaltbar und im Journal aus: Client-Proofing ist ein Übergabe-Workflow für Alben, keine Funktion einer Reportage. Auf der Übersicht wurde der Untertitel doppelt gerendert, weil extractExcerpt() auf ihn zurückfällt. * feat(admin): eigene URLs für alle Bereiche und überarbeiteter Journal Studio Das Panel war eine einzige Client-Komponente, die ihre Tabs über useState umschaltet: keine Route pro Bereich, kein Deep-Link, kein Zurück-Button, und nach jedem Reload landete man wieder auf "Pages". Auch der Journal-Editor hatte keine eigene URL. Jetzt sieben echte Routen (/admin, /admin/pages, /admin/journal, /admin/journal/<slug>, /admin/settings, /admin/settings/<section>, /admin/analytics). Die Shell mit Auth-Prüfung und Kopfzeile sitzt im Layout und umschließt children — so bleibt die Session-Prüfung über Routenwechsel montiert, statt bei jedem Tab-Wechsel neu zu laufen und den Spinner aufblitzen zu lassen. Unbekannte Settings-Sections fallen auf General zurück. Im selben Zug der Journal Studio, der die Routing-Änderung ohnehin berührt: * Alle Eingabefelder nutzten die Klasse `admin-input`, die in keinem CSS definiert war — sie fielen auf Browser-Defaults zurück. Jetzt gestylt, gescoped, damit der generische Name nicht ins übrige Panel leckt. * Der Split View ist per Divider verschiebbar (Maus, Tastatur, Doppelklick zum Zurücksetzen), Breite in localStorage. * Das Studio bricht aus der 1120px-Spalte aus, die Preview hat Platz. * Die Preview zeigte für jedes Foto fest 3:2 und log damit über das Layout der veröffentlichten Seite; die echten Verhältnisse werden jetzt an den Thumbnails gemessen. * Blöcke mit alten positionsbasierten Foto-Referenzen werden markiert — die lassen sich auf einer eigenständigen Journal-Seite nicht auflösen und verschwanden bisher stillschweigend. * Blocktyp-Chips als gemeinsame Komponente, monochrom und per Icon unterschieden statt in einer eigenen Blau/Lila/Orange-Palette, die sonst nirgends im Panel vorkommt. * Emojis raus, SVG-Icons rein. * fix(admin): Designsystem-Lücken im Panel schließen Eine systematische Suche nach Klassen, die im TSX benutzt, aber in keinem CSS definiert sind, hat vier Stellen mit demselben Muster gefunden: * `admin-btn-secondary` und `admin-btn-danger` existierten nicht. Sämtliche Löschen-Buttons sahen aus wie normale Buttons — keine Warnwirkung. Als `.admin-btn.admin-btn-danger` geschrieben, weil die Varianten mit den Größenklassen kombiniert werden, die weiter unten ihren eigenen Hintergrund setzen. * `page-progress-fill` fehlte: die Balken im Analytics-Panel waren leere Rinnen, der Wert unsichtbar. Ebenso `analytics-empty` und `admin-loading-container`. * `subpage-drawer-section`, `subpage-drawer-title-group` und `input-with-icon` im PageBuilder waren wirkungslos und teils mit Inline-Styles notdürftig kompensiert. * `grid-card-preview` fehlte, wodurch alle Layout-Vorschauen auf Höhe null kollabierten. Nur "Showcase" war sichtbar — und das aus Versehen, weil sein Tile `hero-tile` hieß und damit die `aspect-ratio` einer fremden PageBuilder-Klasse erbte. Umbenannt. Dazu die Theme-Vorschauen, die praktisch identisch aussahen: alle sieben zeigten dieselben drei quadratischen Kacheln, einziger Unterschied war die Hintergrundfarbe. Sie spiegeln jetzt die echten Preset-Daten aus lib/config/theme.ts — Schriftcharakter, Eckradius, Rasterdichte, Passepartout bzw. Schatten. Die Kopfzeile richtet sich an einer gemeinsamen Steuerhöhe aus. Der "Site"-Link war höher als die Buttons daneben: `.admin-btn` hatte keine explizite line-height, und <button> bekommt box-sizing: border-box vom Browser, <a> nicht. Die Statusanzeige setzte weder Schriftfamilie noch -größe und fiel auf den Browser-Default zurück — sie war nie Teil des Designsystems. Jetzt gleiche Höhe und Typografie, Pillenform als Zustandsanzeige, Trenner zur Aktionsgruppe. Das dauerhafte Pulsieren des grünen Punkts entfällt; Animation bleibt den Zuständen vorbehalten, die Aufmerksamkeit brauchen. Restliche Emojis durch SVG-Icons ersetzt. * feat(admin): add scroll-to-top toggle and SVG arrow The back-to-top button was always on and drew its arrow with the ↑ text character. Add a `scrollToTop` setting (General section in the admin panel, defaults to on so existing sites are unaffected) and replace the glyph with a stroked SVG that inherits currentColor across all presets. Scroll handling is now rAF-throttled, and prefers-reduced-motion turns off both the hover lift and the smooth scroll. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * security(journal): escape author HTML instead of filtering it CodeQL flags 26 high-severity alerts on the release PR; the bulk of them point at sanitizeHtml(), a denylist of three regexes whose output goes into dangerouslySetInnerHTML. I reproduced the bypasses before changing anything — all four pass the old filter: <img src=x onerror=alert(1)> unquoted handler, regex wants quotes <img src=x onerror='alert(1)'> single quotes, same reason <svg onload=alert(1)> not a <script> tag javasjavascript:cript:alert(1) one-pass replace, the rest recombines Plus an attribute breakout in the link renderer, which interpolated the URL into href="${url}" unescaped: [x](" onmouseover=alert(1) x=") -> <a href="" onmouseover=alert(1" ...> Replaced with escaping. Every `&<>"'` in author text becomes an entity before any markdown rule runs, so the only tags in the output are the ones renderInlineMarkdown builds itself and a URL cannot leave its attribute. Link schemes are now an allowlist (http, https, mailto, tel, relative, anchor); anything else renders as plain text. The serializer needed decodeHtmlEntities to match: without it a save would write `&lt;` into the Markdown file and the next parse would escape the `&` again, corrupting the text further on every round trip. A test covers parse -> serialize -> parse stability. Two existing tests asserted the old behaviour and were rewritten rather than deleted: one expected the script tag to be *removed* from the output, the other expected the substring "onerror" to be absent. Both now assert the property that matters — that no tag can form — because `onerror` surviving as inert text is fine. Exploitation required admin access either way: journal and essay text comes from the studio or from content/*.md. This removes the weakness, it does not close an open door. * fix(journal): contain file paths, fix frontmatter escaping, defuse two regexes Follow-up to the CodeQL findings on release PR #432. I went through all 23 alerts individually; this addresses the ones that are worth addressing and documents the ones that are not. Path containment (12 alerts, all false positives). Every path built from a slug goes through isValidSlug(), a strict `/^[a-zA-Z0-9_-]+$/` allowlist — verified against `../../etc/passwd`, `foo/../../bar`, `a/b`, `..` and friends, all rejected. CodeQL cannot see it because the check lives in another module. Added a containedPath() helper that resolves the path and refuses anything landing outside the content directory: a second lock on a door that was already locked, and a barrier the analysis can follow. Also removed the dead `slug.endsWith('.md')` branches — isValidSlug rejects dots, so they could never be taken. Frontmatter escaping (1 alert, a real bug). The serializer escaped `"` but not `\`, and the parser never unescaped anything. A title containing either character gained a backslash on every save/load cycle: Path C:\Users "quoted" -> Path C:\\Users \"quoted\" -> ... Escaping now covers the backslash first and the parser undoes both. A round trip test covers quotes, backslashes, colons and apostrophes. Two of three ReDoS regexes (2 alerts). The heading pattern had `\s+` next to `(.+)`, which overlap, so the engine tried every split of the whitespace run before failing; it is `[ \t]+` and `(\S.*)` now. The quote author pattern wrapped a lazy group around an optional group — the quadratic case — and is an index split on the first separator now. The third regex, the bold/italic pass, is deliberately left alone. Rewriting it with a negated class removes the backtracking but breaks nesting: `**bold *and italic* here**` renders as `*<em>bold </em>and italic<em> here</em>*`. The input is Markdown from an authenticated admin, never a visitor, so the worst case is an author slowing down their own page. The comment in the code says so. Not addressed: 5 js/insufficient-password-hash alerts. They ask for a slow KDF where the code uses SHA-256/HMAC — correct in general, but the admin password comes from an environment variable and is never stored, so a stronger KDF protects nothing that is not already in plaintext in the environment. 399 unit tests pass (18 new), build and tsc clean. * fix(journal): split the quote author by scanning, not by pattern Cleaning up after myself. #439 replaced the quote author regex `/^(.*?)(?:\s+--\s+(.+))?$/` — a lazy group around an optional one, the quadratic case — with `/\s+--\s+/`, and CodeQL promptly flagged the replacement for the same reason. One reported pattern traded for another. splitQuoteAuthor() scans for the first `--` that has whitespace on both sides. Linear, and it needs no reasoning about the regex engine at all. Behaviour is identical to the original regex, checked case by case against it: separator, no separator, several separators, tabs, wide gaps, `a--b` without spaces, leading and trailing separators, empty string. All nine are covered by tests, plus one asserting it stays fast on a 50k whitespace run. * security(admin): derive the session signing key with scrypt getSigningKey() ran the admin password through a single SHA-256 digest. It is key derivation rather than password storage, so it was never a stored-hash problem — but if the derived key ever leaked, one fast hash makes recovering the password by brute force cheap. CodeQL flags it as js/insufficient-password-hash and, for this particular alert, has a point. scrypt now. Two details that matter: The salt has to be stable. A random salt would produce a different key on every call and invalidate every session; it is derived from AUTH_SECRET, which is deployment-specific. Verified across separate processes: same inputs produce a verifying token, so a restart or redeploy does not log everyone out. The result is cached for the process lifetime. scrypt is deliberately slow and getSigningKey() runs on every admin request — deriving per call would add ~24ms to each one. The cache key is a digest of secret plus password, so a rotation misses the cache and derives again, and no extra plaintext copy of the password is kept around. Measured: first derivation 24ms, subsequent calls 0.12ms. Password change and secret change both invalidate an existing token, checked in separate processes. Note the one-time effect: existing admin sessions are invalidated by the change in derivation, so everyone logs in once more. * security(admin): key the signing-key cache on its inputs, not a digest #441 removed the SHA-256 digest of the admin password from the key derivation and introduced a new one three lines above it, as the cache key. Same rule, same file: CodeQL reported it immediately. The comment justifying it was wrong too. It claimed no second plaintext copy of the password was retained, while building the digest input allocates exactly that in order to hash it. The cache now holds the two input strings and compares them directly. They are the same objects the env and install caches already hold, so nothing extra is retained, and no fast hash of the password exists in memory for the life of the process. Re-verified after the change, in separate processes: a token from one process verifies in another with the same inputs, a changed password or secret rejects it, first derivation 24ms, cached calls 0.001ms. That leaves scrypt as the only place the password is hashed here. The two HMACs further down operate on the derived key and on token data, not on the password; the constant-time comparison in verifyAdminPassword is the previously dismissed one. --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
2026-08-14 16:55:07 +02:00
<span className={`mini-specimen type-${info.type}`}>Aa</span>
<span className="mini-line" />
</div>
<div className="mini-grid">
release: v0.11.0 — journal fixes, admin URLs, design system cleanup (#432) * fix(screenshots): sharp-Typen fuer 0.34 und 0.35 gleichzeitig (#410) sharp 0.35 ist von `export =` auf ESM umgestellt: der Modul-Namespace ist nicht mehr aufrufbar, die Factory sitzt unter .default. Der Type-Check brach damit in scripts/screenshots.ts weg, sobald der Next-Bump (#402) sharp von 0.34.5 auf 0.35.3 mitzieht -- sharp ist hier keine deklarierte Dependency, sondern kommt ueber Next mit. Die Form wird jetzt aus dem installierten Paket abgeleitet statt festgeschrieben, zur Laufzeit wie im Typ. Geprueft mit beiden Versionen: tsc laeuft mit 0.34.5 und mit 0.35.3 fehlerfrei durch. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(deps): bump the nextjs group across 1 directory with 2 updates (#402) Bumps the nextjs group with 2 updates in the / directory: [next](https://github.com/vercel/next.js) and [eslint-config-next](https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next). Updates `next` from 16.2.12 to 16.3.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/compare/v16.2.12...v16.3.0) Updates `eslint-config-next` from 16.2.12 to 16.3.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/commits/v16.3.0/packages/eslint-config-next) --- updated-dependencies: - dependency-name: eslint-config-next dependency-version: 16.3.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: nextjs - dependency-name: next dependency-version: 16.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nextjs ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps-dev): bump prettier from 3.8.3 to 3.9.6 (#405) Bumps [prettier](https://github.com/prettier/prettier) from 3.8.3 to 3.9.6. - [Release notes](https://github.com/prettier/prettier/releases) - [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md) - [Commits](https://github.com/prettier/prettier/compare/3.8.3...3.9.6) --- updated-dependencies: - dependency-name: prettier dependency-version: 3.9.6 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * docs(changelog): Unreleased-Sektion fuer die Bumps nach v0.10.0 (#413) Die Dependency-PRs sind nach dem Release auf dev gelandet, teils auch auf main. Ohne Eintrag waeren sie beim naechsten Release unsichtbar -- inklusive Next 16.3.0, das CVE-2025-13465 mitbringt. Ausserdem im 0.10.0-Abschnitt nachgetragen, dass der Trivy-Scan bis #409 nie gelaufen ist. Der Fix steckt im Tag v0.10.0, fehlte aber in der Aufzaehlung -- und "Images werden bei jedem Publish gescannt" stand im Changelog, waehrend der Job im Action-Setup abbrach. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(gallery): per-album sort order, independent of Immich (#408) (#414) Album order was dictated entirely by Immich: getAlbum() sorted by the album's own asc/desc flag, so a Folio album always mirrored the archive. A curated series has a narrative order that has nothing to do with capture time, and changing the Immich album's sort to fit the website changes it for the archive too. Adds an optional per-album `sort` in gallery.yaml, editable in /admin, defaulting to today's behaviour so every existing config is unchanged: immich (default) | newest | oldest | filename | manual `manual` is a pinned *prefix*: `assetOrder` lists only the photos placed by hand, everything else follows in the album's Immich order. A full permutation of a 2,000-photo album would be ~80 KB of UUIDs in a file that is rewritten and copied to content/.backups/ on every admin save. It also makes drift fall out for free — photos removed in Immich never match, new ones land in the tail rather than being hidden. Sorting is applied after the cache read, not before the cache write, so the LRU keeps one canonical Immich-ordered copy per album. That avoids putting the mode in the cache key, lets a config change take effect without depending on invalidation, and keeps the stale-serving path correct. cache.get() returns the stored object by reference, so withSort() returns a shallow clone with a new array — sorting in place would reorder the shared entry, and under request coalescing every concurrent caller would be sorting the same array. Also fixes a prerequisite bug: /api/admin/albums/[albumId]/assets read album.assets from GET /albums/:id, which Immich 3.x no longer populates (lib/immich.ts:507). The hero picker's "This Album" tab returned nothing and threw outright when the key was absent. It now goes through the client's paginated metadata search, with ?types=all to opt videos in for the reorder editor. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): drop decorative emoji from the sort select labels (#415) An <option> cannot contain markup, so the SVG set in Icons is not reachable there — but a decorative emoji is not a substitute for it. Plain text instead; the album card badge already uses a real icon. The remaining emoji in the admin panel (asset picker tabs, section headings, layout picker options) predate this branch and are left for a separate cleanup. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): replace emoji icons with the shared SVG icon set (#416) The admin panel mixed two icon conventions: inline SVGs from `Icons.tsx` in most components, and decorative emoji in the asset picker and a few PageBuilder labels. Emoji render inconsistently across platforms, ignore the accent colour, and cannot inherit the `.svg-icon` sizing rules. - Icons.tsx: add `IconStar` (filled — it marks a state, not an action) and `IconImage`. - AssetPicker: the three tab labels and the favourite tile badge now use IconFolder / IconStar / IconImage. - PageBuilder: the "Standalone Albums" and "Subpages" headings use the icon set instead of an emoji. - PageBuilder: the layout picker drops its emoji for plain text. An <option> cannot contain markup, so an SVG is impossible there and a decorative glyph is not a substitute. - admin.css: align icon and label in the picker tabs, and swap the favourite badge's text-shadow for drop-shadow, which is what applies to an inline SVG. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): fold PageBuilder's local icons into the shared Icons module (#418) * refactor(admin): fold PageBuilder's local icons into the shared module PageBuilder.tsx carried its own `Icons` object duplicating most of the glyphs already exported by Icons.tsx, with hardcoded sizes and slightly divergent paths. Migrate all 32 call sites to the shared module and delete the local object. Five glyphs had no counterpart and are added to Icons.tsx as 1:1 ports of the local paths: IconX, IconPlus, IconHome, IconCopy, IconImage. The local ExternalLink and Check are dropped rather than ported — both had zero call sites. Two glyphs change shape slightly, which is the point of consolidating: the shared IconCamera includes the viewfinder bump the local copy omitted, and drag handles now use IconGripVertical. IconGripVertical uses the module's square 24x24 viewBox, so `.svg-drag` goes from 12x18 to 18x18 — the old non-square box would letterbox the glyph down to 12x12 and shrink the handle. * fix(admin): resolve icon-module integration after #416 Merging dev brought in #416, which added a second IconImage to Icons.tsx and two <Icons.Camera>/<Icons.Folder> section headers that reference the local Icons object this PR removes. Git merged both cleanly but the result did not type-check. - drop the duplicate IconImage (both copies were byte-identical) - point the two section headers at the imported IconCamera/IconFolder - refresh the SORT_LABELS comment: the icon set is imported now, not declared below --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> * fix(config): allow an empty gallery, guard against a double /api suffix (#421) An empty gallery is now a valid, rendered state instead of a throw: deriveGallery() no longer requires at least one album or subpage, so a deployment with no albums yet renders a bare homepage the owner can fill in via /admin. getConfig() also stops appending /api to an Immich URL that already ends in it, which previously produced .../api/api and broke every upstream request. Includes a restore of the per-album sort test cases, which the branch had lost by being cut before #408/#414. * feat(admin): favicon upload, served from the content volume (#422) Adds a bundled default favicon, an upload widget in admin Settings > General, and a route that serves the icon from the writable content/ volume with a fallback to the bundled default. Raster uploads (PNG/ICO/JPEG) are wrapped in an SVG container; the response carries its own CSP so an uploaded SVG cannot execute script on the origin. The GET route revalidates with an ETag instead of caching immutably, so a newly uploaded icon shows up immediately. Uploads are written via temp file + rename, and a Reset button restores the bundled default. * ci: flag unformatted files in a PR, without blocking it (#424) Prettier is configured as an error rule in eslint.config.mjs but has never run in CI, so part of the tree predates it. A final CI step now diffs against the PR base, runs prettier --list-different over the changed files, and emits a warning annotation per offender plus a job summary. Advisory by design: it never fails the job. Blocking would turn a PR red for merely touching a file that was already unformatted, and normalising the tree in one commit would wreck git blame and conflict with the PRs in flight. Requires fetch-depth: 0, since diffing against the base needs its history. * feat(install): first-run wizard gated by a one-time setup token (#419) Adds /install, a four-step first-run wizard: connect to Immich, optionally pick albums, name the site, finish. It verifies the credentials against the Immich server before writing anything, then writes gallery.yaml, settings.yaml and a content/install.json carrying the Immich credentials and a generated site secret. install.json exists because a running process cannot pick up new env vars — the wizard has to write configuration that takes effect without a restart. getInstallCredentials() merges it under the real environment, so env vars always win and rotation stays a matter of setting one. Both the page and the API routes are gated by a one-time setup token printed to the server log, so a deployment that is reachable before gallery.yaml exists cannot be configured by whoever finds it first. The token is stored in content/.setup-token (0600) rather than a module variable: Next.js bundles the page and each route handler separately, so a module-level token left the page and the API disagreeing inside one process and the wizard stuck on step 1. It is removed once the install completes. The admin password is stored as an scrypt hash using the scheme lib/auth.ts already applies to album passwords; a plaintext ADMIN_PASSWORD env var keeps working. * docs: document the setup wizard, fix the read-only content mount (#425) Quick Start now leads with the /install wizard, with the hand-written YAML route kept alongside it, and a First-Run Setup section covers the setup token, the files the wizard writes, and env-var precedence. Two corrections: both Docker examples mounted content/ as :ro, which silently breaks the wizard, the admin panel and the backup rotation alike — docs/admin-panel.md already said so and the README contradicted it. And nothing documented that content/install.json holds the Immich API key, so a backup of content/ is a backup of credentials. Also adds a Contributors section crediting the people whose work is in the project. * feat(admin): floating save bar pinned to the bottom of the viewport (#426) The save bar was the first, static element inside .admin-main. Since the document itself scrolls, it left the viewport as soon as you scrolled down — editing a subpage section or a settings block far below gave no visible dirty hint and no reachable save button. Replace it with a bottom-pinned floating bar shared by both editors. It only mounts while there is something to act on (unsaved changes, an in-flight save, or a result message), so it never covers content while idle. The success message clears after 5s, which hides the bar again. - new SaveBar component, replacing the duplicated markup in PageBuilder and SettingsEditor - adopt the previously unused .floating-save-bar CSS: slide-in keyframes (carrying translateX(-50%)), dirty border, wrap/gap, mobile variant and a prefers-reduced-motion opt-out; z-index 900 keeps it below modals - .admin-main gains bottom padding so the bar never covers page content - drop the now-unreachable idle hints: the ⌘S hint becomes a button title, the Live Sync note becomes a static line above the settings layout - header "Site" link now bypasses the cache (/?fresh=1), so the preview stays reachable when the bar is hidden Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(admin): themed listbox for the album sort control (#427) The per-album "Photo order" control was a native <select>. Because an <option> cannot contain markup, its choices could not use the admin panel's currentColor SVG set — the reason #415 had to fall back to plain text after dropping the emoji labels. Adds a Listbox component implementing the ARIA combobox/listbox pattern, so options can render a glyph beside their label: - DOM focus stays on the trigger button; the active option is announced through aria-activedescendant, keeping focus management to one element - Keyboard: arrows (clamped at the ends, like a native select), Home/End, Enter/Space to commit, Escape to cancel, Tab commits and moves on, and prefix type-ahead with a repeat-key cycle - Outside dismissal on pointerdown, so a press starting outside closes the popup before the click retargets The sort options now carry an icon each: calendar, arrow-down, arrow-up, an A→Z marker, and the drag glyph for manual — matching the badge the album card already shows. SORT_LABELS stays plain text because the badge feeds it to a title attribute. Closes #417 Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(git): ignore generated design handoff folders * fix(admin): stop the album sort dropdown clipping, and simplify the panel (#428) * fix(admin): render listbox popup in a portal so it escapes modal clipping The sort control's popup was position:absolute inside three clipping ancestors (.album-drawer overflow:hidden > .album-drawer-body overflow-y:auto > .modal-right-column overflow-y:auto), so it was cut off at the bottom of the Edit Album Details modal. z-index could not help: clipping happens before stacking. It also always hung below the trigger, with no flip. Portal the popup to document.body and position it from the trigger's viewport rect, flipping above when there is more room there and capping max-height to the space available so it scrolls internally rather than overflowing. It is dismissed on scroll and resize, since the anchor is only measured on open. The outside-pointerdown handler now also treats the popup as inside; without that the portalled list counts as outside, and a click on an option would close it before the selection commits. * refactor(admin): single-column album details panel The left column spent 1.2fr on a cover thumbnail and three stat rows, two of which (Status, Custom Hero) only restated the form fields opposite them, while the form itself was squeezed into 1.8fr behind a second nested scroller. Stack the drawer in one column instead: cover as a banner, then the form at full width, with the UUID moved into the footer. The body is now the only scroll container, which also removes one of the ancestors that was clipping the sort popup. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> * fix(admin): give the portalled listbox its theme back, lock the page behind modals (#429) Two defects in the album editor. The sort listbox popup painted transparent. Every --admin-* variable is scoped to .admin-layout, and since the popup moved into document.body it sits outside that subtree, so background/border/text all resolved to nothing. It now carries its own copy of the palette in both colour schemes, plus the font it no longer inherits. Scrolling inside a modal also moved the page behind it. No admin modal ever locked body scroll: the overlay covers the page but does not absorb wheel events, so a scroll starting on the backdrop — or continuing past the end of the modal's own scroller — reaches the document. overscroll-behavior cannot cover that case on its own, because it only applies to scroll containers and the backdrop is not one. useScrollLock freezes body while a modal is open and compensates for the width the scrollbar gives up, so nothing shifts underneath. Each lock restores the inline value it found, which makes nesting work without a counter — a picker opened from the drawer restores the drawer's hidden state instead of clearing it. Applied to both drawers and all four picker modals, which share the defect. overscroll-behavior: contain on the scrollers stops the chaining they can handle themselves. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com> * fix(security): allow unsafe-eval in CSP script-src during dev mode * feat(journal): add Journal Studio with split-screen editor, live preview and dedicated routes * fix(build): separate client parser from server journal-service and fix build type errors * fix(journal): Fotos rendern, Layout und Lightbox-Steuerung korrigieren Fünf unabhängige Fehler in der öffentlichen Journal- und Essay-Ansicht: * Foto-Blöcke wurden nie angezeigt. EssayView löst ein Foto über PhotoItem.id auf, und das sind verschlüsselte Tokens — die Blöcke aus dem Markdown tragen aber rohe Asset-UUIDs. Jede Zuordnung lief ins Leere, und nicht auflösbare Blöcke werden still verworfen. Die IDs werden jetzt serverseitig übersetzt; damit verschwinden nebenbei die rohen UUIDs aus dem Client-Payload, die dort laut Projektregel nie auftauchen dürfen. Nicht auflösbare Referenzen werden geloggt. * Überschriften standen weiter links als der Fließtext. Jeder Block hatte einzeln `max-width: 68ch`, und `ch` ist relativ zur Schrift des Elements — die Serif-Überschrift ergab eine breitere Spalte. Ersetzt durch eine gemeinsame, font-unabhängige `--essay-measure`. * Fullbleed-Fotos bluteten nur nach links aus: `.essay-figure` ist `width: 100%`, wodurch die Box überbestimmt ist und der negative rechte Margin verworfen wird. * Foto-Paare stellten beide Bilder gleich breit dar, wodurch ein Hochformat neben einem Querformat doppelt so hoch wurde. Jetzt eine Justified-Reihe: Breite proportional zum Seitenverhältnis, dadurch exakt gleiche Höhen ohne Beschnitt. * Die Lightbox hatte im Journal keine Tastatursteuerung und keine Scroll-Sperre — beides lag in PhotoGrid, also nur im Album-Raster. Verlagert in die Lightbox selbst, der doppelte Handler in PhotoGrid entfernt (sonst wäre pro Pfeildruck zwei Bilder weitergesprungen). Zusätzlich sind Proofing-Herzen und das EXIF-Panel im redaktionellen Modus abschaltbar und im Journal aus: Client-Proofing ist ein Übergabe-Workflow für Alben, keine Funktion einer Reportage. Auf der Übersicht wurde der Untertitel doppelt gerendert, weil extractExcerpt() auf ihn zurückfällt. * feat(admin): eigene URLs für alle Bereiche und überarbeiteter Journal Studio Das Panel war eine einzige Client-Komponente, die ihre Tabs über useState umschaltet: keine Route pro Bereich, kein Deep-Link, kein Zurück-Button, und nach jedem Reload landete man wieder auf "Pages". Auch der Journal-Editor hatte keine eigene URL. Jetzt sieben echte Routen (/admin, /admin/pages, /admin/journal, /admin/journal/<slug>, /admin/settings, /admin/settings/<section>, /admin/analytics). Die Shell mit Auth-Prüfung und Kopfzeile sitzt im Layout und umschließt children — so bleibt die Session-Prüfung über Routenwechsel montiert, statt bei jedem Tab-Wechsel neu zu laufen und den Spinner aufblitzen zu lassen. Unbekannte Settings-Sections fallen auf General zurück. Im selben Zug der Journal Studio, der die Routing-Änderung ohnehin berührt: * Alle Eingabefelder nutzten die Klasse `admin-input`, die in keinem CSS definiert war — sie fielen auf Browser-Defaults zurück. Jetzt gestylt, gescoped, damit der generische Name nicht ins übrige Panel leckt. * Der Split View ist per Divider verschiebbar (Maus, Tastatur, Doppelklick zum Zurücksetzen), Breite in localStorage. * Das Studio bricht aus der 1120px-Spalte aus, die Preview hat Platz. * Die Preview zeigte für jedes Foto fest 3:2 und log damit über das Layout der veröffentlichten Seite; die echten Verhältnisse werden jetzt an den Thumbnails gemessen. * Blöcke mit alten positionsbasierten Foto-Referenzen werden markiert — die lassen sich auf einer eigenständigen Journal-Seite nicht auflösen und verschwanden bisher stillschweigend. * Blocktyp-Chips als gemeinsame Komponente, monochrom und per Icon unterschieden statt in einer eigenen Blau/Lila/Orange-Palette, die sonst nirgends im Panel vorkommt. * Emojis raus, SVG-Icons rein. * fix(admin): Designsystem-Lücken im Panel schließen Eine systematische Suche nach Klassen, die im TSX benutzt, aber in keinem CSS definiert sind, hat vier Stellen mit demselben Muster gefunden: * `admin-btn-secondary` und `admin-btn-danger` existierten nicht. Sämtliche Löschen-Buttons sahen aus wie normale Buttons — keine Warnwirkung. Als `.admin-btn.admin-btn-danger` geschrieben, weil die Varianten mit den Größenklassen kombiniert werden, die weiter unten ihren eigenen Hintergrund setzen. * `page-progress-fill` fehlte: die Balken im Analytics-Panel waren leere Rinnen, der Wert unsichtbar. Ebenso `analytics-empty` und `admin-loading-container`. * `subpage-drawer-section`, `subpage-drawer-title-group` und `input-with-icon` im PageBuilder waren wirkungslos und teils mit Inline-Styles notdürftig kompensiert. * `grid-card-preview` fehlte, wodurch alle Layout-Vorschauen auf Höhe null kollabierten. Nur "Showcase" war sichtbar — und das aus Versehen, weil sein Tile `hero-tile` hieß und damit die `aspect-ratio` einer fremden PageBuilder-Klasse erbte. Umbenannt. Dazu die Theme-Vorschauen, die praktisch identisch aussahen: alle sieben zeigten dieselben drei quadratischen Kacheln, einziger Unterschied war die Hintergrundfarbe. Sie spiegeln jetzt die echten Preset-Daten aus lib/config/theme.ts — Schriftcharakter, Eckradius, Rasterdichte, Passepartout bzw. Schatten. Die Kopfzeile richtet sich an einer gemeinsamen Steuerhöhe aus. Der "Site"-Link war höher als die Buttons daneben: `.admin-btn` hatte keine explizite line-height, und <button> bekommt box-sizing: border-box vom Browser, <a> nicht. Die Statusanzeige setzte weder Schriftfamilie noch -größe und fiel auf den Browser-Default zurück — sie war nie Teil des Designsystems. Jetzt gleiche Höhe und Typografie, Pillenform als Zustandsanzeige, Trenner zur Aktionsgruppe. Das dauerhafte Pulsieren des grünen Punkts entfällt; Animation bleibt den Zuständen vorbehalten, die Aufmerksamkeit brauchen. Restliche Emojis durch SVG-Icons ersetzt. * feat(admin): add scroll-to-top toggle and SVG arrow The back-to-top button was always on and drew its arrow with the ↑ text character. Add a `scrollToTop` setting (General section in the admin panel, defaults to on so existing sites are unaffected) and replace the glyph with a stroked SVG that inherits currentColor across all presets. Scroll handling is now rAF-throttled, and prefers-reduced-motion turns off both the hover lift and the smooth scroll. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * security(journal): escape author HTML instead of filtering it CodeQL flags 26 high-severity alerts on the release PR; the bulk of them point at sanitizeHtml(), a denylist of three regexes whose output goes into dangerouslySetInnerHTML. I reproduced the bypasses before changing anything — all four pass the old filter: <img src=x onerror=alert(1)> unquoted handler, regex wants quotes <img src=x onerror='alert(1)'> single quotes, same reason <svg onload=alert(1)> not a <script> tag javasjavascript:cript:alert(1) one-pass replace, the rest recombines Plus an attribute breakout in the link renderer, which interpolated the URL into href="${url}" unescaped: [x](" onmouseover=alert(1) x=") -> <a href="" onmouseover=alert(1" ...> Replaced with escaping. Every `&<>"'` in author text becomes an entity before any markdown rule runs, so the only tags in the output are the ones renderInlineMarkdown builds itself and a URL cannot leave its attribute. Link schemes are now an allowlist (http, https, mailto, tel, relative, anchor); anything else renders as plain text. The serializer needed decodeHtmlEntities to match: without it a save would write `&lt;` into the Markdown file and the next parse would escape the `&` again, corrupting the text further on every round trip. A test covers parse -> serialize -> parse stability. Two existing tests asserted the old behaviour and were rewritten rather than deleted: one expected the script tag to be *removed* from the output, the other expected the substring "onerror" to be absent. Both now assert the property that matters — that no tag can form — because `onerror` surviving as inert text is fine. Exploitation required admin access either way: journal and essay text comes from the studio or from content/*.md. This removes the weakness, it does not close an open door. * fix(journal): contain file paths, fix frontmatter escaping, defuse two regexes Follow-up to the CodeQL findings on release PR #432. I went through all 23 alerts individually; this addresses the ones that are worth addressing and documents the ones that are not. Path containment (12 alerts, all false positives). Every path built from a slug goes through isValidSlug(), a strict `/^[a-zA-Z0-9_-]+$/` allowlist — verified against `../../etc/passwd`, `foo/../../bar`, `a/b`, `..` and friends, all rejected. CodeQL cannot see it because the check lives in another module. Added a containedPath() helper that resolves the path and refuses anything landing outside the content directory: a second lock on a door that was already locked, and a barrier the analysis can follow. Also removed the dead `slug.endsWith('.md')` branches — isValidSlug rejects dots, so they could never be taken. Frontmatter escaping (1 alert, a real bug). The serializer escaped `"` but not `\`, and the parser never unescaped anything. A title containing either character gained a backslash on every save/load cycle: Path C:\Users "quoted" -> Path C:\\Users \"quoted\" -> ... Escaping now covers the backslash first and the parser undoes both. A round trip test covers quotes, backslashes, colons and apostrophes. Two of three ReDoS regexes (2 alerts). The heading pattern had `\s+` next to `(.+)`, which overlap, so the engine tried every split of the whitespace run before failing; it is `[ \t]+` and `(\S.*)` now. The quote author pattern wrapped a lazy group around an optional group — the quadratic case — and is an index split on the first separator now. The third regex, the bold/italic pass, is deliberately left alone. Rewriting it with a negated class removes the backtracking but breaks nesting: `**bold *and italic* here**` renders as `*<em>bold </em>and italic<em> here</em>*`. The input is Markdown from an authenticated admin, never a visitor, so the worst case is an author slowing down their own page. The comment in the code says so. Not addressed: 5 js/insufficient-password-hash alerts. They ask for a slow KDF where the code uses SHA-256/HMAC — correct in general, but the admin password comes from an environment variable and is never stored, so a stronger KDF protects nothing that is not already in plaintext in the environment. 399 unit tests pass (18 new), build and tsc clean. * fix(journal): split the quote author by scanning, not by pattern Cleaning up after myself. #439 replaced the quote author regex `/^(.*?)(?:\s+--\s+(.+))?$/` — a lazy group around an optional one, the quadratic case — with `/\s+--\s+/`, and CodeQL promptly flagged the replacement for the same reason. One reported pattern traded for another. splitQuoteAuthor() scans for the first `--` that has whitespace on both sides. Linear, and it needs no reasoning about the regex engine at all. Behaviour is identical to the original regex, checked case by case against it: separator, no separator, several separators, tabs, wide gaps, `a--b` without spaces, leading and trailing separators, empty string. All nine are covered by tests, plus one asserting it stays fast on a 50k whitespace run. * security(admin): derive the session signing key with scrypt getSigningKey() ran the admin password through a single SHA-256 digest. It is key derivation rather than password storage, so it was never a stored-hash problem — but if the derived key ever leaked, one fast hash makes recovering the password by brute force cheap. CodeQL flags it as js/insufficient-password-hash and, for this particular alert, has a point. scrypt now. Two details that matter: The salt has to be stable. A random salt would produce a different key on every call and invalidate every session; it is derived from AUTH_SECRET, which is deployment-specific. Verified across separate processes: same inputs produce a verifying token, so a restart or redeploy does not log everyone out. The result is cached for the process lifetime. scrypt is deliberately slow and getSigningKey() runs on every admin request — deriving per call would add ~24ms to each one. The cache key is a digest of secret plus password, so a rotation misses the cache and derives again, and no extra plaintext copy of the password is kept around. Measured: first derivation 24ms, subsequent calls 0.12ms. Password change and secret change both invalidate an existing token, checked in separate processes. Note the one-time effect: existing admin sessions are invalidated by the change in derivation, so everyone logs in once more. * security(admin): key the signing-key cache on its inputs, not a digest #441 removed the SHA-256 digest of the admin password from the key derivation and introduced a new one three lines above it, as the cache key. Same rule, same file: CodeQL reported it immediately. The comment justifying it was wrong too. It claimed no second plaintext copy of the password was retained, while building the digest input allocates exactly that in order to hash it. The cache now holds the two input strings and compares them directly. They are the same objects the env and install caches already hold, so nothing extra is retained, and no fast hash of the password exists in memory for the life of the process. Re-verified after the change, in separate processes: a token from one process verifies in another with the same inputs, a changed password or secret rejects it, first derivation 24ms, cached calls 0.001ms. That leaves scrypt as the only place the password is hashed here. The two HMACs further down operate on the derived key and on token data, not on the password; the constant-time comparison in verifyAdminPassword is the previously dismissed one. --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
2026-08-14 16:55:07 +02:00
<div className="mini-tile" />
<div className="mini-tile" />
<div className="mini-tile" />
</div>
</div>
<div className="preset-card-info">
<span className="preset-card-name">{info.label}</span>
<span className="preset-card-desc">{info.desc}</span>
release: v0.11.0 — journal fixes, admin URLs, design system cleanup (#432) * fix(screenshots): sharp-Typen fuer 0.34 und 0.35 gleichzeitig (#410) sharp 0.35 ist von `export =` auf ESM umgestellt: der Modul-Namespace ist nicht mehr aufrufbar, die Factory sitzt unter .default. Der Type-Check brach damit in scripts/screenshots.ts weg, sobald der Next-Bump (#402) sharp von 0.34.5 auf 0.35.3 mitzieht -- sharp ist hier keine deklarierte Dependency, sondern kommt ueber Next mit. Die Form wird jetzt aus dem installierten Paket abgeleitet statt festgeschrieben, zur Laufzeit wie im Typ. Geprueft mit beiden Versionen: tsc laeuft mit 0.34.5 und mit 0.35.3 fehlerfrei durch. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(deps): bump the nextjs group across 1 directory with 2 updates (#402) Bumps the nextjs group with 2 updates in the / directory: [next](https://github.com/vercel/next.js) and [eslint-config-next](https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next). Updates `next` from 16.2.12 to 16.3.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/compare/v16.2.12...v16.3.0) Updates `eslint-config-next` from 16.2.12 to 16.3.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/commits/v16.3.0/packages/eslint-config-next) --- updated-dependencies: - dependency-name: eslint-config-next dependency-version: 16.3.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: nextjs - dependency-name: next dependency-version: 16.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nextjs ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps-dev): bump prettier from 3.8.3 to 3.9.6 (#405) Bumps [prettier](https://github.com/prettier/prettier) from 3.8.3 to 3.9.6. - [Release notes](https://github.com/prettier/prettier/releases) - [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md) - [Commits](https://github.com/prettier/prettier/compare/3.8.3...3.9.6) --- updated-dependencies: - dependency-name: prettier dependency-version: 3.9.6 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * docs(changelog): Unreleased-Sektion fuer die Bumps nach v0.10.0 (#413) Die Dependency-PRs sind nach dem Release auf dev gelandet, teils auch auf main. Ohne Eintrag waeren sie beim naechsten Release unsichtbar -- inklusive Next 16.3.0, das CVE-2025-13465 mitbringt. Ausserdem im 0.10.0-Abschnitt nachgetragen, dass der Trivy-Scan bis #409 nie gelaufen ist. Der Fix steckt im Tag v0.10.0, fehlte aber in der Aufzaehlung -- und "Images werden bei jedem Publish gescannt" stand im Changelog, waehrend der Job im Action-Setup abbrach. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(gallery): per-album sort order, independent of Immich (#408) (#414) Album order was dictated entirely by Immich: getAlbum() sorted by the album's own asc/desc flag, so a Folio album always mirrored the archive. A curated series has a narrative order that has nothing to do with capture time, and changing the Immich album's sort to fit the website changes it for the archive too. Adds an optional per-album `sort` in gallery.yaml, editable in /admin, defaulting to today's behaviour so every existing config is unchanged: immich (default) | newest | oldest | filename | manual `manual` is a pinned *prefix*: `assetOrder` lists only the photos placed by hand, everything else follows in the album's Immich order. A full permutation of a 2,000-photo album would be ~80 KB of UUIDs in a file that is rewritten and copied to content/.backups/ on every admin save. It also makes drift fall out for free — photos removed in Immich never match, new ones land in the tail rather than being hidden. Sorting is applied after the cache read, not before the cache write, so the LRU keeps one canonical Immich-ordered copy per album. That avoids putting the mode in the cache key, lets a config change take effect without depending on invalidation, and keeps the stale-serving path correct. cache.get() returns the stored object by reference, so withSort() returns a shallow clone with a new array — sorting in place would reorder the shared entry, and under request coalescing every concurrent caller would be sorting the same array. Also fixes a prerequisite bug: /api/admin/albums/[albumId]/assets read album.assets from GET /albums/:id, which Immich 3.x no longer populates (lib/immich.ts:507). The hero picker's "This Album" tab returned nothing and threw outright when the key was absent. It now goes through the client's paginated metadata search, with ?types=all to opt videos in for the reorder editor. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): drop decorative emoji from the sort select labels (#415) An <option> cannot contain markup, so the SVG set in Icons is not reachable there — but a decorative emoji is not a substitute for it. Plain text instead; the album card badge already uses a real icon. The remaining emoji in the admin panel (asset picker tabs, section headings, layout picker options) predate this branch and are left for a separate cleanup. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): replace emoji icons with the shared SVG icon set (#416) The admin panel mixed two icon conventions: inline SVGs from `Icons.tsx` in most components, and decorative emoji in the asset picker and a few PageBuilder labels. Emoji render inconsistently across platforms, ignore the accent colour, and cannot inherit the `.svg-icon` sizing rules. - Icons.tsx: add `IconStar` (filled — it marks a state, not an action) and `IconImage`. - AssetPicker: the three tab labels and the favourite tile badge now use IconFolder / IconStar / IconImage. - PageBuilder: the "Standalone Albums" and "Subpages" headings use the icon set instead of an emoji. - PageBuilder: the layout picker drops its emoji for plain text. An <option> cannot contain markup, so an SVG is impossible there and a decorative glyph is not a substitute. - admin.css: align icon and label in the picker tabs, and swap the favourite badge's text-shadow for drop-shadow, which is what applies to an inline SVG. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): fold PageBuilder's local icons into the shared Icons module (#418) * refactor(admin): fold PageBuilder's local icons into the shared module PageBuilder.tsx carried its own `Icons` object duplicating most of the glyphs already exported by Icons.tsx, with hardcoded sizes and slightly divergent paths. Migrate all 32 call sites to the shared module and delete the local object. Five glyphs had no counterpart and are added to Icons.tsx as 1:1 ports of the local paths: IconX, IconPlus, IconHome, IconCopy, IconImage. The local ExternalLink and Check are dropped rather than ported — both had zero call sites. Two glyphs change shape slightly, which is the point of consolidating: the shared IconCamera includes the viewfinder bump the local copy omitted, and drag handles now use IconGripVertical. IconGripVertical uses the module's square 24x24 viewBox, so `.svg-drag` goes from 12x18 to 18x18 — the old non-square box would letterbox the glyph down to 12x12 and shrink the handle. * fix(admin): resolve icon-module integration after #416 Merging dev brought in #416, which added a second IconImage to Icons.tsx and two <Icons.Camera>/<Icons.Folder> section headers that reference the local Icons object this PR removes. Git merged both cleanly but the result did not type-check. - drop the duplicate IconImage (both copies were byte-identical) - point the two section headers at the imported IconCamera/IconFolder - refresh the SORT_LABELS comment: the icon set is imported now, not declared below --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> * fix(config): allow an empty gallery, guard against a double /api suffix (#421) An empty gallery is now a valid, rendered state instead of a throw: deriveGallery() no longer requires at least one album or subpage, so a deployment with no albums yet renders a bare homepage the owner can fill in via /admin. getConfig() also stops appending /api to an Immich URL that already ends in it, which previously produced .../api/api and broke every upstream request. Includes a restore of the per-album sort test cases, which the branch had lost by being cut before #408/#414. * feat(admin): favicon upload, served from the content volume (#422) Adds a bundled default favicon, an upload widget in admin Settings > General, and a route that serves the icon from the writable content/ volume with a fallback to the bundled default. Raster uploads (PNG/ICO/JPEG) are wrapped in an SVG container; the response carries its own CSP so an uploaded SVG cannot execute script on the origin. The GET route revalidates with an ETag instead of caching immutably, so a newly uploaded icon shows up immediately. Uploads are written via temp file + rename, and a Reset button restores the bundled default. * ci: flag unformatted files in a PR, without blocking it (#424) Prettier is configured as an error rule in eslint.config.mjs but has never run in CI, so part of the tree predates it. A final CI step now diffs against the PR base, runs prettier --list-different over the changed files, and emits a warning annotation per offender plus a job summary. Advisory by design: it never fails the job. Blocking would turn a PR red for merely touching a file that was already unformatted, and normalising the tree in one commit would wreck git blame and conflict with the PRs in flight. Requires fetch-depth: 0, since diffing against the base needs its history. * feat(install): first-run wizard gated by a one-time setup token (#419) Adds /install, a four-step first-run wizard: connect to Immich, optionally pick albums, name the site, finish. It verifies the credentials against the Immich server before writing anything, then writes gallery.yaml, settings.yaml and a content/install.json carrying the Immich credentials and a generated site secret. install.json exists because a running process cannot pick up new env vars — the wizard has to write configuration that takes effect without a restart. getInstallCredentials() merges it under the real environment, so env vars always win and rotation stays a matter of setting one. Both the page and the API routes are gated by a one-time setup token printed to the server log, so a deployment that is reachable before gallery.yaml exists cannot be configured by whoever finds it first. The token is stored in content/.setup-token (0600) rather than a module variable: Next.js bundles the page and each route handler separately, so a module-level token left the page and the API disagreeing inside one process and the wizard stuck on step 1. It is removed once the install completes. The admin password is stored as an scrypt hash using the scheme lib/auth.ts already applies to album passwords; a plaintext ADMIN_PASSWORD env var keeps working. * docs: document the setup wizard, fix the read-only content mount (#425) Quick Start now leads with the /install wizard, with the hand-written YAML route kept alongside it, and a First-Run Setup section covers the setup token, the files the wizard writes, and env-var precedence. Two corrections: both Docker examples mounted content/ as :ro, which silently breaks the wizard, the admin panel and the backup rotation alike — docs/admin-panel.md already said so and the README contradicted it. And nothing documented that content/install.json holds the Immich API key, so a backup of content/ is a backup of credentials. Also adds a Contributors section crediting the people whose work is in the project. * feat(admin): floating save bar pinned to the bottom of the viewport (#426) The save bar was the first, static element inside .admin-main. Since the document itself scrolls, it left the viewport as soon as you scrolled down — editing a subpage section or a settings block far below gave no visible dirty hint and no reachable save button. Replace it with a bottom-pinned floating bar shared by both editors. It only mounts while there is something to act on (unsaved changes, an in-flight save, or a result message), so it never covers content while idle. The success message clears after 5s, which hides the bar again. - new SaveBar component, replacing the duplicated markup in PageBuilder and SettingsEditor - adopt the previously unused .floating-save-bar CSS: slide-in keyframes (carrying translateX(-50%)), dirty border, wrap/gap, mobile variant and a prefers-reduced-motion opt-out; z-index 900 keeps it below modals - .admin-main gains bottom padding so the bar never covers page content - drop the now-unreachable idle hints: the ⌘S hint becomes a button title, the Live Sync note becomes a static line above the settings layout - header "Site" link now bypasses the cache (/?fresh=1), so the preview stays reachable when the bar is hidden Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(admin): themed listbox for the album sort control (#427) The per-album "Photo order" control was a native <select>. Because an <option> cannot contain markup, its choices could not use the admin panel's currentColor SVG set — the reason #415 had to fall back to plain text after dropping the emoji labels. Adds a Listbox component implementing the ARIA combobox/listbox pattern, so options can render a glyph beside their label: - DOM focus stays on the trigger button; the active option is announced through aria-activedescendant, keeping focus management to one element - Keyboard: arrows (clamped at the ends, like a native select), Home/End, Enter/Space to commit, Escape to cancel, Tab commits and moves on, and prefix type-ahead with a repeat-key cycle - Outside dismissal on pointerdown, so a press starting outside closes the popup before the click retargets The sort options now carry an icon each: calendar, arrow-down, arrow-up, an A→Z marker, and the drag glyph for manual — matching the badge the album card already shows. SORT_LABELS stays plain text because the badge feeds it to a title attribute. Closes #417 Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(git): ignore generated design handoff folders * fix(admin): stop the album sort dropdown clipping, and simplify the panel (#428) * fix(admin): render listbox popup in a portal so it escapes modal clipping The sort control's popup was position:absolute inside three clipping ancestors (.album-drawer overflow:hidden > .album-drawer-body overflow-y:auto > .modal-right-column overflow-y:auto), so it was cut off at the bottom of the Edit Album Details modal. z-index could not help: clipping happens before stacking. It also always hung below the trigger, with no flip. Portal the popup to document.body and position it from the trigger's viewport rect, flipping above when there is more room there and capping max-height to the space available so it scrolls internally rather than overflowing. It is dismissed on scroll and resize, since the anchor is only measured on open. The outside-pointerdown handler now also treats the popup as inside; without that the portalled list counts as outside, and a click on an option would close it before the selection commits. * refactor(admin): single-column album details panel The left column spent 1.2fr on a cover thumbnail and three stat rows, two of which (Status, Custom Hero) only restated the form fields opposite them, while the form itself was squeezed into 1.8fr behind a second nested scroller. Stack the drawer in one column instead: cover as a banner, then the form at full width, with the UUID moved into the footer. The body is now the only scroll container, which also removes one of the ancestors that was clipping the sort popup. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> * fix(admin): give the portalled listbox its theme back, lock the page behind modals (#429) Two defects in the album editor. The sort listbox popup painted transparent. Every --admin-* variable is scoped to .admin-layout, and since the popup moved into document.body it sits outside that subtree, so background/border/text all resolved to nothing. It now carries its own copy of the palette in both colour schemes, plus the font it no longer inherits. Scrolling inside a modal also moved the page behind it. No admin modal ever locked body scroll: the overlay covers the page but does not absorb wheel events, so a scroll starting on the backdrop — or continuing past the end of the modal's own scroller — reaches the document. overscroll-behavior cannot cover that case on its own, because it only applies to scroll containers and the backdrop is not one. useScrollLock freezes body while a modal is open and compensates for the width the scrollbar gives up, so nothing shifts underneath. Each lock restores the inline value it found, which makes nesting work without a counter — a picker opened from the drawer restores the drawer's hidden state instead of clearing it. Applied to both drawers and all four picker modals, which share the defect. overscroll-behavior: contain on the scrollers stops the chaining they can handle themselves. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com> * fix(security): allow unsafe-eval in CSP script-src during dev mode * feat(journal): add Journal Studio with split-screen editor, live preview and dedicated routes * fix(build): separate client parser from server journal-service and fix build type errors * fix(journal): Fotos rendern, Layout und Lightbox-Steuerung korrigieren Fünf unabhängige Fehler in der öffentlichen Journal- und Essay-Ansicht: * Foto-Blöcke wurden nie angezeigt. EssayView löst ein Foto über PhotoItem.id auf, und das sind verschlüsselte Tokens — die Blöcke aus dem Markdown tragen aber rohe Asset-UUIDs. Jede Zuordnung lief ins Leere, und nicht auflösbare Blöcke werden still verworfen. Die IDs werden jetzt serverseitig übersetzt; damit verschwinden nebenbei die rohen UUIDs aus dem Client-Payload, die dort laut Projektregel nie auftauchen dürfen. Nicht auflösbare Referenzen werden geloggt. * Überschriften standen weiter links als der Fließtext. Jeder Block hatte einzeln `max-width: 68ch`, und `ch` ist relativ zur Schrift des Elements — die Serif-Überschrift ergab eine breitere Spalte. Ersetzt durch eine gemeinsame, font-unabhängige `--essay-measure`. * Fullbleed-Fotos bluteten nur nach links aus: `.essay-figure` ist `width: 100%`, wodurch die Box überbestimmt ist und der negative rechte Margin verworfen wird. * Foto-Paare stellten beide Bilder gleich breit dar, wodurch ein Hochformat neben einem Querformat doppelt so hoch wurde. Jetzt eine Justified-Reihe: Breite proportional zum Seitenverhältnis, dadurch exakt gleiche Höhen ohne Beschnitt. * Die Lightbox hatte im Journal keine Tastatursteuerung und keine Scroll-Sperre — beides lag in PhotoGrid, also nur im Album-Raster. Verlagert in die Lightbox selbst, der doppelte Handler in PhotoGrid entfernt (sonst wäre pro Pfeildruck zwei Bilder weitergesprungen). Zusätzlich sind Proofing-Herzen und das EXIF-Panel im redaktionellen Modus abschaltbar und im Journal aus: Client-Proofing ist ein Übergabe-Workflow für Alben, keine Funktion einer Reportage. Auf der Übersicht wurde der Untertitel doppelt gerendert, weil extractExcerpt() auf ihn zurückfällt. * feat(admin): eigene URLs für alle Bereiche und überarbeiteter Journal Studio Das Panel war eine einzige Client-Komponente, die ihre Tabs über useState umschaltet: keine Route pro Bereich, kein Deep-Link, kein Zurück-Button, und nach jedem Reload landete man wieder auf "Pages". Auch der Journal-Editor hatte keine eigene URL. Jetzt sieben echte Routen (/admin, /admin/pages, /admin/journal, /admin/journal/<slug>, /admin/settings, /admin/settings/<section>, /admin/analytics). Die Shell mit Auth-Prüfung und Kopfzeile sitzt im Layout und umschließt children — so bleibt die Session-Prüfung über Routenwechsel montiert, statt bei jedem Tab-Wechsel neu zu laufen und den Spinner aufblitzen zu lassen. Unbekannte Settings-Sections fallen auf General zurück. Im selben Zug der Journal Studio, der die Routing-Änderung ohnehin berührt: * Alle Eingabefelder nutzten die Klasse `admin-input`, die in keinem CSS definiert war — sie fielen auf Browser-Defaults zurück. Jetzt gestylt, gescoped, damit der generische Name nicht ins übrige Panel leckt. * Der Split View ist per Divider verschiebbar (Maus, Tastatur, Doppelklick zum Zurücksetzen), Breite in localStorage. * Das Studio bricht aus der 1120px-Spalte aus, die Preview hat Platz. * Die Preview zeigte für jedes Foto fest 3:2 und log damit über das Layout der veröffentlichten Seite; die echten Verhältnisse werden jetzt an den Thumbnails gemessen. * Blöcke mit alten positionsbasierten Foto-Referenzen werden markiert — die lassen sich auf einer eigenständigen Journal-Seite nicht auflösen und verschwanden bisher stillschweigend. * Blocktyp-Chips als gemeinsame Komponente, monochrom und per Icon unterschieden statt in einer eigenen Blau/Lila/Orange-Palette, die sonst nirgends im Panel vorkommt. * Emojis raus, SVG-Icons rein. * fix(admin): Designsystem-Lücken im Panel schließen Eine systematische Suche nach Klassen, die im TSX benutzt, aber in keinem CSS definiert sind, hat vier Stellen mit demselben Muster gefunden: * `admin-btn-secondary` und `admin-btn-danger` existierten nicht. Sämtliche Löschen-Buttons sahen aus wie normale Buttons — keine Warnwirkung. Als `.admin-btn.admin-btn-danger` geschrieben, weil die Varianten mit den Größenklassen kombiniert werden, die weiter unten ihren eigenen Hintergrund setzen. * `page-progress-fill` fehlte: die Balken im Analytics-Panel waren leere Rinnen, der Wert unsichtbar. Ebenso `analytics-empty` und `admin-loading-container`. * `subpage-drawer-section`, `subpage-drawer-title-group` und `input-with-icon` im PageBuilder waren wirkungslos und teils mit Inline-Styles notdürftig kompensiert. * `grid-card-preview` fehlte, wodurch alle Layout-Vorschauen auf Höhe null kollabierten. Nur "Showcase" war sichtbar — und das aus Versehen, weil sein Tile `hero-tile` hieß und damit die `aspect-ratio` einer fremden PageBuilder-Klasse erbte. Umbenannt. Dazu die Theme-Vorschauen, die praktisch identisch aussahen: alle sieben zeigten dieselben drei quadratischen Kacheln, einziger Unterschied war die Hintergrundfarbe. Sie spiegeln jetzt die echten Preset-Daten aus lib/config/theme.ts — Schriftcharakter, Eckradius, Rasterdichte, Passepartout bzw. Schatten. Die Kopfzeile richtet sich an einer gemeinsamen Steuerhöhe aus. Der "Site"-Link war höher als die Buttons daneben: `.admin-btn` hatte keine explizite line-height, und <button> bekommt box-sizing: border-box vom Browser, <a> nicht. Die Statusanzeige setzte weder Schriftfamilie noch -größe und fiel auf den Browser-Default zurück — sie war nie Teil des Designsystems. Jetzt gleiche Höhe und Typografie, Pillenform als Zustandsanzeige, Trenner zur Aktionsgruppe. Das dauerhafte Pulsieren des grünen Punkts entfällt; Animation bleibt den Zuständen vorbehalten, die Aufmerksamkeit brauchen. Restliche Emojis durch SVG-Icons ersetzt. * feat(admin): add scroll-to-top toggle and SVG arrow The back-to-top button was always on and drew its arrow with the ↑ text character. Add a `scrollToTop` setting (General section in the admin panel, defaults to on so existing sites are unaffected) and replace the glyph with a stroked SVG that inherits currentColor across all presets. Scroll handling is now rAF-throttled, and prefers-reduced-motion turns off both the hover lift and the smooth scroll. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * security(journal): escape author HTML instead of filtering it CodeQL flags 26 high-severity alerts on the release PR; the bulk of them point at sanitizeHtml(), a denylist of three regexes whose output goes into dangerouslySetInnerHTML. I reproduced the bypasses before changing anything — all four pass the old filter: <img src=x onerror=alert(1)> unquoted handler, regex wants quotes <img src=x onerror='alert(1)'> single quotes, same reason <svg onload=alert(1)> not a <script> tag javasjavascript:cript:alert(1) one-pass replace, the rest recombines Plus an attribute breakout in the link renderer, which interpolated the URL into href="${url}" unescaped: [x](" onmouseover=alert(1) x=") -> <a href="" onmouseover=alert(1" ...> Replaced with escaping. Every `&<>"'` in author text becomes an entity before any markdown rule runs, so the only tags in the output are the ones renderInlineMarkdown builds itself and a URL cannot leave its attribute. Link schemes are now an allowlist (http, https, mailto, tel, relative, anchor); anything else renders as plain text. The serializer needed decodeHtmlEntities to match: without it a save would write `&lt;` into the Markdown file and the next parse would escape the `&` again, corrupting the text further on every round trip. A test covers parse -> serialize -> parse stability. Two existing tests asserted the old behaviour and were rewritten rather than deleted: one expected the script tag to be *removed* from the output, the other expected the substring "onerror" to be absent. Both now assert the property that matters — that no tag can form — because `onerror` surviving as inert text is fine. Exploitation required admin access either way: journal and essay text comes from the studio or from content/*.md. This removes the weakness, it does not close an open door. * fix(journal): contain file paths, fix frontmatter escaping, defuse two regexes Follow-up to the CodeQL findings on release PR #432. I went through all 23 alerts individually; this addresses the ones that are worth addressing and documents the ones that are not. Path containment (12 alerts, all false positives). Every path built from a slug goes through isValidSlug(), a strict `/^[a-zA-Z0-9_-]+$/` allowlist — verified against `../../etc/passwd`, `foo/../../bar`, `a/b`, `..` and friends, all rejected. CodeQL cannot see it because the check lives in another module. Added a containedPath() helper that resolves the path and refuses anything landing outside the content directory: a second lock on a door that was already locked, and a barrier the analysis can follow. Also removed the dead `slug.endsWith('.md')` branches — isValidSlug rejects dots, so they could never be taken. Frontmatter escaping (1 alert, a real bug). The serializer escaped `"` but not `\`, and the parser never unescaped anything. A title containing either character gained a backslash on every save/load cycle: Path C:\Users "quoted" -> Path C:\\Users \"quoted\" -> ... Escaping now covers the backslash first and the parser undoes both. A round trip test covers quotes, backslashes, colons and apostrophes. Two of three ReDoS regexes (2 alerts). The heading pattern had `\s+` next to `(.+)`, which overlap, so the engine tried every split of the whitespace run before failing; it is `[ \t]+` and `(\S.*)` now. The quote author pattern wrapped a lazy group around an optional group — the quadratic case — and is an index split on the first separator now. The third regex, the bold/italic pass, is deliberately left alone. Rewriting it with a negated class removes the backtracking but breaks nesting: `**bold *and italic* here**` renders as `*<em>bold </em>and italic<em> here</em>*`. The input is Markdown from an authenticated admin, never a visitor, so the worst case is an author slowing down their own page. The comment in the code says so. Not addressed: 5 js/insufficient-password-hash alerts. They ask for a slow KDF where the code uses SHA-256/HMAC — correct in general, but the admin password comes from an environment variable and is never stored, so a stronger KDF protects nothing that is not already in plaintext in the environment. 399 unit tests pass (18 new), build and tsc clean. * fix(journal): split the quote author by scanning, not by pattern Cleaning up after myself. #439 replaced the quote author regex `/^(.*?)(?:\s+--\s+(.+))?$/` — a lazy group around an optional one, the quadratic case — with `/\s+--\s+/`, and CodeQL promptly flagged the replacement for the same reason. One reported pattern traded for another. splitQuoteAuthor() scans for the first `--` that has whitespace on both sides. Linear, and it needs no reasoning about the regex engine at all. Behaviour is identical to the original regex, checked case by case against it: separator, no separator, several separators, tabs, wide gaps, `a--b` without spaces, leading and trailing separators, empty string. All nine are covered by tests, plus one asserting it stays fast on a 50k whitespace run. * security(admin): derive the session signing key with scrypt getSigningKey() ran the admin password through a single SHA-256 digest. It is key derivation rather than password storage, so it was never a stored-hash problem — but if the derived key ever leaked, one fast hash makes recovering the password by brute force cheap. CodeQL flags it as js/insufficient-password-hash and, for this particular alert, has a point. scrypt now. Two details that matter: The salt has to be stable. A random salt would produce a different key on every call and invalidate every session; it is derived from AUTH_SECRET, which is deployment-specific. Verified across separate processes: same inputs produce a verifying token, so a restart or redeploy does not log everyone out. The result is cached for the process lifetime. scrypt is deliberately slow and getSigningKey() runs on every admin request — deriving per call would add ~24ms to each one. The cache key is a digest of secret plus password, so a rotation misses the cache and derives again, and no extra plaintext copy of the password is kept around. Measured: first derivation 24ms, subsequent calls 0.12ms. Password change and secret change both invalidate an existing token, checked in separate processes. Note the one-time effect: existing admin sessions are invalidated by the change in derivation, so everyone logs in once more. * security(admin): key the signing-key cache on its inputs, not a digest #441 removed the SHA-256 digest of the admin password from the key derivation and introduced a new one three lines above it, as the cache key. Same rule, same file: CodeQL reported it immediately. The comment justifying it was wrong too. It claimed no second plaintext copy of the password was retained, while building the digest input allocates exactly that in order to hash it. The cache now holds the two input strings and compares them directly. They are the same objects the env and install caches already hold, so nothing extra is retained, and no fast hash of the password exists in memory for the life of the process. Re-verified after the change, in separate processes: a token from one process verifies in another with the same inputs, a changed password or secret rejects it, first derivation 24ms, cached calls 0.001ms. That leaves scrypt as the only place the password is hashed here. The two HMACs further down operate on the derived key and on token data, not on the password; the constant-time comparison in verifyAdminPassword is the previously dismissed one. --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
2026-08-14 16:55:07 +02:00
<span className="preset-card-specs">
{info.font} &middot; radius {info.radius} &middot; {info.frame}
</span>
</div>
</button>
);
})}
</div>
</div>
security: add Trivy container scan to Docker publish workflow (#399) * feat(admin): add backup manager UI with 1-click restore * feat(admin): collapse older backup entries by default * fix(theme): isolate admin layout, instant DOM theme updates, and add Light/Dark mode toggle * feat(admin): replace text controls for Photo Frame and Hero Style with visual preview cards * fix(admin): define missing CSS rules for button system (.btn, .preset-btn) * feat(admin): redesign theme settings with segmented mode toggle, accent color swatches, and custom iOS-style toggle cards * feat(admin): upgrade all settings tabs with visual grid previews, Google SEO snippet preview, and toggle cards * feat(admin): overhaul Pages Builder UX with slide-over drawer, card hover badges, real-time search, and floating save bar * fix(admin): remove leftover dangling syntax snippet in PageBuilder.tsx * fix(admin): add position: relative to subpage-tile so hover overlay is contained inside the tile * style(admin): replace all emojis with clean Leica-style vector SVG icons * fix(types): extend IconProps with SVGProps to allow style prop on Leica SVG icons * feat(admin): add subpage live-preview, privacy analytics, and asset protection settings * fix(typecheck): fix AlbumEntry property access in subpage drawer preview mode * fix(types): fix ImmichAlbumInfo property names thumbnailAssetId and albumName in PageBuilder.tsx * fix(types): add protection and watermark optional properties to AppConfig interface * feat(settings): add toggle for disabling analytics tracking (defaults to enabled) * feat(ux): show status banner when analytics tracking is disabled + add live sync indicator * feat(watermark): render customizable watermark overlay on Lightbox images + rename section to Portfolio Features & Modules * fix(types): import type LightboxWatermark in PhotoGrid.tsx * fix(types): destructure watermark prop in PhotoGrid function signature * feat(seo): add configurable subpage title template and metadata descriptions * feat(seo): add generateMetadata to about page for title template support * feat(proofing): add client proofing, favorites selection, compact URL bitmasking, and export modal * feat(essay): add Photo Essay storytelling mode with RSC markdown parser and fullbleed/pair layouts * feat(subpages): add page enabled toggle to deactivate subpages without deleting them * feat(admin): add visual essay block builder for photo essay storytelling pages * security: add Trivy container scan to Docker publish workflow Scans the built image for CRITICAL/HIGH CVEs on every release and uploads results to the GitHub Security tab. Non-blocking for now (exit-code 0) so releases aren't gated on findings. Also documents the scan and existing Dependabot coverage in the README. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-08-07 11:08:04 +02:00
<div className="admin-field">
security: add Trivy container scan to Docker publish workflow (#399) * feat(admin): add backup manager UI with 1-click restore * feat(admin): collapse older backup entries by default * fix(theme): isolate admin layout, instant DOM theme updates, and add Light/Dark mode toggle * feat(admin): replace text controls for Photo Frame and Hero Style with visual preview cards * fix(admin): define missing CSS rules for button system (.btn, .preset-btn) * feat(admin): redesign theme settings with segmented mode toggle, accent color swatches, and custom iOS-style toggle cards * feat(admin): upgrade all settings tabs with visual grid previews, Google SEO snippet preview, and toggle cards * feat(admin): overhaul Pages Builder UX with slide-over drawer, card hover badges, real-time search, and floating save bar * fix(admin): remove leftover dangling syntax snippet in PageBuilder.tsx * fix(admin): add position: relative to subpage-tile so hover overlay is contained inside the tile * style(admin): replace all emojis with clean Leica-style vector SVG icons * fix(types): extend IconProps with SVGProps to allow style prop on Leica SVG icons * feat(admin): add subpage live-preview, privacy analytics, and asset protection settings * fix(typecheck): fix AlbumEntry property access in subpage drawer preview mode * fix(types): fix ImmichAlbumInfo property names thumbnailAssetId and albumName in PageBuilder.tsx * fix(types): add protection and watermark optional properties to AppConfig interface * feat(settings): add toggle for disabling analytics tracking (defaults to enabled) * feat(ux): show status banner when analytics tracking is disabled + add live sync indicator * feat(watermark): render customizable watermark overlay on Lightbox images + rename section to Portfolio Features & Modules * fix(types): import type LightboxWatermark in PhotoGrid.tsx * fix(types): destructure watermark prop in PhotoGrid function signature * feat(seo): add configurable subpage title template and metadata descriptions * feat(seo): add generateMetadata to about page for title template support * feat(proofing): add client proofing, favorites selection, compact URL bitmasking, and export modal * feat(essay): add Photo Essay storytelling mode with RSC markdown parser and fullbleed/pair layouts * feat(subpages): add page enabled toggle to deactivate subpages without deleting them * feat(admin): add visual essay block builder for photo essay storytelling pages * security: add Trivy container scan to Docker publish workflow Scans the built image for CRITICAL/HIGH CVEs on every release and uploads results to the GitHub Security tab. Non-blocking for now (exit-code 0) so releases aren't gated on findings. Also documents the scan and existing Dependabot coverage in the README. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-08-07 11:08:04 +02:00
<label>Color Mode</label>
release: v0.11.0 (#459) Ships `dev` as **v0.11.0**. `main` contains nothing that `dev` does not, so this is a clean sync. ## Headline changes since v0.10.0 - **Journal & Journal Studio** — photo essays at `/journal`, split-screen block editor with live preview, drafts, per-entry passwords, cover images - **First-run setup wizard at `/install`** — configure a fresh deployment from the browser; credentials are verified against Immich before anything is written, and the wizard is gated by a one-time token - **About page editor and toggle** in the admin panel - **Per-album photo order** independent of Immich, with a drag & drop editor - **Custom favicon upload** - **Experimental portfolio features** — justified grid, `cover` hero, unlisted subpages, per-album grid overrides, cover focal points, external nav links - **Security** — asset tokens length-capped before decoding (#423), journal author markdown escaped rather than filtered, journal file paths contained, admin session key derived with scrypt (#432), Next.js 16.3.0 for CVE-2025-13465 - **Fixed** — client proofing honours its own configuration again (#454); journal photo rendering (#432) Full detail in [CHANGELOG.md](CHANGELOG.md#0110--2026-08-15). ## Verified `npx tsc --noEmit` clean · `npx vitest run` 435 tests pass · `npm run build` succeeds · lint 0 errors · `prettier --check` clean · local `docker build` of the release tree. ## After merge Tag `v0.11.0` on `main` and publish the release — that triggers `docker-publish.yml`, which pushes the image and moves `latest`. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
2026-08-15 09:09:18 +02:00
<p
style={{
fontSize: '0.78rem',
color: 'var(--admin-text-muted)',
margin: '0.25rem 0 0.6rem',
lineHeight: '1.4',
}}
>
Presets like <strong>Editorial</strong>, <strong>Minimal</strong> &amp;{' '}
<strong>Classic</strong> feature warm light/cream backgrounds in Light Mode and
charcoal in Dark Mode.
security: add Trivy container scan to Docker publish workflow (#399) * feat(admin): add backup manager UI with 1-click restore * feat(admin): collapse older backup entries by default * fix(theme): isolate admin layout, instant DOM theme updates, and add Light/Dark mode toggle * feat(admin): replace text controls for Photo Frame and Hero Style with visual preview cards * fix(admin): define missing CSS rules for button system (.btn, .preset-btn) * feat(admin): redesign theme settings with segmented mode toggle, accent color swatches, and custom iOS-style toggle cards * feat(admin): upgrade all settings tabs with visual grid previews, Google SEO snippet preview, and toggle cards * feat(admin): overhaul Pages Builder UX with slide-over drawer, card hover badges, real-time search, and floating save bar * fix(admin): remove leftover dangling syntax snippet in PageBuilder.tsx * fix(admin): add position: relative to subpage-tile so hover overlay is contained inside the tile * style(admin): replace all emojis with clean Leica-style vector SVG icons * fix(types): extend IconProps with SVGProps to allow style prop on Leica SVG icons * feat(admin): add subpage live-preview, privacy analytics, and asset protection settings * fix(typecheck): fix AlbumEntry property access in subpage drawer preview mode * fix(types): fix ImmichAlbumInfo property names thumbnailAssetId and albumName in PageBuilder.tsx * fix(types): add protection and watermark optional properties to AppConfig interface * feat(settings): add toggle for disabling analytics tracking (defaults to enabled) * feat(ux): show status banner when analytics tracking is disabled + add live sync indicator * feat(watermark): render customizable watermark overlay on Lightbox images + rename section to Portfolio Features & Modules * fix(types): import type LightboxWatermark in PhotoGrid.tsx * fix(types): destructure watermark prop in PhotoGrid function signature * feat(seo): add configurable subpage title template and metadata descriptions * feat(seo): add generateMetadata to about page for title template support * feat(proofing): add client proofing, favorites selection, compact URL bitmasking, and export modal * feat(essay): add Photo Essay storytelling mode with RSC markdown parser and fullbleed/pair layouts * feat(subpages): add page enabled toggle to deactivate subpages without deleting them * feat(admin): add visual essay block builder for photo essay storytelling pages * security: add Trivy container scan to Docker publish workflow Scans the built image for CRITICAL/HIGH CVEs on every release and uploads results to the GitHub Security tab. Non-blocking for now (exit-code 0) so releases aren't gated on findings. Also documents the scan and existing Dependabot coverage in the README. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-08-07 11:08:04 +02:00
</p>
<div className="segmented-control">
<button
type="button"
className={`segment-btn ${currentMode === 'light' ? 'active' : ''}`}
onClick={() => toggleMode('light')}
>
<Icons.IconSun size={14} /> Light Mode (Cream / Beige)
</button>
<button
type="button"
className={`segment-btn ${currentMode === 'dark' ? 'active' : ''}`}
onClick={() => toggleMode('dark')}
>
<Icons.IconMoon size={14} /> Dark Mode (Charcoal)
</button>
</div>
</div>
security: add Trivy container scan to Docker publish workflow (#399) * feat(admin): add backup manager UI with 1-click restore * feat(admin): collapse older backup entries by default * fix(theme): isolate admin layout, instant DOM theme updates, and add Light/Dark mode toggle * feat(admin): replace text controls for Photo Frame and Hero Style with visual preview cards * fix(admin): define missing CSS rules for button system (.btn, .preset-btn) * feat(admin): redesign theme settings with segmented mode toggle, accent color swatches, and custom iOS-style toggle cards * feat(admin): upgrade all settings tabs with visual grid previews, Google SEO snippet preview, and toggle cards * feat(admin): overhaul Pages Builder UX with slide-over drawer, card hover badges, real-time search, and floating save bar * fix(admin): remove leftover dangling syntax snippet in PageBuilder.tsx * fix(admin): add position: relative to subpage-tile so hover overlay is contained inside the tile * style(admin): replace all emojis with clean Leica-style vector SVG icons * fix(types): extend IconProps with SVGProps to allow style prop on Leica SVG icons * feat(admin): add subpage live-preview, privacy analytics, and asset protection settings * fix(typecheck): fix AlbumEntry property access in subpage drawer preview mode * fix(types): fix ImmichAlbumInfo property names thumbnailAssetId and albumName in PageBuilder.tsx * fix(types): add protection and watermark optional properties to AppConfig interface * feat(settings): add toggle for disabling analytics tracking (defaults to enabled) * feat(ux): show status banner when analytics tracking is disabled + add live sync indicator * feat(watermark): render customizable watermark overlay on Lightbox images + rename section to Portfolio Features & Modules * fix(types): import type LightboxWatermark in PhotoGrid.tsx * fix(types): destructure watermark prop in PhotoGrid function signature * feat(seo): add configurable subpage title template and metadata descriptions * feat(seo): add generateMetadata to about page for title template support * feat(proofing): add client proofing, favorites selection, compact URL bitmasking, and export modal * feat(essay): add Photo Essay storytelling mode with RSC markdown parser and fullbleed/pair layouts * feat(subpages): add page enabled toggle to deactivate subpages without deleting them * feat(admin): add visual essay block builder for photo essay storytelling pages * security: add Trivy container scan to Docker publish workflow Scans the built image for CRITICAL/HIGH CVEs on every release and uploads results to the GitHub Security tab. Non-blocking for now (exit-code 0) so releases aren't gated on findings. Also documents the scan and existing Dependabot coverage in the README. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-08-07 11:08:04 +02:00
<div className="settings-section-divider" />
<div className="settings-section-header">
release: v0.11.0 (#459) Ships `dev` as **v0.11.0**. `main` contains nothing that `dev` does not, so this is a clean sync. ## Headline changes since v0.10.0 - **Journal & Journal Studio** — photo essays at `/journal`, split-screen block editor with live preview, drafts, per-entry passwords, cover images - **First-run setup wizard at `/install`** — configure a fresh deployment from the browser; credentials are verified against Immich before anything is written, and the wizard is gated by a one-time token - **About page editor and toggle** in the admin panel - **Per-album photo order** independent of Immich, with a drag & drop editor - **Custom favicon upload** - **Experimental portfolio features** — justified grid, `cover` hero, unlisted subpages, per-album grid overrides, cover focal points, external nav links - **Security** — asset tokens length-capped before decoding (#423), journal author markdown escaped rather than filtered, journal file paths contained, admin session key derived with scrypt (#432), Next.js 16.3.0 for CVE-2025-13465 - **Fixed** — client proofing honours its own configuration again (#454); journal photo rendering (#432) Full detail in [CHANGELOG.md](CHANGELOG.md#0110--2026-08-15). ## Verified `npx tsc --noEmit` clean · `npx vitest run` 435 tests pass · `npm run build` succeeds · lint 0 errors · `prettier --check` clean · local `docker build` of the release tree. ## After merge Tag `v0.11.0` on `main` and publish the release — that triggers `docker-publish.yml`, which pushes the image and moves `latest`. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
2026-08-15 09:09:18 +02:00
<h3>
<Icons.IconTarget size={18} /> Accent Color
</h3>
<p className="settings-section-sub">
Pick a primary accent color for links, buttons, and highlights.
</p>
security: add Trivy container scan to Docker publish workflow (#399) * feat(admin): add backup manager UI with 1-click restore * feat(admin): collapse older backup entries by default * fix(theme): isolate admin layout, instant DOM theme updates, and add Light/Dark mode toggle * feat(admin): replace text controls for Photo Frame and Hero Style with visual preview cards * fix(admin): define missing CSS rules for button system (.btn, .preset-btn) * feat(admin): redesign theme settings with segmented mode toggle, accent color swatches, and custom iOS-style toggle cards * feat(admin): upgrade all settings tabs with visual grid previews, Google SEO snippet preview, and toggle cards * feat(admin): overhaul Pages Builder UX with slide-over drawer, card hover badges, real-time search, and floating save bar * fix(admin): remove leftover dangling syntax snippet in PageBuilder.tsx * fix(admin): add position: relative to subpage-tile so hover overlay is contained inside the tile * style(admin): replace all emojis with clean Leica-style vector SVG icons * fix(types): extend IconProps with SVGProps to allow style prop on Leica SVG icons * feat(admin): add subpage live-preview, privacy analytics, and asset protection settings * fix(typecheck): fix AlbumEntry property access in subpage drawer preview mode * fix(types): fix ImmichAlbumInfo property names thumbnailAssetId and albumName in PageBuilder.tsx * fix(types): add protection and watermark optional properties to AppConfig interface * feat(settings): add toggle for disabling analytics tracking (defaults to enabled) * feat(ux): show status banner when analytics tracking is disabled + add live sync indicator * feat(watermark): render customizable watermark overlay on Lightbox images + rename section to Portfolio Features & Modules * fix(types): import type LightboxWatermark in PhotoGrid.tsx * fix(types): destructure watermark prop in PhotoGrid function signature * feat(seo): add configurable subpage title template and metadata descriptions * feat(seo): add generateMetadata to about page for title template support * feat(proofing): add client proofing, favorites selection, compact URL bitmasking, and export modal * feat(essay): add Photo Essay storytelling mode with RSC markdown parser and fullbleed/pair layouts * feat(subpages): add page enabled toggle to deactivate subpages without deleting them * feat(admin): add visual essay block builder for photo essay storytelling pages * security: add Trivy container scan to Docker publish workflow Scans the built image for CRITICAL/HIGH CVEs on every release and uploads results to the GitHub Security tab. Non-blocking for now (exit-code 0) so releases aren't gated on findings. Also documents the scan and existing Dependabot coverage in the README. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-08-07 11:08:04 +02:00
</div>
<div className="admin-field">
<div className="accent-picker-wrapper">
<div className="color-swatches-row">
{[
{ hex: '#e60012', name: 'Studio Red' },
{ hex: '#b89053', name: 'Editorial Gold' },
{ hex: '#10b981', name: 'Emerald' },
{ hex: '#3b82f6', name: 'Sapphire' },
{ hex: '#8b5cf6', name: 'Violet' },
{ hex: '#ffffff', name: 'Monochrome White' },
{ hex: '#000000', name: 'Obsidian Black' },
].map((swatch) => {
release: v0.11.0 (#459) Ships `dev` as **v0.11.0**. `main` contains nothing that `dev` does not, so this is a clean sync. ## Headline changes since v0.10.0 - **Journal & Journal Studio** — photo essays at `/journal`, split-screen block editor with live preview, drafts, per-entry passwords, cover images - **First-run setup wizard at `/install`** — configure a fresh deployment from the browser; credentials are verified against Immich before anything is written, and the wizard is gated by a one-time token - **About page editor and toggle** in the admin panel - **Per-album photo order** independent of Immich, with a drag & drop editor - **Custom favicon upload** - **Experimental portfolio features** — justified grid, `cover` hero, unlisted subpages, per-album grid overrides, cover focal points, external nav links - **Security** — asset tokens length-capped before decoding (#423), journal author markdown escaped rather than filtered, journal file paths contained, admin session key derived with scrypt (#432), Next.js 16.3.0 for CVE-2025-13465 - **Fixed** — client proofing honours its own configuration again (#454); journal photo rendering (#432) Full detail in [CHANGELOG.md](CHANGELOG.md#0110--2026-08-15). ## Verified `npx tsc --noEmit` clean · `npx vitest run` 435 tests pass · `npm run build` succeeds · lint 0 errors · `prettier --check` clean · local `docker build` of the release tree. ## After merge Tag `v0.11.0` on `main` and publish the release — that triggers `docker-publish.yml`, which pushes the image and moves `latest`. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
2026-08-15 09:09:18 +02:00
const isSelected =
(settings.theme?.accent || '#e60012').toLowerCase() ===
swatch.hex.toLowerCase();
security: add Trivy container scan to Docker publish workflow (#399) * feat(admin): add backup manager UI with 1-click restore * feat(admin): collapse older backup entries by default * fix(theme): isolate admin layout, instant DOM theme updates, and add Light/Dark mode toggle * feat(admin): replace text controls for Photo Frame and Hero Style with visual preview cards * fix(admin): define missing CSS rules for button system (.btn, .preset-btn) * feat(admin): redesign theme settings with segmented mode toggle, accent color swatches, and custom iOS-style toggle cards * feat(admin): upgrade all settings tabs with visual grid previews, Google SEO snippet preview, and toggle cards * feat(admin): overhaul Pages Builder UX with slide-over drawer, card hover badges, real-time search, and floating save bar * fix(admin): remove leftover dangling syntax snippet in PageBuilder.tsx * fix(admin): add position: relative to subpage-tile so hover overlay is contained inside the tile * style(admin): replace all emojis with clean Leica-style vector SVG icons * fix(types): extend IconProps with SVGProps to allow style prop on Leica SVG icons * feat(admin): add subpage live-preview, privacy analytics, and asset protection settings * fix(typecheck): fix AlbumEntry property access in subpage drawer preview mode * fix(types): fix ImmichAlbumInfo property names thumbnailAssetId and albumName in PageBuilder.tsx * fix(types): add protection and watermark optional properties to AppConfig interface * feat(settings): add toggle for disabling analytics tracking (defaults to enabled) * feat(ux): show status banner when analytics tracking is disabled + add live sync indicator * feat(watermark): render customizable watermark overlay on Lightbox images + rename section to Portfolio Features & Modules * fix(types): import type LightboxWatermark in PhotoGrid.tsx * fix(types): destructure watermark prop in PhotoGrid function signature * feat(seo): add configurable subpage title template and metadata descriptions * feat(seo): add generateMetadata to about page for title template support * feat(proofing): add client proofing, favorites selection, compact URL bitmasking, and export modal * feat(essay): add Photo Essay storytelling mode with RSC markdown parser and fullbleed/pair layouts * feat(subpages): add page enabled toggle to deactivate subpages without deleting them * feat(admin): add visual essay block builder for photo essay storytelling pages * security: add Trivy container scan to Docker publish workflow Scans the built image for CRITICAL/HIGH CVEs on every release and uploads results to the GitHub Security tab. Non-blocking for now (exit-code 0) so releases aren't gated on findings. Also documents the scan and existing Dependabot coverage in the README. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-08-07 11:08:04 +02:00
return (
<button
key={swatch.hex}
type="button"
className={`color-swatch-btn ${isSelected ? 'active' : ''}`}
style={{ backgroundColor: swatch.hex }}
onClick={() => update('theme.accent', swatch.hex)}
title={swatch.name}
/>
);
})}
</div>
<div className="color-field">
<input
type="color"
value={settings.theme?.accent || '#e60012'}
onChange={(e) => update('theme.accent', e.target.value)}
/>
<input
type="text"
value={settings.theme?.accent || ''}
onChange={(e) => update('theme.accent', e.target.value)}
placeholder="#e60012"
/>
</div>
</div>
</div>
<div className="settings-section-divider" />
<div className="settings-section-header">
release: v0.11.0 (#459) Ships `dev` as **v0.11.0**. `main` contains nothing that `dev` does not, so this is a clean sync. ## Headline changes since v0.10.0 - **Journal & Journal Studio** — photo essays at `/journal`, split-screen block editor with live preview, drafts, per-entry passwords, cover images - **First-run setup wizard at `/install`** — configure a fresh deployment from the browser; credentials are verified against Immich before anything is written, and the wizard is gated by a one-time token - **About page editor and toggle** in the admin panel - **Per-album photo order** independent of Immich, with a drag & drop editor - **Custom favicon upload** - **Experimental portfolio features** — justified grid, `cover` hero, unlisted subpages, per-album grid overrides, cover focal points, external nav links - **Security** — asset tokens length-capped before decoding (#423), journal author markdown escaped rather than filtered, journal file paths contained, admin session key derived with scrypt (#432), Next.js 16.3.0 for CVE-2025-13465 - **Fixed** — client proofing honours its own configuration again (#454); journal photo rendering (#432) Full detail in [CHANGELOG.md](CHANGELOG.md#0110--2026-08-15). ## Verified `npx tsc --noEmit` clean · `npx vitest run` 435 tests pass · `npm run build` succeeds · lint 0 errors · `prettier --check` clean · local `docker build` of the release tree. ## After merge Tag `v0.11.0` on `main` and publish the release — that triggers `docker-publish.yml`, which pushes the image and moves `latest`. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
2026-08-15 09:09:18 +02:00
<h3>
<Icons.IconFrame size={18} /> Photo Frame &amp; Layout
</h3>
<p className="settings-section-sub">
Customize image presentation borders and hero layouts.
</p>
security: add Trivy container scan to Docker publish workflow (#399) * feat(admin): add backup manager UI with 1-click restore * feat(admin): collapse older backup entries by default * fix(theme): isolate admin layout, instant DOM theme updates, and add Light/Dark mode toggle * feat(admin): replace text controls for Photo Frame and Hero Style with visual preview cards * fix(admin): define missing CSS rules for button system (.btn, .preset-btn) * feat(admin): redesign theme settings with segmented mode toggle, accent color swatches, and custom iOS-style toggle cards * feat(admin): upgrade all settings tabs with visual grid previews, Google SEO snippet preview, and toggle cards * feat(admin): overhaul Pages Builder UX with slide-over drawer, card hover badges, real-time search, and floating save bar * fix(admin): remove leftover dangling syntax snippet in PageBuilder.tsx * fix(admin): add position: relative to subpage-tile so hover overlay is contained inside the tile * style(admin): replace all emojis with clean Leica-style vector SVG icons * fix(types): extend IconProps with SVGProps to allow style prop on Leica SVG icons * feat(admin): add subpage live-preview, privacy analytics, and asset protection settings * fix(typecheck): fix AlbumEntry property access in subpage drawer preview mode * fix(types): fix ImmichAlbumInfo property names thumbnailAssetId and albumName in PageBuilder.tsx * fix(types): add protection and watermark optional properties to AppConfig interface * feat(settings): add toggle for disabling analytics tracking (defaults to enabled) * feat(ux): show status banner when analytics tracking is disabled + add live sync indicator * feat(watermark): render customizable watermark overlay on Lightbox images + rename section to Portfolio Features & Modules * fix(types): import type LightboxWatermark in PhotoGrid.tsx * fix(types): destructure watermark prop in PhotoGrid function signature * feat(seo): add configurable subpage title template and metadata descriptions * feat(seo): add generateMetadata to about page for title template support * feat(proofing): add client proofing, favorites selection, compact URL bitmasking, and export modal * feat(essay): add Photo Essay storytelling mode with RSC markdown parser and fullbleed/pair layouts * feat(subpages): add page enabled toggle to deactivate subpages without deleting them * feat(admin): add visual essay block builder for photo essay storytelling pages * security: add Trivy container scan to Docker publish workflow Scans the built image for CRITICAL/HIGH CVEs on every release and uploads results to the GitHub Security tab. Non-blocking for now (exit-code 0) so releases aren't gated on findings. Also documents the scan and existing Dependabot coverage in the README. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-08-07 11:08:04 +02:00
</div>
<div className="admin-field">
<label>Photo Frame</label>
security: add Trivy container scan to Docker publish workflow (#399) * feat(admin): add backup manager UI with 1-click restore * feat(admin): collapse older backup entries by default * fix(theme): isolate admin layout, instant DOM theme updates, and add Light/Dark mode toggle * feat(admin): replace text controls for Photo Frame and Hero Style with visual preview cards * fix(admin): define missing CSS rules for button system (.btn, .preset-btn) * feat(admin): redesign theme settings with segmented mode toggle, accent color swatches, and custom iOS-style toggle cards * feat(admin): upgrade all settings tabs with visual grid previews, Google SEO snippet preview, and toggle cards * feat(admin): overhaul Pages Builder UX with slide-over drawer, card hover badges, real-time search, and floating save bar * fix(admin): remove leftover dangling syntax snippet in PageBuilder.tsx * fix(admin): add position: relative to subpage-tile so hover overlay is contained inside the tile * style(admin): replace all emojis with clean Leica-style vector SVG icons * fix(types): extend IconProps with SVGProps to allow style prop on Leica SVG icons * feat(admin): add subpage live-preview, privacy analytics, and asset protection settings * fix(typecheck): fix AlbumEntry property access in subpage drawer preview mode * fix(types): fix ImmichAlbumInfo property names thumbnailAssetId and albumName in PageBuilder.tsx * fix(types): add protection and watermark optional properties to AppConfig interface * feat(settings): add toggle for disabling analytics tracking (defaults to enabled) * feat(ux): show status banner when analytics tracking is disabled + add live sync indicator * feat(watermark): render customizable watermark overlay on Lightbox images + rename section to Portfolio Features & Modules * fix(types): import type LightboxWatermark in PhotoGrid.tsx * fix(types): destructure watermark prop in PhotoGrid function signature * feat(seo): add configurable subpage title template and metadata descriptions * feat(seo): add generateMetadata to about page for title template support * feat(proofing): add client proofing, favorites selection, compact URL bitmasking, and export modal * feat(essay): add Photo Essay storytelling mode with RSC markdown parser and fullbleed/pair layouts * feat(subpages): add page enabled toggle to deactivate subpages without deleting them * feat(admin): add visual essay block builder for photo essay storytelling pages * security: add Trivy container scan to Docker publish workflow Scans the built image for CRITICAL/HIGH CVEs on every release and uploads results to the GitHub Security tab. Non-blocking for now (exit-code 0) so releases aren't gated on findings. Also documents the scan and existing Dependabot coverage in the README. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-08-07 11:08:04 +02:00
<div className="preset-card-grid">
{PHOTO_FRAMES.map((f) => {
const info = {
none: { label: 'None', desc: 'Flush image with crisp edges' },
release: v0.11.0 (#459) Ships `dev` as **v0.11.0**. `main` contains nothing that `dev` does not, so this is a clean sync. ## Headline changes since v0.10.0 - **Journal & Journal Studio** — photo essays at `/journal`, split-screen block editor with live preview, drafts, per-entry passwords, cover images - **First-run setup wizard at `/install`** — configure a fresh deployment from the browser; credentials are verified against Immich before anything is written, and the wizard is gated by a one-time token - **About page editor and toggle** in the admin panel - **Per-album photo order** independent of Immich, with a drag & drop editor - **Custom favicon upload** - **Experimental portfolio features** — justified grid, `cover` hero, unlisted subpages, per-album grid overrides, cover focal points, external nav links - **Security** — asset tokens length-capped before decoding (#423), journal author markdown escaped rather than filtered, journal file paths contained, admin session key derived with scrypt (#432), Next.js 16.3.0 for CVE-2025-13465 - **Fixed** — client proofing honours its own configuration again (#454); journal photo rendering (#432) Full detail in [CHANGELOG.md](CHANGELOG.md#0110--2026-08-15). ## Verified `npx tsc --noEmit` clean · `npx vitest run` 435 tests pass · `npm run build` succeeds · lint 0 errors · `prettier --check` clean · local `docker build` of the release tree. ## After merge Tag `v0.11.0` on `main` and publish the release — that triggers `docker-publish.yml`, which pushes the image and moves `latest`. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
2026-08-15 09:09:18 +02:00
passepartout: {
label: 'Passepartout',
desc: 'Classic gallery matting border',
},
security: add Trivy container scan to Docker publish workflow (#399) * feat(admin): add backup manager UI with 1-click restore * feat(admin): collapse older backup entries by default * fix(theme): isolate admin layout, instant DOM theme updates, and add Light/Dark mode toggle * feat(admin): replace text controls for Photo Frame and Hero Style with visual preview cards * fix(admin): define missing CSS rules for button system (.btn, .preset-btn) * feat(admin): redesign theme settings with segmented mode toggle, accent color swatches, and custom iOS-style toggle cards * feat(admin): upgrade all settings tabs with visual grid previews, Google SEO snippet preview, and toggle cards * feat(admin): overhaul Pages Builder UX with slide-over drawer, card hover badges, real-time search, and floating save bar * fix(admin): remove leftover dangling syntax snippet in PageBuilder.tsx * fix(admin): add position: relative to subpage-tile so hover overlay is contained inside the tile * style(admin): replace all emojis with clean Leica-style vector SVG icons * fix(types): extend IconProps with SVGProps to allow style prop on Leica SVG icons * feat(admin): add subpage live-preview, privacy analytics, and asset protection settings * fix(typecheck): fix AlbumEntry property access in subpage drawer preview mode * fix(types): fix ImmichAlbumInfo property names thumbnailAssetId and albumName in PageBuilder.tsx * fix(types): add protection and watermark optional properties to AppConfig interface * feat(settings): add toggle for disabling analytics tracking (defaults to enabled) * feat(ux): show status banner when analytics tracking is disabled + add live sync indicator * feat(watermark): render customizable watermark overlay on Lightbox images + rename section to Portfolio Features & Modules * fix(types): import type LightboxWatermark in PhotoGrid.tsx * fix(types): destructure watermark prop in PhotoGrid function signature * feat(seo): add configurable subpage title template and metadata descriptions * feat(seo): add generateMetadata to about page for title template support * feat(proofing): add client proofing, favorites selection, compact URL bitmasking, and export modal * feat(essay): add Photo Essay storytelling mode with RSC markdown parser and fullbleed/pair layouts * feat(subpages): add page enabled toggle to deactivate subpages without deleting them * feat(admin): add visual essay block builder for photo essay storytelling pages * security: add Trivy container scan to Docker publish workflow Scans the built image for CRITICAL/HIGH CVEs on every release and uploads results to the GitHub Security tab. Non-blocking for now (exit-code 0) so releases aren't gated on findings. Also documents the scan and existing Dependabot coverage in the README. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-08-07 11:08:04 +02:00
shadow: { label: 'Shadow', desc: 'Soft floating drop shadow' },
}[f] || { label: f, desc: '' };
const isActive = (settings.theme?.photoFrame || 'none') === f;
return (
<button
key={f}
type="button"
className={`preset-card frame-card ${isActive ? 'active' : ''}`}
onClick={() => update('theme.photoFrame', f)}
>
<div className="frame-card-preview">
<div className={`mini-frame-demo frame-${f}`}>
<div className="mini-frame-photo" />
</div>
</div>
<div className="preset-card-info">
<span className="preset-card-name">{info.label}</span>
<span className="preset-card-desc">{info.desc}</span>
</div>
</button>
);
})}
</div>
</div>
security: add Trivy container scan to Docker publish workflow (#399) * feat(admin): add backup manager UI with 1-click restore * feat(admin): collapse older backup entries by default * fix(theme): isolate admin layout, instant DOM theme updates, and add Light/Dark mode toggle * feat(admin): replace text controls for Photo Frame and Hero Style with visual preview cards * fix(admin): define missing CSS rules for button system (.btn, .preset-btn) * feat(admin): redesign theme settings with segmented mode toggle, accent color swatches, and custom iOS-style toggle cards * feat(admin): upgrade all settings tabs with visual grid previews, Google SEO snippet preview, and toggle cards * feat(admin): overhaul Pages Builder UX with slide-over drawer, card hover badges, real-time search, and floating save bar * fix(admin): remove leftover dangling syntax snippet in PageBuilder.tsx * fix(admin): add position: relative to subpage-tile so hover overlay is contained inside the tile * style(admin): replace all emojis with clean Leica-style vector SVG icons * fix(types): extend IconProps with SVGProps to allow style prop on Leica SVG icons * feat(admin): add subpage live-preview, privacy analytics, and asset protection settings * fix(typecheck): fix AlbumEntry property access in subpage drawer preview mode * fix(types): fix ImmichAlbumInfo property names thumbnailAssetId and albumName in PageBuilder.tsx * fix(types): add protection and watermark optional properties to AppConfig interface * feat(settings): add toggle for disabling analytics tracking (defaults to enabled) * feat(ux): show status banner when analytics tracking is disabled + add live sync indicator * feat(watermark): render customizable watermark overlay on Lightbox images + rename section to Portfolio Features & Modules * fix(types): import type LightboxWatermark in PhotoGrid.tsx * fix(types): destructure watermark prop in PhotoGrid function signature * feat(seo): add configurable subpage title template and metadata descriptions * feat(seo): add generateMetadata to about page for title template support * feat(proofing): add client proofing, favorites selection, compact URL bitmasking, and export modal * feat(essay): add Photo Essay storytelling mode with RSC markdown parser and fullbleed/pair layouts * feat(subpages): add page enabled toggle to deactivate subpages without deleting them * feat(admin): add visual essay block builder for photo essay storytelling pages * security: add Trivy container scan to Docker publish workflow Scans the built image for CRITICAL/HIGH CVEs on every release and uploads results to the GitHub Security tab. Non-blocking for now (exit-code 0) so releases aren't gated on findings. Also documents the scan and existing Dependabot coverage in the README. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-08-07 11:08:04 +02:00
<div className="admin-field">
<label>Hero Style</label>
security: add Trivy container scan to Docker publish workflow (#399) * feat(admin): add backup manager UI with 1-click restore * feat(admin): collapse older backup entries by default * fix(theme): isolate admin layout, instant DOM theme updates, and add Light/Dark mode toggle * feat(admin): replace text controls for Photo Frame and Hero Style with visual preview cards * fix(admin): define missing CSS rules for button system (.btn, .preset-btn) * feat(admin): redesign theme settings with segmented mode toggle, accent color swatches, and custom iOS-style toggle cards * feat(admin): upgrade all settings tabs with visual grid previews, Google SEO snippet preview, and toggle cards * feat(admin): overhaul Pages Builder UX with slide-over drawer, card hover badges, real-time search, and floating save bar * fix(admin): remove leftover dangling syntax snippet in PageBuilder.tsx * fix(admin): add position: relative to subpage-tile so hover overlay is contained inside the tile * style(admin): replace all emojis with clean Leica-style vector SVG icons * fix(types): extend IconProps with SVGProps to allow style prop on Leica SVG icons * feat(admin): add subpage live-preview, privacy analytics, and asset protection settings * fix(typecheck): fix AlbumEntry property access in subpage drawer preview mode * fix(types): fix ImmichAlbumInfo property names thumbnailAssetId and albumName in PageBuilder.tsx * fix(types): add protection and watermark optional properties to AppConfig interface * feat(settings): add toggle for disabling analytics tracking (defaults to enabled) * feat(ux): show status banner when analytics tracking is disabled + add live sync indicator * feat(watermark): render customizable watermark overlay on Lightbox images + rename section to Portfolio Features & Modules * fix(types): import type LightboxWatermark in PhotoGrid.tsx * fix(types): destructure watermark prop in PhotoGrid function signature * feat(seo): add configurable subpage title template and metadata descriptions * feat(seo): add generateMetadata to about page for title template support * feat(proofing): add client proofing, favorites selection, compact URL bitmasking, and export modal * feat(essay): add Photo Essay storytelling mode with RSC markdown parser and fullbleed/pair layouts * feat(subpages): add page enabled toggle to deactivate subpages without deleting them * feat(admin): add visual essay block builder for photo essay storytelling pages * security: add Trivy container scan to Docker publish workflow Scans the built image for CRITICAL/HIGH CVEs on every release and uploads results to the GitHub Security tab. Non-blocking for now (exit-code 0) so releases aren't gated on findings. Also documents the scan and existing Dependabot coverage in the README. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-08-07 11:08:04 +02:00
<div className="preset-card-grid">
{HERO_STYLES.map((s) => {
const info = {
split: { label: 'Split', desc: 'Side-by-side title & photo' },
fullbleed: { label: 'Fullbleed', desc: 'Edge-to-edge full width banner' },
minimal: { label: 'Minimal', desc: 'Centered title with subtle photo' },
stacked: { label: 'Stacked', desc: 'Title stacked directly over photo' },
typographic: { label: 'Typographic', desc: 'Oversized magazine masthead' },
mosaic: { label: 'Mosaic', desc: 'Dynamic photo collage layout' },
release: v0.11.0 (#459) Ships `dev` as **v0.11.0**. `main` contains nothing that `dev` does not, so this is a clean sync. ## Headline changes since v0.10.0 - **Journal & Journal Studio** — photo essays at `/journal`, split-screen block editor with live preview, drafts, per-entry passwords, cover images - **First-run setup wizard at `/install`** — configure a fresh deployment from the browser; credentials are verified against Immich before anything is written, and the wizard is gated by a one-time token - **About page editor and toggle** in the admin panel - **Per-album photo order** independent of Immich, with a drag & drop editor - **Custom favicon upload** - **Experimental portfolio features** — justified grid, `cover` hero, unlisted subpages, per-album grid overrides, cover focal points, external nav links - **Security** — asset tokens length-capped before decoding (#423), journal author markdown escaped rather than filtered, journal file paths contained, admin session key derived with scrypt (#432), Next.js 16.3.0 for CVE-2025-13465 - **Fixed** — client proofing honours its own configuration again (#454); journal photo rendering (#432) Full detail in [CHANGELOG.md](CHANGELOG.md#0110--2026-08-15). ## Verified `npx tsc --noEmit` clean · `npx vitest run` 435 tests pass · `npm run build` succeeds · lint 0 errors · `prettier --check` clean · local `docker build` of the release tree. ## After merge Tag `v0.11.0` on `main` and publish the release — that triggers `docker-publish.yml`, which pushes the image and moves `latest`. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
2026-08-15 09:09:18 +02:00
cover: {
label: 'Cover (Experimental)',
desc: 'Fullscreen splash with a single Enter link',
},
security: add Trivy container scan to Docker publish workflow (#399) * feat(admin): add backup manager UI with 1-click restore * feat(admin): collapse older backup entries by default * fix(theme): isolate admin layout, instant DOM theme updates, and add Light/Dark mode toggle * feat(admin): replace text controls for Photo Frame and Hero Style with visual preview cards * fix(admin): define missing CSS rules for button system (.btn, .preset-btn) * feat(admin): redesign theme settings with segmented mode toggle, accent color swatches, and custom iOS-style toggle cards * feat(admin): upgrade all settings tabs with visual grid previews, Google SEO snippet preview, and toggle cards * feat(admin): overhaul Pages Builder UX with slide-over drawer, card hover badges, real-time search, and floating save bar * fix(admin): remove leftover dangling syntax snippet in PageBuilder.tsx * fix(admin): add position: relative to subpage-tile so hover overlay is contained inside the tile * style(admin): replace all emojis with clean Leica-style vector SVG icons * fix(types): extend IconProps with SVGProps to allow style prop on Leica SVG icons * feat(admin): add subpage live-preview, privacy analytics, and asset protection settings * fix(typecheck): fix AlbumEntry property access in subpage drawer preview mode * fix(types): fix ImmichAlbumInfo property names thumbnailAssetId and albumName in PageBuilder.tsx * fix(types): add protection and watermark optional properties to AppConfig interface * feat(settings): add toggle for disabling analytics tracking (defaults to enabled) * feat(ux): show status banner when analytics tracking is disabled + add live sync indicator * feat(watermark): render customizable watermark overlay on Lightbox images + rename section to Portfolio Features & Modules * fix(types): import type LightboxWatermark in PhotoGrid.tsx * fix(types): destructure watermark prop in PhotoGrid function signature * feat(seo): add configurable subpage title template and metadata descriptions * feat(seo): add generateMetadata to about page for title template support * feat(proofing): add client proofing, favorites selection, compact URL bitmasking, and export modal * feat(essay): add Photo Essay storytelling mode with RSC markdown parser and fullbleed/pair layouts * feat(subpages): add page enabled toggle to deactivate subpages without deleting them * feat(admin): add visual essay block builder for photo essay storytelling pages * security: add Trivy container scan to Docker publish workflow Scans the built image for CRITICAL/HIGH CVEs on every release and uploads results to the GitHub Security tab. Non-blocking for now (exit-code 0) so releases aren't gated on findings. Also documents the scan and existing Dependabot coverage in the README. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-08-07 11:08:04 +02:00
}[s] || { label: s, desc: '' };
const isActive = (settings.theme?.heroStyle || 'split') === s;
return (
<button
key={s}
type="button"
className={`preset-card hero-card ${isActive ? 'active' : ''}`}
onClick={() => update('theme.heroStyle', s)}
>
<div className="hero-card-preview">
<div className={`mini-hero-demo hero-demo-${s}`}>
{s === 'split' && (
<>
<div className="hero-demo-text">
<div className="demo-line title" />
<div className="demo-line sub" />
</div>
<div className="hero-demo-photo" />
</>
)}
{s === 'fullbleed' && (
<div className="hero-demo-full">
<div className="demo-line title light" />
</div>
)}
{s === 'minimal' && (
<>
<div className="hero-demo-center-text">
<div className="demo-line title short" />
</div>
<div className="hero-demo-photo small" />
</>
)}
{s === 'stacked' && (
<>
<div className="hero-demo-text">
<div className="demo-line title" />
</div>
<div className="hero-demo-photo banner" />
</>
)}
{s === 'typographic' && (
<>
<div className="demo-line title giant" />
<div className="hero-demo-grid2">
<div className="hero-demo-photo" />
<div className="hero-demo-photo" />
</div>
</>
)}
{s === 'mosaic' && (
<div className="hero-demo-mosaic">
<div className="hero-demo-photo big" />
<div className="hero-demo-photo-col">
<div className="hero-demo-photo" />
<div className="hero-demo-photo" />
</div>
</div>
)}
</div>
</div>
<div className="preset-card-info">
<span className="preset-card-name">{info.label}</span>
<span className="preset-card-desc">{info.desc}</span>
</div>
</button>
);
})}
</div>
</div>
security: add Trivy container scan to Docker publish workflow (#399) * feat(admin): add backup manager UI with 1-click restore * feat(admin): collapse older backup entries by default * fix(theme): isolate admin layout, instant DOM theme updates, and add Light/Dark mode toggle * feat(admin): replace text controls for Photo Frame and Hero Style with visual preview cards * fix(admin): define missing CSS rules for button system (.btn, .preset-btn) * feat(admin): redesign theme settings with segmented mode toggle, accent color swatches, and custom iOS-style toggle cards * feat(admin): upgrade all settings tabs with visual grid previews, Google SEO snippet preview, and toggle cards * feat(admin): overhaul Pages Builder UX with slide-over drawer, card hover badges, real-time search, and floating save bar * fix(admin): remove leftover dangling syntax snippet in PageBuilder.tsx * fix(admin): add position: relative to subpage-tile so hover overlay is contained inside the tile * style(admin): replace all emojis with clean Leica-style vector SVG icons * fix(types): extend IconProps with SVGProps to allow style prop on Leica SVG icons * feat(admin): add subpage live-preview, privacy analytics, and asset protection settings * fix(typecheck): fix AlbumEntry property access in subpage drawer preview mode * fix(types): fix ImmichAlbumInfo property names thumbnailAssetId and albumName in PageBuilder.tsx * fix(types): add protection and watermark optional properties to AppConfig interface * feat(settings): add toggle for disabling analytics tracking (defaults to enabled) * feat(ux): show status banner when analytics tracking is disabled + add live sync indicator * feat(watermark): render customizable watermark overlay on Lightbox images + rename section to Portfolio Features & Modules * fix(types): import type LightboxWatermark in PhotoGrid.tsx * fix(types): destructure watermark prop in PhotoGrid function signature * feat(seo): add configurable subpage title template and metadata descriptions * feat(seo): add generateMetadata to about page for title template support * feat(proofing): add client proofing, favorites selection, compact URL bitmasking, and export modal * feat(essay): add Photo Essay storytelling mode with RSC markdown parser and fullbleed/pair layouts * feat(subpages): add page enabled toggle to deactivate subpages without deleting them * feat(admin): add visual essay block builder for photo essay storytelling pages * security: add Trivy container scan to Docker publish workflow Scans the built image for CRITICAL/HIGH CVEs on every release and uploads results to the GitHub Security tab. Non-blocking for now (exit-code 0) so releases aren't gated on findings. Also documents the scan and existing Dependabot coverage in the README. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-08-07 11:08:04 +02:00
<div className="settings-section-divider" />
<div className="settings-section-header">
release: v0.11.0 (#459) Ships `dev` as **v0.11.0**. `main` contains nothing that `dev` does not, so this is a clean sync. ## Headline changes since v0.10.0 - **Journal & Journal Studio** — photo essays at `/journal`, split-screen block editor with live preview, drafts, per-entry passwords, cover images - **First-run setup wizard at `/install`** — configure a fresh deployment from the browser; credentials are verified against Immich before anything is written, and the wizard is gated by a one-time token - **About page editor and toggle** in the admin panel - **Per-album photo order** independent of Immich, with a drag & drop editor - **Custom favicon upload** - **Experimental portfolio features** — justified grid, `cover` hero, unlisted subpages, per-album grid overrides, cover focal points, external nav links - **Security** — asset tokens length-capped before decoding (#423), journal author markdown escaped rather than filtered, journal file paths contained, admin session key derived with scrypt (#432), Next.js 16.3.0 for CVE-2025-13465 - **Fixed** — client proofing honours its own configuration again (#454); journal photo rendering (#432) Full detail in [CHANGELOG.md](CHANGELOG.md#0110--2026-08-15). ## Verified `npx tsc --noEmit` clean · `npx vitest run` 435 tests pass · `npm run build` succeeds · lint 0 errors · `prettier --check` clean · local `docker build` of the release tree. ## After merge Tag `v0.11.0` on `main` and publish the release — that triggers `docker-publish.yml`, which pushes the image and moves `latest`. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
2026-08-15 09:09:18 +02:00
<h3>
<Icons.IconSparkles size={18} /> Finishing Touches
</h3>
<p className="settings-section-sub">
Enable optional visual effects and indicators.
</p>
security: add Trivy container scan to Docker publish workflow (#399) * feat(admin): add backup manager UI with 1-click restore * feat(admin): collapse older backup entries by default * fix(theme): isolate admin layout, instant DOM theme updates, and add Light/Dark mode toggle * feat(admin): replace text controls for Photo Frame and Hero Style with visual preview cards * fix(admin): define missing CSS rules for button system (.btn, .preset-btn) * feat(admin): redesign theme settings with segmented mode toggle, accent color swatches, and custom iOS-style toggle cards * feat(admin): upgrade all settings tabs with visual grid previews, Google SEO snippet preview, and toggle cards * feat(admin): overhaul Pages Builder UX with slide-over drawer, card hover badges, real-time search, and floating save bar * fix(admin): remove leftover dangling syntax snippet in PageBuilder.tsx * fix(admin): add position: relative to subpage-tile so hover overlay is contained inside the tile * style(admin): replace all emojis with clean Leica-style vector SVG icons * fix(types): extend IconProps with SVGProps to allow style prop on Leica SVG icons * feat(admin): add subpage live-preview, privacy analytics, and asset protection settings * fix(typecheck): fix AlbumEntry property access in subpage drawer preview mode * fix(types): fix ImmichAlbumInfo property names thumbnailAssetId and albumName in PageBuilder.tsx * fix(types): add protection and watermark optional properties to AppConfig interface * feat(settings): add toggle for disabling analytics tracking (defaults to enabled) * feat(ux): show status banner when analytics tracking is disabled + add live sync indicator * feat(watermark): render customizable watermark overlay on Lightbox images + rename section to Portfolio Features & Modules * fix(types): import type LightboxWatermark in PhotoGrid.tsx * fix(types): destructure watermark prop in PhotoGrid function signature * feat(seo): add configurable subpage title template and metadata descriptions * feat(seo): add generateMetadata to about page for title template support * feat(proofing): add client proofing, favorites selection, compact URL bitmasking, and export modal * feat(essay): add Photo Essay storytelling mode with RSC markdown parser and fullbleed/pair layouts * feat(subpages): add page enabled toggle to deactivate subpages without deleting them * feat(admin): add visual essay block builder for photo essay storytelling pages * security: add Trivy container scan to Docker publish workflow Scans the built image for CRITICAL/HIGH CVEs on every release and uploads results to the GitHub Security tab. Non-blocking for now (exit-code 0) so releases aren't gated on findings. Also documents the scan and existing Dependabot coverage in the README. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-08-07 11:08:04 +02:00
</div>
<div className="admin-toggle-cards-grid">
<button
type="button"
className={`admin-toggle-card ${settings.theme?.grain === true ? 'active' : ''}`}
onClick={() => update('theme.grain', !settings.theme?.grain)}
>
<div className="toggle-card-info">
release: v0.11.0 (#459) Ships `dev` as **v0.11.0**. `main` contains nothing that `dev` does not, so this is a clean sync. ## Headline changes since v0.10.0 - **Journal & Journal Studio** — photo essays at `/journal`, split-screen block editor with live preview, drafts, per-entry passwords, cover images - **First-run setup wizard at `/install`** — configure a fresh deployment from the browser; credentials are verified against Immich before anything is written, and the wizard is gated by a one-time token - **About page editor and toggle** in the admin panel - **Per-album photo order** independent of Immich, with a drag & drop editor - **Custom favicon upload** - **Experimental portfolio features** — justified grid, `cover` hero, unlisted subpages, per-album grid overrides, cover focal points, external nav links - **Security** — asset tokens length-capped before decoding (#423), journal author markdown escaped rather than filtered, journal file paths contained, admin session key derived with scrypt (#432), Next.js 16.3.0 for CVE-2025-13465 - **Fixed** — client proofing honours its own configuration again (#454); journal photo rendering (#432) Full detail in [CHANGELOG.md](CHANGELOG.md#0110--2026-08-15). ## Verified `npx tsc --noEmit` clean · `npx vitest run` 435 tests pass · `npm run build` succeeds · lint 0 errors · `prettier --check` clean · local `docker build` of the release tree. ## After merge Tag `v0.11.0` on `main` and publish the release — that triggers `docker-publish.yml`, which pushes the image and moves `latest`. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
2026-08-15 09:09:18 +02:00
<span className="toggle-card-title">
<Icons.IconFilm size={16} /> Film Grain Texture
</span>
<span className="toggle-card-desc">
Adds analog noise overlay across portfolio background
</span>
security: add Trivy container scan to Docker publish workflow (#399) * feat(admin): add backup manager UI with 1-click restore * feat(admin): collapse older backup entries by default * fix(theme): isolate admin layout, instant DOM theme updates, and add Light/Dark mode toggle * feat(admin): replace text controls for Photo Frame and Hero Style with visual preview cards * fix(admin): define missing CSS rules for button system (.btn, .preset-btn) * feat(admin): redesign theme settings with segmented mode toggle, accent color swatches, and custom iOS-style toggle cards * feat(admin): upgrade all settings tabs with visual grid previews, Google SEO snippet preview, and toggle cards * feat(admin): overhaul Pages Builder UX with slide-over drawer, card hover badges, real-time search, and floating save bar * fix(admin): remove leftover dangling syntax snippet in PageBuilder.tsx * fix(admin): add position: relative to subpage-tile so hover overlay is contained inside the tile * style(admin): replace all emojis with clean Leica-style vector SVG icons * fix(types): extend IconProps with SVGProps to allow style prop on Leica SVG icons * feat(admin): add subpage live-preview, privacy analytics, and asset protection settings * fix(typecheck): fix AlbumEntry property access in subpage drawer preview mode * fix(types): fix ImmichAlbumInfo property names thumbnailAssetId and albumName in PageBuilder.tsx * fix(types): add protection and watermark optional properties to AppConfig interface * feat(settings): add toggle for disabling analytics tracking (defaults to enabled) * feat(ux): show status banner when analytics tracking is disabled + add live sync indicator * feat(watermark): render customizable watermark overlay on Lightbox images + rename section to Portfolio Features & Modules * fix(types): import type LightboxWatermark in PhotoGrid.tsx * fix(types): destructure watermark prop in PhotoGrid function signature * feat(seo): add configurable subpage title template and metadata descriptions * feat(seo): add generateMetadata to about page for title template support * feat(proofing): add client proofing, favorites selection, compact URL bitmasking, and export modal * feat(essay): add Photo Essay storytelling mode with RSC markdown parser and fullbleed/pair layouts * feat(subpages): add page enabled toggle to deactivate subpages without deleting them * feat(admin): add visual essay block builder for photo essay storytelling pages * security: add Trivy container scan to Docker publish workflow Scans the built image for CRITICAL/HIGH CVEs on every release and uploads results to the GitHub Security tab. Non-blocking for now (exit-code 0) so releases aren't gated on findings. Also documents the scan and existing Dependabot coverage in the README. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-08-07 11:08:04 +02:00
</div>
<div className={`switch-toggle ${settings.theme?.grain === true ? 'on' : ''}`}>
<span className="switch-slider" />
</div>
</button>
<button
type="button"
className={`admin-toggle-card ${settings.theme?.headerDot !== false ? 'active' : ''}`}
onClick={() => update('theme.headerDot', settings.theme?.headerDot === false)}
>
<div className="toggle-card-info">
release: v0.11.0 (#459) Ships `dev` as **v0.11.0**. `main` contains nothing that `dev` does not, so this is a clean sync. ## Headline changes since v0.10.0 - **Journal & Journal Studio** — photo essays at `/journal`, split-screen block editor with live preview, drafts, per-entry passwords, cover images - **First-run setup wizard at `/install`** — configure a fresh deployment from the browser; credentials are verified against Immich before anything is written, and the wizard is gated by a one-time token - **About page editor and toggle** in the admin panel - **Per-album photo order** independent of Immich, with a drag & drop editor - **Custom favicon upload** - **Experimental portfolio features** — justified grid, `cover` hero, unlisted subpages, per-album grid overrides, cover focal points, external nav links - **Security** — asset tokens length-capped before decoding (#423), journal author markdown escaped rather than filtered, journal file paths contained, admin session key derived with scrypt (#432), Next.js 16.3.0 for CVE-2025-13465 - **Fixed** — client proofing honours its own configuration again (#454); journal photo rendering (#432) Full detail in [CHANGELOG.md](CHANGELOG.md#0110--2026-08-15). ## Verified `npx tsc --noEmit` clean · `npx vitest run` 435 tests pass · `npm run build` succeeds · lint 0 errors · `prettier --check` clean · local `docker build` of the release tree. ## After merge Tag `v0.11.0` on `main` and publish the release — that triggers `docker-publish.yml`, which pushes the image and moves `latest`. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
2026-08-15 09:09:18 +02:00
<span className="toggle-card-title">
<Icons.IconTarget size={16} /> Header Accent Dot
</span>
<span className="toggle-card-desc">
Displays accent dot next to active section header
</span>
security: add Trivy container scan to Docker publish workflow (#399) * feat(admin): add backup manager UI with 1-click restore * feat(admin): collapse older backup entries by default * fix(theme): isolate admin layout, instant DOM theme updates, and add Light/Dark mode toggle * feat(admin): replace text controls for Photo Frame and Hero Style with visual preview cards * fix(admin): define missing CSS rules for button system (.btn, .preset-btn) * feat(admin): redesign theme settings with segmented mode toggle, accent color swatches, and custom iOS-style toggle cards * feat(admin): upgrade all settings tabs with visual grid previews, Google SEO snippet preview, and toggle cards * feat(admin): overhaul Pages Builder UX with slide-over drawer, card hover badges, real-time search, and floating save bar * fix(admin): remove leftover dangling syntax snippet in PageBuilder.tsx * fix(admin): add position: relative to subpage-tile so hover overlay is contained inside the tile * style(admin): replace all emojis with clean Leica-style vector SVG icons * fix(types): extend IconProps with SVGProps to allow style prop on Leica SVG icons * feat(admin): add subpage live-preview, privacy analytics, and asset protection settings * fix(typecheck): fix AlbumEntry property access in subpage drawer preview mode * fix(types): fix ImmichAlbumInfo property names thumbnailAssetId and albumName in PageBuilder.tsx * fix(types): add protection and watermark optional properties to AppConfig interface * feat(settings): add toggle for disabling analytics tracking (defaults to enabled) * feat(ux): show status banner when analytics tracking is disabled + add live sync indicator * feat(watermark): render customizable watermark overlay on Lightbox images + rename section to Portfolio Features & Modules * fix(types): import type LightboxWatermark in PhotoGrid.tsx * fix(types): destructure watermark prop in PhotoGrid function signature * feat(seo): add configurable subpage title template and metadata descriptions * feat(seo): add generateMetadata to about page for title template support * feat(proofing): add client proofing, favorites selection, compact URL bitmasking, and export modal * feat(essay): add Photo Essay storytelling mode with RSC markdown parser and fullbleed/pair layouts * feat(subpages): add page enabled toggle to deactivate subpages without deleting them * feat(admin): add visual essay block builder for photo essay storytelling pages * security: add Trivy container scan to Docker publish workflow Scans the built image for CRITICAL/HIGH CVEs on every release and uploads results to the GitHub Security tab. Non-blocking for now (exit-code 0) so releases aren't gated on findings. Also documents the scan and existing Dependabot coverage in the README. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-08-07 11:08:04 +02:00
</div>
release: v0.11.0 (#459) Ships `dev` as **v0.11.0**. `main` contains nothing that `dev` does not, so this is a clean sync. ## Headline changes since v0.10.0 - **Journal & Journal Studio** — photo essays at `/journal`, split-screen block editor with live preview, drafts, per-entry passwords, cover images - **First-run setup wizard at `/install`** — configure a fresh deployment from the browser; credentials are verified against Immich before anything is written, and the wizard is gated by a one-time token - **About page editor and toggle** in the admin panel - **Per-album photo order** independent of Immich, with a drag & drop editor - **Custom favicon upload** - **Experimental portfolio features** — justified grid, `cover` hero, unlisted subpages, per-album grid overrides, cover focal points, external nav links - **Security** — asset tokens length-capped before decoding (#423), journal author markdown escaped rather than filtered, journal file paths contained, admin session key derived with scrypt (#432), Next.js 16.3.0 for CVE-2025-13465 - **Fixed** — client proofing honours its own configuration again (#454); journal photo rendering (#432) Full detail in [CHANGELOG.md](CHANGELOG.md#0110--2026-08-15). ## Verified `npx tsc --noEmit` clean · `npx vitest run` 435 tests pass · `npm run build` succeeds · lint 0 errors · `prettier --check` clean · local `docker build` of the release tree. ## After merge Tag `v0.11.0` on `main` and publish the release — that triggers `docker-publish.yml`, which pushes the image and moves `latest`. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
2026-08-15 09:09:18 +02:00
<div
className={`switch-toggle ${settings.theme?.headerDot !== false ? 'on' : ''}`}
>
security: add Trivy container scan to Docker publish workflow (#399) * feat(admin): add backup manager UI with 1-click restore * feat(admin): collapse older backup entries by default * fix(theme): isolate admin layout, instant DOM theme updates, and add Light/Dark mode toggle * feat(admin): replace text controls for Photo Frame and Hero Style with visual preview cards * fix(admin): define missing CSS rules for button system (.btn, .preset-btn) * feat(admin): redesign theme settings with segmented mode toggle, accent color swatches, and custom iOS-style toggle cards * feat(admin): upgrade all settings tabs with visual grid previews, Google SEO snippet preview, and toggle cards * feat(admin): overhaul Pages Builder UX with slide-over drawer, card hover badges, real-time search, and floating save bar * fix(admin): remove leftover dangling syntax snippet in PageBuilder.tsx * fix(admin): add position: relative to subpage-tile so hover overlay is contained inside the tile * style(admin): replace all emojis with clean Leica-style vector SVG icons * fix(types): extend IconProps with SVGProps to allow style prop on Leica SVG icons * feat(admin): add subpage live-preview, privacy analytics, and asset protection settings * fix(typecheck): fix AlbumEntry property access in subpage drawer preview mode * fix(types): fix ImmichAlbumInfo property names thumbnailAssetId and albumName in PageBuilder.tsx * fix(types): add protection and watermark optional properties to AppConfig interface * feat(settings): add toggle for disabling analytics tracking (defaults to enabled) * feat(ux): show status banner when analytics tracking is disabled + add live sync indicator * feat(watermark): render customizable watermark overlay on Lightbox images + rename section to Portfolio Features & Modules * fix(types): import type LightboxWatermark in PhotoGrid.tsx * fix(types): destructure watermark prop in PhotoGrid function signature * feat(seo): add configurable subpage title template and metadata descriptions * feat(seo): add generateMetadata to about page for title template support * feat(proofing): add client proofing, favorites selection, compact URL bitmasking, and export modal * feat(essay): add Photo Essay storytelling mode with RSC markdown parser and fullbleed/pair layouts * feat(subpages): add page enabled toggle to deactivate subpages without deleting them * feat(admin): add visual essay block builder for photo essay storytelling pages * security: add Trivy container scan to Docker publish workflow Scans the built image for CRITICAL/HIGH CVEs on every release and uploads results to the GitHub Security tab. Non-blocking for now (exit-code 0) so releases aren't gated on findings. Also documents the scan and existing Dependabot coverage in the README. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-08-07 11:08:04 +02:00
<span className="switch-slider" />
</div>
</button>
</div>
</div>
)}
{activeSection === 'grid' && (
<div className="settings-panel">
security: add Trivy container scan to Docker publish workflow (#399) * feat(admin): add backup manager UI with 1-click restore * feat(admin): collapse older backup entries by default * fix(theme): isolate admin layout, instant DOM theme updates, and add Light/Dark mode toggle * feat(admin): replace text controls for Photo Frame and Hero Style with visual preview cards * fix(admin): define missing CSS rules for button system (.btn, .preset-btn) * feat(admin): redesign theme settings with segmented mode toggle, accent color swatches, and custom iOS-style toggle cards * feat(admin): upgrade all settings tabs with visual grid previews, Google SEO snippet preview, and toggle cards * feat(admin): overhaul Pages Builder UX with slide-over drawer, card hover badges, real-time search, and floating save bar * fix(admin): remove leftover dangling syntax snippet in PageBuilder.tsx * fix(admin): add position: relative to subpage-tile so hover overlay is contained inside the tile * style(admin): replace all emojis with clean Leica-style vector SVG icons * fix(types): extend IconProps with SVGProps to allow style prop on Leica SVG icons * feat(admin): add subpage live-preview, privacy analytics, and asset protection settings * fix(typecheck): fix AlbumEntry property access in subpage drawer preview mode * fix(types): fix ImmichAlbumInfo property names thumbnailAssetId and albumName in PageBuilder.tsx * fix(types): add protection and watermark optional properties to AppConfig interface * feat(settings): add toggle for disabling analytics tracking (defaults to enabled) * feat(ux): show status banner when analytics tracking is disabled + add live sync indicator * feat(watermark): render customizable watermark overlay on Lightbox images + rename section to Portfolio Features & Modules * fix(types): import type LightboxWatermark in PhotoGrid.tsx * fix(types): destructure watermark prop in PhotoGrid function signature * feat(seo): add configurable subpage title template and metadata descriptions * feat(seo): add generateMetadata to about page for title template support * feat(proofing): add client proofing, favorites selection, compact URL bitmasking, and export modal * feat(essay): add Photo Essay storytelling mode with RSC markdown parser and fullbleed/pair layouts * feat(subpages): add page enabled toggle to deactivate subpages without deleting them * feat(admin): add visual essay block builder for photo essay storytelling pages * security: add Trivy container scan to Docker publish workflow Scans the built image for CRITICAL/HIGH CVEs on every release and uploads results to the GitHub Security tab. Non-blocking for now (exit-code 0) so releases aren't gated on findings. Also documents the scan and existing Dependabot coverage in the README. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-08-07 11:08:04 +02:00
<div className="settings-section-header">
release: v0.11.0 (#459) Ships `dev` as **v0.11.0**. `main` contains nothing that `dev` does not, so this is a clean sync. ## Headline changes since v0.10.0 - **Journal & Journal Studio** — photo essays at `/journal`, split-screen block editor with live preview, drafts, per-entry passwords, cover images - **First-run setup wizard at `/install`** — configure a fresh deployment from the browser; credentials are verified against Immich before anything is written, and the wizard is gated by a one-time token - **About page editor and toggle** in the admin panel - **Per-album photo order** independent of Immich, with a drag & drop editor - **Custom favicon upload** - **Experimental portfolio features** — justified grid, `cover` hero, unlisted subpages, per-album grid overrides, cover focal points, external nav links - **Security** — asset tokens length-capped before decoding (#423), journal author markdown escaped rather than filtered, journal file paths contained, admin session key derived with scrypt (#432), Next.js 16.3.0 for CVE-2025-13465 - **Fixed** — client proofing honours its own configuration again (#454); journal photo rendering (#432) Full detail in [CHANGELOG.md](CHANGELOG.md#0110--2026-08-15). ## Verified `npx tsc --noEmit` clean · `npx vitest run` 435 tests pass · `npm run build` succeeds · lint 0 errors · `prettier --check` clean · local `docker build` of the release tree. ## After merge Tag `v0.11.0` on `main` and publish the release — that triggers `docker-publish.yml`, which pushes the image and moves `latest`. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
2026-08-15 09:09:18 +02:00
<h3>
<Icons.IconGrid size={18} /> Grid &amp; Layout Engine
</h3>
<p className="settings-section-sub">
Configure photography gallery column structures and thumbnail aspect ratios.
</p>
security: add Trivy container scan to Docker publish workflow (#399) * feat(admin): add backup manager UI with 1-click restore * feat(admin): collapse older backup entries by default * fix(theme): isolate admin layout, instant DOM theme updates, and add Light/Dark mode toggle * feat(admin): replace text controls for Photo Frame and Hero Style with visual preview cards * fix(admin): define missing CSS rules for button system (.btn, .preset-btn) * feat(admin): redesign theme settings with segmented mode toggle, accent color swatches, and custom iOS-style toggle cards * feat(admin): upgrade all settings tabs with visual grid previews, Google SEO snippet preview, and toggle cards * feat(admin): overhaul Pages Builder UX with slide-over drawer, card hover badges, real-time search, and floating save bar * fix(admin): remove leftover dangling syntax snippet in PageBuilder.tsx * fix(admin): add position: relative to subpage-tile so hover overlay is contained inside the tile * style(admin): replace all emojis with clean Leica-style vector SVG icons * fix(types): extend IconProps with SVGProps to allow style prop on Leica SVG icons * feat(admin): add subpage live-preview, privacy analytics, and asset protection settings * fix(typecheck): fix AlbumEntry property access in subpage drawer preview mode * fix(types): fix ImmichAlbumInfo property names thumbnailAssetId and albumName in PageBuilder.tsx * fix(types): add protection and watermark optional properties to AppConfig interface * feat(settings): add toggle for disabling analytics tracking (defaults to enabled) * feat(ux): show status banner when analytics tracking is disabled + add live sync indicator * feat(watermark): render customizable watermark overlay on Lightbox images + rename section to Portfolio Features & Modules * fix(types): import type LightboxWatermark in PhotoGrid.tsx * fix(types): destructure watermark prop in PhotoGrid function signature * feat(seo): add configurable subpage title template and metadata descriptions * feat(seo): add generateMetadata to about page for title template support * feat(proofing): add client proofing, favorites selection, compact URL bitmasking, and export modal * feat(essay): add Photo Essay storytelling mode with RSC markdown parser and fullbleed/pair layouts * feat(subpages): add page enabled toggle to deactivate subpages without deleting them * feat(admin): add visual essay block builder for photo essay storytelling pages * security: add Trivy container scan to Docker publish workflow Scans the built image for CRITICAL/HIGH CVEs on every release and uploads results to the GitHub Security tab. Non-blocking for now (exit-code 0) so releases aren't gated on findings. Also documents the scan and existing Dependabot coverage in the README. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-08-07 11:08:04 +02:00
</div>
<div className="admin-field">
security: add Trivy container scan to Docker publish workflow (#399) * feat(admin): add backup manager UI with 1-click restore * feat(admin): collapse older backup entries by default * fix(theme): isolate admin layout, instant DOM theme updates, and add Light/Dark mode toggle * feat(admin): replace text controls for Photo Frame and Hero Style with visual preview cards * fix(admin): define missing CSS rules for button system (.btn, .preset-btn) * feat(admin): redesign theme settings with segmented mode toggle, accent color swatches, and custom iOS-style toggle cards * feat(admin): upgrade all settings tabs with visual grid previews, Google SEO snippet preview, and toggle cards * feat(admin): overhaul Pages Builder UX with slide-over drawer, card hover badges, real-time search, and floating save bar * fix(admin): remove leftover dangling syntax snippet in PageBuilder.tsx * fix(admin): add position: relative to subpage-tile so hover overlay is contained inside the tile * style(admin): replace all emojis with clean Leica-style vector SVG icons * fix(types): extend IconProps with SVGProps to allow style prop on Leica SVG icons * feat(admin): add subpage live-preview, privacy analytics, and asset protection settings * fix(typecheck): fix AlbumEntry property access in subpage drawer preview mode * fix(types): fix ImmichAlbumInfo property names thumbnailAssetId and albumName in PageBuilder.tsx * fix(types): add protection and watermark optional properties to AppConfig interface * feat(settings): add toggle for disabling analytics tracking (defaults to enabled) * feat(ux): show status banner when analytics tracking is disabled + add live sync indicator * feat(watermark): render customizable watermark overlay on Lightbox images + rename section to Portfolio Features & Modules * fix(types): import type LightboxWatermark in PhotoGrid.tsx * fix(types): destructure watermark prop in PhotoGrid function signature * feat(seo): add configurable subpage title template and metadata descriptions * feat(seo): add generateMetadata to about page for title template support * feat(proofing): add client proofing, favorites selection, compact URL bitmasking, and export modal * feat(essay): add Photo Essay storytelling mode with RSC markdown parser and fullbleed/pair layouts * feat(subpages): add page enabled toggle to deactivate subpages without deleting them * feat(admin): add visual essay block builder for photo essay storytelling pages * security: add Trivy container scan to Docker publish workflow Scans the built image for CRITICAL/HIGH CVEs on every release and uploads results to the GitHub Security tab. Non-blocking for now (exit-code 0) so releases aren't gated on findings. Also documents the scan and existing Dependabot coverage in the README. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-08-07 11:08:04 +02:00
<label>Layout Algorithm</label>
<div className="preset-card-grid">
{LAYOUTS.map((l) => {
const info = {
release: v0.11.0 (#459) Ships `dev` as **v0.11.0**. `main` contains nothing that `dev` does not, so this is a clean sync. ## Headline changes since v0.10.0 - **Journal & Journal Studio** — photo essays at `/journal`, split-screen block editor with live preview, drafts, per-entry passwords, cover images - **First-run setup wizard at `/install`** — configure a fresh deployment from the browser; credentials are verified against Immich before anything is written, and the wizard is gated by a one-time token - **About page editor and toggle** in the admin panel - **Per-album photo order** independent of Immich, with a drag & drop editor - **Custom favicon upload** - **Experimental portfolio features** — justified grid, `cover` hero, unlisted subpages, per-album grid overrides, cover focal points, external nav links - **Security** — asset tokens length-capped before decoding (#423), journal author markdown escaped rather than filtered, journal file paths contained, admin session key derived with scrypt (#432), Next.js 16.3.0 for CVE-2025-13465 - **Fixed** — client proofing honours its own configuration again (#454); journal photo rendering (#432) Full detail in [CHANGELOG.md](CHANGELOG.md#0110--2026-08-15). ## Verified `npx tsc --noEmit` clean · `npx vitest run` 435 tests pass · `npm run build` succeeds · lint 0 errors · `prettier --check` clean · local `docker build` of the release tree. ## After merge Tag `v0.11.0` on `main` and publish the release — that triggers `docker-publish.yml`, which pushes the image and moves `latest`. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
2026-08-15 09:09:18 +02:00
masonry: {
label: 'Masonry',
desc: 'Dynamic pinterest-style staggered columns',
},
security: add Trivy container scan to Docker publish workflow (#399) * feat(admin): add backup manager UI with 1-click restore * feat(admin): collapse older backup entries by default * fix(theme): isolate admin layout, instant DOM theme updates, and add Light/Dark mode toggle * feat(admin): replace text controls for Photo Frame and Hero Style with visual preview cards * fix(admin): define missing CSS rules for button system (.btn, .preset-btn) * feat(admin): redesign theme settings with segmented mode toggle, accent color swatches, and custom iOS-style toggle cards * feat(admin): upgrade all settings tabs with visual grid previews, Google SEO snippet preview, and toggle cards * feat(admin): overhaul Pages Builder UX with slide-over drawer, card hover badges, real-time search, and floating save bar * fix(admin): remove leftover dangling syntax snippet in PageBuilder.tsx * fix(admin): add position: relative to subpage-tile so hover overlay is contained inside the tile * style(admin): replace all emojis with clean Leica-style vector SVG icons * fix(types): extend IconProps with SVGProps to allow style prop on Leica SVG icons * feat(admin): add subpage live-preview, privacy analytics, and asset protection settings * fix(typecheck): fix AlbumEntry property access in subpage drawer preview mode * fix(types): fix ImmichAlbumInfo property names thumbnailAssetId and albumName in PageBuilder.tsx * fix(types): add protection and watermark optional properties to AppConfig interface * feat(settings): add toggle for disabling analytics tracking (defaults to enabled) * feat(ux): show status banner when analytics tracking is disabled + add live sync indicator * feat(watermark): render customizable watermark overlay on Lightbox images + rename section to Portfolio Features & Modules * fix(types): import type LightboxWatermark in PhotoGrid.tsx * fix(types): destructure watermark prop in PhotoGrid function signature * feat(seo): add configurable subpage title template and metadata descriptions * feat(seo): add generateMetadata to about page for title template support * feat(proofing): add client proofing, favorites selection, compact URL bitmasking, and export modal * feat(essay): add Photo Essay storytelling mode with RSC markdown parser and fullbleed/pair layouts * feat(subpages): add page enabled toggle to deactivate subpages without deleting them * feat(admin): add visual essay block builder for photo essay storytelling pages * security: add Trivy container scan to Docker publish workflow Scans the built image for CRITICAL/HIGH CVEs on every release and uploads results to the GitHub Security tab. Non-blocking for now (exit-code 0) so releases aren't gated on findings. Also documents the scan and existing Dependabot coverage in the README. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-08-07 11:08:04 +02:00
uniform: { label: 'Uniform Grid', desc: 'Clean equal aspect ratio grid' },
release: v0.11.0 (#459) Ships `dev` as **v0.11.0**. `main` contains nothing that `dev` does not, so this is a clean sync. ## Headline changes since v0.10.0 - **Journal & Journal Studio** — photo essays at `/journal`, split-screen block editor with live preview, drafts, per-entry passwords, cover images - **First-run setup wizard at `/install`** — configure a fresh deployment from the browser; credentials are verified against Immich before anything is written, and the wizard is gated by a one-time token - **About page editor and toggle** in the admin panel - **Per-album photo order** independent of Immich, with a drag & drop editor - **Custom favicon upload** - **Experimental portfolio features** — justified grid, `cover` hero, unlisted subpages, per-album grid overrides, cover focal points, external nav links - **Security** — asset tokens length-capped before decoding (#423), journal author markdown escaped rather than filtered, journal file paths contained, admin session key derived with scrypt (#432), Next.js 16.3.0 for CVE-2025-13465 - **Fixed** — client proofing honours its own configuration again (#454); journal photo rendering (#432) Full detail in [CHANGELOG.md](CHANGELOG.md#0110--2026-08-15). ## Verified `npx tsc --noEmit` clean · `npx vitest run` 435 tests pass · `npm run build` succeeds · lint 0 errors · `prettier --check` clean · local `docker build` of the release tree. ## After merge Tag `v0.11.0` on `main` and publish the release — that triggers `docker-publish.yml`, which pushes the image and moves `latest`. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
2026-08-15 09:09:18 +02:00
showcase: {
label: 'Showcase',
desc: 'Featured hero photos mixed with smaller tiles',
},
filmstrip: {
label: 'Filmstrip',
desc: 'Horizontal scrollable film strip timeline',
},
'editorial-flow': {
label: 'Editorial Flow',
desc: 'Magazine story layout with varying photo sizes',
},
justified: {
label: 'Justified (Experimental)',
desc: 'Equal-height rows that fill the full width',
},
security: add Trivy container scan to Docker publish workflow (#399) * feat(admin): add backup manager UI with 1-click restore * feat(admin): collapse older backup entries by default * fix(theme): isolate admin layout, instant DOM theme updates, and add Light/Dark mode toggle * feat(admin): replace text controls for Photo Frame and Hero Style with visual preview cards * fix(admin): define missing CSS rules for button system (.btn, .preset-btn) * feat(admin): redesign theme settings with segmented mode toggle, accent color swatches, and custom iOS-style toggle cards * feat(admin): upgrade all settings tabs with visual grid previews, Google SEO snippet preview, and toggle cards * feat(admin): overhaul Pages Builder UX with slide-over drawer, card hover badges, real-time search, and floating save bar * fix(admin): remove leftover dangling syntax snippet in PageBuilder.tsx * fix(admin): add position: relative to subpage-tile so hover overlay is contained inside the tile * style(admin): replace all emojis with clean Leica-style vector SVG icons * fix(types): extend IconProps with SVGProps to allow style prop on Leica SVG icons * feat(admin): add subpage live-preview, privacy analytics, and asset protection settings * fix(typecheck): fix AlbumEntry property access in subpage drawer preview mode * fix(types): fix ImmichAlbumInfo property names thumbnailAssetId and albumName in PageBuilder.tsx * fix(types): add protection and watermark optional properties to AppConfig interface * feat(settings): add toggle for disabling analytics tracking (defaults to enabled) * feat(ux): show status banner when analytics tracking is disabled + add live sync indicator * feat(watermark): render customizable watermark overlay on Lightbox images + rename section to Portfolio Features & Modules * fix(types): import type LightboxWatermark in PhotoGrid.tsx * fix(types): destructure watermark prop in PhotoGrid function signature * feat(seo): add configurable subpage title template and metadata descriptions * feat(seo): add generateMetadata to about page for title template support * feat(proofing): add client proofing, favorites selection, compact URL bitmasking, and export modal * feat(essay): add Photo Essay storytelling mode with RSC markdown parser and fullbleed/pair layouts * feat(subpages): add page enabled toggle to deactivate subpages without deleting them * feat(admin): add visual essay block builder for photo essay storytelling pages * security: add Trivy container scan to Docker publish workflow Scans the built image for CRITICAL/HIGH CVEs on every release and uploads results to the GitHub Security tab. Non-blocking for now (exit-code 0) so releases aren't gated on findings. Also documents the scan and existing Dependabot coverage in the README. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-08-07 11:08:04 +02:00
}[l] || { label: l, desc: '' };
const isActive = (settings.grid?.layout || 'masonry') === l;
return (
<button
key={l}
type="button"
className={`preset-card grid-layout-card ${isActive ? 'active' : ''}`}
onClick={() => update('grid.layout', l)}
>
<div className="grid-card-preview">
<div className={`mini-layout-demo layout-demo-${l}`}>
{l === 'masonry' && (
<div className="demo-masonry-col-group">
release: v0.11.0 (#459) Ships `dev` as **v0.11.0**. `main` contains nothing that `dev` does not, so this is a clean sync. ## Headline changes since v0.10.0 - **Journal & Journal Studio** — photo essays at `/journal`, split-screen block editor with live preview, drafts, per-entry passwords, cover images - **First-run setup wizard at `/install`** — configure a fresh deployment from the browser; credentials are verified against Immich before anything is written, and the wizard is gated by a one-time token - **About page editor and toggle** in the admin panel - **Per-album photo order** independent of Immich, with a drag & drop editor - **Custom favicon upload** - **Experimental portfolio features** — justified grid, `cover` hero, unlisted subpages, per-album grid overrides, cover focal points, external nav links - **Security** — asset tokens length-capped before decoding (#423), journal author markdown escaped rather than filtered, journal file paths contained, admin session key derived with scrypt (#432), Next.js 16.3.0 for CVE-2025-13465 - **Fixed** — client proofing honours its own configuration again (#454); journal photo rendering (#432) Full detail in [CHANGELOG.md](CHANGELOG.md#0110--2026-08-15). ## Verified `npx tsc --noEmit` clean · `npx vitest run` 435 tests pass · `npm run build` succeeds · lint 0 errors · `prettier --check` clean · local `docker build` of the release tree. ## After merge Tag `v0.11.0` on `main` and publish the release — that triggers `docker-publish.yml`, which pushes the image and moves `latest`. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
2026-08-15 09:09:18 +02:00
<div className="demo-col">
<div className="demo-tile h-high" />
<div className="demo-tile h-low" />
</div>
<div className="demo-col">
<div className="demo-tile h-low" />
<div className="demo-tile h-high" />
</div>
<div className="demo-col">
<div className="demo-tile h-med" />
<div className="demo-tile h-med" />
</div>
security: add Trivy container scan to Docker publish workflow (#399) * feat(admin): add backup manager UI with 1-click restore * feat(admin): collapse older backup entries by default * fix(theme): isolate admin layout, instant DOM theme updates, and add Light/Dark mode toggle * feat(admin): replace text controls for Photo Frame and Hero Style with visual preview cards * fix(admin): define missing CSS rules for button system (.btn, .preset-btn) * feat(admin): redesign theme settings with segmented mode toggle, accent color swatches, and custom iOS-style toggle cards * feat(admin): upgrade all settings tabs with visual grid previews, Google SEO snippet preview, and toggle cards * feat(admin): overhaul Pages Builder UX with slide-over drawer, card hover badges, real-time search, and floating save bar * fix(admin): remove leftover dangling syntax snippet in PageBuilder.tsx * fix(admin): add position: relative to subpage-tile so hover overlay is contained inside the tile * style(admin): replace all emojis with clean Leica-style vector SVG icons * fix(types): extend IconProps with SVGProps to allow style prop on Leica SVG icons * feat(admin): add subpage live-preview, privacy analytics, and asset protection settings * fix(typecheck): fix AlbumEntry property access in subpage drawer preview mode * fix(types): fix ImmichAlbumInfo property names thumbnailAssetId and albumName in PageBuilder.tsx * fix(types): add protection and watermark optional properties to AppConfig interface * feat(settings): add toggle for disabling analytics tracking (defaults to enabled) * feat(ux): show status banner when analytics tracking is disabled + add live sync indicator * feat(watermark): render customizable watermark overlay on Lightbox images + rename section to Portfolio Features & Modules * fix(types): import type LightboxWatermark in PhotoGrid.tsx * fix(types): destructure watermark prop in PhotoGrid function signature * feat(seo): add configurable subpage title template and metadata descriptions * feat(seo): add generateMetadata to about page for title template support * feat(proofing): add client proofing, favorites selection, compact URL bitmasking, and export modal * feat(essay): add Photo Essay storytelling mode with RSC markdown parser and fullbleed/pair layouts * feat(subpages): add page enabled toggle to deactivate subpages without deleting them * feat(admin): add visual essay block builder for photo essay storytelling pages * security: add Trivy container scan to Docker publish workflow Scans the built image for CRITICAL/HIGH CVEs on every release and uploads results to the GitHub Security tab. Non-blocking for now (exit-code 0) so releases aren't gated on findings. Also documents the scan and existing Dependabot coverage in the README. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-08-07 11:08:04 +02:00
</div>
)}
{l === 'uniform' && (
<div className="demo-uniform-grid">
release: v0.11.0 (#459) Ships `dev` as **v0.11.0**. `main` contains nothing that `dev` does not, so this is a clean sync. ## Headline changes since v0.10.0 - **Journal & Journal Studio** — photo essays at `/journal`, split-screen block editor with live preview, drafts, per-entry passwords, cover images - **First-run setup wizard at `/install`** — configure a fresh deployment from the browser; credentials are verified against Immich before anything is written, and the wizard is gated by a one-time token - **About page editor and toggle** in the admin panel - **Per-album photo order** independent of Immich, with a drag & drop editor - **Custom favicon upload** - **Experimental portfolio features** — justified grid, `cover` hero, unlisted subpages, per-album grid overrides, cover focal points, external nav links - **Security** — asset tokens length-capped before decoding (#423), journal author markdown escaped rather than filtered, journal file paths contained, admin session key derived with scrypt (#432), Next.js 16.3.0 for CVE-2025-13465 - **Fixed** — client proofing honours its own configuration again (#454); journal photo rendering (#432) Full detail in [CHANGELOG.md](CHANGELOG.md#0110--2026-08-15). ## Verified `npx tsc --noEmit` clean · `npx vitest run` 435 tests pass · `npm run build` succeeds · lint 0 errors · `prettier --check` clean · local `docker build` of the release tree. ## After merge Tag `v0.11.0` on `main` and publish the release — that triggers `docker-publish.yml`, which pushes the image and moves `latest`. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
2026-08-15 09:09:18 +02:00
<div className="demo-tile" />
<div className="demo-tile" />
<div className="demo-tile" />
<div className="demo-tile" />
<div className="demo-tile" />
<div className="demo-tile" />
security: add Trivy container scan to Docker publish workflow (#399) * feat(admin): add backup manager UI with 1-click restore * feat(admin): collapse older backup entries by default * fix(theme): isolate admin layout, instant DOM theme updates, and add Light/Dark mode toggle * feat(admin): replace text controls for Photo Frame and Hero Style with visual preview cards * fix(admin): define missing CSS rules for button system (.btn, .preset-btn) * feat(admin): redesign theme settings with segmented mode toggle, accent color swatches, and custom iOS-style toggle cards * feat(admin): upgrade all settings tabs with visual grid previews, Google SEO snippet preview, and toggle cards * feat(admin): overhaul Pages Builder UX with slide-over drawer, card hover badges, real-time search, and floating save bar * fix(admin): remove leftover dangling syntax snippet in PageBuilder.tsx * fix(admin): add position: relative to subpage-tile so hover overlay is contained inside the tile * style(admin): replace all emojis with clean Leica-style vector SVG icons * fix(types): extend IconProps with SVGProps to allow style prop on Leica SVG icons * feat(admin): add subpage live-preview, privacy analytics, and asset protection settings * fix(typecheck): fix AlbumEntry property access in subpage drawer preview mode * fix(types): fix ImmichAlbumInfo property names thumbnailAssetId and albumName in PageBuilder.tsx * fix(types): add protection and watermark optional properties to AppConfig interface * feat(settings): add toggle for disabling analytics tracking (defaults to enabled) * feat(ux): show status banner when analytics tracking is disabled + add live sync indicator * feat(watermark): render customizable watermark overlay on Lightbox images + rename section to Portfolio Features & Modules * fix(types): import type LightboxWatermark in PhotoGrid.tsx * fix(types): destructure watermark prop in PhotoGrid function signature * feat(seo): add configurable subpage title template and metadata descriptions * feat(seo): add generateMetadata to about page for title template support * feat(proofing): add client proofing, favorites selection, compact URL bitmasking, and export modal * feat(essay): add Photo Essay storytelling mode with RSC markdown parser and fullbleed/pair layouts * feat(subpages): add page enabled toggle to deactivate subpages without deleting them * feat(admin): add visual essay block builder for photo essay storytelling pages * security: add Trivy container scan to Docker publish workflow Scans the built image for CRITICAL/HIGH CVEs on every release and uploads results to the GitHub Security tab. Non-blocking for now (exit-code 0) so releases aren't gated on findings. Also documents the scan and existing Dependabot coverage in the README. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-08-07 11:08:04 +02:00
</div>
)}
{l === 'showcase' && (
<div className="demo-showcase-grid">
release: v0.11.0 — journal fixes, admin URLs, design system cleanup (#432) * fix(screenshots): sharp-Typen fuer 0.34 und 0.35 gleichzeitig (#410) sharp 0.35 ist von `export =` auf ESM umgestellt: der Modul-Namespace ist nicht mehr aufrufbar, die Factory sitzt unter .default. Der Type-Check brach damit in scripts/screenshots.ts weg, sobald der Next-Bump (#402) sharp von 0.34.5 auf 0.35.3 mitzieht -- sharp ist hier keine deklarierte Dependency, sondern kommt ueber Next mit. Die Form wird jetzt aus dem installierten Paket abgeleitet statt festgeschrieben, zur Laufzeit wie im Typ. Geprueft mit beiden Versionen: tsc laeuft mit 0.34.5 und mit 0.35.3 fehlerfrei durch. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(deps): bump the nextjs group across 1 directory with 2 updates (#402) Bumps the nextjs group with 2 updates in the / directory: [next](https://github.com/vercel/next.js) and [eslint-config-next](https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next). Updates `next` from 16.2.12 to 16.3.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/compare/v16.2.12...v16.3.0) Updates `eslint-config-next` from 16.2.12 to 16.3.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/commits/v16.3.0/packages/eslint-config-next) --- updated-dependencies: - dependency-name: eslint-config-next dependency-version: 16.3.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: nextjs - dependency-name: next dependency-version: 16.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nextjs ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps-dev): bump prettier from 3.8.3 to 3.9.6 (#405) Bumps [prettier](https://github.com/prettier/prettier) from 3.8.3 to 3.9.6. - [Release notes](https://github.com/prettier/prettier/releases) - [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md) - [Commits](https://github.com/prettier/prettier/compare/3.8.3...3.9.6) --- updated-dependencies: - dependency-name: prettier dependency-version: 3.9.6 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * docs(changelog): Unreleased-Sektion fuer die Bumps nach v0.10.0 (#413) Die Dependency-PRs sind nach dem Release auf dev gelandet, teils auch auf main. Ohne Eintrag waeren sie beim naechsten Release unsichtbar -- inklusive Next 16.3.0, das CVE-2025-13465 mitbringt. Ausserdem im 0.10.0-Abschnitt nachgetragen, dass der Trivy-Scan bis #409 nie gelaufen ist. Der Fix steckt im Tag v0.10.0, fehlte aber in der Aufzaehlung -- und "Images werden bei jedem Publish gescannt" stand im Changelog, waehrend der Job im Action-Setup abbrach. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(gallery): per-album sort order, independent of Immich (#408) (#414) Album order was dictated entirely by Immich: getAlbum() sorted by the album's own asc/desc flag, so a Folio album always mirrored the archive. A curated series has a narrative order that has nothing to do with capture time, and changing the Immich album's sort to fit the website changes it for the archive too. Adds an optional per-album `sort` in gallery.yaml, editable in /admin, defaulting to today's behaviour so every existing config is unchanged: immich (default) | newest | oldest | filename | manual `manual` is a pinned *prefix*: `assetOrder` lists only the photos placed by hand, everything else follows in the album's Immich order. A full permutation of a 2,000-photo album would be ~80 KB of UUIDs in a file that is rewritten and copied to content/.backups/ on every admin save. It also makes drift fall out for free — photos removed in Immich never match, new ones land in the tail rather than being hidden. Sorting is applied after the cache read, not before the cache write, so the LRU keeps one canonical Immich-ordered copy per album. That avoids putting the mode in the cache key, lets a config change take effect without depending on invalidation, and keeps the stale-serving path correct. cache.get() returns the stored object by reference, so withSort() returns a shallow clone with a new array — sorting in place would reorder the shared entry, and under request coalescing every concurrent caller would be sorting the same array. Also fixes a prerequisite bug: /api/admin/albums/[albumId]/assets read album.assets from GET /albums/:id, which Immich 3.x no longer populates (lib/immich.ts:507). The hero picker's "This Album" tab returned nothing and threw outright when the key was absent. It now goes through the client's paginated metadata search, with ?types=all to opt videos in for the reorder editor. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): drop decorative emoji from the sort select labels (#415) An <option> cannot contain markup, so the SVG set in Icons is not reachable there — but a decorative emoji is not a substitute for it. Plain text instead; the album card badge already uses a real icon. The remaining emoji in the admin panel (asset picker tabs, section headings, layout picker options) predate this branch and are left for a separate cleanup. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): replace emoji icons with the shared SVG icon set (#416) The admin panel mixed two icon conventions: inline SVGs from `Icons.tsx` in most components, and decorative emoji in the asset picker and a few PageBuilder labels. Emoji render inconsistently across platforms, ignore the accent colour, and cannot inherit the `.svg-icon` sizing rules. - Icons.tsx: add `IconStar` (filled — it marks a state, not an action) and `IconImage`. - AssetPicker: the three tab labels and the favourite tile badge now use IconFolder / IconStar / IconImage. - PageBuilder: the "Standalone Albums" and "Subpages" headings use the icon set instead of an emoji. - PageBuilder: the layout picker drops its emoji for plain text. An <option> cannot contain markup, so an SVG is impossible there and a decorative glyph is not a substitute. - admin.css: align icon and label in the picker tabs, and swap the favourite badge's text-shadow for drop-shadow, which is what applies to an inline SVG. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): fold PageBuilder's local icons into the shared Icons module (#418) * refactor(admin): fold PageBuilder's local icons into the shared module PageBuilder.tsx carried its own `Icons` object duplicating most of the glyphs already exported by Icons.tsx, with hardcoded sizes and slightly divergent paths. Migrate all 32 call sites to the shared module and delete the local object. Five glyphs had no counterpart and are added to Icons.tsx as 1:1 ports of the local paths: IconX, IconPlus, IconHome, IconCopy, IconImage. The local ExternalLink and Check are dropped rather than ported — both had zero call sites. Two glyphs change shape slightly, which is the point of consolidating: the shared IconCamera includes the viewfinder bump the local copy omitted, and drag handles now use IconGripVertical. IconGripVertical uses the module's square 24x24 viewBox, so `.svg-drag` goes from 12x18 to 18x18 — the old non-square box would letterbox the glyph down to 12x12 and shrink the handle. * fix(admin): resolve icon-module integration after #416 Merging dev brought in #416, which added a second IconImage to Icons.tsx and two <Icons.Camera>/<Icons.Folder> section headers that reference the local Icons object this PR removes. Git merged both cleanly but the result did not type-check. - drop the duplicate IconImage (both copies were byte-identical) - point the two section headers at the imported IconCamera/IconFolder - refresh the SORT_LABELS comment: the icon set is imported now, not declared below --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> * fix(config): allow an empty gallery, guard against a double /api suffix (#421) An empty gallery is now a valid, rendered state instead of a throw: deriveGallery() no longer requires at least one album or subpage, so a deployment with no albums yet renders a bare homepage the owner can fill in via /admin. getConfig() also stops appending /api to an Immich URL that already ends in it, which previously produced .../api/api and broke every upstream request. Includes a restore of the per-album sort test cases, which the branch had lost by being cut before #408/#414. * feat(admin): favicon upload, served from the content volume (#422) Adds a bundled default favicon, an upload widget in admin Settings > General, and a route that serves the icon from the writable content/ volume with a fallback to the bundled default. Raster uploads (PNG/ICO/JPEG) are wrapped in an SVG container; the response carries its own CSP so an uploaded SVG cannot execute script on the origin. The GET route revalidates with an ETag instead of caching immutably, so a newly uploaded icon shows up immediately. Uploads are written via temp file + rename, and a Reset button restores the bundled default. * ci: flag unformatted files in a PR, without blocking it (#424) Prettier is configured as an error rule in eslint.config.mjs but has never run in CI, so part of the tree predates it. A final CI step now diffs against the PR base, runs prettier --list-different over the changed files, and emits a warning annotation per offender plus a job summary. Advisory by design: it never fails the job. Blocking would turn a PR red for merely touching a file that was already unformatted, and normalising the tree in one commit would wreck git blame and conflict with the PRs in flight. Requires fetch-depth: 0, since diffing against the base needs its history. * feat(install): first-run wizard gated by a one-time setup token (#419) Adds /install, a four-step first-run wizard: connect to Immich, optionally pick albums, name the site, finish. It verifies the credentials against the Immich server before writing anything, then writes gallery.yaml, settings.yaml and a content/install.json carrying the Immich credentials and a generated site secret. install.json exists because a running process cannot pick up new env vars — the wizard has to write configuration that takes effect without a restart. getInstallCredentials() merges it under the real environment, so env vars always win and rotation stays a matter of setting one. Both the page and the API routes are gated by a one-time setup token printed to the server log, so a deployment that is reachable before gallery.yaml exists cannot be configured by whoever finds it first. The token is stored in content/.setup-token (0600) rather than a module variable: Next.js bundles the page and each route handler separately, so a module-level token left the page and the API disagreeing inside one process and the wizard stuck on step 1. It is removed once the install completes. The admin password is stored as an scrypt hash using the scheme lib/auth.ts already applies to album passwords; a plaintext ADMIN_PASSWORD env var keeps working. * docs: document the setup wizard, fix the read-only content mount (#425) Quick Start now leads with the /install wizard, with the hand-written YAML route kept alongside it, and a First-Run Setup section covers the setup token, the files the wizard writes, and env-var precedence. Two corrections: both Docker examples mounted content/ as :ro, which silently breaks the wizard, the admin panel and the backup rotation alike — docs/admin-panel.md already said so and the README contradicted it. And nothing documented that content/install.json holds the Immich API key, so a backup of content/ is a backup of credentials. Also adds a Contributors section crediting the people whose work is in the project. * feat(admin): floating save bar pinned to the bottom of the viewport (#426) The save bar was the first, static element inside .admin-main. Since the document itself scrolls, it left the viewport as soon as you scrolled down — editing a subpage section or a settings block far below gave no visible dirty hint and no reachable save button. Replace it with a bottom-pinned floating bar shared by both editors. It only mounts while there is something to act on (unsaved changes, an in-flight save, or a result message), so it never covers content while idle. The success message clears after 5s, which hides the bar again. - new SaveBar component, replacing the duplicated markup in PageBuilder and SettingsEditor - adopt the previously unused .floating-save-bar CSS: slide-in keyframes (carrying translateX(-50%)), dirty border, wrap/gap, mobile variant and a prefers-reduced-motion opt-out; z-index 900 keeps it below modals - .admin-main gains bottom padding so the bar never covers page content - drop the now-unreachable idle hints: the ⌘S hint becomes a button title, the Live Sync note becomes a static line above the settings layout - header "Site" link now bypasses the cache (/?fresh=1), so the preview stays reachable when the bar is hidden Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(admin): themed listbox for the album sort control (#427) The per-album "Photo order" control was a native <select>. Because an <option> cannot contain markup, its choices could not use the admin panel's currentColor SVG set — the reason #415 had to fall back to plain text after dropping the emoji labels. Adds a Listbox component implementing the ARIA combobox/listbox pattern, so options can render a glyph beside their label: - DOM focus stays on the trigger button; the active option is announced through aria-activedescendant, keeping focus management to one element - Keyboard: arrows (clamped at the ends, like a native select), Home/End, Enter/Space to commit, Escape to cancel, Tab commits and moves on, and prefix type-ahead with a repeat-key cycle - Outside dismissal on pointerdown, so a press starting outside closes the popup before the click retargets The sort options now carry an icon each: calendar, arrow-down, arrow-up, an A→Z marker, and the drag glyph for manual — matching the badge the album card already shows. SORT_LABELS stays plain text because the badge feeds it to a title attribute. Closes #417 Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(git): ignore generated design handoff folders * fix(admin): stop the album sort dropdown clipping, and simplify the panel (#428) * fix(admin): render listbox popup in a portal so it escapes modal clipping The sort control's popup was position:absolute inside three clipping ancestors (.album-drawer overflow:hidden > .album-drawer-body overflow-y:auto > .modal-right-column overflow-y:auto), so it was cut off at the bottom of the Edit Album Details modal. z-index could not help: clipping happens before stacking. It also always hung below the trigger, with no flip. Portal the popup to document.body and position it from the trigger's viewport rect, flipping above when there is more room there and capping max-height to the space available so it scrolls internally rather than overflowing. It is dismissed on scroll and resize, since the anchor is only measured on open. The outside-pointerdown handler now also treats the popup as inside; without that the portalled list counts as outside, and a click on an option would close it before the selection commits. * refactor(admin): single-column album details panel The left column spent 1.2fr on a cover thumbnail and three stat rows, two of which (Status, Custom Hero) only restated the form fields opposite them, while the form itself was squeezed into 1.8fr behind a second nested scroller. Stack the drawer in one column instead: cover as a banner, then the form at full width, with the UUID moved into the footer. The body is now the only scroll container, which also removes one of the ancestors that was clipping the sort popup. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> * fix(admin): give the portalled listbox its theme back, lock the page behind modals (#429) Two defects in the album editor. The sort listbox popup painted transparent. Every --admin-* variable is scoped to .admin-layout, and since the popup moved into document.body it sits outside that subtree, so background/border/text all resolved to nothing. It now carries its own copy of the palette in both colour schemes, plus the font it no longer inherits. Scrolling inside a modal also moved the page behind it. No admin modal ever locked body scroll: the overlay covers the page but does not absorb wheel events, so a scroll starting on the backdrop — or continuing past the end of the modal's own scroller — reaches the document. overscroll-behavior cannot cover that case on its own, because it only applies to scroll containers and the backdrop is not one. useScrollLock freezes body while a modal is open and compensates for the width the scrollbar gives up, so nothing shifts underneath. Each lock restores the inline value it found, which makes nesting work without a counter — a picker opened from the drawer restores the drawer's hidden state instead of clearing it. Applied to both drawers and all four picker modals, which share the defect. overscroll-behavior: contain on the scrollers stops the chaining they can handle themselves. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com> * fix(security): allow unsafe-eval in CSP script-src during dev mode * feat(journal): add Journal Studio with split-screen editor, live preview and dedicated routes * fix(build): separate client parser from server journal-service and fix build type errors * fix(journal): Fotos rendern, Layout und Lightbox-Steuerung korrigieren Fünf unabhängige Fehler in der öffentlichen Journal- und Essay-Ansicht: * Foto-Blöcke wurden nie angezeigt. EssayView löst ein Foto über PhotoItem.id auf, und das sind verschlüsselte Tokens — die Blöcke aus dem Markdown tragen aber rohe Asset-UUIDs. Jede Zuordnung lief ins Leere, und nicht auflösbare Blöcke werden still verworfen. Die IDs werden jetzt serverseitig übersetzt; damit verschwinden nebenbei die rohen UUIDs aus dem Client-Payload, die dort laut Projektregel nie auftauchen dürfen. Nicht auflösbare Referenzen werden geloggt. * Überschriften standen weiter links als der Fließtext. Jeder Block hatte einzeln `max-width: 68ch`, und `ch` ist relativ zur Schrift des Elements — die Serif-Überschrift ergab eine breitere Spalte. Ersetzt durch eine gemeinsame, font-unabhängige `--essay-measure`. * Fullbleed-Fotos bluteten nur nach links aus: `.essay-figure` ist `width: 100%`, wodurch die Box überbestimmt ist und der negative rechte Margin verworfen wird. * Foto-Paare stellten beide Bilder gleich breit dar, wodurch ein Hochformat neben einem Querformat doppelt so hoch wurde. Jetzt eine Justified-Reihe: Breite proportional zum Seitenverhältnis, dadurch exakt gleiche Höhen ohne Beschnitt. * Die Lightbox hatte im Journal keine Tastatursteuerung und keine Scroll-Sperre — beides lag in PhotoGrid, also nur im Album-Raster. Verlagert in die Lightbox selbst, der doppelte Handler in PhotoGrid entfernt (sonst wäre pro Pfeildruck zwei Bilder weitergesprungen). Zusätzlich sind Proofing-Herzen und das EXIF-Panel im redaktionellen Modus abschaltbar und im Journal aus: Client-Proofing ist ein Übergabe-Workflow für Alben, keine Funktion einer Reportage. Auf der Übersicht wurde der Untertitel doppelt gerendert, weil extractExcerpt() auf ihn zurückfällt. * feat(admin): eigene URLs für alle Bereiche und überarbeiteter Journal Studio Das Panel war eine einzige Client-Komponente, die ihre Tabs über useState umschaltet: keine Route pro Bereich, kein Deep-Link, kein Zurück-Button, und nach jedem Reload landete man wieder auf "Pages". Auch der Journal-Editor hatte keine eigene URL. Jetzt sieben echte Routen (/admin, /admin/pages, /admin/journal, /admin/journal/<slug>, /admin/settings, /admin/settings/<section>, /admin/analytics). Die Shell mit Auth-Prüfung und Kopfzeile sitzt im Layout und umschließt children — so bleibt die Session-Prüfung über Routenwechsel montiert, statt bei jedem Tab-Wechsel neu zu laufen und den Spinner aufblitzen zu lassen. Unbekannte Settings-Sections fallen auf General zurück. Im selben Zug der Journal Studio, der die Routing-Änderung ohnehin berührt: * Alle Eingabefelder nutzten die Klasse `admin-input`, die in keinem CSS definiert war — sie fielen auf Browser-Defaults zurück. Jetzt gestylt, gescoped, damit der generische Name nicht ins übrige Panel leckt. * Der Split View ist per Divider verschiebbar (Maus, Tastatur, Doppelklick zum Zurücksetzen), Breite in localStorage. * Das Studio bricht aus der 1120px-Spalte aus, die Preview hat Platz. * Die Preview zeigte für jedes Foto fest 3:2 und log damit über das Layout der veröffentlichten Seite; die echten Verhältnisse werden jetzt an den Thumbnails gemessen. * Blöcke mit alten positionsbasierten Foto-Referenzen werden markiert — die lassen sich auf einer eigenständigen Journal-Seite nicht auflösen und verschwanden bisher stillschweigend. * Blocktyp-Chips als gemeinsame Komponente, monochrom und per Icon unterschieden statt in einer eigenen Blau/Lila/Orange-Palette, die sonst nirgends im Panel vorkommt. * Emojis raus, SVG-Icons rein. * fix(admin): Designsystem-Lücken im Panel schließen Eine systematische Suche nach Klassen, die im TSX benutzt, aber in keinem CSS definiert sind, hat vier Stellen mit demselben Muster gefunden: * `admin-btn-secondary` und `admin-btn-danger` existierten nicht. Sämtliche Löschen-Buttons sahen aus wie normale Buttons — keine Warnwirkung. Als `.admin-btn.admin-btn-danger` geschrieben, weil die Varianten mit den Größenklassen kombiniert werden, die weiter unten ihren eigenen Hintergrund setzen. * `page-progress-fill` fehlte: die Balken im Analytics-Panel waren leere Rinnen, der Wert unsichtbar. Ebenso `analytics-empty` und `admin-loading-container`. * `subpage-drawer-section`, `subpage-drawer-title-group` und `input-with-icon` im PageBuilder waren wirkungslos und teils mit Inline-Styles notdürftig kompensiert. * `grid-card-preview` fehlte, wodurch alle Layout-Vorschauen auf Höhe null kollabierten. Nur "Showcase" war sichtbar — und das aus Versehen, weil sein Tile `hero-tile` hieß und damit die `aspect-ratio` einer fremden PageBuilder-Klasse erbte. Umbenannt. Dazu die Theme-Vorschauen, die praktisch identisch aussahen: alle sieben zeigten dieselben drei quadratischen Kacheln, einziger Unterschied war die Hintergrundfarbe. Sie spiegeln jetzt die echten Preset-Daten aus lib/config/theme.ts — Schriftcharakter, Eckradius, Rasterdichte, Passepartout bzw. Schatten. Die Kopfzeile richtet sich an einer gemeinsamen Steuerhöhe aus. Der "Site"-Link war höher als die Buttons daneben: `.admin-btn` hatte keine explizite line-height, und <button> bekommt box-sizing: border-box vom Browser, <a> nicht. Die Statusanzeige setzte weder Schriftfamilie noch -größe und fiel auf den Browser-Default zurück — sie war nie Teil des Designsystems. Jetzt gleiche Höhe und Typografie, Pillenform als Zustandsanzeige, Trenner zur Aktionsgruppe. Das dauerhafte Pulsieren des grünen Punkts entfällt; Animation bleibt den Zuständen vorbehalten, die Aufmerksamkeit brauchen. Restliche Emojis durch SVG-Icons ersetzt. * feat(admin): add scroll-to-top toggle and SVG arrow The back-to-top button was always on and drew its arrow with the ↑ text character. Add a `scrollToTop` setting (General section in the admin panel, defaults to on so existing sites are unaffected) and replace the glyph with a stroked SVG that inherits currentColor across all presets. Scroll handling is now rAF-throttled, and prefers-reduced-motion turns off both the hover lift and the smooth scroll. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * security(journal): escape author HTML instead of filtering it CodeQL flags 26 high-severity alerts on the release PR; the bulk of them point at sanitizeHtml(), a denylist of three regexes whose output goes into dangerouslySetInnerHTML. I reproduced the bypasses before changing anything — all four pass the old filter: <img src=x onerror=alert(1)> unquoted handler, regex wants quotes <img src=x onerror='alert(1)'> single quotes, same reason <svg onload=alert(1)> not a <script> tag javasjavascript:cript:alert(1) one-pass replace, the rest recombines Plus an attribute breakout in the link renderer, which interpolated the URL into href="${url}" unescaped: [x](" onmouseover=alert(1) x=") -> <a href="" onmouseover=alert(1" ...> Replaced with escaping. Every `&<>"'` in author text becomes an entity before any markdown rule runs, so the only tags in the output are the ones renderInlineMarkdown builds itself and a URL cannot leave its attribute. Link schemes are now an allowlist (http, https, mailto, tel, relative, anchor); anything else renders as plain text. The serializer needed decodeHtmlEntities to match: without it a save would write `&lt;` into the Markdown file and the next parse would escape the `&` again, corrupting the text further on every round trip. A test covers parse -> serialize -> parse stability. Two existing tests asserted the old behaviour and were rewritten rather than deleted: one expected the script tag to be *removed* from the output, the other expected the substring "onerror" to be absent. Both now assert the property that matters — that no tag can form — because `onerror` surviving as inert text is fine. Exploitation required admin access either way: journal and essay text comes from the studio or from content/*.md. This removes the weakness, it does not close an open door. * fix(journal): contain file paths, fix frontmatter escaping, defuse two regexes Follow-up to the CodeQL findings on release PR #432. I went through all 23 alerts individually; this addresses the ones that are worth addressing and documents the ones that are not. Path containment (12 alerts, all false positives). Every path built from a slug goes through isValidSlug(), a strict `/^[a-zA-Z0-9_-]+$/` allowlist — verified against `../../etc/passwd`, `foo/../../bar`, `a/b`, `..` and friends, all rejected. CodeQL cannot see it because the check lives in another module. Added a containedPath() helper that resolves the path and refuses anything landing outside the content directory: a second lock on a door that was already locked, and a barrier the analysis can follow. Also removed the dead `slug.endsWith('.md')` branches — isValidSlug rejects dots, so they could never be taken. Frontmatter escaping (1 alert, a real bug). The serializer escaped `"` but not `\`, and the parser never unescaped anything. A title containing either character gained a backslash on every save/load cycle: Path C:\Users "quoted" -> Path C:\\Users \"quoted\" -> ... Escaping now covers the backslash first and the parser undoes both. A round trip test covers quotes, backslashes, colons and apostrophes. Two of three ReDoS regexes (2 alerts). The heading pattern had `\s+` next to `(.+)`, which overlap, so the engine tried every split of the whitespace run before failing; it is `[ \t]+` and `(\S.*)` now. The quote author pattern wrapped a lazy group around an optional group — the quadratic case — and is an index split on the first separator now. The third regex, the bold/italic pass, is deliberately left alone. Rewriting it with a negated class removes the backtracking but breaks nesting: `**bold *and italic* here**` renders as `*<em>bold </em>and italic<em> here</em>*`. The input is Markdown from an authenticated admin, never a visitor, so the worst case is an author slowing down their own page. The comment in the code says so. Not addressed: 5 js/insufficient-password-hash alerts. They ask for a slow KDF where the code uses SHA-256/HMAC — correct in general, but the admin password comes from an environment variable and is never stored, so a stronger KDF protects nothing that is not already in plaintext in the environment. 399 unit tests pass (18 new), build and tsc clean. * fix(journal): split the quote author by scanning, not by pattern Cleaning up after myself. #439 replaced the quote author regex `/^(.*?)(?:\s+--\s+(.+))?$/` — a lazy group around an optional one, the quadratic case — with `/\s+--\s+/`, and CodeQL promptly flagged the replacement for the same reason. One reported pattern traded for another. splitQuoteAuthor() scans for the first `--` that has whitespace on both sides. Linear, and it needs no reasoning about the regex engine at all. Behaviour is identical to the original regex, checked case by case against it: separator, no separator, several separators, tabs, wide gaps, `a--b` without spaces, leading and trailing separators, empty string. All nine are covered by tests, plus one asserting it stays fast on a 50k whitespace run. * security(admin): derive the session signing key with scrypt getSigningKey() ran the admin password through a single SHA-256 digest. It is key derivation rather than password storage, so it was never a stored-hash problem — but if the derived key ever leaked, one fast hash makes recovering the password by brute force cheap. CodeQL flags it as js/insufficient-password-hash and, for this particular alert, has a point. scrypt now. Two details that matter: The salt has to be stable. A random salt would produce a different key on every call and invalidate every session; it is derived from AUTH_SECRET, which is deployment-specific. Verified across separate processes: same inputs produce a verifying token, so a restart or redeploy does not log everyone out. The result is cached for the process lifetime. scrypt is deliberately slow and getSigningKey() runs on every admin request — deriving per call would add ~24ms to each one. The cache key is a digest of secret plus password, so a rotation misses the cache and derives again, and no extra plaintext copy of the password is kept around. Measured: first derivation 24ms, subsequent calls 0.12ms. Password change and secret change both invalidate an existing token, checked in separate processes. Note the one-time effect: existing admin sessions are invalidated by the change in derivation, so everyone logs in once more. * security(admin): key the signing-key cache on its inputs, not a digest #441 removed the SHA-256 digest of the admin password from the key derivation and introduced a new one three lines above it, as the cache key. Same rule, same file: CodeQL reported it immediately. The comment justifying it was wrong too. It claimed no second plaintext copy of the password was retained, while building the digest input allocates exactly that in order to hash it. The cache now holds the two input strings and compares them directly. They are the same objects the env and install caches already hold, so nothing extra is retained, and no fast hash of the password exists in memory for the life of the process. Re-verified after the change, in separate processes: a token from one process verifies in another with the same inputs, a changed password or secret rejects it, first derivation 24ms, cached calls 0.001ms. That leaves scrypt as the only place the password is hashed here. The two HMACs further down operate on the derived key and on token data, not on the password; the constant-time comparison in verifyAdminPassword is the previously dismissed one. --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
2026-08-14 16:55:07 +02:00
<div className="demo-tile demo-hero" />
release: v0.11.0 (#459) Ships `dev` as **v0.11.0**. `main` contains nothing that `dev` does not, so this is a clean sync. ## Headline changes since v0.10.0 - **Journal & Journal Studio** — photo essays at `/journal`, split-screen block editor with live preview, drafts, per-entry passwords, cover images - **First-run setup wizard at `/install`** — configure a fresh deployment from the browser; credentials are verified against Immich before anything is written, and the wizard is gated by a one-time token - **About page editor and toggle** in the admin panel - **Per-album photo order** independent of Immich, with a drag & drop editor - **Custom favicon upload** - **Experimental portfolio features** — justified grid, `cover` hero, unlisted subpages, per-album grid overrides, cover focal points, external nav links - **Security** — asset tokens length-capped before decoding (#423), journal author markdown escaped rather than filtered, journal file paths contained, admin session key derived with scrypt (#432), Next.js 16.3.0 for CVE-2025-13465 - **Fixed** — client proofing honours its own configuration again (#454); journal photo rendering (#432) Full detail in [CHANGELOG.md](CHANGELOG.md#0110--2026-08-15). ## Verified `npx tsc --noEmit` clean · `npx vitest run` 435 tests pass · `npm run build` succeeds · lint 0 errors · `prettier --check` clean · local `docker build` of the release tree. ## After merge Tag `v0.11.0` on `main` and publish the release — that triggers `docker-publish.yml`, which pushes the image and moves `latest`. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
2026-08-15 09:09:18 +02:00
<div className="demo-col">
<div className="demo-tile" />
<div className="demo-tile" />
</div>
security: add Trivy container scan to Docker publish workflow (#399) * feat(admin): add backup manager UI with 1-click restore * feat(admin): collapse older backup entries by default * fix(theme): isolate admin layout, instant DOM theme updates, and add Light/Dark mode toggle * feat(admin): replace text controls for Photo Frame and Hero Style with visual preview cards * fix(admin): define missing CSS rules for button system (.btn, .preset-btn) * feat(admin): redesign theme settings with segmented mode toggle, accent color swatches, and custom iOS-style toggle cards * feat(admin): upgrade all settings tabs with visual grid previews, Google SEO snippet preview, and toggle cards * feat(admin): overhaul Pages Builder UX with slide-over drawer, card hover badges, real-time search, and floating save bar * fix(admin): remove leftover dangling syntax snippet in PageBuilder.tsx * fix(admin): add position: relative to subpage-tile so hover overlay is contained inside the tile * style(admin): replace all emojis with clean Leica-style vector SVG icons * fix(types): extend IconProps with SVGProps to allow style prop on Leica SVG icons * feat(admin): add subpage live-preview, privacy analytics, and asset protection settings * fix(typecheck): fix AlbumEntry property access in subpage drawer preview mode * fix(types): fix ImmichAlbumInfo property names thumbnailAssetId and albumName in PageBuilder.tsx * fix(types): add protection and watermark optional properties to AppConfig interface * feat(settings): add toggle for disabling analytics tracking (defaults to enabled) * feat(ux): show status banner when analytics tracking is disabled + add live sync indicator * feat(watermark): render customizable watermark overlay on Lightbox images + rename section to Portfolio Features & Modules * fix(types): import type LightboxWatermark in PhotoGrid.tsx * fix(types): destructure watermark prop in PhotoGrid function signature * feat(seo): add configurable subpage title template and metadata descriptions * feat(seo): add generateMetadata to about page for title template support * feat(proofing): add client proofing, favorites selection, compact URL bitmasking, and export modal * feat(essay): add Photo Essay storytelling mode with RSC markdown parser and fullbleed/pair layouts * feat(subpages): add page enabled toggle to deactivate subpages without deleting them * feat(admin): add visual essay block builder for photo essay storytelling pages * security: add Trivy container scan to Docker publish workflow Scans the built image for CRITICAL/HIGH CVEs on every release and uploads results to the GitHub Security tab. Non-blocking for now (exit-code 0) so releases aren't gated on findings. Also documents the scan and existing Dependabot coverage in the README. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-08-07 11:08:04 +02:00
</div>
)}
{l === 'filmstrip' && (
<div className="demo-filmstrip-row">
release: v0.11.0 (#459) Ships `dev` as **v0.11.0**. `main` contains nothing that `dev` does not, so this is a clean sync. ## Headline changes since v0.10.0 - **Journal & Journal Studio** — photo essays at `/journal`, split-screen block editor with live preview, drafts, per-entry passwords, cover images - **First-run setup wizard at `/install`** — configure a fresh deployment from the browser; credentials are verified against Immich before anything is written, and the wizard is gated by a one-time token - **About page editor and toggle** in the admin panel - **Per-album photo order** independent of Immich, with a drag & drop editor - **Custom favicon upload** - **Experimental portfolio features** — justified grid, `cover` hero, unlisted subpages, per-album grid overrides, cover focal points, external nav links - **Security** — asset tokens length-capped before decoding (#423), journal author markdown escaped rather than filtered, journal file paths contained, admin session key derived with scrypt (#432), Next.js 16.3.0 for CVE-2025-13465 - **Fixed** — client proofing honours its own configuration again (#454); journal photo rendering (#432) Full detail in [CHANGELOG.md](CHANGELOG.md#0110--2026-08-15). ## Verified `npx tsc --noEmit` clean · `npx vitest run` 435 tests pass · `npm run build` succeeds · lint 0 errors · `prettier --check` clean · local `docker build` of the release tree. ## After merge Tag `v0.11.0` on `main` and publish the release — that triggers `docker-publish.yml`, which pushes the image and moves `latest`. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
2026-08-15 09:09:18 +02:00
<div className="demo-tile strip" />
<div className="demo-tile strip" />
<div className="demo-tile strip" />
security: add Trivy container scan to Docker publish workflow (#399) * feat(admin): add backup manager UI with 1-click restore * feat(admin): collapse older backup entries by default * fix(theme): isolate admin layout, instant DOM theme updates, and add Light/Dark mode toggle * feat(admin): replace text controls for Photo Frame and Hero Style with visual preview cards * fix(admin): define missing CSS rules for button system (.btn, .preset-btn) * feat(admin): redesign theme settings with segmented mode toggle, accent color swatches, and custom iOS-style toggle cards * feat(admin): upgrade all settings tabs with visual grid previews, Google SEO snippet preview, and toggle cards * feat(admin): overhaul Pages Builder UX with slide-over drawer, card hover badges, real-time search, and floating save bar * fix(admin): remove leftover dangling syntax snippet in PageBuilder.tsx * fix(admin): add position: relative to subpage-tile so hover overlay is contained inside the tile * style(admin): replace all emojis with clean Leica-style vector SVG icons * fix(types): extend IconProps with SVGProps to allow style prop on Leica SVG icons * feat(admin): add subpage live-preview, privacy analytics, and asset protection settings * fix(typecheck): fix AlbumEntry property access in subpage drawer preview mode * fix(types): fix ImmichAlbumInfo property names thumbnailAssetId and albumName in PageBuilder.tsx * fix(types): add protection and watermark optional properties to AppConfig interface * feat(settings): add toggle for disabling analytics tracking (defaults to enabled) * feat(ux): show status banner when analytics tracking is disabled + add live sync indicator * feat(watermark): render customizable watermark overlay on Lightbox images + rename section to Portfolio Features & Modules * fix(types): import type LightboxWatermark in PhotoGrid.tsx * fix(types): destructure watermark prop in PhotoGrid function signature * feat(seo): add configurable subpage title template and metadata descriptions * feat(seo): add generateMetadata to about page for title template support * feat(proofing): add client proofing, favorites selection, compact URL bitmasking, and export modal * feat(essay): add Photo Essay storytelling mode with RSC markdown parser and fullbleed/pair layouts * feat(subpages): add page enabled toggle to deactivate subpages without deleting them * feat(admin): add visual essay block builder for photo essay storytelling pages * security: add Trivy container scan to Docker publish workflow Scans the built image for CRITICAL/HIGH CVEs on every release and uploads results to the GitHub Security tab. Non-blocking for now (exit-code 0) so releases aren't gated on findings. Also documents the scan and existing Dependabot coverage in the README. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-08-07 11:08:04 +02:00
</div>
)}
{l === 'editorial-flow' && (
<div className="demo-editorial-flow">
<div className="demo-tile wide" />
release: v0.11.0 (#459) Ships `dev` as **v0.11.0**. `main` contains nothing that `dev` does not, so this is a clean sync. ## Headline changes since v0.10.0 - **Journal & Journal Studio** — photo essays at `/journal`, split-screen block editor with live preview, drafts, per-entry passwords, cover images - **First-run setup wizard at `/install`** — configure a fresh deployment from the browser; credentials are verified against Immich before anything is written, and the wizard is gated by a one-time token - **About page editor and toggle** in the admin panel - **Per-album photo order** independent of Immich, with a drag & drop editor - **Custom favicon upload** - **Experimental portfolio features** — justified grid, `cover` hero, unlisted subpages, per-album grid overrides, cover focal points, external nav links - **Security** — asset tokens length-capped before decoding (#423), journal author markdown escaped rather than filtered, journal file paths contained, admin session key derived with scrypt (#432), Next.js 16.3.0 for CVE-2025-13465 - **Fixed** — client proofing honours its own configuration again (#454); journal photo rendering (#432) Full detail in [CHANGELOG.md](CHANGELOG.md#0110--2026-08-15). ## Verified `npx tsc --noEmit` clean · `npx vitest run` 435 tests pass · `npm run build` succeeds · lint 0 errors · `prettier --check` clean · local `docker build` of the release tree. ## After merge Tag `v0.11.0` on `main` and publish the release — that triggers `docker-publish.yml`, which pushes the image and moves `latest`. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
2026-08-15 09:09:18 +02:00
<div className="demo-row">
<div className="demo-tile" />
<div className="demo-tile" />
</div>
security: add Trivy container scan to Docker publish workflow (#399) * feat(admin): add backup manager UI with 1-click restore * feat(admin): collapse older backup entries by default * fix(theme): isolate admin layout, instant DOM theme updates, and add Light/Dark mode toggle * feat(admin): replace text controls for Photo Frame and Hero Style with visual preview cards * fix(admin): define missing CSS rules for button system (.btn, .preset-btn) * feat(admin): redesign theme settings with segmented mode toggle, accent color swatches, and custom iOS-style toggle cards * feat(admin): upgrade all settings tabs with visual grid previews, Google SEO snippet preview, and toggle cards * feat(admin): overhaul Pages Builder UX with slide-over drawer, card hover badges, real-time search, and floating save bar * fix(admin): remove leftover dangling syntax snippet in PageBuilder.tsx * fix(admin): add position: relative to subpage-tile so hover overlay is contained inside the tile * style(admin): replace all emojis with clean Leica-style vector SVG icons * fix(types): extend IconProps with SVGProps to allow style prop on Leica SVG icons * feat(admin): add subpage live-preview, privacy analytics, and asset protection settings * fix(typecheck): fix AlbumEntry property access in subpage drawer preview mode * fix(types): fix ImmichAlbumInfo property names thumbnailAssetId and albumName in PageBuilder.tsx * fix(types): add protection and watermark optional properties to AppConfig interface * feat(settings): add toggle for disabling analytics tracking (defaults to enabled) * feat(ux): show status banner when analytics tracking is disabled + add live sync indicator * feat(watermark): render customizable watermark overlay on Lightbox images + rename section to Portfolio Features & Modules * fix(types): import type LightboxWatermark in PhotoGrid.tsx * fix(types): destructure watermark prop in PhotoGrid function signature * feat(seo): add configurable subpage title template and metadata descriptions * feat(seo): add generateMetadata to about page for title template support * feat(proofing): add client proofing, favorites selection, compact URL bitmasking, and export modal * feat(essay): add Photo Essay storytelling mode with RSC markdown parser and fullbleed/pair layouts * feat(subpages): add page enabled toggle to deactivate subpages without deleting them * feat(admin): add visual essay block builder for photo essay storytelling pages * security: add Trivy container scan to Docker publish workflow Scans the built image for CRITICAL/HIGH CVEs on every release and uploads results to the GitHub Security tab. Non-blocking for now (exit-code 0) so releases aren't gated on findings. Also documents the scan and existing Dependabot coverage in the README. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-08-07 11:08:04 +02:00
</div>
)}
experimental: portfolio features (justified layout, unlisted pages, captions, per-album grid, focal point, nav links, cover hero) (#431) ## Was ist das? Sieben neue Portfolio-Features, alle als **experimental** gekennzeichnet — in YAML-Kommentaren, Admin-Panel-Labels und Commit-Scopes, damit sie einzeln nachvollziehbar und revertierbar bleiben. ## Features (je ein Commit) | Commit | Feature | | --- | --- | | `justified rows gallery layout` | Neues Grid-Layout `justified`: zeilenbasiert, gleiche Höhen, volle Breite — Flexbox ohne JS-Messung, letzte Zeile bleibt natürlich klein | | `hide subpages from navigation` | `hidden: true`: Seite aus Nav/Homepage raus, per Direktlink erreichbar — im Gegensatz zu `enabled: false` (404) | | `lightbox captions` | Immich-Asset-Description als Bildunterschrift im Info-Panel; EXIF-Route liefert bei `exifOnHover: false` jetzt nur noch die Caption statt 403 | | `per-album grid overrides` | `grid:` pro Album-Eintrag, Präzedenz global < Subpage < Album | | `per-album cover focal point` | `coverPosition:` → `object-position` auf Cover-Karten, strikt validiert | | `external links in header navigation` | `navLinks:` in settings.yaml, nur http(s), sanitisiert | | `cover splash hero style` | `heroStyle: cover`: Fullscreen-Splash mit Enter-Link ins Portfolio | Alle Optionen sind im Admin-Panel editierbar (PageBuilder / SettingsEditor). ## Tests - 356 Unit-Tests grün (13 neue: deriveGallery hidden/grid/coverPosition, sanitizeNavLinks, EXIF-Route-Captions, justified-Layout-Validierung) - `npx tsc --noEmit`: 0 Fehler - `npm run build`: sauber - Justified-Zeilenmathematik und Cover-Splash per Browser-Harness visuell/numerisch verifiziert (volle Zeilen enden exakt an der Containerkante, letzte Zeile bleibt natürlich) --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
2026-08-14 17:56:22 +02:00
{l === 'justified' && (
<div className="demo-editorial-flow">
release: v0.11.0 (#459) Ships `dev` as **v0.11.0**. `main` contains nothing that `dev` does not, so this is a clean sync. ## Headline changes since v0.10.0 - **Journal & Journal Studio** — photo essays at `/journal`, split-screen block editor with live preview, drafts, per-entry passwords, cover images - **First-run setup wizard at `/install`** — configure a fresh deployment from the browser; credentials are verified against Immich before anything is written, and the wizard is gated by a one-time token - **About page editor and toggle** in the admin panel - **Per-album photo order** independent of Immich, with a drag & drop editor - **Custom favicon upload** - **Experimental portfolio features** — justified grid, `cover` hero, unlisted subpages, per-album grid overrides, cover focal points, external nav links - **Security** — asset tokens length-capped before decoding (#423), journal author markdown escaped rather than filtered, journal file paths contained, admin session key derived with scrypt (#432), Next.js 16.3.0 for CVE-2025-13465 - **Fixed** — client proofing honours its own configuration again (#454); journal photo rendering (#432) Full detail in [CHANGELOG.md](CHANGELOG.md#0110--2026-08-15). ## Verified `npx tsc --noEmit` clean · `npx vitest run` 435 tests pass · `npm run build` succeeds · lint 0 errors · `prettier --check` clean · local `docker build` of the release tree. ## After merge Tag `v0.11.0` on `main` and publish the release — that triggers `docker-publish.yml`, which pushes the image and moves `latest`. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
2026-08-15 09:09:18 +02:00
<div className="demo-row">
<div className="demo-tile wide" />
<div className="demo-tile" />
</div>
<div className="demo-row">
<div className="demo-tile" />
<div className="demo-tile wide" />
</div>
experimental: portfolio features (justified layout, unlisted pages, captions, per-album grid, focal point, nav links, cover hero) (#431) ## Was ist das? Sieben neue Portfolio-Features, alle als **experimental** gekennzeichnet — in YAML-Kommentaren, Admin-Panel-Labels und Commit-Scopes, damit sie einzeln nachvollziehbar und revertierbar bleiben. ## Features (je ein Commit) | Commit | Feature | | --- | --- | | `justified rows gallery layout` | Neues Grid-Layout `justified`: zeilenbasiert, gleiche Höhen, volle Breite — Flexbox ohne JS-Messung, letzte Zeile bleibt natürlich klein | | `hide subpages from navigation` | `hidden: true`: Seite aus Nav/Homepage raus, per Direktlink erreichbar — im Gegensatz zu `enabled: false` (404) | | `lightbox captions` | Immich-Asset-Description als Bildunterschrift im Info-Panel; EXIF-Route liefert bei `exifOnHover: false` jetzt nur noch die Caption statt 403 | | `per-album grid overrides` | `grid:` pro Album-Eintrag, Präzedenz global < Subpage < Album | | `per-album cover focal point` | `coverPosition:` → `object-position` auf Cover-Karten, strikt validiert | | `external links in header navigation` | `navLinks:` in settings.yaml, nur http(s), sanitisiert | | `cover splash hero style` | `heroStyle: cover`: Fullscreen-Splash mit Enter-Link ins Portfolio | Alle Optionen sind im Admin-Panel editierbar (PageBuilder / SettingsEditor). ## Tests - 356 Unit-Tests grün (13 neue: deriveGallery hidden/grid/coverPosition, sanitizeNavLinks, EXIF-Route-Captions, justified-Layout-Validierung) - `npx tsc --noEmit`: 0 Fehler - `npm run build`: sauber - Justified-Zeilenmathematik und Cover-Splash per Browser-Harness visuell/numerisch verifiziert (volle Zeilen enden exakt an der Containerkante, letzte Zeile bleibt natürlich) --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
2026-08-14 17:56:22 +02:00
</div>
)}
security: add Trivy container scan to Docker publish workflow (#399) * feat(admin): add backup manager UI with 1-click restore * feat(admin): collapse older backup entries by default * fix(theme): isolate admin layout, instant DOM theme updates, and add Light/Dark mode toggle * feat(admin): replace text controls for Photo Frame and Hero Style with visual preview cards * fix(admin): define missing CSS rules for button system (.btn, .preset-btn) * feat(admin): redesign theme settings with segmented mode toggle, accent color swatches, and custom iOS-style toggle cards * feat(admin): upgrade all settings tabs with visual grid previews, Google SEO snippet preview, and toggle cards * feat(admin): overhaul Pages Builder UX with slide-over drawer, card hover badges, real-time search, and floating save bar * fix(admin): remove leftover dangling syntax snippet in PageBuilder.tsx * fix(admin): add position: relative to subpage-tile so hover overlay is contained inside the tile * style(admin): replace all emojis with clean Leica-style vector SVG icons * fix(types): extend IconProps with SVGProps to allow style prop on Leica SVG icons * feat(admin): add subpage live-preview, privacy analytics, and asset protection settings * fix(typecheck): fix AlbumEntry property access in subpage drawer preview mode * fix(types): fix ImmichAlbumInfo property names thumbnailAssetId and albumName in PageBuilder.tsx * fix(types): add protection and watermark optional properties to AppConfig interface * feat(settings): add toggle for disabling analytics tracking (defaults to enabled) * feat(ux): show status banner when analytics tracking is disabled + add live sync indicator * feat(watermark): render customizable watermark overlay on Lightbox images + rename section to Portfolio Features & Modules * fix(types): import type LightboxWatermark in PhotoGrid.tsx * fix(types): destructure watermark prop in PhotoGrid function signature * feat(seo): add configurable subpage title template and metadata descriptions * feat(seo): add generateMetadata to about page for title template support * feat(proofing): add client proofing, favorites selection, compact URL bitmasking, and export modal * feat(essay): add Photo Essay storytelling mode with RSC markdown parser and fullbleed/pair layouts * feat(subpages): add page enabled toggle to deactivate subpages without deleting them * feat(admin): add visual essay block builder for photo essay storytelling pages * security: add Trivy container scan to Docker publish workflow Scans the built image for CRITICAL/HIGH CVEs on every release and uploads results to the GitHub Security tab. Non-blocking for now (exit-code 0) so releases aren't gated on findings. Also documents the scan and existing Dependabot coverage in the README. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-08-07 11:08:04 +02:00
</div>
</div>
<div className="preset-card-info">
<span className="preset-card-name">{info.label}</span>
<span className="preset-card-desc">{info.desc}</span>
</div>
</button>
);
})}
</div>
</div>
security: add Trivy container scan to Docker publish workflow (#399) * feat(admin): add backup manager UI with 1-click restore * feat(admin): collapse older backup entries by default * fix(theme): isolate admin layout, instant DOM theme updates, and add Light/Dark mode toggle * feat(admin): replace text controls for Photo Frame and Hero Style with visual preview cards * fix(admin): define missing CSS rules for button system (.btn, .preset-btn) * feat(admin): redesign theme settings with segmented mode toggle, accent color swatches, and custom iOS-style toggle cards * feat(admin): upgrade all settings tabs with visual grid previews, Google SEO snippet preview, and toggle cards * feat(admin): overhaul Pages Builder UX with slide-over drawer, card hover badges, real-time search, and floating save bar * fix(admin): remove leftover dangling syntax snippet in PageBuilder.tsx * fix(admin): add position: relative to subpage-tile so hover overlay is contained inside the tile * style(admin): replace all emojis with clean Leica-style vector SVG icons * fix(types): extend IconProps with SVGProps to allow style prop on Leica SVG icons * feat(admin): add subpage live-preview, privacy analytics, and asset protection settings * fix(typecheck): fix AlbumEntry property access in subpage drawer preview mode * fix(types): fix ImmichAlbumInfo property names thumbnailAssetId and albumName in PageBuilder.tsx * fix(types): add protection and watermark optional properties to AppConfig interface * feat(settings): add toggle for disabling analytics tracking (defaults to enabled) * feat(ux): show status banner when analytics tracking is disabled + add live sync indicator * feat(watermark): render customizable watermark overlay on Lightbox images + rename section to Portfolio Features & Modules * fix(types): import type LightboxWatermark in PhotoGrid.tsx * fix(types): destructure watermark prop in PhotoGrid function signature * feat(seo): add configurable subpage title template and metadata descriptions * feat(seo): add generateMetadata to about page for title template support * feat(proofing): add client proofing, favorites selection, compact URL bitmasking, and export modal * feat(essay): add Photo Essay storytelling mode with RSC markdown parser and fullbleed/pair layouts * feat(subpages): add page enabled toggle to deactivate subpages without deleting them * feat(admin): add visual essay block builder for photo essay storytelling pages * security: add Trivy container scan to Docker publish workflow Scans the built image for CRITICAL/HIGH CVEs on every release and uploads results to the GitHub Security tab. Non-blocking for now (exit-code 0) so releases aren't gated on findings. Also documents the scan and existing Dependabot coverage in the README. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-08-07 11:08:04 +02:00
<div className="admin-field">
<label>Aspect Ratio</label>
<div className="preset-card-grid">
{ASPECT_RATIOS.map((r) => {
const info = {
'1': { label: 'Square (1:1)', desc: '1:1 ratio square crops' },
'3/2': { label: 'Landscape (3:2)', desc: 'Standard 35mm DSLR landscape' },
'2/3': { label: 'Portrait (2:3)', desc: 'Vertical portrait orientation' },
'16/9': { label: 'Cinema (16:9)', desc: 'Widescreen 16:9 cinematic ratio' },
release: v0.11.0 (#459) Ships `dev` as **v0.11.0**. `main` contains nothing that `dev` does not, so this is a clean sync. ## Headline changes since v0.10.0 - **Journal & Journal Studio** — photo essays at `/journal`, split-screen block editor with live preview, drafts, per-entry passwords, cover images - **First-run setup wizard at `/install`** — configure a fresh deployment from the browser; credentials are verified against Immich before anything is written, and the wizard is gated by a one-time token - **About page editor and toggle** in the admin panel - **Per-album photo order** independent of Immich, with a drag & drop editor - **Custom favicon upload** - **Experimental portfolio features** — justified grid, `cover` hero, unlisted subpages, per-album grid overrides, cover focal points, external nav links - **Security** — asset tokens length-capped before decoding (#423), journal author markdown escaped rather than filtered, journal file paths contained, admin session key derived with scrypt (#432), Next.js 16.3.0 for CVE-2025-13465 - **Fixed** — client proofing honours its own configuration again (#454); journal photo rendering (#432) Full detail in [CHANGELOG.md](CHANGELOG.md#0110--2026-08-15). ## Verified `npx tsc --noEmit` clean · `npx vitest run` 435 tests pass · `npm run build` succeeds · lint 0 errors · `prettier --check` clean · local `docker build` of the release tree. ## After merge Tag `v0.11.0` on `main` and publish the release — that triggers `docker-publish.yml`, which pushes the image and moves `latest`. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
2026-08-15 09:09:18 +02:00
auto: {
label: 'Original Auto',
desc: 'Uncropped original image proportions',
},
security: add Trivy container scan to Docker publish workflow (#399) * feat(admin): add backup manager UI with 1-click restore * feat(admin): collapse older backup entries by default * fix(theme): isolate admin layout, instant DOM theme updates, and add Light/Dark mode toggle * feat(admin): replace text controls for Photo Frame and Hero Style with visual preview cards * fix(admin): define missing CSS rules for button system (.btn, .preset-btn) * feat(admin): redesign theme settings with segmented mode toggle, accent color swatches, and custom iOS-style toggle cards * feat(admin): upgrade all settings tabs with visual grid previews, Google SEO snippet preview, and toggle cards * feat(admin): overhaul Pages Builder UX with slide-over drawer, card hover badges, real-time search, and floating save bar * fix(admin): remove leftover dangling syntax snippet in PageBuilder.tsx * fix(admin): add position: relative to subpage-tile so hover overlay is contained inside the tile * style(admin): replace all emojis with clean Leica-style vector SVG icons * fix(types): extend IconProps with SVGProps to allow style prop on Leica SVG icons * feat(admin): add subpage live-preview, privacy analytics, and asset protection settings * fix(typecheck): fix AlbumEntry property access in subpage drawer preview mode * fix(types): fix ImmichAlbumInfo property names thumbnailAssetId and albumName in PageBuilder.tsx * fix(types): add protection and watermark optional properties to AppConfig interface * feat(settings): add toggle for disabling analytics tracking (defaults to enabled) * feat(ux): show status banner when analytics tracking is disabled + add live sync indicator * feat(watermark): render customizable watermark overlay on Lightbox images + rename section to Portfolio Features & Modules * fix(types): import type LightboxWatermark in PhotoGrid.tsx * fix(types): destructure watermark prop in PhotoGrid function signature * feat(seo): add configurable subpage title template and metadata descriptions * feat(seo): add generateMetadata to about page for title template support * feat(proofing): add client proofing, favorites selection, compact URL bitmasking, and export modal * feat(essay): add Photo Essay storytelling mode with RSC markdown parser and fullbleed/pair layouts * feat(subpages): add page enabled toggle to deactivate subpages without deleting them * feat(admin): add visual essay block builder for photo essay storytelling pages * security: add Trivy container scan to Docker publish workflow Scans the built image for CRITICAL/HIGH CVEs on every release and uploads results to the GitHub Security tab. Non-blocking for now (exit-code 0) so releases aren't gated on findings. Also documents the scan and existing Dependabot coverage in the README. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-08-07 11:08:04 +02:00
}[r] || { label: r, desc: '' };
const isActive = (settings.grid?.aspectRatio || '1') === r;
return (
<button
key={r}
type="button"
className={`preset-card ratio-card ${isActive ? 'active' : ''}`}
onClick={() => update('grid.aspectRatio', r)}
>
<div className="ratio-card-preview">
<div className={`mini-aspect-box ratio-${r.replace('/', '-')}`}>
<div className="mini-aspect-inner" />
</div>
</div>
<div className="preset-card-info">
<span className="preset-card-name">{info.label}</span>
<span className="preset-card-desc">{info.desc}</span>
</div>
</button>
);
})}
</div>
</div>
<div className="settings-section-divider" />
<div className="settings-section-header">
release: v0.11.0 (#459) Ships `dev` as **v0.11.0**. `main` contains nothing that `dev` does not, so this is a clean sync. ## Headline changes since v0.10.0 - **Journal & Journal Studio** — photo essays at `/journal`, split-screen block editor with live preview, drafts, per-entry passwords, cover images - **First-run setup wizard at `/install`** — configure a fresh deployment from the browser; credentials are verified against Immich before anything is written, and the wizard is gated by a one-time token - **About page editor and toggle** in the admin panel - **Per-album photo order** independent of Immich, with a drag & drop editor - **Custom favicon upload** - **Experimental portfolio features** — justified grid, `cover` hero, unlisted subpages, per-album grid overrides, cover focal points, external nav links - **Security** — asset tokens length-capped before decoding (#423), journal author markdown escaped rather than filtered, journal file paths contained, admin session key derived with scrypt (#432), Next.js 16.3.0 for CVE-2025-13465 - **Fixed** — client proofing honours its own configuration again (#454); journal photo rendering (#432) Full detail in [CHANGELOG.md](CHANGELOG.md#0110--2026-08-15). ## Verified `npx tsc --noEmit` clean · `npx vitest run` 435 tests pass · `npm run build` succeeds · lint 0 errors · `prettier --check` clean · local `docker build` of the release tree. ## After merge Tag `v0.11.0` on `main` and publish the release — that triggers `docker-publish.yml`, which pushes the image and moves `latest`. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
2026-08-15 09:09:18 +02:00
<h3>
<Icons.IconColumns size={18} /> Spacing &amp; Columns
</h3>
<p className="settings-section-sub">
Adjust column counts and grid gap spacing. The column count also tiles the album
covers on a subpage; their spacing stays with the theme unless a page overrides
it.
</p>
security: add Trivy container scan to Docker publish workflow (#399) * feat(admin): add backup manager UI with 1-click restore * feat(admin): collapse older backup entries by default * fix(theme): isolate admin layout, instant DOM theme updates, and add Light/Dark mode toggle * feat(admin): replace text controls for Photo Frame and Hero Style with visual preview cards * fix(admin): define missing CSS rules for button system (.btn, .preset-btn) * feat(admin): redesign theme settings with segmented mode toggle, accent color swatches, and custom iOS-style toggle cards * feat(admin): upgrade all settings tabs with visual grid previews, Google SEO snippet preview, and toggle cards * feat(admin): overhaul Pages Builder UX with slide-over drawer, card hover badges, real-time search, and floating save bar * fix(admin): remove leftover dangling syntax snippet in PageBuilder.tsx * fix(admin): add position: relative to subpage-tile so hover overlay is contained inside the tile * style(admin): replace all emojis with clean Leica-style vector SVG icons * fix(types): extend IconProps with SVGProps to allow style prop on Leica SVG icons * feat(admin): add subpage live-preview, privacy analytics, and asset protection settings * fix(typecheck): fix AlbumEntry property access in subpage drawer preview mode * fix(types): fix ImmichAlbumInfo property names thumbnailAssetId and albumName in PageBuilder.tsx * fix(types): add protection and watermark optional properties to AppConfig interface * feat(settings): add toggle for disabling analytics tracking (defaults to enabled) * feat(ux): show status banner when analytics tracking is disabled + add live sync indicator * feat(watermark): render customizable watermark overlay on Lightbox images + rename section to Portfolio Features & Modules * fix(types): import type LightboxWatermark in PhotoGrid.tsx * fix(types): destructure watermark prop in PhotoGrid function signature * feat(seo): add configurable subpage title template and metadata descriptions * feat(seo): add generateMetadata to about page for title template support * feat(proofing): add client proofing, favorites selection, compact URL bitmasking, and export modal * feat(essay): add Photo Essay storytelling mode with RSC markdown parser and fullbleed/pair layouts * feat(subpages): add page enabled toggle to deactivate subpages without deleting them * feat(admin): add visual essay block builder for photo essay storytelling pages * security: add Trivy container scan to Docker publish workflow Scans the built image for CRITICAL/HIGH CVEs on every release and uploads results to the GitHub Security tab. Non-blocking for now (exit-code 0) so releases aren't gated on findings. Also documents the scan and existing Dependabot coverage in the README. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-08-07 11:08:04 +02:00
</div>
<div className="admin-field-row">
<div className="admin-field">
security: add Trivy container scan to Docker publish workflow (#399) * feat(admin): add backup manager UI with 1-click restore * feat(admin): collapse older backup entries by default * fix(theme): isolate admin layout, instant DOM theme updates, and add Light/Dark mode toggle * feat(admin): replace text controls for Photo Frame and Hero Style with visual preview cards * fix(admin): define missing CSS rules for button system (.btn, .preset-btn) * feat(admin): redesign theme settings with segmented mode toggle, accent color swatches, and custom iOS-style toggle cards * feat(admin): upgrade all settings tabs with visual grid previews, Google SEO snippet preview, and toggle cards * feat(admin): overhaul Pages Builder UX with slide-over drawer, card hover badges, real-time search, and floating save bar * fix(admin): remove leftover dangling syntax snippet in PageBuilder.tsx * fix(admin): add position: relative to subpage-tile so hover overlay is contained inside the tile * style(admin): replace all emojis with clean Leica-style vector SVG icons * fix(types): extend IconProps with SVGProps to allow style prop on Leica SVG icons * feat(admin): add subpage live-preview, privacy analytics, and asset protection settings * fix(typecheck): fix AlbumEntry property access in subpage drawer preview mode * fix(types): fix ImmichAlbumInfo property names thumbnailAssetId and albumName in PageBuilder.tsx * fix(types): add protection and watermark optional properties to AppConfig interface * feat(settings): add toggle for disabling analytics tracking (defaults to enabled) * feat(ux): show status banner when analytics tracking is disabled + add live sync indicator * feat(watermark): render customizable watermark overlay on Lightbox images + rename section to Portfolio Features & Modules * fix(types): import type LightboxWatermark in PhotoGrid.tsx * fix(types): destructure watermark prop in PhotoGrid function signature * feat(seo): add configurable subpage title template and metadata descriptions * feat(seo): add generateMetadata to about page for title template support * feat(proofing): add client proofing, favorites selection, compact URL bitmasking, and export modal * feat(essay): add Photo Essay storytelling mode with RSC markdown parser and fullbleed/pair layouts * feat(subpages): add page enabled toggle to deactivate subpages without deleting them * feat(admin): add visual essay block builder for photo essay storytelling pages * security: add Trivy container scan to Docker publish workflow Scans the built image for CRITICAL/HIGH CVEs on every release and uploads results to the GitHub Security tab. Non-blocking for now (exit-code 0) so releases aren't gated on findings. Also documents the scan and existing Dependabot coverage in the README. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-08-07 11:08:04 +02:00
<label>Columns (1 - 6)</label>
<input
type="number"
min={1}
max={6}
value={settings.grid?.columns ?? 3}
onChange={(e) => update('grid.columns', parseInt(e.target.value) || 3)}
/>
</div>
<div className="admin-field">
security: add Trivy container scan to Docker publish workflow (#399) * feat(admin): add backup manager UI with 1-click restore * feat(admin): collapse older backup entries by default * fix(theme): isolate admin layout, instant DOM theme updates, and add Light/Dark mode toggle * feat(admin): replace text controls for Photo Frame and Hero Style with visual preview cards * fix(admin): define missing CSS rules for button system (.btn, .preset-btn) * feat(admin): redesign theme settings with segmented mode toggle, accent color swatches, and custom iOS-style toggle cards * feat(admin): upgrade all settings tabs with visual grid previews, Google SEO snippet preview, and toggle cards * feat(admin): overhaul Pages Builder UX with slide-over drawer, card hover badges, real-time search, and floating save bar * fix(admin): remove leftover dangling syntax snippet in PageBuilder.tsx * fix(admin): add position: relative to subpage-tile so hover overlay is contained inside the tile * style(admin): replace all emojis with clean Leica-style vector SVG icons * fix(types): extend IconProps with SVGProps to allow style prop on Leica SVG icons * feat(admin): add subpage live-preview, privacy analytics, and asset protection settings * fix(typecheck): fix AlbumEntry property access in subpage drawer preview mode * fix(types): fix ImmichAlbumInfo property names thumbnailAssetId and albumName in PageBuilder.tsx * fix(types): add protection and watermark optional properties to AppConfig interface * feat(settings): add toggle for disabling analytics tracking (defaults to enabled) * feat(ux): show status banner when analytics tracking is disabled + add live sync indicator * feat(watermark): render customizable watermark overlay on Lightbox images + rename section to Portfolio Features & Modules * fix(types): import type LightboxWatermark in PhotoGrid.tsx * fix(types): destructure watermark prop in PhotoGrid function signature * feat(seo): add configurable subpage title template and metadata descriptions * feat(seo): add generateMetadata to about page for title template support * feat(proofing): add client proofing, favorites selection, compact URL bitmasking, and export modal * feat(essay): add Photo Essay storytelling mode with RSC markdown parser and fullbleed/pair layouts * feat(subpages): add page enabled toggle to deactivate subpages without deleting them * feat(admin): add visual essay block builder for photo essay storytelling pages * security: add Trivy container scan to Docker publish workflow Scans the built image for CRITICAL/HIGH CVEs on every release and uploads results to the GitHub Security tab. Non-blocking for now (exit-code 0) so releases aren't gated on findings. Also documents the scan and existing Dependabot coverage in the README. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-08-07 11:08:04 +02:00
<label>Gap Spacing (px)</label>
<input
type="number"
min={0}
max={48}
value={settings.grid?.gap ?? 12}
onChange={(e) => update('grid.gap', parseInt(e.target.value) || 0)}
/>
</div>
</div>
</div>
)}
{activeSection === 'footer' && (
<div className="settings-panel">
security: add Trivy container scan to Docker publish workflow (#399) * feat(admin): add backup manager UI with 1-click restore * feat(admin): collapse older backup entries by default * fix(theme): isolate admin layout, instant DOM theme updates, and add Light/Dark mode toggle * feat(admin): replace text controls for Photo Frame and Hero Style with visual preview cards * fix(admin): define missing CSS rules for button system (.btn, .preset-btn) * feat(admin): redesign theme settings with segmented mode toggle, accent color swatches, and custom iOS-style toggle cards * feat(admin): upgrade all settings tabs with visual grid previews, Google SEO snippet preview, and toggle cards * feat(admin): overhaul Pages Builder UX with slide-over drawer, card hover badges, real-time search, and floating save bar * fix(admin): remove leftover dangling syntax snippet in PageBuilder.tsx * fix(admin): add position: relative to subpage-tile so hover overlay is contained inside the tile * style(admin): replace all emojis with clean Leica-style vector SVG icons * fix(types): extend IconProps with SVGProps to allow style prop on Leica SVG icons * feat(admin): add subpage live-preview, privacy analytics, and asset protection settings * fix(typecheck): fix AlbumEntry property access in subpage drawer preview mode * fix(types): fix ImmichAlbumInfo property names thumbnailAssetId and albumName in PageBuilder.tsx * fix(types): add protection and watermark optional properties to AppConfig interface * feat(settings): add toggle for disabling analytics tracking (defaults to enabled) * feat(ux): show status banner when analytics tracking is disabled + add live sync indicator * feat(watermark): render customizable watermark overlay on Lightbox images + rename section to Portfolio Features & Modules * fix(types): import type LightboxWatermark in PhotoGrid.tsx * fix(types): destructure watermark prop in PhotoGrid function signature * feat(seo): add configurable subpage title template and metadata descriptions * feat(seo): add generateMetadata to about page for title template support * feat(proofing): add client proofing, favorites selection, compact URL bitmasking, and export modal * feat(essay): add Photo Essay storytelling mode with RSC markdown parser and fullbleed/pair layouts * feat(subpages): add page enabled toggle to deactivate subpages without deleting them * feat(admin): add visual essay block builder for photo essay storytelling pages * security: add Trivy container scan to Docker publish workflow Scans the built image for CRITICAL/HIGH CVEs on every release and uploads results to the GitHub Security tab. Non-blocking for now (exit-code 0) so releases aren't gated on findings. Also documents the scan and existing Dependabot coverage in the README. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-08-07 11:08:04 +02:00
<div className="settings-section-header">
release: v0.11.0 (#459) Ships `dev` as **v0.11.0**. `main` contains nothing that `dev` does not, so this is a clean sync. ## Headline changes since v0.10.0 - **Journal & Journal Studio** — photo essays at `/journal`, split-screen block editor with live preview, drafts, per-entry passwords, cover images - **First-run setup wizard at `/install`** — configure a fresh deployment from the browser; credentials are verified against Immich before anything is written, and the wizard is gated by a one-time token - **About page editor and toggle** in the admin panel - **Per-album photo order** independent of Immich, with a drag & drop editor - **Custom favicon upload** - **Experimental portfolio features** — justified grid, `cover` hero, unlisted subpages, per-album grid overrides, cover focal points, external nav links - **Security** — asset tokens length-capped before decoding (#423), journal author markdown escaped rather than filtered, journal file paths contained, admin session key derived with scrypt (#432), Next.js 16.3.0 for CVE-2025-13465 - **Fixed** — client proofing honours its own configuration again (#454); journal photo rendering (#432) Full detail in [CHANGELOG.md](CHANGELOG.md#0110--2026-08-15). ## Verified `npx tsc --noEmit` clean · `npx vitest run` 435 tests pass · `npm run build` succeeds · lint 0 errors · `prettier --check` clean · local `docker build` of the release tree. ## After merge Tag `v0.11.0` on `main` and publish the release — that triggers `docker-publish.yml`, which pushes the image and moves `latest`. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
2026-08-15 09:09:18 +02:00
<h3>
<Icons.IconLink size={18} /> Footer &amp; Social Links
</h3>
<p className="settings-section-sub">
Display branding, Instagram, email and website links in portfolio footer.
</p>
security: add Trivy container scan to Docker publish workflow (#399) * feat(admin): add backup manager UI with 1-click restore * feat(admin): collapse older backup entries by default * fix(theme): isolate admin layout, instant DOM theme updates, and add Light/Dark mode toggle * feat(admin): replace text controls for Photo Frame and Hero Style with visual preview cards * fix(admin): define missing CSS rules for button system (.btn, .preset-btn) * feat(admin): redesign theme settings with segmented mode toggle, accent color swatches, and custom iOS-style toggle cards * feat(admin): upgrade all settings tabs with visual grid previews, Google SEO snippet preview, and toggle cards * feat(admin): overhaul Pages Builder UX with slide-over drawer, card hover badges, real-time search, and floating save bar * fix(admin): remove leftover dangling syntax snippet in PageBuilder.tsx * fix(admin): add position: relative to subpage-tile so hover overlay is contained inside the tile * style(admin): replace all emojis with clean Leica-style vector SVG icons * fix(types): extend IconProps with SVGProps to allow style prop on Leica SVG icons * feat(admin): add subpage live-preview, privacy analytics, and asset protection settings * fix(typecheck): fix AlbumEntry property access in subpage drawer preview mode * fix(types): fix ImmichAlbumInfo property names thumbnailAssetId and albumName in PageBuilder.tsx * fix(types): add protection and watermark optional properties to AppConfig interface * feat(settings): add toggle for disabling analytics tracking (defaults to enabled) * feat(ux): show status banner when analytics tracking is disabled + add live sync indicator * feat(watermark): render customizable watermark overlay on Lightbox images + rename section to Portfolio Features & Modules * fix(types): import type LightboxWatermark in PhotoGrid.tsx * fix(types): destructure watermark prop in PhotoGrid function signature * feat(seo): add configurable subpage title template and metadata descriptions * feat(seo): add generateMetadata to about page for title template support * feat(proofing): add client proofing, favorites selection, compact URL bitmasking, and export modal * feat(essay): add Photo Essay storytelling mode with RSC markdown parser and fullbleed/pair layouts * feat(subpages): add page enabled toggle to deactivate subpages without deleting them * feat(admin): add visual essay block builder for photo essay storytelling pages * security: add Trivy container scan to Docker publish workflow Scans the built image for CRITICAL/HIGH CVEs on every release and uploads results to the GitHub Security tab. Non-blocking for now (exit-code 0) so releases aren't gated on findings. Also documents the scan and existing Dependabot coverage in the README. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-08-07 11:08:04 +02:00
</div>
<div className="admin-field">
security: add Trivy container scan to Docker publish workflow (#399) * feat(admin): add backup manager UI with 1-click restore * feat(admin): collapse older backup entries by default * fix(theme): isolate admin layout, instant DOM theme updates, and add Light/Dark mode toggle * feat(admin): replace text controls for Photo Frame and Hero Style with visual preview cards * fix(admin): define missing CSS rules for button system (.btn, .preset-btn) * feat(admin): redesign theme settings with segmented mode toggle, accent color swatches, and custom iOS-style toggle cards * feat(admin): upgrade all settings tabs with visual grid previews, Google SEO snippet preview, and toggle cards * feat(admin): overhaul Pages Builder UX with slide-over drawer, card hover badges, real-time search, and floating save bar * fix(admin): remove leftover dangling syntax snippet in PageBuilder.tsx * fix(admin): add position: relative to subpage-tile so hover overlay is contained inside the tile * style(admin): replace all emojis with clean Leica-style vector SVG icons * fix(types): extend IconProps with SVGProps to allow style prop on Leica SVG icons * feat(admin): add subpage live-preview, privacy analytics, and asset protection settings * fix(typecheck): fix AlbumEntry property access in subpage drawer preview mode * fix(types): fix ImmichAlbumInfo property names thumbnailAssetId and albumName in PageBuilder.tsx * fix(types): add protection and watermark optional properties to AppConfig interface * feat(settings): add toggle for disabling analytics tracking (defaults to enabled) * feat(ux): show status banner when analytics tracking is disabled + add live sync indicator * feat(watermark): render customizable watermark overlay on Lightbox images + rename section to Portfolio Features & Modules * fix(types): import type LightboxWatermark in PhotoGrid.tsx * fix(types): destructure watermark prop in PhotoGrid function signature * feat(seo): add configurable subpage title template and metadata descriptions * feat(seo): add generateMetadata to about page for title template support * feat(proofing): add client proofing, favorites selection, compact URL bitmasking, and export modal * feat(essay): add Photo Essay storytelling mode with RSC markdown parser and fullbleed/pair layouts * feat(subpages): add page enabled toggle to deactivate subpages without deleting them * feat(admin): add visual essay block builder for photo essay storytelling pages * security: add Trivy container scan to Docker publish workflow Scans the built image for CRITICAL/HIGH CVEs on every release and uploads results to the GitHub Security tab. Non-blocking for now (exit-code 0) so releases aren't gated on findings. Also documents the scan and existing Dependabot coverage in the README. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-08-07 11:08:04 +02:00
<label>Footer Brand Name</label>
<input
value={settings.footer?.name || ''}
onChange={(e) => update('footer.name', e.target.value)}
placeholder="My Photography"
/>
</div>
<div className="admin-field">
<label>Instagram URL</label>
<input
value={settings.footer?.instagram || ''}
onChange={(e) => update('footer.instagram', e.target.value)}
placeholder="https://instagram.com/your-handle"
/>
</div>
security: add Trivy container scan to Docker publish workflow (#399) * feat(admin): add backup manager UI with 1-click restore * feat(admin): collapse older backup entries by default * fix(theme): isolate admin layout, instant DOM theme updates, and add Light/Dark mode toggle * feat(admin): replace text controls for Photo Frame and Hero Style with visual preview cards * fix(admin): define missing CSS rules for button system (.btn, .preset-btn) * feat(admin): redesign theme settings with segmented mode toggle, accent color swatches, and custom iOS-style toggle cards * feat(admin): upgrade all settings tabs with visual grid previews, Google SEO snippet preview, and toggle cards * feat(admin): overhaul Pages Builder UX with slide-over drawer, card hover badges, real-time search, and floating save bar * fix(admin): remove leftover dangling syntax snippet in PageBuilder.tsx * fix(admin): add position: relative to subpage-tile so hover overlay is contained inside the tile * style(admin): replace all emojis with clean Leica-style vector SVG icons * fix(types): extend IconProps with SVGProps to allow style prop on Leica SVG icons * feat(admin): add subpage live-preview, privacy analytics, and asset protection settings * fix(typecheck): fix AlbumEntry property access in subpage drawer preview mode * fix(types): fix ImmichAlbumInfo property names thumbnailAssetId and albumName in PageBuilder.tsx * fix(types): add protection and watermark optional properties to AppConfig interface * feat(settings): add toggle for disabling analytics tracking (defaults to enabled) * feat(ux): show status banner when analytics tracking is disabled + add live sync indicator * feat(watermark): render customizable watermark overlay on Lightbox images + rename section to Portfolio Features & Modules * fix(types): import type LightboxWatermark in PhotoGrid.tsx * fix(types): destructure watermark prop in PhotoGrid function signature * feat(seo): add configurable subpage title template and metadata descriptions * feat(seo): add generateMetadata to about page for title template support * feat(proofing): add client proofing, favorites selection, compact URL bitmasking, and export modal * feat(essay): add Photo Essay storytelling mode with RSC markdown parser and fullbleed/pair layouts * feat(subpages): add page enabled toggle to deactivate subpages without deleting them * feat(admin): add visual essay block builder for photo essay storytelling pages * security: add Trivy container scan to Docker publish workflow Scans the built image for CRITICAL/HIGH CVEs on every release and uploads results to the GitHub Security tab. Non-blocking for now (exit-code 0) so releases aren't gated on findings. Also documents the scan and existing Dependabot coverage in the README. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-08-07 11:08:04 +02:00
<div className="admin-field-row">
<div className="admin-field">
<label>Contact Email</label>
<input
value={settings.footer?.email || ''}
onChange={(e) => update('footer.email', e.target.value)}
placeholder="hello@example.com"
/>
</div>
<div className="admin-field">
<label>Personal Website</label>
<input
value={settings.footer?.website || ''}
onChange={(e) => update('footer.website', e.target.value)}
placeholder="https://example.com"
/>
</div>
</div>
experimental: portfolio features (justified layout, unlisted pages, captions, per-album grid, focal point, nav links, cover hero) (#431) ## Was ist das? Sieben neue Portfolio-Features, alle als **experimental** gekennzeichnet — in YAML-Kommentaren, Admin-Panel-Labels und Commit-Scopes, damit sie einzeln nachvollziehbar und revertierbar bleiben. ## Features (je ein Commit) | Commit | Feature | | --- | --- | | `justified rows gallery layout` | Neues Grid-Layout `justified`: zeilenbasiert, gleiche Höhen, volle Breite — Flexbox ohne JS-Messung, letzte Zeile bleibt natürlich klein | | `hide subpages from navigation` | `hidden: true`: Seite aus Nav/Homepage raus, per Direktlink erreichbar — im Gegensatz zu `enabled: false` (404) | | `lightbox captions` | Immich-Asset-Description als Bildunterschrift im Info-Panel; EXIF-Route liefert bei `exifOnHover: false` jetzt nur noch die Caption statt 403 | | `per-album grid overrides` | `grid:` pro Album-Eintrag, Präzedenz global < Subpage < Album | | `per-album cover focal point` | `coverPosition:` → `object-position` auf Cover-Karten, strikt validiert | | `external links in header navigation` | `navLinks:` in settings.yaml, nur http(s), sanitisiert | | `cover splash hero style` | `heroStyle: cover`: Fullscreen-Splash mit Enter-Link ins Portfolio | Alle Optionen sind im Admin-Panel editierbar (PageBuilder / SettingsEditor). ## Tests - 356 Unit-Tests grün (13 neue: deriveGallery hidden/grid/coverPosition, sanitizeNavLinks, EXIF-Route-Captions, justified-Layout-Validierung) - `npx tsc --noEmit`: 0 Fehler - `npm run build`: sauber - Justified-Zeilenmathematik und Cover-Splash per Browser-Harness visuell/numerisch verifiziert (volle Zeilen enden exakt an der Containerkante, letzte Zeile bleibt natürlich) --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
2026-08-14 17:56:22 +02:00
<div className="settings-section-header" style={{ marginTop: '2rem' }}>
release: v0.11.0 (#459) Ships `dev` as **v0.11.0**. `main` contains nothing that `dev` does not, so this is a clean sync. ## Headline changes since v0.10.0 - **Journal & Journal Studio** — photo essays at `/journal`, split-screen block editor with live preview, drafts, per-entry passwords, cover images - **First-run setup wizard at `/install`** — configure a fresh deployment from the browser; credentials are verified against Immich before anything is written, and the wizard is gated by a one-time token - **About page editor and toggle** in the admin panel - **Per-album photo order** independent of Immich, with a drag & drop editor - **Custom favicon upload** - **Experimental portfolio features** — justified grid, `cover` hero, unlisted subpages, per-album grid overrides, cover focal points, external nav links - **Security** — asset tokens length-capped before decoding (#423), journal author markdown escaped rather than filtered, journal file paths contained, admin session key derived with scrypt (#432), Next.js 16.3.0 for CVE-2025-13465 - **Fixed** — client proofing honours its own configuration again (#454); journal photo rendering (#432) Full detail in [CHANGELOG.md](CHANGELOG.md#0110--2026-08-15). ## Verified `npx tsc --noEmit` clean · `npx vitest run` 435 tests pass · `npm run build` succeeds · lint 0 errors · `prettier --check` clean · local `docker build` of the release tree. ## After merge Tag `v0.11.0` on `main` and publish the release — that triggers `docker-publish.yml`, which pushes the image and moves `latest`. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
2026-08-15 09:09:18 +02:00
<h3>
<Icons.IconLink size={18} /> Header Navigation Links (Experimental)
</h3>
<p className="settings-section-sub">
External links shown after your pages in the header menu. Only http(s) URLs are
allowed; they open in a new tab.
</p>
experimental: portfolio features (justified layout, unlisted pages, captions, per-album grid, focal point, nav links, cover hero) (#431) ## Was ist das? Sieben neue Portfolio-Features, alle als **experimental** gekennzeichnet — in YAML-Kommentaren, Admin-Panel-Labels und Commit-Scopes, damit sie einzeln nachvollziehbar und revertierbar bleiben. ## Features (je ein Commit) | Commit | Feature | | --- | --- | | `justified rows gallery layout` | Neues Grid-Layout `justified`: zeilenbasiert, gleiche Höhen, volle Breite — Flexbox ohne JS-Messung, letzte Zeile bleibt natürlich klein | | `hide subpages from navigation` | `hidden: true`: Seite aus Nav/Homepage raus, per Direktlink erreichbar — im Gegensatz zu `enabled: false` (404) | | `lightbox captions` | Immich-Asset-Description als Bildunterschrift im Info-Panel; EXIF-Route liefert bei `exifOnHover: false` jetzt nur noch die Caption statt 403 | | `per-album grid overrides` | `grid:` pro Album-Eintrag, Präzedenz global < Subpage < Album | | `per-album cover focal point` | `coverPosition:` → `object-position` auf Cover-Karten, strikt validiert | | `external links in header navigation` | `navLinks:` in settings.yaml, nur http(s), sanitisiert | | `cover splash hero style` | `heroStyle: cover`: Fullscreen-Splash mit Enter-Link ins Portfolio | Alle Optionen sind im Admin-Panel editierbar (PageBuilder / SettingsEditor). ## Tests - 356 Unit-Tests grün (13 neue: deriveGallery hidden/grid/coverPosition, sanitizeNavLinks, EXIF-Route-Captions, justified-Layout-Validierung) - `npx tsc --noEmit`: 0 Fehler - `npm run build`: sauber - Justified-Zeilenmathematik und Cover-Splash per Browser-Harness visuell/numerisch verifiziert (volle Zeilen enden exakt an der Containerkante, letzte Zeile bleibt natürlich) --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
2026-08-14 17:56:22 +02:00
</div>
{(settings.navLinks || []).map((link, i) => (
<div className="admin-field-row" key={i}>
<div className="admin-field">
<label>Label</label>
<input
value={link.label || ''}
onChange={(e) => {
const next = [...(settings.navLinks || [])];
next[i] = { ...next[i], label: e.target.value };
update('navLinks', next);
}}
placeholder="Shop"
/>
</div>
<div className="admin-field">
<label>URL</label>
<input
value={link.url || ''}
onChange={(e) => {
const next = [...(settings.navLinks || [])];
next[i] = { ...next[i], url: e.target.value };
update('navLinks', next);
}}
placeholder="https://shop.example.com"
/>
</div>
<button
type="button"
className="admin-btn admin-btn-sm"
style={{ alignSelf: 'flex-end' }}
onClick={() => {
const next = (settings.navLinks || []).filter((_, j) => j !== i);
update('navLinks', next.length > 0 ? next : undefined);
}}
title="Remove link"
>
Remove
</button>
</div>
))}
<button
type="button"
className="admin-btn admin-btn-sm"
release: v0.11.0 (#459) Ships `dev` as **v0.11.0**. `main` contains nothing that `dev` does not, so this is a clean sync. ## Headline changes since v0.10.0 - **Journal & Journal Studio** — photo essays at `/journal`, split-screen block editor with live preview, drafts, per-entry passwords, cover images - **First-run setup wizard at `/install`** — configure a fresh deployment from the browser; credentials are verified against Immich before anything is written, and the wizard is gated by a one-time token - **About page editor and toggle** in the admin panel - **Per-album photo order** independent of Immich, with a drag & drop editor - **Custom favicon upload** - **Experimental portfolio features** — justified grid, `cover` hero, unlisted subpages, per-album grid overrides, cover focal points, external nav links - **Security** — asset tokens length-capped before decoding (#423), journal author markdown escaped rather than filtered, journal file paths contained, admin session key derived with scrypt (#432), Next.js 16.3.0 for CVE-2025-13465 - **Fixed** — client proofing honours its own configuration again (#454); journal photo rendering (#432) Full detail in [CHANGELOG.md](CHANGELOG.md#0110--2026-08-15). ## Verified `npx tsc --noEmit` clean · `npx vitest run` 435 tests pass · `npm run build` succeeds · lint 0 errors · `prettier --check` clean · local `docker build` of the release tree. ## After merge Tag `v0.11.0` on `main` and publish the release — that triggers `docker-publish.yml`, which pushes the image and moves `latest`. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
2026-08-15 09:09:18 +02:00
onClick={() =>
update('navLinks', [...(settings.navLinks || []), { label: '', url: '' }])
}
experimental: portfolio features (justified layout, unlisted pages, captions, per-album grid, focal point, nav links, cover hero) (#431) ## Was ist das? Sieben neue Portfolio-Features, alle als **experimental** gekennzeichnet — in YAML-Kommentaren, Admin-Panel-Labels und Commit-Scopes, damit sie einzeln nachvollziehbar und revertierbar bleiben. ## Features (je ein Commit) | Commit | Feature | | --- | --- | | `justified rows gallery layout` | Neues Grid-Layout `justified`: zeilenbasiert, gleiche Höhen, volle Breite — Flexbox ohne JS-Messung, letzte Zeile bleibt natürlich klein | | `hide subpages from navigation` | `hidden: true`: Seite aus Nav/Homepage raus, per Direktlink erreichbar — im Gegensatz zu `enabled: false` (404) | | `lightbox captions` | Immich-Asset-Description als Bildunterschrift im Info-Panel; EXIF-Route liefert bei `exifOnHover: false` jetzt nur noch die Caption statt 403 | | `per-album grid overrides` | `grid:` pro Album-Eintrag, Präzedenz global < Subpage < Album | | `per-album cover focal point` | `coverPosition:` → `object-position` auf Cover-Karten, strikt validiert | | `external links in header navigation` | `navLinks:` in settings.yaml, nur http(s), sanitisiert | | `cover splash hero style` | `heroStyle: cover`: Fullscreen-Splash mit Enter-Link ins Portfolio | Alle Optionen sind im Admin-Panel editierbar (PageBuilder / SettingsEditor). ## Tests - 356 Unit-Tests grün (13 neue: deriveGallery hidden/grid/coverPosition, sanitizeNavLinks, EXIF-Route-Captions, justified-Layout-Validierung) - `npx tsc --noEmit`: 0 Fehler - `npm run build`: sauber - Justified-Zeilenmathematik und Cover-Splash per Browser-Harness visuell/numerisch verifiziert (volle Zeilen enden exakt an der Containerkante, letzte Zeile bleibt natürlich) --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
2026-08-14 17:56:22 +02:00
>
+ Add external link
</button>
</div>
)}
{activeSection === 'legal' && (
<div className="settings-panel">
security: add Trivy container scan to Docker publish workflow (#399) * feat(admin): add backup manager UI with 1-click restore * feat(admin): collapse older backup entries by default * fix(theme): isolate admin layout, instant DOM theme updates, and add Light/Dark mode toggle * feat(admin): replace text controls for Photo Frame and Hero Style with visual preview cards * fix(admin): define missing CSS rules for button system (.btn, .preset-btn) * feat(admin): redesign theme settings with segmented mode toggle, accent color swatches, and custom iOS-style toggle cards * feat(admin): upgrade all settings tabs with visual grid previews, Google SEO snippet preview, and toggle cards * feat(admin): overhaul Pages Builder UX with slide-over drawer, card hover badges, real-time search, and floating save bar * fix(admin): remove leftover dangling syntax snippet in PageBuilder.tsx * fix(admin): add position: relative to subpage-tile so hover overlay is contained inside the tile * style(admin): replace all emojis with clean Leica-style vector SVG icons * fix(types): extend IconProps with SVGProps to allow style prop on Leica SVG icons * feat(admin): add subpage live-preview, privacy analytics, and asset protection settings * fix(typecheck): fix AlbumEntry property access in subpage drawer preview mode * fix(types): fix ImmichAlbumInfo property names thumbnailAssetId and albumName in PageBuilder.tsx * fix(types): add protection and watermark optional properties to AppConfig interface * feat(settings): add toggle for disabling analytics tracking (defaults to enabled) * feat(ux): show status banner when analytics tracking is disabled + add live sync indicator * feat(watermark): render customizable watermark overlay on Lightbox images + rename section to Portfolio Features & Modules * fix(types): import type LightboxWatermark in PhotoGrid.tsx * fix(types): destructure watermark prop in PhotoGrid function signature * feat(seo): add configurable subpage title template and metadata descriptions * feat(seo): add generateMetadata to about page for title template support * feat(proofing): add client proofing, favorites selection, compact URL bitmasking, and export modal * feat(essay): add Photo Essay storytelling mode with RSC markdown parser and fullbleed/pair layouts * feat(subpages): add page enabled toggle to deactivate subpages without deleting them * feat(admin): add visual essay block builder for photo essay storytelling pages * security: add Trivy container scan to Docker publish workflow Scans the built image for CRITICAL/HIGH CVEs on every release and uploads results to the GitHub Security tab. Non-blocking for now (exit-code 0) so releases aren't gated on findings. Also documents the scan and existing Dependabot coverage in the README. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-08-07 11:08:04 +02:00
<div className="settings-section-header">
release: v0.11.0 (#459) Ships `dev` as **v0.11.0**. `main` contains nothing that `dev` does not, so this is a clean sync. ## Headline changes since v0.10.0 - **Journal & Journal Studio** — photo essays at `/journal`, split-screen block editor with live preview, drafts, per-entry passwords, cover images - **First-run setup wizard at `/install`** — configure a fresh deployment from the browser; credentials are verified against Immich before anything is written, and the wizard is gated by a one-time token - **About page editor and toggle** in the admin panel - **Per-album photo order** independent of Immich, with a drag & drop editor - **Custom favicon upload** - **Experimental portfolio features** — justified grid, `cover` hero, unlisted subpages, per-album grid overrides, cover focal points, external nav links - **Security** — asset tokens length-capped before decoding (#423), journal author markdown escaped rather than filtered, journal file paths contained, admin session key derived with scrypt (#432), Next.js 16.3.0 for CVE-2025-13465 - **Fixed** — client proofing honours its own configuration again (#454); journal photo rendering (#432) Full detail in [CHANGELOG.md](CHANGELOG.md#0110--2026-08-15). ## Verified `npx tsc --noEmit` clean · `npx vitest run` 435 tests pass · `npm run build` succeeds · lint 0 errors · `prettier --check` clean · local `docker build` of the release tree. ## After merge Tag `v0.11.0` on `main` and publish the release — that triggers `docker-publish.yml`, which pushes the image and moves `latest`. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
2026-08-15 09:09:18 +02:00
<h3>
<Icons.IconScale size={18} /> Legal Notice &amp; Impressum
</h3>
<p className="settings-section-sub">
Configure required legal disclosure page for EU / German Telemediengesetz
compliance.
</p>
security: add Trivy container scan to Docker publish workflow (#399) * feat(admin): add backup manager UI with 1-click restore * feat(admin): collapse older backup entries by default * fix(theme): isolate admin layout, instant DOM theme updates, and add Light/Dark mode toggle * feat(admin): replace text controls for Photo Frame and Hero Style with visual preview cards * fix(admin): define missing CSS rules for button system (.btn, .preset-btn) * feat(admin): redesign theme settings with segmented mode toggle, accent color swatches, and custom iOS-style toggle cards * feat(admin): upgrade all settings tabs with visual grid previews, Google SEO snippet preview, and toggle cards * feat(admin): overhaul Pages Builder UX with slide-over drawer, card hover badges, real-time search, and floating save bar * fix(admin): remove leftover dangling syntax snippet in PageBuilder.tsx * fix(admin): add position: relative to subpage-tile so hover overlay is contained inside the tile * style(admin): replace all emojis with clean Leica-style vector SVG icons * fix(types): extend IconProps with SVGProps to allow style prop on Leica SVG icons * feat(admin): add subpage live-preview, privacy analytics, and asset protection settings * fix(typecheck): fix AlbumEntry property access in subpage drawer preview mode * fix(types): fix ImmichAlbumInfo property names thumbnailAssetId and albumName in PageBuilder.tsx * fix(types): add protection and watermark optional properties to AppConfig interface * feat(settings): add toggle for disabling analytics tracking (defaults to enabled) * feat(ux): show status banner when analytics tracking is disabled + add live sync indicator * feat(watermark): render customizable watermark overlay on Lightbox images + rename section to Portfolio Features & Modules * fix(types): import type LightboxWatermark in PhotoGrid.tsx * fix(types): destructure watermark prop in PhotoGrid function signature * feat(seo): add configurable subpage title template and metadata descriptions * feat(seo): add generateMetadata to about page for title template support * feat(proofing): add client proofing, favorites selection, compact URL bitmasking, and export modal * feat(essay): add Photo Essay storytelling mode with RSC markdown parser and fullbleed/pair layouts * feat(subpages): add page enabled toggle to deactivate subpages without deleting them * feat(admin): add visual essay block builder for photo essay storytelling pages * security: add Trivy container scan to Docker publish workflow Scans the built image for CRITICAL/HIGH CVEs on every release and uploads results to the GitHub Security tab. Non-blocking for now (exit-code 0) so releases aren't gated on findings. Also documents the scan and existing Dependabot coverage in the README. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-08-07 11:08:04 +02:00
</div>
<div className="admin-toggle-cards-grid" style={{ marginBottom: '1.25rem' }}>
<button
type="button"
className={`admin-toggle-card ${settings.legal?.enabled === true ? 'active' : ''}`}
onClick={() => update('legal.enabled', !settings.legal?.enabled)}
>
<div className="toggle-card-info">
release: v0.11.0 (#459) Ships `dev` as **v0.11.0**. `main` contains nothing that `dev` does not, so this is a clean sync. ## Headline changes since v0.10.0 - **Journal & Journal Studio** — photo essays at `/journal`, split-screen block editor with live preview, drafts, per-entry passwords, cover images - **First-run setup wizard at `/install`** — configure a fresh deployment from the browser; credentials are verified against Immich before anything is written, and the wizard is gated by a one-time token - **About page editor and toggle** in the admin panel - **Per-album photo order** independent of Immich, with a drag & drop editor - **Custom favicon upload** - **Experimental portfolio features** — justified grid, `cover` hero, unlisted subpages, per-album grid overrides, cover focal points, external nav links - **Security** — asset tokens length-capped before decoding (#423), journal author markdown escaped rather than filtered, journal file paths contained, admin session key derived with scrypt (#432), Next.js 16.3.0 for CVE-2025-13465 - **Fixed** — client proofing honours its own configuration again (#454); journal photo rendering (#432) Full detail in [CHANGELOG.md](CHANGELOG.md#0110--2026-08-15). ## Verified `npx tsc --noEmit` clean · `npx vitest run` 435 tests pass · `npm run build` succeeds · lint 0 errors · `prettier --check` clean · local `docker build` of the release tree. ## After merge Tag `v0.11.0` on `main` and publish the release — that triggers `docker-publish.yml`, which pushes the image and moves `latest`. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
2026-08-15 09:09:18 +02:00
<span className="toggle-card-title">
<Icons.IconFileText size={16} /> Enable Impressum Page (/impressum)
</span>
<span className="toggle-card-desc">
Automatically generates and links /impressum in footer
</span>
security: add Trivy container scan to Docker publish workflow (#399) * feat(admin): add backup manager UI with 1-click restore * feat(admin): collapse older backup entries by default * fix(theme): isolate admin layout, instant DOM theme updates, and add Light/Dark mode toggle * feat(admin): replace text controls for Photo Frame and Hero Style with visual preview cards * fix(admin): define missing CSS rules for button system (.btn, .preset-btn) * feat(admin): redesign theme settings with segmented mode toggle, accent color swatches, and custom iOS-style toggle cards * feat(admin): upgrade all settings tabs with visual grid previews, Google SEO snippet preview, and toggle cards * feat(admin): overhaul Pages Builder UX with slide-over drawer, card hover badges, real-time search, and floating save bar * fix(admin): remove leftover dangling syntax snippet in PageBuilder.tsx * fix(admin): add position: relative to subpage-tile so hover overlay is contained inside the tile * style(admin): replace all emojis with clean Leica-style vector SVG icons * fix(types): extend IconProps with SVGProps to allow style prop on Leica SVG icons * feat(admin): add subpage live-preview, privacy analytics, and asset protection settings * fix(typecheck): fix AlbumEntry property access in subpage drawer preview mode * fix(types): fix ImmichAlbumInfo property names thumbnailAssetId and albumName in PageBuilder.tsx * fix(types): add protection and watermark optional properties to AppConfig interface * feat(settings): add toggle for disabling analytics tracking (defaults to enabled) * feat(ux): show status banner when analytics tracking is disabled + add live sync indicator * feat(watermark): render customizable watermark overlay on Lightbox images + rename section to Portfolio Features & Modules * fix(types): import type LightboxWatermark in PhotoGrid.tsx * fix(types): destructure watermark prop in PhotoGrid function signature * feat(seo): add configurable subpage title template and metadata descriptions * feat(seo): add generateMetadata to about page for title template support * feat(proofing): add client proofing, favorites selection, compact URL bitmasking, and export modal * feat(essay): add Photo Essay storytelling mode with RSC markdown parser and fullbleed/pair layouts * feat(subpages): add page enabled toggle to deactivate subpages without deleting them * feat(admin): add visual essay block builder for photo essay storytelling pages * security: add Trivy container scan to Docker publish workflow Scans the built image for CRITICAL/HIGH CVEs on every release and uploads results to the GitHub Security tab. Non-blocking for now (exit-code 0) so releases aren't gated on findings. Also documents the scan and existing Dependabot coverage in the README. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-08-07 11:08:04 +02:00
</div>
<div className={`switch-toggle ${settings.legal?.enabled === true ? 'on' : ''}`}>
<span className="switch-slider" />
</div>
</button>
</div>
security: add Trivy container scan to Docker publish workflow (#399) * feat(admin): add backup manager UI with 1-click restore * feat(admin): collapse older backup entries by default * fix(theme): isolate admin layout, instant DOM theme updates, and add Light/Dark mode toggle * feat(admin): replace text controls for Photo Frame and Hero Style with visual preview cards * fix(admin): define missing CSS rules for button system (.btn, .preset-btn) * feat(admin): redesign theme settings with segmented mode toggle, accent color swatches, and custom iOS-style toggle cards * feat(admin): upgrade all settings tabs with visual grid previews, Google SEO snippet preview, and toggle cards * feat(admin): overhaul Pages Builder UX with slide-over drawer, card hover badges, real-time search, and floating save bar * fix(admin): remove leftover dangling syntax snippet in PageBuilder.tsx * fix(admin): add position: relative to subpage-tile so hover overlay is contained inside the tile * style(admin): replace all emojis with clean Leica-style vector SVG icons * fix(types): extend IconProps with SVGProps to allow style prop on Leica SVG icons * feat(admin): add subpage live-preview, privacy analytics, and asset protection settings * fix(typecheck): fix AlbumEntry property access in subpage drawer preview mode * fix(types): fix ImmichAlbumInfo property names thumbnailAssetId and albumName in PageBuilder.tsx * fix(types): add protection and watermark optional properties to AppConfig interface * feat(settings): add toggle for disabling analytics tracking (defaults to enabled) * feat(ux): show status banner when analytics tracking is disabled + add live sync indicator * feat(watermark): render customizable watermark overlay on Lightbox images + rename section to Portfolio Features & Modules * fix(types): import type LightboxWatermark in PhotoGrid.tsx * fix(types): destructure watermark prop in PhotoGrid function signature * feat(seo): add configurable subpage title template and metadata descriptions * feat(seo): add generateMetadata to about page for title template support * feat(proofing): add client proofing, favorites selection, compact URL bitmasking, and export modal * feat(essay): add Photo Essay storytelling mode with RSC markdown parser and fullbleed/pair layouts * feat(subpages): add page enabled toggle to deactivate subpages without deleting them * feat(admin): add visual essay block builder for photo essay storytelling pages * security: add Trivy container scan to Docker publish workflow Scans the built image for CRITICAL/HIGH CVEs on every release and uploads results to the GitHub Security tab. Non-blocking for now (exit-code 0) so releases aren't gated on findings. Also documents the scan and existing Dependabot coverage in the README. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-08-07 11:08:04 +02:00
{settings.legal?.enabled && (
<>
security: add Trivy container scan to Docker publish workflow (#399) * feat(admin): add backup manager UI with 1-click restore * feat(admin): collapse older backup entries by default * fix(theme): isolate admin layout, instant DOM theme updates, and add Light/Dark mode toggle * feat(admin): replace text controls for Photo Frame and Hero Style with visual preview cards * fix(admin): define missing CSS rules for button system (.btn, .preset-btn) * feat(admin): redesign theme settings with segmented mode toggle, accent color swatches, and custom iOS-style toggle cards * feat(admin): upgrade all settings tabs with visual grid previews, Google SEO snippet preview, and toggle cards * feat(admin): overhaul Pages Builder UX with slide-over drawer, card hover badges, real-time search, and floating save bar * fix(admin): remove leftover dangling syntax snippet in PageBuilder.tsx * fix(admin): add position: relative to subpage-tile so hover overlay is contained inside the tile * style(admin): replace all emojis with clean Leica-style vector SVG icons * fix(types): extend IconProps with SVGProps to allow style prop on Leica SVG icons * feat(admin): add subpage live-preview, privacy analytics, and asset protection settings * fix(typecheck): fix AlbumEntry property access in subpage drawer preview mode * fix(types): fix ImmichAlbumInfo property names thumbnailAssetId and albumName in PageBuilder.tsx * fix(types): add protection and watermark optional properties to AppConfig interface * feat(settings): add toggle for disabling analytics tracking (defaults to enabled) * feat(ux): show status banner when analytics tracking is disabled + add live sync indicator * feat(watermark): render customizable watermark overlay on Lightbox images + rename section to Portfolio Features & Modules * fix(types): import type LightboxWatermark in PhotoGrid.tsx * fix(types): destructure watermark prop in PhotoGrid function signature * feat(seo): add configurable subpage title template and metadata descriptions * feat(seo): add generateMetadata to about page for title template support * feat(proofing): add client proofing, favorites selection, compact URL bitmasking, and export modal * feat(essay): add Photo Essay storytelling mode with RSC markdown parser and fullbleed/pair layouts * feat(subpages): add page enabled toggle to deactivate subpages without deleting them * feat(admin): add visual essay block builder for photo essay storytelling pages * security: add Trivy container scan to Docker publish workflow Scans the built image for CRITICAL/HIGH CVEs on every release and uploads results to the GitHub Security tab. Non-blocking for now (exit-code 0) so releases aren't gated on findings. Also documents the scan and existing Dependabot coverage in the README. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-08-07 11:08:04 +02:00
<div className="admin-field-row">
<div className="admin-field">
<label>Full Name / Business Name</label>
<input
value={settings.legal?.name || ''}
onChange={(e) => update('legal.name', e.target.value)}
placeholder="Max Mustermann"
/>
</div>
<div className="admin-field">
<label>Street Address</label>
<input
value={settings.legal?.address || ''}
onChange={(e) => update('legal.address', e.target.value)}
placeholder="Musterstraße 1"
/>
</div>
</div>
<div className="admin-field-row">
<div className="admin-field">
security: add Trivy container scan to Docker publish workflow (#399) * feat(admin): add backup manager UI with 1-click restore * feat(admin): collapse older backup entries by default * fix(theme): isolate admin layout, instant DOM theme updates, and add Light/Dark mode toggle * feat(admin): replace text controls for Photo Frame and Hero Style with visual preview cards * fix(admin): define missing CSS rules for button system (.btn, .preset-btn) * feat(admin): redesign theme settings with segmented mode toggle, accent color swatches, and custom iOS-style toggle cards * feat(admin): upgrade all settings tabs with visual grid previews, Google SEO snippet preview, and toggle cards * feat(admin): overhaul Pages Builder UX with slide-over drawer, card hover badges, real-time search, and floating save bar * fix(admin): remove leftover dangling syntax snippet in PageBuilder.tsx * fix(admin): add position: relative to subpage-tile so hover overlay is contained inside the tile * style(admin): replace all emojis with clean Leica-style vector SVG icons * fix(types): extend IconProps with SVGProps to allow style prop on Leica SVG icons * feat(admin): add subpage live-preview, privacy analytics, and asset protection settings * fix(typecheck): fix AlbumEntry property access in subpage drawer preview mode * fix(types): fix ImmichAlbumInfo property names thumbnailAssetId and albumName in PageBuilder.tsx * fix(types): add protection and watermark optional properties to AppConfig interface * feat(settings): add toggle for disabling analytics tracking (defaults to enabled) * feat(ux): show status banner when analytics tracking is disabled + add live sync indicator * feat(watermark): render customizable watermark overlay on Lightbox images + rename section to Portfolio Features & Modules * fix(types): import type LightboxWatermark in PhotoGrid.tsx * fix(types): destructure watermark prop in PhotoGrid function signature * feat(seo): add configurable subpage title template and metadata descriptions * feat(seo): add generateMetadata to about page for title template support * feat(proofing): add client proofing, favorites selection, compact URL bitmasking, and export modal * feat(essay): add Photo Essay storytelling mode with RSC markdown parser and fullbleed/pair layouts * feat(subpages): add page enabled toggle to deactivate subpages without deleting them * feat(admin): add visual essay block builder for photo essay storytelling pages * security: add Trivy container scan to Docker publish workflow Scans the built image for CRITICAL/HIGH CVEs on every release and uploads results to the GitHub Security tab. Non-blocking for now (exit-code 0) so releases aren't gated on findings. Also documents the scan and existing Dependabot coverage in the README. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-08-07 11:08:04 +02:00
<label>ZIP &amp; City</label>
<input
value={settings.legal?.zipCity || ''}
onChange={(e) => update('legal.zipCity', e.target.value)}
placeholder="12345 Berlin"
/>
</div>
<div className="admin-field">
<label>Country</label>
<input
value={settings.legal?.country || ''}
onChange={(e) => update('legal.country', e.target.value)}
placeholder="Germany"
/>
</div>
</div>
<div className="admin-field-row">
<div className="admin-field">
security: add Trivy container scan to Docker publish workflow (#399) * feat(admin): add backup manager UI with 1-click restore * feat(admin): collapse older backup entries by default * fix(theme): isolate admin layout, instant DOM theme updates, and add Light/Dark mode toggle * feat(admin): replace text controls for Photo Frame and Hero Style with visual preview cards * fix(admin): define missing CSS rules for button system (.btn, .preset-btn) * feat(admin): redesign theme settings with segmented mode toggle, accent color swatches, and custom iOS-style toggle cards * feat(admin): upgrade all settings tabs with visual grid previews, Google SEO snippet preview, and toggle cards * feat(admin): overhaul Pages Builder UX with slide-over drawer, card hover badges, real-time search, and floating save bar * fix(admin): remove leftover dangling syntax snippet in PageBuilder.tsx * fix(admin): add position: relative to subpage-tile so hover overlay is contained inside the tile * style(admin): replace all emojis with clean Leica-style vector SVG icons * fix(types): extend IconProps with SVGProps to allow style prop on Leica SVG icons * feat(admin): add subpage live-preview, privacy analytics, and asset protection settings * fix(typecheck): fix AlbumEntry property access in subpage drawer preview mode * fix(types): fix ImmichAlbumInfo property names thumbnailAssetId and albumName in PageBuilder.tsx * fix(types): add protection and watermark optional properties to AppConfig interface * feat(settings): add toggle for disabling analytics tracking (defaults to enabled) * feat(ux): show status banner when analytics tracking is disabled + add live sync indicator * feat(watermark): render customizable watermark overlay on Lightbox images + rename section to Portfolio Features & Modules * fix(types): import type LightboxWatermark in PhotoGrid.tsx * fix(types): destructure watermark prop in PhotoGrid function signature * feat(seo): add configurable subpage title template and metadata descriptions * feat(seo): add generateMetadata to about page for title template support * feat(proofing): add client proofing, favorites selection, compact URL bitmasking, and export modal * feat(essay): add Photo Essay storytelling mode with RSC markdown parser and fullbleed/pair layouts * feat(subpages): add page enabled toggle to deactivate subpages without deleting them * feat(admin): add visual essay block builder for photo essay storytelling pages * security: add Trivy container scan to Docker publish workflow Scans the built image for CRITICAL/HIGH CVEs on every release and uploads results to the GitHub Security tab. Non-blocking for now (exit-code 0) so releases aren't gated on findings. Also documents the scan and existing Dependabot coverage in the README. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-08-07 11:08:04 +02:00
<label>Legal Email</label>
<input
value={settings.legal?.email || ''}
onChange={(e) => update('legal.email', e.target.value)}
placeholder="legal@example.com"
/>
</div>
<div className="admin-field">
security: add Trivy container scan to Docker publish workflow (#399) * feat(admin): add backup manager UI with 1-click restore * feat(admin): collapse older backup entries by default * fix(theme): isolate admin layout, instant DOM theme updates, and add Light/Dark mode toggle * feat(admin): replace text controls for Photo Frame and Hero Style with visual preview cards * fix(admin): define missing CSS rules for button system (.btn, .preset-btn) * feat(admin): redesign theme settings with segmented mode toggle, accent color swatches, and custom iOS-style toggle cards * feat(admin): upgrade all settings tabs with visual grid previews, Google SEO snippet preview, and toggle cards * feat(admin): overhaul Pages Builder UX with slide-over drawer, card hover badges, real-time search, and floating save bar * fix(admin): remove leftover dangling syntax snippet in PageBuilder.tsx * fix(admin): add position: relative to subpage-tile so hover overlay is contained inside the tile * style(admin): replace all emojis with clean Leica-style vector SVG icons * fix(types): extend IconProps with SVGProps to allow style prop on Leica SVG icons * feat(admin): add subpage live-preview, privacy analytics, and asset protection settings * fix(typecheck): fix AlbumEntry property access in subpage drawer preview mode * fix(types): fix ImmichAlbumInfo property names thumbnailAssetId and albumName in PageBuilder.tsx * fix(types): add protection and watermark optional properties to AppConfig interface * feat(settings): add toggle for disabling analytics tracking (defaults to enabled) * feat(ux): show status banner when analytics tracking is disabled + add live sync indicator * feat(watermark): render customizable watermark overlay on Lightbox images + rename section to Portfolio Features & Modules * fix(types): import type LightboxWatermark in PhotoGrid.tsx * fix(types): destructure watermark prop in PhotoGrid function signature * feat(seo): add configurable subpage title template and metadata descriptions * feat(seo): add generateMetadata to about page for title template support * feat(proofing): add client proofing, favorites selection, compact URL bitmasking, and export modal * feat(essay): add Photo Essay storytelling mode with RSC markdown parser and fullbleed/pair layouts * feat(subpages): add page enabled toggle to deactivate subpages without deleting them * feat(admin): add visual essay block builder for photo essay storytelling pages * security: add Trivy container scan to Docker publish workflow Scans the built image for CRITICAL/HIGH CVEs on every release and uploads results to the GitHub Security tab. Non-blocking for now (exit-code 0) so releases aren't gated on findings. Also documents the scan and existing Dependabot coverage in the README. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-08-07 11:08:04 +02:00
<label>Phone Number</label>
<input
value={settings.legal?.phone || ''}
onChange={(e) => update('legal.phone', e.target.value)}
placeholder="+49 123 456789"
/>
</div>
</div>
<div className="admin-field">
security: add Trivy container scan to Docker publish workflow (#399) * feat(admin): add backup manager UI with 1-click restore * feat(admin): collapse older backup entries by default * fix(theme): isolate admin layout, instant DOM theme updates, and add Light/Dark mode toggle * feat(admin): replace text controls for Photo Frame and Hero Style with visual preview cards * fix(admin): define missing CSS rules for button system (.btn, .preset-btn) * feat(admin): redesign theme settings with segmented mode toggle, accent color swatches, and custom iOS-style toggle cards * feat(admin): upgrade all settings tabs with visual grid previews, Google SEO snippet preview, and toggle cards * feat(admin): overhaul Pages Builder UX with slide-over drawer, card hover badges, real-time search, and floating save bar * fix(admin): remove leftover dangling syntax snippet in PageBuilder.tsx * fix(admin): add position: relative to subpage-tile so hover overlay is contained inside the tile * style(admin): replace all emojis with clean Leica-style vector SVG icons * fix(types): extend IconProps with SVGProps to allow style prop on Leica SVG icons * feat(admin): add subpage live-preview, privacy analytics, and asset protection settings * fix(typecheck): fix AlbumEntry property access in subpage drawer preview mode * fix(types): fix ImmichAlbumInfo property names thumbnailAssetId and albumName in PageBuilder.tsx * fix(types): add protection and watermark optional properties to AppConfig interface * feat(settings): add toggle for disabling analytics tracking (defaults to enabled) * feat(ux): show status banner when analytics tracking is disabled + add live sync indicator * feat(watermark): render customizable watermark overlay on Lightbox images + rename section to Portfolio Features & Modules * fix(types): import type LightboxWatermark in PhotoGrid.tsx * fix(types): destructure watermark prop in PhotoGrid function signature * feat(seo): add configurable subpage title template and metadata descriptions * feat(seo): add generateMetadata to about page for title template support * feat(proofing): add client proofing, favorites selection, compact URL bitmasking, and export modal * feat(essay): add Photo Essay storytelling mode with RSC markdown parser and fullbleed/pair layouts * feat(subpages): add page enabled toggle to deactivate subpages without deleting them * feat(admin): add visual essay block builder for photo essay storytelling pages * security: add Trivy container scan to Docker publish workflow Scans the built image for CRITICAL/HIGH CVEs on every release and uploads results to the GitHub Security tab. Non-blocking for now (exit-code 0) so releases aren't gated on findings. Also documents the scan and existing Dependabot coverage in the README. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-08-07 11:08:04 +02:00
<label>Additional Disclosures / Tax ID</label>
<textarea
value={settings.legal?.extraInfo || ''}
onChange={(e) => update('legal.extraInfo', e.target.value)}
security: add Trivy container scan to Docker publish workflow (#399) * feat(admin): add backup manager UI with 1-click restore * feat(admin): collapse older backup entries by default * fix(theme): isolate admin layout, instant DOM theme updates, and add Light/Dark mode toggle * feat(admin): replace text controls for Photo Frame and Hero Style with visual preview cards * fix(admin): define missing CSS rules for button system (.btn, .preset-btn) * feat(admin): redesign theme settings with segmented mode toggle, accent color swatches, and custom iOS-style toggle cards * feat(admin): upgrade all settings tabs with visual grid previews, Google SEO snippet preview, and toggle cards * feat(admin): overhaul Pages Builder UX with slide-over drawer, card hover badges, real-time search, and floating save bar * fix(admin): remove leftover dangling syntax snippet in PageBuilder.tsx * fix(admin): add position: relative to subpage-tile so hover overlay is contained inside the tile * style(admin): replace all emojis with clean Leica-style vector SVG icons * fix(types): extend IconProps with SVGProps to allow style prop on Leica SVG icons * feat(admin): add subpage live-preview, privacy analytics, and asset protection settings * fix(typecheck): fix AlbumEntry property access in subpage drawer preview mode * fix(types): fix ImmichAlbumInfo property names thumbnailAssetId and albumName in PageBuilder.tsx * fix(types): add protection and watermark optional properties to AppConfig interface * feat(settings): add toggle for disabling analytics tracking (defaults to enabled) * feat(ux): show status banner when analytics tracking is disabled + add live sync indicator * feat(watermark): render customizable watermark overlay on Lightbox images + rename section to Portfolio Features & Modules * fix(types): import type LightboxWatermark in PhotoGrid.tsx * fix(types): destructure watermark prop in PhotoGrid function signature * feat(seo): add configurable subpage title template and metadata descriptions * feat(seo): add generateMetadata to about page for title template support * feat(proofing): add client proofing, favorites selection, compact URL bitmasking, and export modal * feat(essay): add Photo Essay storytelling mode with RSC markdown parser and fullbleed/pair layouts * feat(subpages): add page enabled toggle to deactivate subpages without deleting them * feat(admin): add visual essay block builder for photo essay storytelling pages * security: add Trivy container scan to Docker publish workflow Scans the built image for CRITICAL/HIGH CVEs on every release and uploads results to the GitHub Security tab. Non-blocking for now (exit-code 0) so releases aren't gated on findings. Also documents the scan and existing Dependabot coverage in the README. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-08-07 11:08:04 +02:00
placeholder="Verantwortlich für den Inhalt nach § 18 Abs. 2 MStV..."
rows={3}
/>
</div>
</>
)}
</div>
)}
{activeSection === 'seo' && (
<div className="settings-panel">
security: add Trivy container scan to Docker publish workflow (#399) * feat(admin): add backup manager UI with 1-click restore * feat(admin): collapse older backup entries by default * fix(theme): isolate admin layout, instant DOM theme updates, and add Light/Dark mode toggle * feat(admin): replace text controls for Photo Frame and Hero Style with visual preview cards * fix(admin): define missing CSS rules for button system (.btn, .preset-btn) * feat(admin): redesign theme settings with segmented mode toggle, accent color swatches, and custom iOS-style toggle cards * feat(admin): upgrade all settings tabs with visual grid previews, Google SEO snippet preview, and toggle cards * feat(admin): overhaul Pages Builder UX with slide-over drawer, card hover badges, real-time search, and floating save bar * fix(admin): remove leftover dangling syntax snippet in PageBuilder.tsx * fix(admin): add position: relative to subpage-tile so hover overlay is contained inside the tile * style(admin): replace all emojis with clean Leica-style vector SVG icons * fix(types): extend IconProps with SVGProps to allow style prop on Leica SVG icons * feat(admin): add subpage live-preview, privacy analytics, and asset protection settings * fix(typecheck): fix AlbumEntry property access in subpage drawer preview mode * fix(types): fix ImmichAlbumInfo property names thumbnailAssetId and albumName in PageBuilder.tsx * fix(types): add protection and watermark optional properties to AppConfig interface * feat(settings): add toggle for disabling analytics tracking (defaults to enabled) * feat(ux): show status banner when analytics tracking is disabled + add live sync indicator * feat(watermark): render customizable watermark overlay on Lightbox images + rename section to Portfolio Features & Modules * fix(types): import type LightboxWatermark in PhotoGrid.tsx * fix(types): destructure watermark prop in PhotoGrid function signature * feat(seo): add configurable subpage title template and metadata descriptions * feat(seo): add generateMetadata to about page for title template support * feat(proofing): add client proofing, favorites selection, compact URL bitmasking, and export modal * feat(essay): add Photo Essay storytelling mode with RSC markdown parser and fullbleed/pair layouts * feat(subpages): add page enabled toggle to deactivate subpages without deleting them * feat(admin): add visual essay block builder for photo essay storytelling pages * security: add Trivy container scan to Docker publish workflow Scans the built image for CRITICAL/HIGH CVEs on every release and uploads results to the GitHub Security tab. Non-blocking for now (exit-code 0) so releases aren't gated on findings. Also documents the scan and existing Dependabot coverage in the README. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-08-07 11:08:04 +02:00
<div className="settings-section-header">
release: v0.11.0 (#459) Ships `dev` as **v0.11.0**. `main` contains nothing that `dev` does not, so this is a clean sync. ## Headline changes since v0.10.0 - **Journal & Journal Studio** — photo essays at `/journal`, split-screen block editor with live preview, drafts, per-entry passwords, cover images - **First-run setup wizard at `/install`** — configure a fresh deployment from the browser; credentials are verified against Immich before anything is written, and the wizard is gated by a one-time token - **About page editor and toggle** in the admin panel - **Per-album photo order** independent of Immich, with a drag & drop editor - **Custom favicon upload** - **Experimental portfolio features** — justified grid, `cover` hero, unlisted subpages, per-album grid overrides, cover focal points, external nav links - **Security** — asset tokens length-capped before decoding (#423), journal author markdown escaped rather than filtered, journal file paths contained, admin session key derived with scrypt (#432), Next.js 16.3.0 for CVE-2025-13465 - **Fixed** — client proofing honours its own configuration again (#454); journal photo rendering (#432) Full detail in [CHANGELOG.md](CHANGELOG.md#0110--2026-08-15). ## Verified `npx tsc --noEmit` clean · `npx vitest run` 435 tests pass · `npm run build` succeeds · lint 0 errors · `prettier --check` clean · local `docker build` of the release tree. ## After merge Tag `v0.11.0` on `main` and publish the release — that triggers `docker-publish.yml`, which pushes the image and moves `latest`. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
2026-08-15 09:09:18 +02:00
<h3>
<Icons.IconSearch size={18} /> Search Engine Optimization (SEO)
</h3>
<p className="settings-section-sub">
Customize search engine metadata, OpenGraph tags, and indexing rules.
</p>
security: add Trivy container scan to Docker publish workflow (#399) * feat(admin): add backup manager UI with 1-click restore * feat(admin): collapse older backup entries by default * fix(theme): isolate admin layout, instant DOM theme updates, and add Light/Dark mode toggle * feat(admin): replace text controls for Photo Frame and Hero Style with visual preview cards * fix(admin): define missing CSS rules for button system (.btn, .preset-btn) * feat(admin): redesign theme settings with segmented mode toggle, accent color swatches, and custom iOS-style toggle cards * feat(admin): upgrade all settings tabs with visual grid previews, Google SEO snippet preview, and toggle cards * feat(admin): overhaul Pages Builder UX with slide-over drawer, card hover badges, real-time search, and floating save bar * fix(admin): remove leftover dangling syntax snippet in PageBuilder.tsx * fix(admin): add position: relative to subpage-tile so hover overlay is contained inside the tile * style(admin): replace all emojis with clean Leica-style vector SVG icons * fix(types): extend IconProps with SVGProps to allow style prop on Leica SVG icons * feat(admin): add subpage live-preview, privacy analytics, and asset protection settings * fix(typecheck): fix AlbumEntry property access in subpage drawer preview mode * fix(types): fix ImmichAlbumInfo property names thumbnailAssetId and albumName in PageBuilder.tsx * fix(types): add protection and watermark optional properties to AppConfig interface * feat(settings): add toggle for disabling analytics tracking (defaults to enabled) * feat(ux): show status banner when analytics tracking is disabled + add live sync indicator * feat(watermark): render customizable watermark overlay on Lightbox images + rename section to Portfolio Features & Modules * fix(types): import type LightboxWatermark in PhotoGrid.tsx * fix(types): destructure watermark prop in PhotoGrid function signature * feat(seo): add configurable subpage title template and metadata descriptions * feat(seo): add generateMetadata to about page for title template support * feat(proofing): add client proofing, favorites selection, compact URL bitmasking, and export modal * feat(essay): add Photo Essay storytelling mode with RSC markdown parser and fullbleed/pair layouts * feat(subpages): add page enabled toggle to deactivate subpages without deleting them * feat(admin): add visual essay block builder for photo essay storytelling pages * security: add Trivy container scan to Docker publish workflow Scans the built image for CRITICAL/HIGH CVEs on every release and uploads results to the GitHub Security tab. Non-blocking for now (exit-code 0) so releases aren't gated on findings. Also documents the scan and existing Dependabot coverage in the README. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-08-07 11:08:04 +02:00
</div>
{/* Live Google Search Result Snippet Card */}
<div className="google-snippet-preview">
<div className="google-snippet-header">
release: v0.11.0 (#459) Ships `dev` as **v0.11.0**. `main` contains nothing that `dev` does not, so this is a clean sync. ## Headline changes since v0.10.0 - **Journal & Journal Studio** — photo essays at `/journal`, split-screen block editor with live preview, drafts, per-entry passwords, cover images - **First-run setup wizard at `/install`** — configure a fresh deployment from the browser; credentials are verified against Immich before anything is written, and the wizard is gated by a one-time token - **About page editor and toggle** in the admin panel - **Per-album photo order** independent of Immich, with a drag & drop editor - **Custom favicon upload** - **Experimental portfolio features** — justified grid, `cover` hero, unlisted subpages, per-album grid overrides, cover focal points, external nav links - **Security** — asset tokens length-capped before decoding (#423), journal author markdown escaped rather than filtered, journal file paths contained, admin session key derived with scrypt (#432), Next.js 16.3.0 for CVE-2025-13465 - **Fixed** — client proofing honours its own configuration again (#454); journal photo rendering (#432) Full detail in [CHANGELOG.md](CHANGELOG.md#0110--2026-08-15). ## Verified `npx tsc --noEmit` clean · `npx vitest run` 435 tests pass · `npm run build` succeeds · lint 0 errors · `prettier --check` clean · local `docker build` of the release tree. ## After merge Tag `v0.11.0` on `main` and publish the release — that triggers `docker-publish.yml`, which pushes the image and moves `latest`. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
2026-08-15 09:09:18 +02:00
<span>
<Icons.IconGlobe size={14} /> Google Search Result Preview
</span>
security: add Trivy container scan to Docker publish workflow (#399) * feat(admin): add backup manager UI with 1-click restore * feat(admin): collapse older backup entries by default * fix(theme): isolate admin layout, instant DOM theme updates, and add Light/Dark mode toggle * feat(admin): replace text controls for Photo Frame and Hero Style with visual preview cards * fix(admin): define missing CSS rules for button system (.btn, .preset-btn) * feat(admin): redesign theme settings with segmented mode toggle, accent color swatches, and custom iOS-style toggle cards * feat(admin): upgrade all settings tabs with visual grid previews, Google SEO snippet preview, and toggle cards * feat(admin): overhaul Pages Builder UX with slide-over drawer, card hover badges, real-time search, and floating save bar * fix(admin): remove leftover dangling syntax snippet in PageBuilder.tsx * fix(admin): add position: relative to subpage-tile so hover overlay is contained inside the tile * style(admin): replace all emojis with clean Leica-style vector SVG icons * fix(types): extend IconProps with SVGProps to allow style prop on Leica SVG icons * feat(admin): add subpage live-preview, privacy analytics, and asset protection settings * fix(typecheck): fix AlbumEntry property access in subpage drawer preview mode * fix(types): fix ImmichAlbumInfo property names thumbnailAssetId and albumName in PageBuilder.tsx * fix(types): add protection and watermark optional properties to AppConfig interface * feat(settings): add toggle for disabling analytics tracking (defaults to enabled) * feat(ux): show status banner when analytics tracking is disabled + add live sync indicator * feat(watermark): render customizable watermark overlay on Lightbox images + rename section to Portfolio Features & Modules * fix(types): import type LightboxWatermark in PhotoGrid.tsx * fix(types): destructure watermark prop in PhotoGrid function signature * feat(seo): add configurable subpage title template and metadata descriptions * feat(seo): add generateMetadata to about page for title template support * feat(proofing): add client proofing, favorites selection, compact URL bitmasking, and export modal * feat(essay): add Photo Essay storytelling mode with RSC markdown parser and fullbleed/pair layouts * feat(subpages): add page enabled toggle to deactivate subpages without deleting them * feat(admin): add visual essay block builder for photo essay storytelling pages * security: add Trivy container scan to Docker publish workflow Scans the built image for CRITICAL/HIGH CVEs on every release and uploads results to the GitHub Security tab. Non-blocking for now (exit-code 0) so releases aren't gated on findings. Also documents the scan and existing Dependabot coverage in the README. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-08-07 11:08:04 +02:00
</div>
<div className="google-snippet-card">
<div className="google-snippet-url">
https://yourportfolio.com <span className="google-snippet-arrow">▼</span>
</div>
<div className="google-snippet-title">
{settings.seo?.title || settings.title || 'My Photography Portfolio'}
</div>
<div className="google-snippet-desc">
release: v0.11.0 (#459) Ships `dev` as **v0.11.0**. `main` contains nothing that `dev` does not, so this is a clean sync. ## Headline changes since v0.10.0 - **Journal & Journal Studio** — photo essays at `/journal`, split-screen block editor with live preview, drafts, per-entry passwords, cover images - **First-run setup wizard at `/install`** — configure a fresh deployment from the browser; credentials are verified against Immich before anything is written, and the wizard is gated by a one-time token - **About page editor and toggle** in the admin panel - **Per-album photo order** independent of Immich, with a drag & drop editor - **Custom favicon upload** - **Experimental portfolio features** — justified grid, `cover` hero, unlisted subpages, per-album grid overrides, cover focal points, external nav links - **Security** — asset tokens length-capped before decoding (#423), journal author markdown escaped rather than filtered, journal file paths contained, admin session key derived with scrypt (#432), Next.js 16.3.0 for CVE-2025-13465 - **Fixed** — client proofing honours its own configuration again (#454); journal photo rendering (#432) Full detail in [CHANGELOG.md](CHANGELOG.md#0110--2026-08-15). ## Verified `npx tsc --noEmit` clean · `npx vitest run` 435 tests pass · `npm run build` succeeds · lint 0 errors · `prettier --check` clean · local `docker build` of the release tree. ## After merge Tag `v0.11.0` on `main` and publish the release — that triggers `docker-publish.yml`, which pushes the image and moves `latest`. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
2026-08-15 09:09:18 +02:00
{settings.seo?.description ||
settings.subtitle ||
'A curated selection of photography work.'}
security: add Trivy container scan to Docker publish workflow (#399) * feat(admin): add backup manager UI with 1-click restore * feat(admin): collapse older backup entries by default * fix(theme): isolate admin layout, instant DOM theme updates, and add Light/Dark mode toggle * feat(admin): replace text controls for Photo Frame and Hero Style with visual preview cards * fix(admin): define missing CSS rules for button system (.btn, .preset-btn) * feat(admin): redesign theme settings with segmented mode toggle, accent color swatches, and custom iOS-style toggle cards * feat(admin): upgrade all settings tabs with visual grid previews, Google SEO snippet preview, and toggle cards * feat(admin): overhaul Pages Builder UX with slide-over drawer, card hover badges, real-time search, and floating save bar * fix(admin): remove leftover dangling syntax snippet in PageBuilder.tsx * fix(admin): add position: relative to subpage-tile so hover overlay is contained inside the tile * style(admin): replace all emojis with clean Leica-style vector SVG icons * fix(types): extend IconProps with SVGProps to allow style prop on Leica SVG icons * feat(admin): add subpage live-preview, privacy analytics, and asset protection settings * fix(typecheck): fix AlbumEntry property access in subpage drawer preview mode * fix(types): fix ImmichAlbumInfo property names thumbnailAssetId and albumName in PageBuilder.tsx * fix(types): add protection and watermark optional properties to AppConfig interface * feat(settings): add toggle for disabling analytics tracking (defaults to enabled) * feat(ux): show status banner when analytics tracking is disabled + add live sync indicator * feat(watermark): render customizable watermark overlay on Lightbox images + rename section to Portfolio Features & Modules * fix(types): import type LightboxWatermark in PhotoGrid.tsx * fix(types): destructure watermark prop in PhotoGrid function signature * feat(seo): add configurable subpage title template and metadata descriptions * feat(seo): add generateMetadata to about page for title template support * feat(proofing): add client proofing, favorites selection, compact URL bitmasking, and export modal * feat(essay): add Photo Essay storytelling mode with RSC markdown parser and fullbleed/pair layouts * feat(subpages): add page enabled toggle to deactivate subpages without deleting them * feat(admin): add visual essay block builder for photo essay storytelling pages * security: add Trivy container scan to Docker publish workflow Scans the built image for CRITICAL/HIGH CVEs on every release and uploads results to the GitHub Security tab. Non-blocking for now (exit-code 0) so releases aren't gated on findings. Also documents the scan and existing Dependabot coverage in the README. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-08-07 11:08:04 +02:00
</div>
</div>
</div>
<div className="admin-field">
security: add Trivy container scan to Docker publish workflow (#399) * feat(admin): add backup manager UI with 1-click restore * feat(admin): collapse older backup entries by default * fix(theme): isolate admin layout, instant DOM theme updates, and add Light/Dark mode toggle * feat(admin): replace text controls for Photo Frame and Hero Style with visual preview cards * fix(admin): define missing CSS rules for button system (.btn, .preset-btn) * feat(admin): redesign theme settings with segmented mode toggle, accent color swatches, and custom iOS-style toggle cards * feat(admin): upgrade all settings tabs with visual grid previews, Google SEO snippet preview, and toggle cards * feat(admin): overhaul Pages Builder UX with slide-over drawer, card hover badges, real-time search, and floating save bar * fix(admin): remove leftover dangling syntax snippet in PageBuilder.tsx * fix(admin): add position: relative to subpage-tile so hover overlay is contained inside the tile * style(admin): replace all emojis with clean Leica-style vector SVG icons * fix(types): extend IconProps with SVGProps to allow style prop on Leica SVG icons * feat(admin): add subpage live-preview, privacy analytics, and asset protection settings * fix(typecheck): fix AlbumEntry property access in subpage drawer preview mode * fix(types): fix ImmichAlbumInfo property names thumbnailAssetId and albumName in PageBuilder.tsx * fix(types): add protection and watermark optional properties to AppConfig interface * feat(settings): add toggle for disabling analytics tracking (defaults to enabled) * feat(ux): show status banner when analytics tracking is disabled + add live sync indicator * feat(watermark): render customizable watermark overlay on Lightbox images + rename section to Portfolio Features & Modules * fix(types): import type LightboxWatermark in PhotoGrid.tsx * fix(types): destructure watermark prop in PhotoGrid function signature * feat(seo): add configurable subpage title template and metadata descriptions * feat(seo): add generateMetadata to about page for title template support * feat(proofing): add client proofing, favorites selection, compact URL bitmasking, and export modal * feat(essay): add Photo Essay storytelling mode with RSC markdown parser and fullbleed/pair layouts * feat(subpages): add page enabled toggle to deactivate subpages without deleting them * feat(admin): add visual essay block builder for photo essay storytelling pages * security: add Trivy container scan to Docker publish workflow Scans the built image for CRITICAL/HIGH CVEs on every release and uploads results to the GitHub Security tab. Non-blocking for now (exit-code 0) so releases aren't gated on findings. Also documents the scan and existing Dependabot coverage in the README. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-08-07 11:08:04 +02:00
<label>SEO Meta Title</label>
<input
value={settings.seo?.title || ''}
onChange={(e) => update('seo.title', e.target.value)}
security: add Trivy container scan to Docker publish workflow (#399) * feat(admin): add backup manager UI with 1-click restore * feat(admin): collapse older backup entries by default * fix(theme): isolate admin layout, instant DOM theme updates, and add Light/Dark mode toggle * feat(admin): replace text controls for Photo Frame and Hero Style with visual preview cards * fix(admin): define missing CSS rules for button system (.btn, .preset-btn) * feat(admin): redesign theme settings with segmented mode toggle, accent color swatches, and custom iOS-style toggle cards * feat(admin): upgrade all settings tabs with visual grid previews, Google SEO snippet preview, and toggle cards * feat(admin): overhaul Pages Builder UX with slide-over drawer, card hover badges, real-time search, and floating save bar * fix(admin): remove leftover dangling syntax snippet in PageBuilder.tsx * fix(admin): add position: relative to subpage-tile so hover overlay is contained inside the tile * style(admin): replace all emojis with clean Leica-style vector SVG icons * fix(types): extend IconProps with SVGProps to allow style prop on Leica SVG icons * feat(admin): add subpage live-preview, privacy analytics, and asset protection settings * fix(typecheck): fix AlbumEntry property access in subpage drawer preview mode * fix(types): fix ImmichAlbumInfo property names thumbnailAssetId and albumName in PageBuilder.tsx * fix(types): add protection and watermark optional properties to AppConfig interface * feat(settings): add toggle for disabling analytics tracking (defaults to enabled) * feat(ux): show status banner when analytics tracking is disabled + add live sync indicator * feat(watermark): render customizable watermark overlay on Lightbox images + rename section to Portfolio Features & Modules * fix(types): import type LightboxWatermark in PhotoGrid.tsx * fix(types): destructure watermark prop in PhotoGrid function signature * feat(seo): add configurable subpage title template and metadata descriptions * feat(seo): add generateMetadata to about page for title template support * feat(proofing): add client proofing, favorites selection, compact URL bitmasking, and export modal * feat(essay): add Photo Essay storytelling mode with RSC markdown parser and fullbleed/pair layouts * feat(subpages): add page enabled toggle to deactivate subpages without deleting them * feat(admin): add visual essay block builder for photo essay storytelling pages * security: add Trivy container scan to Docker publish workflow Scans the built image for CRITICAL/HIGH CVEs on every release and uploads results to the GitHub Security tab. Non-blocking for now (exit-code 0) so releases aren't gated on findings. Also documents the scan and existing Dependabot coverage in the README. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-08-07 11:08:04 +02:00
placeholder="Overrides default site title for Google search results"
/>
</div>
<div className="admin-field">
<label>Subpage Title Template</label>
<input
value={settings.seo?.titleTemplate || ''}
onChange={(e) => update('seo.titleTemplate', e.target.value)}
placeholder={`%s | ${settings.seo?.title || settings.title || 'My Portfolio'}`}
/>
security: add Trivy container scan to Docker publish workflow (#399) * feat(admin): add backup manager UI with 1-click restore * feat(admin): collapse older backup entries by default * fix(theme): isolate admin layout, instant DOM theme updates, and add Light/Dark mode toggle * feat(admin): replace text controls for Photo Frame and Hero Style with visual preview cards * fix(admin): define missing CSS rules for button system (.btn, .preset-btn) * feat(admin): redesign theme settings with segmented mode toggle, accent color swatches, and custom iOS-style toggle cards * feat(admin): upgrade all settings tabs with visual grid previews, Google SEO snippet preview, and toggle cards * feat(admin): overhaul Pages Builder UX with slide-over drawer, card hover badges, real-time search, and floating save bar * fix(admin): remove leftover dangling syntax snippet in PageBuilder.tsx * fix(admin): add position: relative to subpage-tile so hover overlay is contained inside the tile * style(admin): replace all emojis with clean Leica-style vector SVG icons * fix(types): extend IconProps with SVGProps to allow style prop on Leica SVG icons * feat(admin): add subpage live-preview, privacy analytics, and asset protection settings * fix(typecheck): fix AlbumEntry property access in subpage drawer preview mode * fix(types): fix ImmichAlbumInfo property names thumbnailAssetId and albumName in PageBuilder.tsx * fix(types): add protection and watermark optional properties to AppConfig interface * feat(settings): add toggle for disabling analytics tracking (defaults to enabled) * feat(ux): show status banner when analytics tracking is disabled + add live sync indicator * feat(watermark): render customizable watermark overlay on Lightbox images + rename section to Portfolio Features & Modules * fix(types): import type LightboxWatermark in PhotoGrid.tsx * fix(types): destructure watermark prop in PhotoGrid function signature * feat(seo): add configurable subpage title template and metadata descriptions * feat(seo): add generateMetadata to about page for title template support * feat(proofing): add client proofing, favorites selection, compact URL bitmasking, and export modal * feat(essay): add Photo Essay storytelling mode with RSC markdown parser and fullbleed/pair layouts * feat(subpages): add page enabled toggle to deactivate subpages without deleting them * feat(admin): add visual essay block builder for photo essay storytelling pages * security: add Trivy container scan to Docker publish workflow Scans the built image for CRITICAL/HIGH CVEs on every release and uploads results to the GitHub Security tab. Non-blocking for now (exit-code 0) so releases aren't gated on findings. Also documents the scan and existing Dependabot coverage in the README. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-08-07 11:08:04 +02:00
<p style={{ fontSize: '0.8rem', opacity: 0.7, marginTop: '4px' }}>
release: v0.11.0 (#459) Ships `dev` as **v0.11.0**. `main` contains nothing that `dev` does not, so this is a clean sync. ## Headline changes since v0.10.0 - **Journal & Journal Studio** — photo essays at `/journal`, split-screen block editor with live preview, drafts, per-entry passwords, cover images - **First-run setup wizard at `/install`** — configure a fresh deployment from the browser; credentials are verified against Immich before anything is written, and the wizard is gated by a one-time token - **About page editor and toggle** in the admin panel - **Per-album photo order** independent of Immich, with a drag & drop editor - **Custom favicon upload** - **Experimental portfolio features** — justified grid, `cover` hero, unlisted subpages, per-album grid overrides, cover focal points, external nav links - **Security** — asset tokens length-capped before decoding (#423), journal author markdown escaped rather than filtered, journal file paths contained, admin session key derived with scrypt (#432), Next.js 16.3.0 for CVE-2025-13465 - **Fixed** — client proofing honours its own configuration again (#454); journal photo rendering (#432) Full detail in [CHANGELOG.md](CHANGELOG.md#0110--2026-08-15). ## Verified `npx tsc --noEmit` clean · `npx vitest run` 435 tests pass · `npm run build` succeeds · lint 0 errors · `prettier --check` clean · local `docker build` of the release tree. ## After merge Tag `v0.11.0` on `main` and publish the release — that triggers `docker-publish.yml`, which pushes the image and moves `latest`. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
2026-08-15 09:09:18 +02:00
Template for subpages &amp; albums. Use <code>%s</code> as placeholder for the
page title.
security: add Trivy container scan to Docker publish workflow (#399) * feat(admin): add backup manager UI with 1-click restore * feat(admin): collapse older backup entries by default * fix(theme): isolate admin layout, instant DOM theme updates, and add Light/Dark mode toggle * feat(admin): replace text controls for Photo Frame and Hero Style with visual preview cards * fix(admin): define missing CSS rules for button system (.btn, .preset-btn) * feat(admin): redesign theme settings with segmented mode toggle, accent color swatches, and custom iOS-style toggle cards * feat(admin): upgrade all settings tabs with visual grid previews, Google SEO snippet preview, and toggle cards * feat(admin): overhaul Pages Builder UX with slide-over drawer, card hover badges, real-time search, and floating save bar * fix(admin): remove leftover dangling syntax snippet in PageBuilder.tsx * fix(admin): add position: relative to subpage-tile so hover overlay is contained inside the tile * style(admin): replace all emojis with clean Leica-style vector SVG icons * fix(types): extend IconProps with SVGProps to allow style prop on Leica SVG icons * feat(admin): add subpage live-preview, privacy analytics, and asset protection settings * fix(typecheck): fix AlbumEntry property access in subpage drawer preview mode * fix(types): fix ImmichAlbumInfo property names thumbnailAssetId and albumName in PageBuilder.tsx * fix(types): add protection and watermark optional properties to AppConfig interface * feat(settings): add toggle for disabling analytics tracking (defaults to enabled) * feat(ux): show status banner when analytics tracking is disabled + add live sync indicator * feat(watermark): render customizable watermark overlay on Lightbox images + rename section to Portfolio Features & Modules * fix(types): import type LightboxWatermark in PhotoGrid.tsx * fix(types): destructure watermark prop in PhotoGrid function signature * feat(seo): add configurable subpage title template and metadata descriptions * feat(seo): add generateMetadata to about page for title template support * feat(proofing): add client proofing, favorites selection, compact URL bitmasking, and export modal * feat(essay): add Photo Essay storytelling mode with RSC markdown parser and fullbleed/pair layouts * feat(subpages): add page enabled toggle to deactivate subpages without deleting them * feat(admin): add visual essay block builder for photo essay storytelling pages * security: add Trivy container scan to Docker publish workflow Scans the built image for CRITICAL/HIGH CVEs on every release and uploads results to the GitHub Security tab. Non-blocking for now (exit-code 0) so releases aren't gated on findings. Also documents the scan and existing Dependabot coverage in the README. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-08-07 11:08:04 +02:00
<br />
<strong>Preview:</strong>{' '}
{(
settings.seo?.titleTemplate ||
`%s | ${settings.seo?.title || settings.title || 'My Portfolio'}`
).replace('%s', 'Landscapes')}
</p>
</div>
security: add Trivy container scan to Docker publish workflow (#399) * feat(admin): add backup manager UI with 1-click restore * feat(admin): collapse older backup entries by default * fix(theme): isolate admin layout, instant DOM theme updates, and add Light/Dark mode toggle * feat(admin): replace text controls for Photo Frame and Hero Style with visual preview cards * fix(admin): define missing CSS rules for button system (.btn, .preset-btn) * feat(admin): redesign theme settings with segmented mode toggle, accent color swatches, and custom iOS-style toggle cards * feat(admin): upgrade all settings tabs with visual grid previews, Google SEO snippet preview, and toggle cards * feat(admin): overhaul Pages Builder UX with slide-over drawer, card hover badges, real-time search, and floating save bar * fix(admin): remove leftover dangling syntax snippet in PageBuilder.tsx * fix(admin): add position: relative to subpage-tile so hover overlay is contained inside the tile * style(admin): replace all emojis with clean Leica-style vector SVG icons * fix(types): extend IconProps with SVGProps to allow style prop on Leica SVG icons * feat(admin): add subpage live-preview, privacy analytics, and asset protection settings * fix(typecheck): fix AlbumEntry property access in subpage drawer preview mode * fix(types): fix ImmichAlbumInfo property names thumbnailAssetId and albumName in PageBuilder.tsx * fix(types): add protection and watermark optional properties to AppConfig interface * feat(settings): add toggle for disabling analytics tracking (defaults to enabled) * feat(ux): show status banner when analytics tracking is disabled + add live sync indicator * feat(watermark): render customizable watermark overlay on Lightbox images + rename section to Portfolio Features & Modules * fix(types): import type LightboxWatermark in PhotoGrid.tsx * fix(types): destructure watermark prop in PhotoGrid function signature * feat(seo): add configurable subpage title template and metadata descriptions * feat(seo): add generateMetadata to about page for title template support * feat(proofing): add client proofing, favorites selection, compact URL bitmasking, and export modal * feat(essay): add Photo Essay storytelling mode with RSC markdown parser and fullbleed/pair layouts * feat(subpages): add page enabled toggle to deactivate subpages without deleting them * feat(admin): add visual essay block builder for photo essay storytelling pages * security: add Trivy container scan to Docker publish workflow Scans the built image for CRITICAL/HIGH CVEs on every release and uploads results to the GitHub Security tab. Non-blocking for now (exit-code 0) so releases aren't gated on findings. Also documents the scan and existing Dependabot coverage in the README. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-08-07 11:08:04 +02:00
<div className="admin-field">
security: add Trivy container scan to Docker publish workflow (#399) * feat(admin): add backup manager UI with 1-click restore * feat(admin): collapse older backup entries by default * fix(theme): isolate admin layout, instant DOM theme updates, and add Light/Dark mode toggle * feat(admin): replace text controls for Photo Frame and Hero Style with visual preview cards * fix(admin): define missing CSS rules for button system (.btn, .preset-btn) * feat(admin): redesign theme settings with segmented mode toggle, accent color swatches, and custom iOS-style toggle cards * feat(admin): upgrade all settings tabs with visual grid previews, Google SEO snippet preview, and toggle cards * feat(admin): overhaul Pages Builder UX with slide-over drawer, card hover badges, real-time search, and floating save bar * fix(admin): remove leftover dangling syntax snippet in PageBuilder.tsx * fix(admin): add position: relative to subpage-tile so hover overlay is contained inside the tile * style(admin): replace all emojis with clean Leica-style vector SVG icons * fix(types): extend IconProps with SVGProps to allow style prop on Leica SVG icons * feat(admin): add subpage live-preview, privacy analytics, and asset protection settings * fix(typecheck): fix AlbumEntry property access in subpage drawer preview mode * fix(types): fix ImmichAlbumInfo property names thumbnailAssetId and albumName in PageBuilder.tsx * fix(types): add protection and watermark optional properties to AppConfig interface * feat(settings): add toggle for disabling analytics tracking (defaults to enabled) * feat(ux): show status banner when analytics tracking is disabled + add live sync indicator * feat(watermark): render customizable watermark overlay on Lightbox images + rename section to Portfolio Features & Modules * fix(types): import type LightboxWatermark in PhotoGrid.tsx * fix(types): destructure watermark prop in PhotoGrid function signature * feat(seo): add configurable subpage title template and metadata descriptions * feat(seo): add generateMetadata to about page for title template support * feat(proofing): add client proofing, favorites selection, compact URL bitmasking, and export modal * feat(essay): add Photo Essay storytelling mode with RSC markdown parser and fullbleed/pair layouts * feat(subpages): add page enabled toggle to deactivate subpages without deleting them * feat(admin): add visual essay block builder for photo essay storytelling pages * security: add Trivy container scan to Docker publish workflow Scans the built image for CRITICAL/HIGH CVEs on every release and uploads results to the GitHub Security tab. Non-blocking for now (exit-code 0) so releases aren't gated on findings. Also documents the scan and existing Dependabot coverage in the README. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-08-07 11:08:04 +02:00
<label>SEO Meta Description</label>
<textarea
value={settings.seo?.description || ''}
onChange={(e) => update('seo.description', e.target.value)}
security: add Trivy container scan to Docker publish workflow (#399) * feat(admin): add backup manager UI with 1-click restore * feat(admin): collapse older backup entries by default * fix(theme): isolate admin layout, instant DOM theme updates, and add Light/Dark mode toggle * feat(admin): replace text controls for Photo Frame and Hero Style with visual preview cards * fix(admin): define missing CSS rules for button system (.btn, .preset-btn) * feat(admin): redesign theme settings with segmented mode toggle, accent color swatches, and custom iOS-style toggle cards * feat(admin): upgrade all settings tabs with visual grid previews, Google SEO snippet preview, and toggle cards * feat(admin): overhaul Pages Builder UX with slide-over drawer, card hover badges, real-time search, and floating save bar * fix(admin): remove leftover dangling syntax snippet in PageBuilder.tsx * fix(admin): add position: relative to subpage-tile so hover overlay is contained inside the tile * style(admin): replace all emojis with clean Leica-style vector SVG icons * fix(types): extend IconProps with SVGProps to allow style prop on Leica SVG icons * feat(admin): add subpage live-preview, privacy analytics, and asset protection settings * fix(typecheck): fix AlbumEntry property access in subpage drawer preview mode * fix(types): fix ImmichAlbumInfo property names thumbnailAssetId and albumName in PageBuilder.tsx * fix(types): add protection and watermark optional properties to AppConfig interface * feat(settings): add toggle for disabling analytics tracking (defaults to enabled) * feat(ux): show status banner when analytics tracking is disabled + add live sync indicator * feat(watermark): render customizable watermark overlay on Lightbox images + rename section to Portfolio Features & Modules * fix(types): import type LightboxWatermark in PhotoGrid.tsx * fix(types): destructure watermark prop in PhotoGrid function signature * feat(seo): add configurable subpage title template and metadata descriptions * feat(seo): add generateMetadata to about page for title template support * feat(proofing): add client proofing, favorites selection, compact URL bitmasking, and export modal * feat(essay): add Photo Essay storytelling mode with RSC markdown parser and fullbleed/pair layouts * feat(subpages): add page enabled toggle to deactivate subpages without deleting them * feat(admin): add visual essay block builder for photo essay storytelling pages * security: add Trivy container scan to Docker publish workflow Scans the built image for CRITICAL/HIGH CVEs on every release and uploads results to the GitHub Security tab. Non-blocking for now (exit-code 0) so releases aren't gated on findings. Also documents the scan and existing Dependabot coverage in the README. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-08-07 11:08:04 +02:00
placeholder="A curated selection of photography work..."
rows={3}
/>
</div>
security: add Trivy container scan to Docker publish workflow (#399) * feat(admin): add backup manager UI with 1-click restore * feat(admin): collapse older backup entries by default * fix(theme): isolate admin layout, instant DOM theme updates, and add Light/Dark mode toggle * feat(admin): replace text controls for Photo Frame and Hero Style with visual preview cards * fix(admin): define missing CSS rules for button system (.btn, .preset-btn) * feat(admin): redesign theme settings with segmented mode toggle, accent color swatches, and custom iOS-style toggle cards * feat(admin): upgrade all settings tabs with visual grid previews, Google SEO snippet preview, and toggle cards * feat(admin): overhaul Pages Builder UX with slide-over drawer, card hover badges, real-time search, and floating save bar * fix(admin): remove leftover dangling syntax snippet in PageBuilder.tsx * fix(admin): add position: relative to subpage-tile so hover overlay is contained inside the tile * style(admin): replace all emojis with clean Leica-style vector SVG icons * fix(types): extend IconProps with SVGProps to allow style prop on Leica SVG icons * feat(admin): add subpage live-preview, privacy analytics, and asset protection settings * fix(typecheck): fix AlbumEntry property access in subpage drawer preview mode * fix(types): fix ImmichAlbumInfo property names thumbnailAssetId and albumName in PageBuilder.tsx * fix(types): add protection and watermark optional properties to AppConfig interface * feat(settings): add toggle for disabling analytics tracking (defaults to enabled) * feat(ux): show status banner when analytics tracking is disabled + add live sync indicator * feat(watermark): render customizable watermark overlay on Lightbox images + rename section to Portfolio Features & Modules * fix(types): import type LightboxWatermark in PhotoGrid.tsx * fix(types): destructure watermark prop in PhotoGrid function signature * feat(seo): add configurable subpage title template and metadata descriptions * feat(seo): add generateMetadata to about page for title template support * feat(proofing): add client proofing, favorites selection, compact URL bitmasking, and export modal * feat(essay): add Photo Essay storytelling mode with RSC markdown parser and fullbleed/pair layouts * feat(subpages): add page enabled toggle to deactivate subpages without deleting them * feat(admin): add visual essay block builder for photo essay storytelling pages * security: add Trivy container scan to Docker publish workflow Scans the built image for CRITICAL/HIGH CVEs on every release and uploads results to the GitHub Security tab. Non-blocking for now (exit-code 0) so releases aren't gated on findings. Also documents the scan and existing Dependabot coverage in the README. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-08-07 11:08:04 +02:00
<div className="settings-section-divider" />
<div className="settings-section-header">
release: v0.11.0 (#459) Ships `dev` as **v0.11.0**. `main` contains nothing that `dev` does not, so this is a clean sync. ## Headline changes since v0.10.0 - **Journal & Journal Studio** — photo essays at `/journal`, split-screen block editor with live preview, drafts, per-entry passwords, cover images - **First-run setup wizard at `/install`** — configure a fresh deployment from the browser; credentials are verified against Immich before anything is written, and the wizard is gated by a one-time token - **About page editor and toggle** in the admin panel - **Per-album photo order** independent of Immich, with a drag & drop editor - **Custom favicon upload** - **Experimental portfolio features** — justified grid, `cover` hero, unlisted subpages, per-album grid overrides, cover focal points, external nav links - **Security** — asset tokens length-capped before decoding (#423), journal author markdown escaped rather than filtered, journal file paths contained, admin session key derived with scrypt (#432), Next.js 16.3.0 for CVE-2025-13465 - **Fixed** — client proofing honours its own configuration again (#454); journal photo rendering (#432) Full detail in [CHANGELOG.md](CHANGELOG.md#0110--2026-08-15). ## Verified `npx tsc --noEmit` clean · `npx vitest run` 435 tests pass · `npm run build` succeeds · lint 0 errors · `prettier --check` clean · local `docker build` of the release tree. ## After merge Tag `v0.11.0` on `main` and publish the release — that triggers `docker-publish.yml`, which pushes the image and moves `latest`. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
2026-08-15 09:09:18 +02:00
<h3>
<Icons.IconGlobe size={18} /> Search Crawler Directives
</h3>
<p className="settings-section-sub">
Control how Googlebot and other web crawlers index your site.
</p>
</div>
security: add Trivy container scan to Docker publish workflow (#399) * feat(admin): add backup manager UI with 1-click restore * feat(admin): collapse older backup entries by default * fix(theme): isolate admin layout, instant DOM theme updates, and add Light/Dark mode toggle * feat(admin): replace text controls for Photo Frame and Hero Style with visual preview cards * fix(admin): define missing CSS rules for button system (.btn, .preset-btn) * feat(admin): redesign theme settings with segmented mode toggle, accent color swatches, and custom iOS-style toggle cards * feat(admin): upgrade all settings tabs with visual grid previews, Google SEO snippet preview, and toggle cards * feat(admin): overhaul Pages Builder UX with slide-over drawer, card hover badges, real-time search, and floating save bar * fix(admin): remove leftover dangling syntax snippet in PageBuilder.tsx * fix(admin): add position: relative to subpage-tile so hover overlay is contained inside the tile * style(admin): replace all emojis with clean Leica-style vector SVG icons * fix(types): extend IconProps with SVGProps to allow style prop on Leica SVG icons * feat(admin): add subpage live-preview, privacy analytics, and asset protection settings * fix(typecheck): fix AlbumEntry property access in subpage drawer preview mode * fix(types): fix ImmichAlbumInfo property names thumbnailAssetId and albumName in PageBuilder.tsx * fix(types): add protection and watermark optional properties to AppConfig interface * feat(settings): add toggle for disabling analytics tracking (defaults to enabled) * feat(ux): show status banner when analytics tracking is disabled + add live sync indicator * feat(watermark): render customizable watermark overlay on Lightbox images + rename section to Portfolio Features & Modules * fix(types): import type LightboxWatermark in PhotoGrid.tsx * fix(types): destructure watermark prop in PhotoGrid function signature * feat(seo): add configurable subpage title template and metadata descriptions * feat(seo): add generateMetadata to about page for title template support * feat(proofing): add client proofing, favorites selection, compact URL bitmasking, and export modal * feat(essay): add Photo Essay storytelling mode with RSC markdown parser and fullbleed/pair layouts * feat(subpages): add page enabled toggle to deactivate subpages without deleting them * feat(admin): add visual essay block builder for photo essay storytelling pages * security: add Trivy container scan to Docker publish workflow Scans the built image for CRITICAL/HIGH CVEs on every release and uploads results to the GitHub Security tab. Non-blocking for now (exit-code 0) so releases aren't gated on findings. Also documents the scan and existing Dependabot coverage in the README. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-08-07 11:08:04 +02:00
<div className="admin-toggle-cards-grid">
<button
type="button"
className={`admin-toggle-card ${settings.seo?.noIndex === true ? 'active' : ''}`}
onClick={() => update('seo.noIndex', !settings.seo?.noIndex)}
>
<div className="toggle-card-info">
release: v0.11.0 (#459) Ships `dev` as **v0.11.0**. `main` contains nothing that `dev` does not, so this is a clean sync. ## Headline changes since v0.10.0 - **Journal & Journal Studio** — photo essays at `/journal`, split-screen block editor with live preview, drafts, per-entry passwords, cover images - **First-run setup wizard at `/install`** — configure a fresh deployment from the browser; credentials are verified against Immich before anything is written, and the wizard is gated by a one-time token - **About page editor and toggle** in the admin panel - **Per-album photo order** independent of Immich, with a drag & drop editor - **Custom favicon upload** - **Experimental portfolio features** — justified grid, `cover` hero, unlisted subpages, per-album grid overrides, cover focal points, external nav links - **Security** — asset tokens length-capped before decoding (#423), journal author markdown escaped rather than filtered, journal file paths contained, admin session key derived with scrypt (#432), Next.js 16.3.0 for CVE-2025-13465 - **Fixed** — client proofing honours its own configuration again (#454); journal photo rendering (#432) Full detail in [CHANGELOG.md](CHANGELOG.md#0110--2026-08-15). ## Verified `npx tsc --noEmit` clean · `npx vitest run` 435 tests pass · `npm run build` succeeds · lint 0 errors · `prettier --check` clean · local `docker build` of the release tree. ## After merge Tag `v0.11.0` on `main` and publish the release — that triggers `docker-publish.yml`, which pushes the image and moves `latest`. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
2026-08-15 09:09:18 +02:00
<span className="toggle-card-title">
<Icons.IconBan size={16} /> noindex (Hide from Google)
</span>
<span className="toggle-card-desc">
Instructs search engines NOT to index this site in search results
</span>
security: add Trivy container scan to Docker publish workflow (#399) * feat(admin): add backup manager UI with 1-click restore * feat(admin): collapse older backup entries by default * fix(theme): isolate admin layout, instant DOM theme updates, and add Light/Dark mode toggle * feat(admin): replace text controls for Photo Frame and Hero Style with visual preview cards * fix(admin): define missing CSS rules for button system (.btn, .preset-btn) * feat(admin): redesign theme settings with segmented mode toggle, accent color swatches, and custom iOS-style toggle cards * feat(admin): upgrade all settings tabs with visual grid previews, Google SEO snippet preview, and toggle cards * feat(admin): overhaul Pages Builder UX with slide-over drawer, card hover badges, real-time search, and floating save bar * fix(admin): remove leftover dangling syntax snippet in PageBuilder.tsx * fix(admin): add position: relative to subpage-tile so hover overlay is contained inside the tile * style(admin): replace all emojis with clean Leica-style vector SVG icons * fix(types): extend IconProps with SVGProps to allow style prop on Leica SVG icons * feat(admin): add subpage live-preview, privacy analytics, and asset protection settings * fix(typecheck): fix AlbumEntry property access in subpage drawer preview mode * fix(types): fix ImmichAlbumInfo property names thumbnailAssetId and albumName in PageBuilder.tsx * fix(types): add protection and watermark optional properties to AppConfig interface * feat(settings): add toggle for disabling analytics tracking (defaults to enabled) * feat(ux): show status banner when analytics tracking is disabled + add live sync indicator * feat(watermark): render customizable watermark overlay on Lightbox images + rename section to Portfolio Features & Modules * fix(types): import type LightboxWatermark in PhotoGrid.tsx * fix(types): destructure watermark prop in PhotoGrid function signature * feat(seo): add configurable subpage title template and metadata descriptions * feat(seo): add generateMetadata to about page for title template support * feat(proofing): add client proofing, favorites selection, compact URL bitmasking, and export modal * feat(essay): add Photo Essay storytelling mode with RSC markdown parser and fullbleed/pair layouts * feat(subpages): add page enabled toggle to deactivate subpages without deleting them * feat(admin): add visual essay block builder for photo essay storytelling pages * security: add Trivy container scan to Docker publish workflow Scans the built image for CRITICAL/HIGH CVEs on every release and uploads results to the GitHub Security tab. Non-blocking for now (exit-code 0) so releases aren't gated on findings. Also documents the scan and existing Dependabot coverage in the README. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-08-07 11:08:04 +02:00
</div>
<div className={`switch-toggle ${settings.seo?.noIndex === true ? 'on' : ''}`}>
<span className="switch-slider" />
</div>
</button>
<button
type="button"
className={`admin-toggle-card ${settings.seo?.noFollow === true ? 'active' : ''}`}
onClick={() => update('seo.noFollow', !settings.seo?.noFollow)}
>
<div className="toggle-card-info">
release: v0.11.0 (#459) Ships `dev` as **v0.11.0**. `main` contains nothing that `dev` does not, so this is a clean sync. ## Headline changes since v0.10.0 - **Journal & Journal Studio** — photo essays at `/journal`, split-screen block editor with live preview, drafts, per-entry passwords, cover images - **First-run setup wizard at `/install`** — configure a fresh deployment from the browser; credentials are verified against Immich before anything is written, and the wizard is gated by a one-time token - **About page editor and toggle** in the admin panel - **Per-album photo order** independent of Immich, with a drag & drop editor - **Custom favicon upload** - **Experimental portfolio features** — justified grid, `cover` hero, unlisted subpages, per-album grid overrides, cover focal points, external nav links - **Security** — asset tokens length-capped before decoding (#423), journal author markdown escaped rather than filtered, journal file paths contained, admin session key derived with scrypt (#432), Next.js 16.3.0 for CVE-2025-13465 - **Fixed** — client proofing honours its own configuration again (#454); journal photo rendering (#432) Full detail in [CHANGELOG.md](CHANGELOG.md#0110--2026-08-15). ## Verified `npx tsc --noEmit` clean · `npx vitest run` 435 tests pass · `npm run build` succeeds · lint 0 errors · `prettier --check` clean · local `docker build` of the release tree. ## After merge Tag `v0.11.0` on `main` and publish the release — that triggers `docker-publish.yml`, which pushes the image and moves `latest`. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
2026-08-15 09:09:18 +02:00
<span className="toggle-card-title">
<Icons.IconLink size={16} /> nofollow (Block Link Following)
</span>
<span className="toggle-card-desc">
Instructs search engine crawlers not to follow outgoing links
</span>
security: add Trivy container scan to Docker publish workflow (#399) * feat(admin): add backup manager UI with 1-click restore * feat(admin): collapse older backup entries by default * fix(theme): isolate admin layout, instant DOM theme updates, and add Light/Dark mode toggle * feat(admin): replace text controls for Photo Frame and Hero Style with visual preview cards * fix(admin): define missing CSS rules for button system (.btn, .preset-btn) * feat(admin): redesign theme settings with segmented mode toggle, accent color swatches, and custom iOS-style toggle cards * feat(admin): upgrade all settings tabs with visual grid previews, Google SEO snippet preview, and toggle cards * feat(admin): overhaul Pages Builder UX with slide-over drawer, card hover badges, real-time search, and floating save bar * fix(admin): remove leftover dangling syntax snippet in PageBuilder.tsx * fix(admin): add position: relative to subpage-tile so hover overlay is contained inside the tile * style(admin): replace all emojis with clean Leica-style vector SVG icons * fix(types): extend IconProps with SVGProps to allow style prop on Leica SVG icons * feat(admin): add subpage live-preview, privacy analytics, and asset protection settings * fix(typecheck): fix AlbumEntry property access in subpage drawer preview mode * fix(types): fix ImmichAlbumInfo property names thumbnailAssetId and albumName in PageBuilder.tsx * fix(types): add protection and watermark optional properties to AppConfig interface * feat(settings): add toggle for disabling analytics tracking (defaults to enabled) * feat(ux): show status banner when analytics tracking is disabled + add live sync indicator * feat(watermark): render customizable watermark overlay on Lightbox images + rename section to Portfolio Features & Modules * fix(types): import type LightboxWatermark in PhotoGrid.tsx * fix(types): destructure watermark prop in PhotoGrid function signature * feat(seo): add configurable subpage title template and metadata descriptions * feat(seo): add generateMetadata to about page for title template support * feat(proofing): add client proofing, favorites selection, compact URL bitmasking, and export modal * feat(essay): add Photo Essay storytelling mode with RSC markdown parser and fullbleed/pair layouts * feat(subpages): add page enabled toggle to deactivate subpages without deleting them * feat(admin): add visual essay block builder for photo essay storytelling pages * security: add Trivy container scan to Docker publish workflow Scans the built image for CRITICAL/HIGH CVEs on every release and uploads results to the GitHub Security tab. Non-blocking for now (exit-code 0) so releases aren't gated on findings. Also documents the scan and existing Dependabot coverage in the README. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-08-07 11:08:04 +02:00
</div>
<div className={`switch-toggle ${settings.seo?.noFollow === true ? 'on' : ''}`}>
<span className="switch-slider" />
</div>
</button>
</div>
</div>
)}
{activeSection === 'security' && (
<div className="settings-panel">
<div className="settings-section-header">
<h3>
<Icons.IconLock size={18} /> Site Password
</h3>
<p className="settings-section-sub">
Puts the whole public site behind one password — useful while a portfolio is still
being built, or for a folio only ever shown to clients.
</p>
</div>
<div className="admin-field">
<label>Site Password</label>
<input
type="text"
value={settings.sitePassword || ''}
onChange={(e) => update('sitePassword', e.target.value)}
placeholder="Leave empty for a public site"
autoComplete="off"
/>
<p className="admin-field-hint">
Stored in <code>settings.yaml</code>. Log in once and the server log prints a{' '}
<code>scrypt:…</code> hash to paste back here instead of the plaintext. The{' '}
<code>SITE_PASSWORD</code> environment variable overrides this field. The admin
panel keeps its own password and is never behind this gate.
</p>
</div>
<div className="settings-section-divider" />
security: add Trivy container scan to Docker publish workflow (#399) * feat(admin): add backup manager UI with 1-click restore * feat(admin): collapse older backup entries by default * fix(theme): isolate admin layout, instant DOM theme updates, and add Light/Dark mode toggle * feat(admin): replace text controls for Photo Frame and Hero Style with visual preview cards * fix(admin): define missing CSS rules for button system (.btn, .preset-btn) * feat(admin): redesign theme settings with segmented mode toggle, accent color swatches, and custom iOS-style toggle cards * feat(admin): upgrade all settings tabs with visual grid previews, Google SEO snippet preview, and toggle cards * feat(admin): overhaul Pages Builder UX with slide-over drawer, card hover badges, real-time search, and floating save bar * fix(admin): remove leftover dangling syntax snippet in PageBuilder.tsx * fix(admin): add position: relative to subpage-tile so hover overlay is contained inside the tile * style(admin): replace all emojis with clean Leica-style vector SVG icons * fix(types): extend IconProps with SVGProps to allow style prop on Leica SVG icons * feat(admin): add subpage live-preview, privacy analytics, and asset protection settings * fix(typecheck): fix AlbumEntry property access in subpage drawer preview mode * fix(types): fix ImmichAlbumInfo property names thumbnailAssetId and albumName in PageBuilder.tsx * fix(types): add protection and watermark optional properties to AppConfig interface * feat(settings): add toggle for disabling analytics tracking (defaults to enabled) * feat(ux): show status banner when analytics tracking is disabled + add live sync indicator * feat(watermark): render customizable watermark overlay on Lightbox images + rename section to Portfolio Features & Modules * fix(types): import type LightboxWatermark in PhotoGrid.tsx * fix(types): destructure watermark prop in PhotoGrid function signature * feat(seo): add configurable subpage title template and metadata descriptions * feat(seo): add generateMetadata to about page for title template support * feat(proofing): add client proofing, favorites selection, compact URL bitmasking, and export modal * feat(essay): add Photo Essay storytelling mode with RSC markdown parser and fullbleed/pair layouts * feat(subpages): add page enabled toggle to deactivate subpages without deleting them * feat(admin): add visual essay block builder for photo essay storytelling pages * security: add Trivy container scan to Docker publish workflow Scans the built image for CRITICAL/HIGH CVEs on every release and uploads results to the GitHub Security tab. Non-blocking for now (exit-code 0) so releases aren't gated on findings. Also documents the scan and existing Dependabot coverage in the README. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-08-07 11:08:04 +02:00
<div className="settings-section-header">
release: v0.11.0 (#459) Ships `dev` as **v0.11.0**. `main` contains nothing that `dev` does not, so this is a clean sync. ## Headline changes since v0.10.0 - **Journal & Journal Studio** — photo essays at `/journal`, split-screen block editor with live preview, drafts, per-entry passwords, cover images - **First-run setup wizard at `/install`** — configure a fresh deployment from the browser; credentials are verified against Immich before anything is written, and the wizard is gated by a one-time token - **About page editor and toggle** in the admin panel - **Per-album photo order** independent of Immich, with a drag & drop editor - **Custom favicon upload** - **Experimental portfolio features** — justified grid, `cover` hero, unlisted subpages, per-album grid overrides, cover focal points, external nav links - **Security** — asset tokens length-capped before decoding (#423), journal author markdown escaped rather than filtered, journal file paths contained, admin session key derived with scrypt (#432), Next.js 16.3.0 for CVE-2025-13465 - **Fixed** — client proofing honours its own configuration again (#454); journal photo rendering (#432) Full detail in [CHANGELOG.md](CHANGELOG.md#0110--2026-08-15). ## Verified `npx tsc --noEmit` clean · `npx vitest run` 435 tests pass · `npm run build` succeeds · lint 0 errors · `prettier --check` clean · local `docker build` of the release tree. ## After merge Tag `v0.11.0` on `main` and publish the release — that triggers `docker-publish.yml`, which pushes the image and moves `latest`. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
2026-08-15 09:09:18 +02:00
<h3>
<Icons.IconShieldCheck size={18} /> Asset Protection &amp; Watermark
</h3>
<p className="settings-section-sub">
Configure image protection rules, right-click prevention, and watermark overlay.
</p>
security: add Trivy container scan to Docker publish workflow (#399) * feat(admin): add backup manager UI with 1-click restore * feat(admin): collapse older backup entries by default * fix(theme): isolate admin layout, instant DOM theme updates, and add Light/Dark mode toggle * feat(admin): replace text controls for Photo Frame and Hero Style with visual preview cards * fix(admin): define missing CSS rules for button system (.btn, .preset-btn) * feat(admin): redesign theme settings with segmented mode toggle, accent color swatches, and custom iOS-style toggle cards * feat(admin): upgrade all settings tabs with visual grid previews, Google SEO snippet preview, and toggle cards * feat(admin): overhaul Pages Builder UX with slide-over drawer, card hover badges, real-time search, and floating save bar * fix(admin): remove leftover dangling syntax snippet in PageBuilder.tsx * fix(admin): add position: relative to subpage-tile so hover overlay is contained inside the tile * style(admin): replace all emojis with clean Leica-style vector SVG icons * fix(types): extend IconProps with SVGProps to allow style prop on Leica SVG icons * feat(admin): add subpage live-preview, privacy analytics, and asset protection settings * fix(typecheck): fix AlbumEntry property access in subpage drawer preview mode * fix(types): fix ImmichAlbumInfo property names thumbnailAssetId and albumName in PageBuilder.tsx * fix(types): add protection and watermark optional properties to AppConfig interface * feat(settings): add toggle for disabling analytics tracking (defaults to enabled) * feat(ux): show status banner when analytics tracking is disabled + add live sync indicator * feat(watermark): render customizable watermark overlay on Lightbox images + rename section to Portfolio Features & Modules * fix(types): import type LightboxWatermark in PhotoGrid.tsx * fix(types): destructure watermark prop in PhotoGrid function signature * feat(seo): add configurable subpage title template and metadata descriptions * feat(seo): add generateMetadata to about page for title template support * feat(proofing): add client proofing, favorites selection, compact URL bitmasking, and export modal * feat(essay): add Photo Essay storytelling mode with RSC markdown parser and fullbleed/pair layouts * feat(subpages): add page enabled toggle to deactivate subpages without deleting them * feat(admin): add visual essay block builder for photo essay storytelling pages * security: add Trivy container scan to Docker publish workflow Scans the built image for CRITICAL/HIGH CVEs on every release and uploads results to the GitHub Security tab. Non-blocking for now (exit-code 0) so releases aren't gated on findings. Also documents the scan and existing Dependabot coverage in the README. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-08-07 11:08:04 +02:00
</div>
<div className="admin-toggle-cards-grid">
<button
type="button"
className={`admin-toggle-card ${settings.protection?.disableRightClick === true ? 'active' : ''}`}
release: v0.11.0 (#459) Ships `dev` as **v0.11.0**. `main` contains nothing that `dev` does not, so this is a clean sync. ## Headline changes since v0.10.0 - **Journal & Journal Studio** — photo essays at `/journal`, split-screen block editor with live preview, drafts, per-entry passwords, cover images - **First-run setup wizard at `/install`** — configure a fresh deployment from the browser; credentials are verified against Immich before anything is written, and the wizard is gated by a one-time token - **About page editor and toggle** in the admin panel - **Per-album photo order** independent of Immich, with a drag & drop editor - **Custom favicon upload** - **Experimental portfolio features** — justified grid, `cover` hero, unlisted subpages, per-album grid overrides, cover focal points, external nav links - **Security** — asset tokens length-capped before decoding (#423), journal author markdown escaped rather than filtered, journal file paths contained, admin session key derived with scrypt (#432), Next.js 16.3.0 for CVE-2025-13465 - **Fixed** — client proofing honours its own configuration again (#454); journal photo rendering (#432) Full detail in [CHANGELOG.md](CHANGELOG.md#0110--2026-08-15). ## Verified `npx tsc --noEmit` clean · `npx vitest run` 435 tests pass · `npm run build` succeeds · lint 0 errors · `prettier --check` clean · local `docker build` of the release tree. ## After merge Tag `v0.11.0` on `main` and publish the release — that triggers `docker-publish.yml`, which pushes the image and moves `latest`. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
2026-08-15 09:09:18 +02:00
onClick={() =>
update('protection.disableRightClick', !settings.protection?.disableRightClick)
}
security: add Trivy container scan to Docker publish workflow (#399) * feat(admin): add backup manager UI with 1-click restore * feat(admin): collapse older backup entries by default * fix(theme): isolate admin layout, instant DOM theme updates, and add Light/Dark mode toggle * feat(admin): replace text controls for Photo Frame and Hero Style with visual preview cards * fix(admin): define missing CSS rules for button system (.btn, .preset-btn) * feat(admin): redesign theme settings with segmented mode toggle, accent color swatches, and custom iOS-style toggle cards * feat(admin): upgrade all settings tabs with visual grid previews, Google SEO snippet preview, and toggle cards * feat(admin): overhaul Pages Builder UX with slide-over drawer, card hover badges, real-time search, and floating save bar * fix(admin): remove leftover dangling syntax snippet in PageBuilder.tsx * fix(admin): add position: relative to subpage-tile so hover overlay is contained inside the tile * style(admin): replace all emojis with clean Leica-style vector SVG icons * fix(types): extend IconProps with SVGProps to allow style prop on Leica SVG icons * feat(admin): add subpage live-preview, privacy analytics, and asset protection settings * fix(typecheck): fix AlbumEntry property access in subpage drawer preview mode * fix(types): fix ImmichAlbumInfo property names thumbnailAssetId and albumName in PageBuilder.tsx * fix(types): add protection and watermark optional properties to AppConfig interface * feat(settings): add toggle for disabling analytics tracking (defaults to enabled) * feat(ux): show status banner when analytics tracking is disabled + add live sync indicator * feat(watermark): render customizable watermark overlay on Lightbox images + rename section to Portfolio Features & Modules * fix(types): import type LightboxWatermark in PhotoGrid.tsx * fix(types): destructure watermark prop in PhotoGrid function signature * feat(seo): add configurable subpage title template and metadata descriptions * feat(seo): add generateMetadata to about page for title template support * feat(proofing): add client proofing, favorites selection, compact URL bitmasking, and export modal * feat(essay): add Photo Essay storytelling mode with RSC markdown parser and fullbleed/pair layouts * feat(subpages): add page enabled toggle to deactivate subpages without deleting them * feat(admin): add visual essay block builder for photo essay storytelling pages * security: add Trivy container scan to Docker publish workflow Scans the built image for CRITICAL/HIGH CVEs on every release and uploads results to the GitHub Security tab. Non-blocking for now (exit-code 0) so releases aren't gated on findings. Also documents the scan and existing Dependabot coverage in the README. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-08-07 11:08:04 +02:00
>
<div className="toggle-card-info">
release: v0.11.0 (#459) Ships `dev` as **v0.11.0**. `main` contains nothing that `dev` does not, so this is a clean sync. ## Headline changes since v0.10.0 - **Journal & Journal Studio** — photo essays at `/journal`, split-screen block editor with live preview, drafts, per-entry passwords, cover images - **First-run setup wizard at `/install`** — configure a fresh deployment from the browser; credentials are verified against Immich before anything is written, and the wizard is gated by a one-time token - **About page editor and toggle** in the admin panel - **Per-album photo order** independent of Immich, with a drag & drop editor - **Custom favicon upload** - **Experimental portfolio features** — justified grid, `cover` hero, unlisted subpages, per-album grid overrides, cover focal points, external nav links - **Security** — asset tokens length-capped before decoding (#423), journal author markdown escaped rather than filtered, journal file paths contained, admin session key derived with scrypt (#432), Next.js 16.3.0 for CVE-2025-13465 - **Fixed** — client proofing honours its own configuration again (#454); journal photo rendering (#432) Full detail in [CHANGELOG.md](CHANGELOG.md#0110--2026-08-15). ## Verified `npx tsc --noEmit` clean · `npx vitest run` 435 tests pass · `npm run build` succeeds · lint 0 errors · `prettier --check` clean · local `docker build` of the release tree. ## After merge Tag `v0.11.0` on `main` and publish the release — that triggers `docker-publish.yml`, which pushes the image and moves `latest`. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
2026-08-15 09:09:18 +02:00
<span className="toggle-card-title">
<Icons.IconLock size={16} /> Disable Right-Click Menu
</span>
<span className="toggle-card-desc">
Prevents context menu on portfolio images to hinder unauthorized downloads
</span>
security: add Trivy container scan to Docker publish workflow (#399) * feat(admin): add backup manager UI with 1-click restore * feat(admin): collapse older backup entries by default * fix(theme): isolate admin layout, instant DOM theme updates, and add Light/Dark mode toggle * feat(admin): replace text controls for Photo Frame and Hero Style with visual preview cards * fix(admin): define missing CSS rules for button system (.btn, .preset-btn) * feat(admin): redesign theme settings with segmented mode toggle, accent color swatches, and custom iOS-style toggle cards * feat(admin): upgrade all settings tabs with visual grid previews, Google SEO snippet preview, and toggle cards * feat(admin): overhaul Pages Builder UX with slide-over drawer, card hover badges, real-time search, and floating save bar * fix(admin): remove leftover dangling syntax snippet in PageBuilder.tsx * fix(admin): add position: relative to subpage-tile so hover overlay is contained inside the tile * style(admin): replace all emojis with clean Leica-style vector SVG icons * fix(types): extend IconProps with SVGProps to allow style prop on Leica SVG icons * feat(admin): add subpage live-preview, privacy analytics, and asset protection settings * fix(typecheck): fix AlbumEntry property access in subpage drawer preview mode * fix(types): fix ImmichAlbumInfo property names thumbnailAssetId and albumName in PageBuilder.tsx * fix(types): add protection and watermark optional properties to AppConfig interface * feat(settings): add toggle for disabling analytics tracking (defaults to enabled) * feat(ux): show status banner when analytics tracking is disabled + add live sync indicator * feat(watermark): render customizable watermark overlay on Lightbox images + rename section to Portfolio Features & Modules * fix(types): import type LightboxWatermark in PhotoGrid.tsx * fix(types): destructure watermark prop in PhotoGrid function signature * feat(seo): add configurable subpage title template and metadata descriptions * feat(seo): add generateMetadata to about page for title template support * feat(proofing): add client proofing, favorites selection, compact URL bitmasking, and export modal * feat(essay): add Photo Essay storytelling mode with RSC markdown parser and fullbleed/pair layouts * feat(subpages): add page enabled toggle to deactivate subpages without deleting them * feat(admin): add visual essay block builder for photo essay storytelling pages * security: add Trivy container scan to Docker publish workflow Scans the built image for CRITICAL/HIGH CVEs on every release and uploads results to the GitHub Security tab. Non-blocking for now (exit-code 0) so releases aren't gated on findings. Also documents the scan and existing Dependabot coverage in the README. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-08-07 11:08:04 +02:00
</div>
release: v0.11.0 (#459) Ships `dev` as **v0.11.0**. `main` contains nothing that `dev` does not, so this is a clean sync. ## Headline changes since v0.10.0 - **Journal & Journal Studio** — photo essays at `/journal`, split-screen block editor with live preview, drafts, per-entry passwords, cover images - **First-run setup wizard at `/install`** — configure a fresh deployment from the browser; credentials are verified against Immich before anything is written, and the wizard is gated by a one-time token - **About page editor and toggle** in the admin panel - **Per-album photo order** independent of Immich, with a drag & drop editor - **Custom favicon upload** - **Experimental portfolio features** — justified grid, `cover` hero, unlisted subpages, per-album grid overrides, cover focal points, external nav links - **Security** — asset tokens length-capped before decoding (#423), journal author markdown escaped rather than filtered, journal file paths contained, admin session key derived with scrypt (#432), Next.js 16.3.0 for CVE-2025-13465 - **Fixed** — client proofing honours its own configuration again (#454); journal photo rendering (#432) Full detail in [CHANGELOG.md](CHANGELOG.md#0110--2026-08-15). ## Verified `npx tsc --noEmit` clean · `npx vitest run` 435 tests pass · `npm run build` succeeds · lint 0 errors · `prettier --check` clean · local `docker build` of the release tree. ## After merge Tag `v0.11.0` on `main` and publish the release — that triggers `docker-publish.yml`, which pushes the image and moves `latest`. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
2026-08-15 09:09:18 +02:00
<div
className={`switch-toggle ${settings.protection?.disableRightClick === true ? 'on' : ''}`}
>
security: add Trivy container scan to Docker publish workflow (#399) * feat(admin): add backup manager UI with 1-click restore * feat(admin): collapse older backup entries by default * fix(theme): isolate admin layout, instant DOM theme updates, and add Light/Dark mode toggle * feat(admin): replace text controls for Photo Frame and Hero Style with visual preview cards * fix(admin): define missing CSS rules for button system (.btn, .preset-btn) * feat(admin): redesign theme settings with segmented mode toggle, accent color swatches, and custom iOS-style toggle cards * feat(admin): upgrade all settings tabs with visual grid previews, Google SEO snippet preview, and toggle cards * feat(admin): overhaul Pages Builder UX with slide-over drawer, card hover badges, real-time search, and floating save bar * fix(admin): remove leftover dangling syntax snippet in PageBuilder.tsx * fix(admin): add position: relative to subpage-tile so hover overlay is contained inside the tile * style(admin): replace all emojis with clean Leica-style vector SVG icons * fix(types): extend IconProps with SVGProps to allow style prop on Leica SVG icons * feat(admin): add subpage live-preview, privacy analytics, and asset protection settings * fix(typecheck): fix AlbumEntry property access in subpage drawer preview mode * fix(types): fix ImmichAlbumInfo property names thumbnailAssetId and albumName in PageBuilder.tsx * fix(types): add protection and watermark optional properties to AppConfig interface * feat(settings): add toggle for disabling analytics tracking (defaults to enabled) * feat(ux): show status banner when analytics tracking is disabled + add live sync indicator * feat(watermark): render customizable watermark overlay on Lightbox images + rename section to Portfolio Features & Modules * fix(types): import type LightboxWatermark in PhotoGrid.tsx * fix(types): destructure watermark prop in PhotoGrid function signature * feat(seo): add configurable subpage title template and metadata descriptions * feat(seo): add generateMetadata to about page for title template support * feat(proofing): add client proofing, favorites selection, compact URL bitmasking, and export modal * feat(essay): add Photo Essay storytelling mode with RSC markdown parser and fullbleed/pair layouts * feat(subpages): add page enabled toggle to deactivate subpages without deleting them * feat(admin): add visual essay block builder for photo essay storytelling pages * security: add Trivy container scan to Docker publish workflow Scans the built image for CRITICAL/HIGH CVEs on every release and uploads results to the GitHub Security tab. Non-blocking for now (exit-code 0) so releases aren't gated on findings. Also documents the scan and existing Dependabot coverage in the README. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-08-07 11:08:04 +02:00
<span className="switch-slider" />
</div>
</button>
<button
type="button"
className={`admin-toggle-card ${settings.protection?.disableImageDrag === true ? 'active' : ''}`}
release: v0.11.0 (#459) Ships `dev` as **v0.11.0**. `main` contains nothing that `dev` does not, so this is a clean sync. ## Headline changes since v0.10.0 - **Journal & Journal Studio** — photo essays at `/journal`, split-screen block editor with live preview, drafts, per-entry passwords, cover images - **First-run setup wizard at `/install`** — configure a fresh deployment from the browser; credentials are verified against Immich before anything is written, and the wizard is gated by a one-time token - **About page editor and toggle** in the admin panel - **Per-album photo order** independent of Immich, with a drag & drop editor - **Custom favicon upload** - **Experimental portfolio features** — justified grid, `cover` hero, unlisted subpages, per-album grid overrides, cover focal points, external nav links - **Security** — asset tokens length-capped before decoding (#423), journal author markdown escaped rather than filtered, journal file paths contained, admin session key derived with scrypt (#432), Next.js 16.3.0 for CVE-2025-13465 - **Fixed** — client proofing honours its own configuration again (#454); journal photo rendering (#432) Full detail in [CHANGELOG.md](CHANGELOG.md#0110--2026-08-15). ## Verified `npx tsc --noEmit` clean · `npx vitest run` 435 tests pass · `npm run build` succeeds · lint 0 errors · `prettier --check` clean · local `docker build` of the release tree. ## After merge Tag `v0.11.0` on `main` and publish the release — that triggers `docker-publish.yml`, which pushes the image and moves `latest`. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
2026-08-15 09:09:18 +02:00
onClick={() =>
update('protection.disableImageDrag', !settings.protection?.disableImageDrag)
}
security: add Trivy container scan to Docker publish workflow (#399) * feat(admin): add backup manager UI with 1-click restore * feat(admin): collapse older backup entries by default * fix(theme): isolate admin layout, instant DOM theme updates, and add Light/Dark mode toggle * feat(admin): replace text controls for Photo Frame and Hero Style with visual preview cards * fix(admin): define missing CSS rules for button system (.btn, .preset-btn) * feat(admin): redesign theme settings with segmented mode toggle, accent color swatches, and custom iOS-style toggle cards * feat(admin): upgrade all settings tabs with visual grid previews, Google SEO snippet preview, and toggle cards * feat(admin): overhaul Pages Builder UX with slide-over drawer, card hover badges, real-time search, and floating save bar * fix(admin): remove leftover dangling syntax snippet in PageBuilder.tsx * fix(admin): add position: relative to subpage-tile so hover overlay is contained inside the tile * style(admin): replace all emojis with clean Leica-style vector SVG icons * fix(types): extend IconProps with SVGProps to allow style prop on Leica SVG icons * feat(admin): add subpage live-preview, privacy analytics, and asset protection settings * fix(typecheck): fix AlbumEntry property access in subpage drawer preview mode * fix(types): fix ImmichAlbumInfo property names thumbnailAssetId and albumName in PageBuilder.tsx * fix(types): add protection and watermark optional properties to AppConfig interface * feat(settings): add toggle for disabling analytics tracking (defaults to enabled) * feat(ux): show status banner when analytics tracking is disabled + add live sync indicator * feat(watermark): render customizable watermark overlay on Lightbox images + rename section to Portfolio Features & Modules * fix(types): import type LightboxWatermark in PhotoGrid.tsx * fix(types): destructure watermark prop in PhotoGrid function signature * feat(seo): add configurable subpage title template and metadata descriptions * feat(seo): add generateMetadata to about page for title template support * feat(proofing): add client proofing, favorites selection, compact URL bitmasking, and export modal * feat(essay): add Photo Essay storytelling mode with RSC markdown parser and fullbleed/pair layouts * feat(subpages): add page enabled toggle to deactivate subpages without deleting them * feat(admin): add visual essay block builder for photo essay storytelling pages * security: add Trivy container scan to Docker publish workflow Scans the built image for CRITICAL/HIGH CVEs on every release and uploads results to the GitHub Security tab. Non-blocking for now (exit-code 0) so releases aren't gated on findings. Also documents the scan and existing Dependabot coverage in the README. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-08-07 11:08:04 +02:00
>
<div className="toggle-card-info">
release: v0.11.0 (#459) Ships `dev` as **v0.11.0**. `main` contains nothing that `dev` does not, so this is a clean sync. ## Headline changes since v0.10.0 - **Journal & Journal Studio** — photo essays at `/journal`, split-screen block editor with live preview, drafts, per-entry passwords, cover images - **First-run setup wizard at `/install`** — configure a fresh deployment from the browser; credentials are verified against Immich before anything is written, and the wizard is gated by a one-time token - **About page editor and toggle** in the admin panel - **Per-album photo order** independent of Immich, with a drag & drop editor - **Custom favicon upload** - **Experimental portfolio features** — justified grid, `cover` hero, unlisted subpages, per-album grid overrides, cover focal points, external nav links - **Security** — asset tokens length-capped before decoding (#423), journal author markdown escaped rather than filtered, journal file paths contained, admin session key derived with scrypt (#432), Next.js 16.3.0 for CVE-2025-13465 - **Fixed** — client proofing honours its own configuration again (#454); journal photo rendering (#432) Full detail in [CHANGELOG.md](CHANGELOG.md#0110--2026-08-15). ## Verified `npx tsc --noEmit` clean · `npx vitest run` 435 tests pass · `npm run build` succeeds · lint 0 errors · `prettier --check` clean · local `docker build` of the release tree. ## After merge Tag `v0.11.0` on `main` and publish the release — that triggers `docker-publish.yml`, which pushes the image and moves `latest`. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
2026-08-15 09:09:18 +02:00
<span className="toggle-card-title">
<Icons.IconBan size={16} /> Disable Image Dragging
</span>
<span className="toggle-card-desc">
Prevents visitors from dragging images off the portfolio page
</span>
security: add Trivy container scan to Docker publish workflow (#399) * feat(admin): add backup manager UI with 1-click restore * feat(admin): collapse older backup entries by default * fix(theme): isolate admin layout, instant DOM theme updates, and add Light/Dark mode toggle * feat(admin): replace text controls for Photo Frame and Hero Style with visual preview cards * fix(admin): define missing CSS rules for button system (.btn, .preset-btn) * feat(admin): redesign theme settings with segmented mode toggle, accent color swatches, and custom iOS-style toggle cards * feat(admin): upgrade all settings tabs with visual grid previews, Google SEO snippet preview, and toggle cards * feat(admin): overhaul Pages Builder UX with slide-over drawer, card hover badges, real-time search, and floating save bar * fix(admin): remove leftover dangling syntax snippet in PageBuilder.tsx * fix(admin): add position: relative to subpage-tile so hover overlay is contained inside the tile * style(admin): replace all emojis with clean Leica-style vector SVG icons * fix(types): extend IconProps with SVGProps to allow style prop on Leica SVG icons * feat(admin): add subpage live-preview, privacy analytics, and asset protection settings * fix(typecheck): fix AlbumEntry property access in subpage drawer preview mode * fix(types): fix ImmichAlbumInfo property names thumbnailAssetId and albumName in PageBuilder.tsx * fix(types): add protection and watermark optional properties to AppConfig interface * feat(settings): add toggle for disabling analytics tracking (defaults to enabled) * feat(ux): show status banner when analytics tracking is disabled + add live sync indicator * feat(watermark): render customizable watermark overlay on Lightbox images + rename section to Portfolio Features & Modules * fix(types): import type LightboxWatermark in PhotoGrid.tsx * fix(types): destructure watermark prop in PhotoGrid function signature * feat(seo): add configurable subpage title template and metadata descriptions * feat(seo): add generateMetadata to about page for title template support * feat(proofing): add client proofing, favorites selection, compact URL bitmasking, and export modal * feat(essay): add Photo Essay storytelling mode with RSC markdown parser and fullbleed/pair layouts * feat(subpages): add page enabled toggle to deactivate subpages without deleting them * feat(admin): add visual essay block builder for photo essay storytelling pages * security: add Trivy container scan to Docker publish workflow Scans the built image for CRITICAL/HIGH CVEs on every release and uploads results to the GitHub Security tab. Non-blocking for now (exit-code 0) so releases aren't gated on findings. Also documents the scan and existing Dependabot coverage in the README. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-08-07 11:08:04 +02:00
</div>
release: v0.11.0 (#459) Ships `dev` as **v0.11.0**. `main` contains nothing that `dev` does not, so this is a clean sync. ## Headline changes since v0.10.0 - **Journal & Journal Studio** — photo essays at `/journal`, split-screen block editor with live preview, drafts, per-entry passwords, cover images - **First-run setup wizard at `/install`** — configure a fresh deployment from the browser; credentials are verified against Immich before anything is written, and the wizard is gated by a one-time token - **About page editor and toggle** in the admin panel - **Per-album photo order** independent of Immich, with a drag & drop editor - **Custom favicon upload** - **Experimental portfolio features** — justified grid, `cover` hero, unlisted subpages, per-album grid overrides, cover focal points, external nav links - **Security** — asset tokens length-capped before decoding (#423), journal author markdown escaped rather than filtered, journal file paths contained, admin session key derived with scrypt (#432), Next.js 16.3.0 for CVE-2025-13465 - **Fixed** — client proofing honours its own configuration again (#454); journal photo rendering (#432) Full detail in [CHANGELOG.md](CHANGELOG.md#0110--2026-08-15). ## Verified `npx tsc --noEmit` clean · `npx vitest run` 435 tests pass · `npm run build` succeeds · lint 0 errors · `prettier --check` clean · local `docker build` of the release tree. ## After merge Tag `v0.11.0` on `main` and publish the release — that triggers `docker-publish.yml`, which pushes the image and moves `latest`. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
2026-08-15 09:09:18 +02:00
<div
className={`switch-toggle ${settings.protection?.disableImageDrag === true ? 'on' : ''}`}
>
security: add Trivy container scan to Docker publish workflow (#399) * feat(admin): add backup manager UI with 1-click restore * feat(admin): collapse older backup entries by default * fix(theme): isolate admin layout, instant DOM theme updates, and add Light/Dark mode toggle * feat(admin): replace text controls for Photo Frame and Hero Style with visual preview cards * fix(admin): define missing CSS rules for button system (.btn, .preset-btn) * feat(admin): redesign theme settings with segmented mode toggle, accent color swatches, and custom iOS-style toggle cards * feat(admin): upgrade all settings tabs with visual grid previews, Google SEO snippet preview, and toggle cards * feat(admin): overhaul Pages Builder UX with slide-over drawer, card hover badges, real-time search, and floating save bar * fix(admin): remove leftover dangling syntax snippet in PageBuilder.tsx * fix(admin): add position: relative to subpage-tile so hover overlay is contained inside the tile * style(admin): replace all emojis with clean Leica-style vector SVG icons * fix(types): extend IconProps with SVGProps to allow style prop on Leica SVG icons * feat(admin): add subpage live-preview, privacy analytics, and asset protection settings * fix(typecheck): fix AlbumEntry property access in subpage drawer preview mode * fix(types): fix ImmichAlbumInfo property names thumbnailAssetId and albumName in PageBuilder.tsx * fix(types): add protection and watermark optional properties to AppConfig interface * feat(settings): add toggle for disabling analytics tracking (defaults to enabled) * feat(ux): show status banner when analytics tracking is disabled + add live sync indicator * feat(watermark): render customizable watermark overlay on Lightbox images + rename section to Portfolio Features & Modules * fix(types): import type LightboxWatermark in PhotoGrid.tsx * fix(types): destructure watermark prop in PhotoGrid function signature * feat(seo): add configurable subpage title template and metadata descriptions * feat(seo): add generateMetadata to about page for title template support * feat(proofing): add client proofing, favorites selection, compact URL bitmasking, and export modal * feat(essay): add Photo Essay storytelling mode with RSC markdown parser and fullbleed/pair layouts * feat(subpages): add page enabled toggle to deactivate subpages without deleting them * feat(admin): add visual essay block builder for photo essay storytelling pages * security: add Trivy container scan to Docker publish workflow Scans the built image for CRITICAL/HIGH CVEs on every release and uploads results to the GitHub Security tab. Non-blocking for now (exit-code 0) so releases aren't gated on findings. Also documents the scan and existing Dependabot coverage in the README. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-08-07 11:08:04 +02:00
<span className="switch-slider" />
</div>
</button>
</div>
<div className="settings-section-divider" />
<div className="settings-section-header">
release: v0.11.0 (#459) Ships `dev` as **v0.11.0**. `main` contains nothing that `dev` does not, so this is a clean sync. ## Headline changes since v0.10.0 - **Journal & Journal Studio** — photo essays at `/journal`, split-screen block editor with live preview, drafts, per-entry passwords, cover images - **First-run setup wizard at `/install`** — configure a fresh deployment from the browser; credentials are verified against Immich before anything is written, and the wizard is gated by a one-time token - **About page editor and toggle** in the admin panel - **Per-album photo order** independent of Immich, with a drag & drop editor - **Custom favicon upload** - **Experimental portfolio features** — justified grid, `cover` hero, unlisted subpages, per-album grid overrides, cover focal points, external nav links - **Security** — asset tokens length-capped before decoding (#423), journal author markdown escaped rather than filtered, journal file paths contained, admin session key derived with scrypt (#432), Next.js 16.3.0 for CVE-2025-13465 - **Fixed** — client proofing honours its own configuration again (#454); journal photo rendering (#432) Full detail in [CHANGELOG.md](CHANGELOG.md#0110--2026-08-15). ## Verified `npx tsc --noEmit` clean · `npx vitest run` 435 tests pass · `npm run build` succeeds · lint 0 errors · `prettier --check` clean · local `docker build` of the release tree. ## After merge Tag `v0.11.0` on `main` and publish the release — that triggers `docker-publish.yml`, which pushes the image and moves `latest`. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
2026-08-15 09:09:18 +02:00
<h3>
<Icons.IconSparkles size={18} /> Dynamic Watermark Overlay
</h3>
<p className="settings-section-sub">
Overlay copyright branding text on Lightbox images.
</p>
security: add Trivy container scan to Docker publish workflow (#399) * feat(admin): add backup manager UI with 1-click restore * feat(admin): collapse older backup entries by default * fix(theme): isolate admin layout, instant DOM theme updates, and add Light/Dark mode toggle * feat(admin): replace text controls for Photo Frame and Hero Style with visual preview cards * fix(admin): define missing CSS rules for button system (.btn, .preset-btn) * feat(admin): redesign theme settings with segmented mode toggle, accent color swatches, and custom iOS-style toggle cards * feat(admin): upgrade all settings tabs with visual grid previews, Google SEO snippet preview, and toggle cards * feat(admin): overhaul Pages Builder UX with slide-over drawer, card hover badges, real-time search, and floating save bar * fix(admin): remove leftover dangling syntax snippet in PageBuilder.tsx * fix(admin): add position: relative to subpage-tile so hover overlay is contained inside the tile * style(admin): replace all emojis with clean Leica-style vector SVG icons * fix(types): extend IconProps with SVGProps to allow style prop on Leica SVG icons * feat(admin): add subpage live-preview, privacy analytics, and asset protection settings * fix(typecheck): fix AlbumEntry property access in subpage drawer preview mode * fix(types): fix ImmichAlbumInfo property names thumbnailAssetId and albumName in PageBuilder.tsx * fix(types): add protection and watermark optional properties to AppConfig interface * feat(settings): add toggle for disabling analytics tracking (defaults to enabled) * feat(ux): show status banner when analytics tracking is disabled + add live sync indicator * feat(watermark): render customizable watermark overlay on Lightbox images + rename section to Portfolio Features & Modules * fix(types): import type LightboxWatermark in PhotoGrid.tsx * fix(types): destructure watermark prop in PhotoGrid function signature * feat(seo): add configurable subpage title template and metadata descriptions * feat(seo): add generateMetadata to about page for title template support * feat(proofing): add client proofing, favorites selection, compact URL bitmasking, and export modal * feat(essay): add Photo Essay storytelling mode with RSC markdown parser and fullbleed/pair layouts * feat(subpages): add page enabled toggle to deactivate subpages without deleting them * feat(admin): add visual essay block builder for photo essay storytelling pages * security: add Trivy container scan to Docker publish workflow Scans the built image for CRITICAL/HIGH CVEs on every release and uploads results to the GitHub Security tab. Non-blocking for now (exit-code 0) so releases aren't gated on findings. Also documents the scan and existing Dependabot coverage in the README. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-08-07 11:08:04 +02:00
</div>
<div className="admin-toggle-cards-grid" style={{ marginBottom: '1.25rem' }}>
<button
type="button"
className={`admin-toggle-card ${settings.watermark?.enabled === true ? 'active' : ''}`}
onClick={() => update('watermark.enabled', !settings.watermark?.enabled)}
>
<div className="toggle-card-info">
release: v0.11.0 (#459) Ships `dev` as **v0.11.0**. `main` contains nothing that `dev` does not, so this is a clean sync. ## Headline changes since v0.10.0 - **Journal & Journal Studio** — photo essays at `/journal`, split-screen block editor with live preview, drafts, per-entry passwords, cover images - **First-run setup wizard at `/install`** — configure a fresh deployment from the browser; credentials are verified against Immich before anything is written, and the wizard is gated by a one-time token - **About page editor and toggle** in the admin panel - **Per-album photo order** independent of Immich, with a drag & drop editor - **Custom favicon upload** - **Experimental portfolio features** — justified grid, `cover` hero, unlisted subpages, per-album grid overrides, cover focal points, external nav links - **Security** — asset tokens length-capped before decoding (#423), journal author markdown escaped rather than filtered, journal file paths contained, admin session key derived with scrypt (#432), Next.js 16.3.0 for CVE-2025-13465 - **Fixed** — client proofing honours its own configuration again (#454); journal photo rendering (#432) Full detail in [CHANGELOG.md](CHANGELOG.md#0110--2026-08-15). ## Verified `npx tsc --noEmit` clean · `npx vitest run` 435 tests pass · `npm run build` succeeds · lint 0 errors · `prettier --check` clean · local `docker build` of the release tree. ## After merge Tag `v0.11.0` on `main` and publish the release — that triggers `docker-publish.yml`, which pushes the image and moves `latest`. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
2026-08-15 09:09:18 +02:00
<span className="toggle-card-title">
<Icons.IconFrame size={16} /> Enable Watermark
</span>
<span className="toggle-card-desc">
Overlay copyright text on portfolio image views
</span>
security: add Trivy container scan to Docker publish workflow (#399) * feat(admin): add backup manager UI with 1-click restore * feat(admin): collapse older backup entries by default * fix(theme): isolate admin layout, instant DOM theme updates, and add Light/Dark mode toggle * feat(admin): replace text controls for Photo Frame and Hero Style with visual preview cards * fix(admin): define missing CSS rules for button system (.btn, .preset-btn) * feat(admin): redesign theme settings with segmented mode toggle, accent color swatches, and custom iOS-style toggle cards * feat(admin): upgrade all settings tabs with visual grid previews, Google SEO snippet preview, and toggle cards * feat(admin): overhaul Pages Builder UX with slide-over drawer, card hover badges, real-time search, and floating save bar * fix(admin): remove leftover dangling syntax snippet in PageBuilder.tsx * fix(admin): add position: relative to subpage-tile so hover overlay is contained inside the tile * style(admin): replace all emojis with clean Leica-style vector SVG icons * fix(types): extend IconProps with SVGProps to allow style prop on Leica SVG icons * feat(admin): add subpage live-preview, privacy analytics, and asset protection settings * fix(typecheck): fix AlbumEntry property access in subpage drawer preview mode * fix(types): fix ImmichAlbumInfo property names thumbnailAssetId and albumName in PageBuilder.tsx * fix(types): add protection and watermark optional properties to AppConfig interface * feat(settings): add toggle for disabling analytics tracking (defaults to enabled) * feat(ux): show status banner when analytics tracking is disabled + add live sync indicator * feat(watermark): render customizable watermark overlay on Lightbox images + rename section to Portfolio Features & Modules * fix(types): import type LightboxWatermark in PhotoGrid.tsx * fix(types): destructure watermark prop in PhotoGrid function signature * feat(seo): add configurable subpage title template and metadata descriptions * feat(seo): add generateMetadata to about page for title template support * feat(proofing): add client proofing, favorites selection, compact URL bitmasking, and export modal * feat(essay): add Photo Essay storytelling mode with RSC markdown parser and fullbleed/pair layouts * feat(subpages): add page enabled toggle to deactivate subpages without deleting them * feat(admin): add visual essay block builder for photo essay storytelling pages * security: add Trivy container scan to Docker publish workflow Scans the built image for CRITICAL/HIGH CVEs on every release and uploads results to the GitHub Security tab. Non-blocking for now (exit-code 0) so releases aren't gated on findings. Also documents the scan and existing Dependabot coverage in the README. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-08-07 11:08:04 +02:00
</div>
release: v0.11.0 (#459) Ships `dev` as **v0.11.0**. `main` contains nothing that `dev` does not, so this is a clean sync. ## Headline changes since v0.10.0 - **Journal & Journal Studio** — photo essays at `/journal`, split-screen block editor with live preview, drafts, per-entry passwords, cover images - **First-run setup wizard at `/install`** — configure a fresh deployment from the browser; credentials are verified against Immich before anything is written, and the wizard is gated by a one-time token - **About page editor and toggle** in the admin panel - **Per-album photo order** independent of Immich, with a drag & drop editor - **Custom favicon upload** - **Experimental portfolio features** — justified grid, `cover` hero, unlisted subpages, per-album grid overrides, cover focal points, external nav links - **Security** — asset tokens length-capped before decoding (#423), journal author markdown escaped rather than filtered, journal file paths contained, admin session key derived with scrypt (#432), Next.js 16.3.0 for CVE-2025-13465 - **Fixed** — client proofing honours its own configuration again (#454); journal photo rendering (#432) Full detail in [CHANGELOG.md](CHANGELOG.md#0110--2026-08-15). ## Verified `npx tsc --noEmit` clean · `npx vitest run` 435 tests pass · `npm run build` succeeds · lint 0 errors · `prettier --check` clean · local `docker build` of the release tree. ## After merge Tag `v0.11.0` on `main` and publish the release — that triggers `docker-publish.yml`, which pushes the image and moves `latest`. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
2026-08-15 09:09:18 +02:00
<div
className={`switch-toggle ${settings.watermark?.enabled === true ? 'on' : ''}`}
>
security: add Trivy container scan to Docker publish workflow (#399) * feat(admin): add backup manager UI with 1-click restore * feat(admin): collapse older backup entries by default * fix(theme): isolate admin layout, instant DOM theme updates, and add Light/Dark mode toggle * feat(admin): replace text controls for Photo Frame and Hero Style with visual preview cards * fix(admin): define missing CSS rules for button system (.btn, .preset-btn) * feat(admin): redesign theme settings with segmented mode toggle, accent color swatches, and custom iOS-style toggle cards * feat(admin): upgrade all settings tabs with visual grid previews, Google SEO snippet preview, and toggle cards * feat(admin): overhaul Pages Builder UX with slide-over drawer, card hover badges, real-time search, and floating save bar * fix(admin): remove leftover dangling syntax snippet in PageBuilder.tsx * fix(admin): add position: relative to subpage-tile so hover overlay is contained inside the tile * style(admin): replace all emojis with clean Leica-style vector SVG icons * fix(types): extend IconProps with SVGProps to allow style prop on Leica SVG icons * feat(admin): add subpage live-preview, privacy analytics, and asset protection settings * fix(typecheck): fix AlbumEntry property access in subpage drawer preview mode * fix(types): fix ImmichAlbumInfo property names thumbnailAssetId and albumName in PageBuilder.tsx * fix(types): add protection and watermark optional properties to AppConfig interface * feat(settings): add toggle for disabling analytics tracking (defaults to enabled) * feat(ux): show status banner when analytics tracking is disabled + add live sync indicator * feat(watermark): render customizable watermark overlay on Lightbox images + rename section to Portfolio Features & Modules * fix(types): import type LightboxWatermark in PhotoGrid.tsx * fix(types): destructure watermark prop in PhotoGrid function signature * feat(seo): add configurable subpage title template and metadata descriptions * feat(seo): add generateMetadata to about page for title template support * feat(proofing): add client proofing, favorites selection, compact URL bitmasking, and export modal * feat(essay): add Photo Essay storytelling mode with RSC markdown parser and fullbleed/pair layouts * feat(subpages): add page enabled toggle to deactivate subpages without deleting them * feat(admin): add visual essay block builder for photo essay storytelling pages * security: add Trivy container scan to Docker publish workflow Scans the built image for CRITICAL/HIGH CVEs on every release and uploads results to the GitHub Security tab. Non-blocking for now (exit-code 0) so releases aren't gated on findings. Also documents the scan and existing Dependabot coverage in the README. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-08-07 11:08:04 +02:00
<span className="switch-slider" />
</div>
</button>
</div>
{settings.watermark?.enabled && (
<>
<div className="admin-field">
<label>Watermark Text</label>
<input
value={settings.watermark?.text || ''}
onChange={(e) => update('watermark.text', e.target.value)}
placeholder="© Ralfo Photography"
/>
</div>
<div className="admin-field-row">
<div className="admin-field">
<label>Position</label>
<select
value={settings.watermark?.position || 'bottom-right'}
onChange={(e) => update('watermark.position', e.target.value)}
>
<option value="bottom-right">Bottom Right</option>
<option value="bottom-left">Bottom Left</option>
<option value="center">Center Overlay</option>
</select>
</div>
<div className="admin-field">
{/* Read through the same normaliser the lightbox uses, so a
config written as a percentage shows as "90%" here rather
than "9000%" — and is written back as a fraction on save. */}
release: v0.11.0 (#459) Ships `dev` as **v0.11.0**. `main` contains nothing that `dev` does not, so this is a clean sync. ## Headline changes since v0.10.0 - **Journal & Journal Studio** — photo essays at `/journal`, split-screen block editor with live preview, drafts, per-entry passwords, cover images - **First-run setup wizard at `/install`** — configure a fresh deployment from the browser; credentials are verified against Immich before anything is written, and the wizard is gated by a one-time token - **About page editor and toggle** in the admin panel - **Per-album photo order** independent of Immich, with a drag & drop editor - **Custom favicon upload** - **Experimental portfolio features** — justified grid, `cover` hero, unlisted subpages, per-album grid overrides, cover focal points, external nav links - **Security** — asset tokens length-capped before decoding (#423), journal author markdown escaped rather than filtered, journal file paths contained, admin session key derived with scrypt (#432), Next.js 16.3.0 for CVE-2025-13465 - **Fixed** — client proofing honours its own configuration again (#454); journal photo rendering (#432) Full detail in [CHANGELOG.md](CHANGELOG.md#0110--2026-08-15). ## Verified `npx tsc --noEmit` clean · `npx vitest run` 435 tests pass · `npm run build` succeeds · lint 0 errors · `prettier --check` clean · local `docker build` of the release tree. ## After merge Tag `v0.11.0` on `main` and publish the release — that triggers `docker-publish.yml`, which pushes the image and moves `latest`. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
2026-08-15 09:09:18 +02:00
<label>
Opacity (
{Math.round(resolveWatermarkOpacity(settings.watermark?.opacity) * 100)}
%)
release: v0.11.0 (#459) Ships `dev` as **v0.11.0**. `main` contains nothing that `dev` does not, so this is a clean sync. ## Headline changes since v0.10.0 - **Journal & Journal Studio** — photo essays at `/journal`, split-screen block editor with live preview, drafts, per-entry passwords, cover images - **First-run setup wizard at `/install`** — configure a fresh deployment from the browser; credentials are verified against Immich before anything is written, and the wizard is gated by a one-time token - **About page editor and toggle** in the admin panel - **Per-album photo order** independent of Immich, with a drag & drop editor - **Custom favicon upload** - **Experimental portfolio features** — justified grid, `cover` hero, unlisted subpages, per-album grid overrides, cover focal points, external nav links - **Security** — asset tokens length-capped before decoding (#423), journal author markdown escaped rather than filtered, journal file paths contained, admin session key derived with scrypt (#432), Next.js 16.3.0 for CVE-2025-13465 - **Fixed** — client proofing honours its own configuration again (#454); journal photo rendering (#432) Full detail in [CHANGELOG.md](CHANGELOG.md#0110--2026-08-15). ## Verified `npx tsc --noEmit` clean · `npx vitest run` 435 tests pass · `npm run build` succeeds · lint 0 errors · `prettier --check` clean · local `docker build` of the release tree. ## After merge Tag `v0.11.0` on `main` and publish the release — that triggers `docker-publish.yml`, which pushes the image and moves `latest`. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
2026-08-15 09:09:18 +02:00
</label>
security: add Trivy container scan to Docker publish workflow (#399) * feat(admin): add backup manager UI with 1-click restore * feat(admin): collapse older backup entries by default * fix(theme): isolate admin layout, instant DOM theme updates, and add Light/Dark mode toggle * feat(admin): replace text controls for Photo Frame and Hero Style with visual preview cards * fix(admin): define missing CSS rules for button system (.btn, .preset-btn) * feat(admin): redesign theme settings with segmented mode toggle, accent color swatches, and custom iOS-style toggle cards * feat(admin): upgrade all settings tabs with visual grid previews, Google SEO snippet preview, and toggle cards * feat(admin): overhaul Pages Builder UX with slide-over drawer, card hover badges, real-time search, and floating save bar * fix(admin): remove leftover dangling syntax snippet in PageBuilder.tsx * fix(admin): add position: relative to subpage-tile so hover overlay is contained inside the tile * style(admin): replace all emojis with clean Leica-style vector SVG icons * fix(types): extend IconProps with SVGProps to allow style prop on Leica SVG icons * feat(admin): add subpage live-preview, privacy analytics, and asset protection settings * fix(typecheck): fix AlbumEntry property access in subpage drawer preview mode * fix(types): fix ImmichAlbumInfo property names thumbnailAssetId and albumName in PageBuilder.tsx * fix(types): add protection and watermark optional properties to AppConfig interface * feat(settings): add toggle for disabling analytics tracking (defaults to enabled) * feat(ux): show status banner when analytics tracking is disabled + add live sync indicator * feat(watermark): render customizable watermark overlay on Lightbox images + rename section to Portfolio Features & Modules * fix(types): import type LightboxWatermark in PhotoGrid.tsx * fix(types): destructure watermark prop in PhotoGrid function signature * feat(seo): add configurable subpage title template and metadata descriptions * feat(seo): add generateMetadata to about page for title template support * feat(proofing): add client proofing, favorites selection, compact URL bitmasking, and export modal * feat(essay): add Photo Essay storytelling mode with RSC markdown parser and fullbleed/pair layouts * feat(subpages): add page enabled toggle to deactivate subpages without deleting them * feat(admin): add visual essay block builder for photo essay storytelling pages * security: add Trivy container scan to Docker publish workflow Scans the built image for CRITICAL/HIGH CVEs on every release and uploads results to the GitHub Security tab. Non-blocking for now (exit-code 0) so releases aren't gated on findings. Also documents the scan and existing Dependabot coverage in the README. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-08-07 11:08:04 +02:00
<input
type="range"
min="0.1"
max="1"
security: add Trivy container scan to Docker publish workflow (#399) * feat(admin): add backup manager UI with 1-click restore * feat(admin): collapse older backup entries by default * fix(theme): isolate admin layout, instant DOM theme updates, and add Light/Dark mode toggle * feat(admin): replace text controls for Photo Frame and Hero Style with visual preview cards * fix(admin): define missing CSS rules for button system (.btn, .preset-btn) * feat(admin): redesign theme settings with segmented mode toggle, accent color swatches, and custom iOS-style toggle cards * feat(admin): upgrade all settings tabs with visual grid previews, Google SEO snippet preview, and toggle cards * feat(admin): overhaul Pages Builder UX with slide-over drawer, card hover badges, real-time search, and floating save bar * fix(admin): remove leftover dangling syntax snippet in PageBuilder.tsx * fix(admin): add position: relative to subpage-tile so hover overlay is contained inside the tile * style(admin): replace all emojis with clean Leica-style vector SVG icons * fix(types): extend IconProps with SVGProps to allow style prop on Leica SVG icons * feat(admin): add subpage live-preview, privacy analytics, and asset protection settings * fix(typecheck): fix AlbumEntry property access in subpage drawer preview mode * fix(types): fix ImmichAlbumInfo property names thumbnailAssetId and albumName in PageBuilder.tsx * fix(types): add protection and watermark optional properties to AppConfig interface * feat(settings): add toggle for disabling analytics tracking (defaults to enabled) * feat(ux): show status banner when analytics tracking is disabled + add live sync indicator * feat(watermark): render customizable watermark overlay on Lightbox images + rename section to Portfolio Features & Modules * fix(types): import type LightboxWatermark in PhotoGrid.tsx * fix(types): destructure watermark prop in PhotoGrid function signature * feat(seo): add configurable subpage title template and metadata descriptions * feat(seo): add generateMetadata to about page for title template support * feat(proofing): add client proofing, favorites selection, compact URL bitmasking, and export modal * feat(essay): add Photo Essay storytelling mode with RSC markdown parser and fullbleed/pair layouts * feat(subpages): add page enabled toggle to deactivate subpages without deleting them * feat(admin): add visual essay block builder for photo essay storytelling pages * security: add Trivy container scan to Docker publish workflow Scans the built image for CRITICAL/HIGH CVEs on every release and uploads results to the GitHub Security tab. Non-blocking for now (exit-code 0) so releases aren't gated on findings. Also documents the scan and existing Dependabot coverage in the README. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-08-07 11:08:04 +02:00
step="0.05"
value={resolveWatermarkOpacity(settings.watermark?.opacity)}
security: add Trivy container scan to Docker publish workflow (#399) * feat(admin): add backup manager UI with 1-click restore * feat(admin): collapse older backup entries by default * fix(theme): isolate admin layout, instant DOM theme updates, and add Light/Dark mode toggle * feat(admin): replace text controls for Photo Frame and Hero Style with visual preview cards * fix(admin): define missing CSS rules for button system (.btn, .preset-btn) * feat(admin): redesign theme settings with segmented mode toggle, accent color swatches, and custom iOS-style toggle cards * feat(admin): upgrade all settings tabs with visual grid previews, Google SEO snippet preview, and toggle cards * feat(admin): overhaul Pages Builder UX with slide-over drawer, card hover badges, real-time search, and floating save bar * fix(admin): remove leftover dangling syntax snippet in PageBuilder.tsx * fix(admin): add position: relative to subpage-tile so hover overlay is contained inside the tile * style(admin): replace all emojis with clean Leica-style vector SVG icons * fix(types): extend IconProps with SVGProps to allow style prop on Leica SVG icons * feat(admin): add subpage live-preview, privacy analytics, and asset protection settings * fix(typecheck): fix AlbumEntry property access in subpage drawer preview mode * fix(types): fix ImmichAlbumInfo property names thumbnailAssetId and albumName in PageBuilder.tsx * fix(types): add protection and watermark optional properties to AppConfig interface * feat(settings): add toggle for disabling analytics tracking (defaults to enabled) * feat(ux): show status banner when analytics tracking is disabled + add live sync indicator * feat(watermark): render customizable watermark overlay on Lightbox images + rename section to Portfolio Features & Modules * fix(types): import type LightboxWatermark in PhotoGrid.tsx * fix(types): destructure watermark prop in PhotoGrid function signature * feat(seo): add configurable subpage title template and metadata descriptions * feat(seo): add generateMetadata to about page for title template support * feat(proofing): add client proofing, favorites selection, compact URL bitmasking, and export modal * feat(essay): add Photo Essay storytelling mode with RSC markdown parser and fullbleed/pair layouts * feat(subpages): add page enabled toggle to deactivate subpages without deleting them * feat(admin): add visual essay block builder for photo essay storytelling pages * security: add Trivy container scan to Docker publish workflow Scans the built image for CRITICAL/HIGH CVEs on every release and uploads results to the GitHub Security tab. Non-blocking for now (exit-code 0) so releases aren't gated on findings. Also documents the scan and existing Dependabot coverage in the README. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-08-07 11:08:04 +02:00
onChange={(e) => update('watermark.opacity', parseFloat(e.target.value))}
/>
</div>
</div>
</>
)}
</div>
)}
{activeSection === 'about' && (
<div className="settings-panel">
<div className="settings-section-header">
<h3>
<Icons.IconCamera size={18} /> About Page
</h3>
<p className="settings-section-sub">
Edit the portrait, biography and gear shown on the About page. Use General to show
or hide the page itself.
</p>
</div>
{aboutLoading ? (
<div className="admin-spinner" style={{ margin: '2rem auto' }} />
) : (
<>
<div className="admin-field">
<label>Portrait Asset ID</label>
<input
value={aboutMeta.portrait || ''}
onChange={(e) => updateAboutMeta('portrait', e.target.value)}
placeholder="Immich asset UUID for the portrait photo"
/>
</div>
<div className="admin-field">
<label>Name</label>
<input
value={aboutMeta.name || ''}
onChange={(e) => updateAboutMeta('name', e.target.value)}
placeholder="Your name"
/>
</div>
<div className="admin-field">
<label>Location</label>
<input
value={aboutMeta.location || ''}
onChange={(e) => updateAboutMeta('location', e.target.value)}
placeholder="City, Country"
/>
</div>
<div className="admin-field">
<label>Gear (one per line)</label>
<textarea
value={aboutGearText}
onChange={(e) => {
setAboutGearText(e.target.value);
setAboutDirty(true);
setAboutMessage('');
}}
placeholder={`Leica Q3\nSummilux 35mm f/1.4`}
rows={4}
/>
</div>
<div className="admin-field">
<label>Biography (Markdown)</label>
<textarea
value={aboutBody}
onChange={(e) => {
setAboutBody(e.target.value);
setAboutDirty(true);
setAboutMessage('');
}}
placeholder="Photographer based in..."
rows={6}
/>
</div>
</>
)}
</div>
)}
</div>
</div>
</div>
);
}