Koko210/immich-folio
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
2fe1157a5d702a8b5e7557f213dd75df83b77cfd
immich-folio/app/admin/admin.css

4371 lines
88 KiB
CSS
Raw Normal View History

feat: add visual admin panel with page builder and settings editor - Add /admin route with password-protected visual page builder - Page Builder: manage hero images, standalone albums, subpages, and sections - Album Picker: browse all shared Immich albums with search and filtering - Settings Editor: theme, grid, footer, legal, SEO configuration - YAML service with atomic writes and automatic backups (content/.backups/) - HMAC-signed admin sessions (24h expiry, HttpOnly cookies) - API endpoints: /api/admin/{auth,gallery,settings,albums,reload} - Enable with ADMIN_PASSWORD env var; disabled by default - invalidateConfigCache() export for hot-reload after saves
2026-05-29 17:04:37 +02:00
/* ── Admin Panel Styles ─────────────────────────────────────── */
/* Self-contained — does not affect the public-facing gallery. */
fix: admin panel light/dark theme support, improved contrast, and backup confirmation a) Admin panel now respects the site's light/dark theme toggle via CSS custom properties that respond to [data-theme='light'] on <html>. All hardcoded dark colors replaced with semantic CSS variables. b) Improved contrast in dark mode: secondary text changed from #666/#555 to #a0a0a0, muted text from #555 to #707070. All text is now clearly readable against dark backgrounds. c) Backup system was already implemented in yaml-service.ts (creates timestamped backups in content/.backups/ before each save, keeps last 10 versions). Now the UI shows a confirmation message that a backup was created after each successful save.
2026-05-29 17:20:56 +02:00
/* Supports light/dark mode via data-theme attribute on <html>. */
/* ── Theme Variables ───────────────────────────────────────── */
release: v0.11.0 — journal fixes, admin URLs, design system cleanup (#432) * fix(screenshots): sharp-Typen fuer 0.34 und 0.35 gleichzeitig (#410) sharp 0.35 ist von `export =` auf ESM umgestellt: der Modul-Namespace ist nicht mehr aufrufbar, die Factory sitzt unter .default. Der Type-Check brach damit in scripts/screenshots.ts weg, sobald der Next-Bump (#402) sharp von 0.34.5 auf 0.35.3 mitzieht -- sharp ist hier keine deklarierte Dependency, sondern kommt ueber Next mit. Die Form wird jetzt aus dem installierten Paket abgeleitet statt festgeschrieben, zur Laufzeit wie im Typ. Geprueft mit beiden Versionen: tsc laeuft mit 0.34.5 und mit 0.35.3 fehlerfrei durch. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(deps): bump the nextjs group across 1 directory with 2 updates (#402) Bumps the nextjs group with 2 updates in the / directory: [next](https://github.com/vercel/next.js) and [eslint-config-next](https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next). Updates `next` from 16.2.12 to 16.3.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/compare/v16.2.12...v16.3.0) Updates `eslint-config-next` from 16.2.12 to 16.3.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/commits/v16.3.0/packages/eslint-config-next) --- updated-dependencies: - dependency-name: eslint-config-next dependency-version: 16.3.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: nextjs - dependency-name: next dependency-version: 16.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nextjs ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps-dev): bump prettier from 3.8.3 to 3.9.6 (#405) Bumps [prettier](https://github.com/prettier/prettier) from 3.8.3 to 3.9.6. - [Release notes](https://github.com/prettier/prettier/releases) - [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md) - [Commits](https://github.com/prettier/prettier/compare/3.8.3...3.9.6) --- updated-dependencies: - dependency-name: prettier dependency-version: 3.9.6 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * docs(changelog): Unreleased-Sektion fuer die Bumps nach v0.10.0 (#413) Die Dependency-PRs sind nach dem Release auf dev gelandet, teils auch auf main. Ohne Eintrag waeren sie beim naechsten Release unsichtbar -- inklusive Next 16.3.0, das CVE-2025-13465 mitbringt. Ausserdem im 0.10.0-Abschnitt nachgetragen, dass der Trivy-Scan bis #409 nie gelaufen ist. Der Fix steckt im Tag v0.10.0, fehlte aber in der Aufzaehlung -- und "Images werden bei jedem Publish gescannt" stand im Changelog, waehrend der Job im Action-Setup abbrach. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(gallery): per-album sort order, independent of Immich (#408) (#414) Album order was dictated entirely by Immich: getAlbum() sorted by the album's own asc/desc flag, so a Folio album always mirrored the archive. A curated series has a narrative order that has nothing to do with capture time, and changing the Immich album's sort to fit the website changes it for the archive too. Adds an optional per-album `sort` in gallery.yaml, editable in /admin, defaulting to today's behaviour so every existing config is unchanged: immich (default) | newest | oldest | filename | manual `manual` is a pinned *prefix*: `assetOrder` lists only the photos placed by hand, everything else follows in the album's Immich order. A full permutation of a 2,000-photo album would be ~80 KB of UUIDs in a file that is rewritten and copied to content/.backups/ on every admin save. It also makes drift fall out for free — photos removed in Immich never match, new ones land in the tail rather than being hidden. Sorting is applied after the cache read, not before the cache write, so the LRU keeps one canonical Immich-ordered copy per album. That avoids putting the mode in the cache key, lets a config change take effect without depending on invalidation, and keeps the stale-serving path correct. cache.get() returns the stored object by reference, so withSort() returns a shallow clone with a new array — sorting in place would reorder the shared entry, and under request coalescing every concurrent caller would be sorting the same array. Also fixes a prerequisite bug: /api/admin/albums/[albumId]/assets read album.assets from GET /albums/:id, which Immich 3.x no longer populates (lib/immich.ts:507). The hero picker's "This Album" tab returned nothing and threw outright when the key was absent. It now goes through the client's paginated metadata search, with ?types=all to opt videos in for the reorder editor. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): drop decorative emoji from the sort select labels (#415) An <option> cannot contain markup, so the SVG set in Icons is not reachable there — but a decorative emoji is not a substitute for it. Plain text instead; the album card badge already uses a real icon. The remaining emoji in the admin panel (asset picker tabs, section headings, layout picker options) predate this branch and are left for a separate cleanup. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): replace emoji icons with the shared SVG icon set (#416) The admin panel mixed two icon conventions: inline SVGs from `Icons.tsx` in most components, and decorative emoji in the asset picker and a few PageBuilder labels. Emoji render inconsistently across platforms, ignore the accent colour, and cannot inherit the `.svg-icon` sizing rules. - Icons.tsx: add `IconStar` (filled — it marks a state, not an action) and `IconImage`. - AssetPicker: the three tab labels and the favourite tile badge now use IconFolder / IconStar / IconImage. - PageBuilder: the "Standalone Albums" and "Subpages" headings use the icon set instead of an emoji. - PageBuilder: the layout picker drops its emoji for plain text. An <option> cannot contain markup, so an SVG is impossible there and a decorative glyph is not a substitute. - admin.css: align icon and label in the picker tabs, and swap the favourite badge's text-shadow for drop-shadow, which is what applies to an inline SVG. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): fold PageBuilder's local icons into the shared Icons module (#418) * refactor(admin): fold PageBuilder's local icons into the shared module PageBuilder.tsx carried its own `Icons` object duplicating most of the glyphs already exported by Icons.tsx, with hardcoded sizes and slightly divergent paths. Migrate all 32 call sites to the shared module and delete the local object. Five glyphs had no counterpart and are added to Icons.tsx as 1:1 ports of the local paths: IconX, IconPlus, IconHome, IconCopy, IconImage. The local ExternalLink and Check are dropped rather than ported — both had zero call sites. Two glyphs change shape slightly, which is the point of consolidating: the shared IconCamera includes the viewfinder bump the local copy omitted, and drag handles now use IconGripVertical. IconGripVertical uses the module's square 24x24 viewBox, so `.svg-drag` goes from 12x18 to 18x18 — the old non-square box would letterbox the glyph down to 12x12 and shrink the handle. * fix(admin): resolve icon-module integration after #416 Merging dev brought in #416, which added a second IconImage to Icons.tsx and two <Icons.Camera>/<Icons.Folder> section headers that reference the local Icons object this PR removes. Git merged both cleanly but the result did not type-check. - drop the duplicate IconImage (both copies were byte-identical) - point the two section headers at the imported IconCamera/IconFolder - refresh the SORT_LABELS comment: the icon set is imported now, not declared below --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> * fix(config): allow an empty gallery, guard against a double /api suffix (#421) An empty gallery is now a valid, rendered state instead of a throw: deriveGallery() no longer requires at least one album or subpage, so a deployment with no albums yet renders a bare homepage the owner can fill in via /admin. getConfig() also stops appending /api to an Immich URL that already ends in it, which previously produced .../api/api and broke every upstream request. Includes a restore of the per-album sort test cases, which the branch had lost by being cut before #408/#414. * feat(admin): favicon upload, served from the content volume (#422) Adds a bundled default favicon, an upload widget in admin Settings > General, and a route that serves the icon from the writable content/ volume with a fallback to the bundled default. Raster uploads (PNG/ICO/JPEG) are wrapped in an SVG container; the response carries its own CSP so an uploaded SVG cannot execute script on the origin. The GET route revalidates with an ETag instead of caching immutably, so a newly uploaded icon shows up immediately. Uploads are written via temp file + rename, and a Reset button restores the bundled default. * ci: flag unformatted files in a PR, without blocking it (#424) Prettier is configured as an error rule in eslint.config.mjs but has never run in CI, so part of the tree predates it. A final CI step now diffs against the PR base, runs prettier --list-different over the changed files, and emits a warning annotation per offender plus a job summary. Advisory by design: it never fails the job. Blocking would turn a PR red for merely touching a file that was already unformatted, and normalising the tree in one commit would wreck git blame and conflict with the PRs in flight. Requires fetch-depth: 0, since diffing against the base needs its history. * feat(install): first-run wizard gated by a one-time setup token (#419) Adds /install, a four-step first-run wizard: connect to Immich, optionally pick albums, name the site, finish. It verifies the credentials against the Immich server before writing anything, then writes gallery.yaml, settings.yaml and a content/install.json carrying the Immich credentials and a generated site secret. install.json exists because a running process cannot pick up new env vars — the wizard has to write configuration that takes effect without a restart. getInstallCredentials() merges it under the real environment, so env vars always win and rotation stays a matter of setting one. Both the page and the API routes are gated by a one-time setup token printed to the server log, so a deployment that is reachable before gallery.yaml exists cannot be configured by whoever finds it first. The token is stored in content/.setup-token (0600) rather than a module variable: Next.js bundles the page and each route handler separately, so a module-level token left the page and the API disagreeing inside one process and the wizard stuck on step 1. It is removed once the install completes. The admin password is stored as an scrypt hash using the scheme lib/auth.ts already applies to album passwords; a plaintext ADMIN_PASSWORD env var keeps working. * docs: document the setup wizard, fix the read-only content mount (#425) Quick Start now leads with the /install wizard, with the hand-written YAML route kept alongside it, and a First-Run Setup section covers the setup token, the files the wizard writes, and env-var precedence. Two corrections: both Docker examples mounted content/ as :ro, which silently breaks the wizard, the admin panel and the backup rotation alike — docs/admin-panel.md already said so and the README contradicted it. And nothing documented that content/install.json holds the Immich API key, so a backup of content/ is a backup of credentials. Also adds a Contributors section crediting the people whose work is in the project. * feat(admin): floating save bar pinned to the bottom of the viewport (#426) The save bar was the first, static element inside .admin-main. Since the document itself scrolls, it left the viewport as soon as you scrolled down — editing a subpage section or a settings block far below gave no visible dirty hint and no reachable save button. Replace it with a bottom-pinned floating bar shared by both editors. It only mounts while there is something to act on (unsaved changes, an in-flight save, or a result message), so it never covers content while idle. The success message clears after 5s, which hides the bar again. - new SaveBar component, replacing the duplicated markup in PageBuilder and SettingsEditor - adopt the previously unused .floating-save-bar CSS: slide-in keyframes (carrying translateX(-50%)), dirty border, wrap/gap, mobile variant and a prefers-reduced-motion opt-out; z-index 900 keeps it below modals - .admin-main gains bottom padding so the bar never covers page content - drop the now-unreachable idle hints: the ⌘S hint becomes a button title, the Live Sync note becomes a static line above the settings layout - header "Site" link now bypasses the cache (/?fresh=1), so the preview stays reachable when the bar is hidden Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(admin): themed listbox for the album sort control (#427) The per-album "Photo order" control was a native <select>. Because an <option> cannot contain markup, its choices could not use the admin panel's currentColor SVG set — the reason #415 had to fall back to plain text after dropping the emoji labels. Adds a Listbox component implementing the ARIA combobox/listbox pattern, so options can render a glyph beside their label: - DOM focus stays on the trigger button; the active option is announced through aria-activedescendant, keeping focus management to one element - Keyboard: arrows (clamped at the ends, like a native select), Home/End, Enter/Space to commit, Escape to cancel, Tab commits and moves on, and prefix type-ahead with a repeat-key cycle - Outside dismissal on pointerdown, so a press starting outside closes the popup before the click retargets The sort options now carry an icon each: calendar, arrow-down, arrow-up, an A→Z marker, and the drag glyph for manual — matching the badge the album card already shows. SORT_LABELS stays plain text because the badge feeds it to a title attribute. Closes #417 Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(git): ignore generated design handoff folders * fix(admin): stop the album sort dropdown clipping, and simplify the panel (#428) * fix(admin): render listbox popup in a portal so it escapes modal clipping The sort control's popup was position:absolute inside three clipping ancestors (.album-drawer overflow:hidden > .album-drawer-body overflow-y:auto > .modal-right-column overflow-y:auto), so it was cut off at the bottom of the Edit Album Details modal. z-index could not help: clipping happens before stacking. It also always hung below the trigger, with no flip. Portal the popup to document.body and position it from the trigger's viewport rect, flipping above when there is more room there and capping max-height to the space available so it scrolls internally rather than overflowing. It is dismissed on scroll and resize, since the anchor is only measured on open. The outside-pointerdown handler now also treats the popup as inside; without that the portalled list counts as outside, and a click on an option would close it before the selection commits. * refactor(admin): single-column album details panel The left column spent 1.2fr on a cover thumbnail and three stat rows, two of which (Status, Custom Hero) only restated the form fields opposite them, while the form itself was squeezed into 1.8fr behind a second nested scroller. Stack the drawer in one column instead: cover as a banner, then the form at full width, with the UUID moved into the footer. The body is now the only scroll container, which also removes one of the ancestors that was clipping the sort popup. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> * fix(admin): give the portalled listbox its theme back, lock the page behind modals (#429) Two defects in the album editor. The sort listbox popup painted transparent. Every --admin-* variable is scoped to .admin-layout, and since the popup moved into document.body it sits outside that subtree, so background/border/text all resolved to nothing. It now carries its own copy of the palette in both colour schemes, plus the font it no longer inherits. Scrolling inside a modal also moved the page behind it. No admin modal ever locked body scroll: the overlay covers the page but does not absorb wheel events, so a scroll starting on the backdrop — or continuing past the end of the modal's own scroller — reaches the document. overscroll-behavior cannot cover that case on its own, because it only applies to scroll containers and the backdrop is not one. useScrollLock freezes body while a modal is open and compensates for the width the scrollbar gives up, so nothing shifts underneath. Each lock restores the inline value it found, which makes nesting work without a counter — a picker opened from the drawer restores the drawer's hidden state instead of clearing it. Applied to both drawers and all four picker modals, which share the defect. overscroll-behavior: contain on the scrollers stops the chaining they can handle themselves. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com> * fix(security): allow unsafe-eval in CSP script-src during dev mode * feat(journal): add Journal Studio with split-screen editor, live preview and dedicated routes * fix(build): separate client parser from server journal-service and fix build type errors * fix(journal): Fotos rendern, Layout und Lightbox-Steuerung korrigieren Fünf unabhängige Fehler in der öffentlichen Journal- und Essay-Ansicht: * Foto-Blöcke wurden nie angezeigt. EssayView löst ein Foto über PhotoItem.id auf, und das sind verschlüsselte Tokens — die Blöcke aus dem Markdown tragen aber rohe Asset-UUIDs. Jede Zuordnung lief ins Leere, und nicht auflösbare Blöcke werden still verworfen. Die IDs werden jetzt serverseitig übersetzt; damit verschwinden nebenbei die rohen UUIDs aus dem Client-Payload, die dort laut Projektregel nie auftauchen dürfen. Nicht auflösbare Referenzen werden geloggt. * Überschriften standen weiter links als der Fließtext. Jeder Block hatte einzeln `max-width: 68ch`, und `ch` ist relativ zur Schrift des Elements — die Serif-Überschrift ergab eine breitere Spalte. Ersetzt durch eine gemeinsame, font-unabhängige `--essay-measure`. * Fullbleed-Fotos bluteten nur nach links aus: `.essay-figure` ist `width: 100%`, wodurch die Box überbestimmt ist und der negative rechte Margin verworfen wird. * Foto-Paare stellten beide Bilder gleich breit dar, wodurch ein Hochformat neben einem Querformat doppelt so hoch wurde. Jetzt eine Justified-Reihe: Breite proportional zum Seitenverhältnis, dadurch exakt gleiche Höhen ohne Beschnitt. * Die Lightbox hatte im Journal keine Tastatursteuerung und keine Scroll-Sperre — beides lag in PhotoGrid, also nur im Album-Raster. Verlagert in die Lightbox selbst, der doppelte Handler in PhotoGrid entfernt (sonst wäre pro Pfeildruck zwei Bilder weitergesprungen). Zusätzlich sind Proofing-Herzen und das EXIF-Panel im redaktionellen Modus abschaltbar und im Journal aus: Client-Proofing ist ein Übergabe-Workflow für Alben, keine Funktion einer Reportage. Auf der Übersicht wurde der Untertitel doppelt gerendert, weil extractExcerpt() auf ihn zurückfällt. * feat(admin): eigene URLs für alle Bereiche und überarbeiteter Journal Studio Das Panel war eine einzige Client-Komponente, die ihre Tabs über useState umschaltet: keine Route pro Bereich, kein Deep-Link, kein Zurück-Button, und nach jedem Reload landete man wieder auf "Pages". Auch der Journal-Editor hatte keine eigene URL. Jetzt sieben echte Routen (/admin, /admin/pages, /admin/journal, /admin/journal/<slug>, /admin/settings, /admin/settings/<section>, /admin/analytics). Die Shell mit Auth-Prüfung und Kopfzeile sitzt im Layout und umschließt children — so bleibt die Session-Prüfung über Routenwechsel montiert, statt bei jedem Tab-Wechsel neu zu laufen und den Spinner aufblitzen zu lassen. Unbekannte Settings-Sections fallen auf General zurück. Im selben Zug der Journal Studio, der die Routing-Änderung ohnehin berührt: * Alle Eingabefelder nutzten die Klasse `admin-input`, die in keinem CSS definiert war — sie fielen auf Browser-Defaults zurück. Jetzt gestylt, gescoped, damit der generische Name nicht ins übrige Panel leckt. * Der Split View ist per Divider verschiebbar (Maus, Tastatur, Doppelklick zum Zurücksetzen), Breite in localStorage. * Das Studio bricht aus der 1120px-Spalte aus, die Preview hat Platz. * Die Preview zeigte für jedes Foto fest 3:2 und log damit über das Layout der veröffentlichten Seite; die echten Verhältnisse werden jetzt an den Thumbnails gemessen. * Blöcke mit alten positionsbasierten Foto-Referenzen werden markiert — die lassen sich auf einer eigenständigen Journal-Seite nicht auflösen und verschwanden bisher stillschweigend. * Blocktyp-Chips als gemeinsame Komponente, monochrom und per Icon unterschieden statt in einer eigenen Blau/Lila/Orange-Palette, die sonst nirgends im Panel vorkommt. * Emojis raus, SVG-Icons rein. * fix(admin): Designsystem-Lücken im Panel schließen Eine systematische Suche nach Klassen, die im TSX benutzt, aber in keinem CSS definiert sind, hat vier Stellen mit demselben Muster gefunden: * `admin-btn-secondary` und `admin-btn-danger` existierten nicht. Sämtliche Löschen-Buttons sahen aus wie normale Buttons — keine Warnwirkung. Als `.admin-btn.admin-btn-danger` geschrieben, weil die Varianten mit den Größenklassen kombiniert werden, die weiter unten ihren eigenen Hintergrund setzen. * `page-progress-fill` fehlte: die Balken im Analytics-Panel waren leere Rinnen, der Wert unsichtbar. Ebenso `analytics-empty` und `admin-loading-container`. * `subpage-drawer-section`, `subpage-drawer-title-group` und `input-with-icon` im PageBuilder waren wirkungslos und teils mit Inline-Styles notdürftig kompensiert. * `grid-card-preview` fehlte, wodurch alle Layout-Vorschauen auf Höhe null kollabierten. Nur "Showcase" war sichtbar — und das aus Versehen, weil sein Tile `hero-tile` hieß und damit die `aspect-ratio` einer fremden PageBuilder-Klasse erbte. Umbenannt. Dazu die Theme-Vorschauen, die praktisch identisch aussahen: alle sieben zeigten dieselben drei quadratischen Kacheln, einziger Unterschied war die Hintergrundfarbe. Sie spiegeln jetzt die echten Preset-Daten aus lib/config/theme.ts — Schriftcharakter, Eckradius, Rasterdichte, Passepartout bzw. Schatten. Die Kopfzeile richtet sich an einer gemeinsamen Steuerhöhe aus. Der "Site"-Link war höher als die Buttons daneben: `.admin-btn` hatte keine explizite line-height, und <button> bekommt box-sizing: border-box vom Browser, <a> nicht. Die Statusanzeige setzte weder Schriftfamilie noch -größe und fiel auf den Browser-Default zurück — sie war nie Teil des Designsystems. Jetzt gleiche Höhe und Typografie, Pillenform als Zustandsanzeige, Trenner zur Aktionsgruppe. Das dauerhafte Pulsieren des grünen Punkts entfällt; Animation bleibt den Zuständen vorbehalten, die Aufmerksamkeit brauchen. Restliche Emojis durch SVG-Icons ersetzt. * feat(admin): add scroll-to-top toggle and SVG arrow The back-to-top button was always on and drew its arrow with the ↑ text character. Add a `scrollToTop` setting (General section in the admin panel, defaults to on so existing sites are unaffected) and replace the glyph with a stroked SVG that inherits currentColor across all presets. Scroll handling is now rAF-throttled, and prefers-reduced-motion turns off both the hover lift and the smooth scroll. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * security(journal): escape author HTML instead of filtering it CodeQL flags 26 high-severity alerts on the release PR; the bulk of them point at sanitizeHtml(), a denylist of three regexes whose output goes into dangerouslySetInnerHTML. I reproduced the bypasses before changing anything — all four pass the old filter: <img src=x onerror=alert(1)> unquoted handler, regex wants quotes <img src=x onerror='alert(1)'> single quotes, same reason <svg onload=alert(1)> not a <script> tag javasjavascript:cript:alert(1) one-pass replace, the rest recombines Plus an attribute breakout in the link renderer, which interpolated the URL into href="${url}" unescaped: [x](" onmouseover=alert(1) x=") -> <a href="" onmouseover=alert(1" ...> Replaced with escaping. Every `&<>"'` in author text becomes an entity before any markdown rule runs, so the only tags in the output are the ones renderInlineMarkdown builds itself and a URL cannot leave its attribute. Link schemes are now an allowlist (http, https, mailto, tel, relative, anchor); anything else renders as plain text. The serializer needed decodeHtmlEntities to match: without it a save would write `&lt;` into the Markdown file and the next parse would escape the `&` again, corrupting the text further on every round trip. A test covers parse -> serialize -> parse stability. Two existing tests asserted the old behaviour and were rewritten rather than deleted: one expected the script tag to be *removed* from the output, the other expected the substring "onerror" to be absent. Both now assert the property that matters — that no tag can form — because `onerror` surviving as inert text is fine. Exploitation required admin access either way: journal and essay text comes from the studio or from content/*.md. This removes the weakness, it does not close an open door. * fix(journal): contain file paths, fix frontmatter escaping, defuse two regexes Follow-up to the CodeQL findings on release PR #432. I went through all 23 alerts individually; this addresses the ones that are worth addressing and documents the ones that are not. Path containment (12 alerts, all false positives). Every path built from a slug goes through isValidSlug(), a strict `/^[a-zA-Z0-9_-]+$/` allowlist — verified against `../../etc/passwd`, `foo/../../bar`, `a/b`, `..` and friends, all rejected. CodeQL cannot see it because the check lives in another module. Added a containedPath() helper that resolves the path and refuses anything landing outside the content directory: a second lock on a door that was already locked, and a barrier the analysis can follow. Also removed the dead `slug.endsWith('.md')` branches — isValidSlug rejects dots, so they could never be taken. Frontmatter escaping (1 alert, a real bug). The serializer escaped `"` but not `\`, and the parser never unescaped anything. A title containing either character gained a backslash on every save/load cycle: Path C:\Users "quoted" -> Path C:\\Users \"quoted\" -> ... Escaping now covers the backslash first and the parser undoes both. A round trip test covers quotes, backslashes, colons and apostrophes. Two of three ReDoS regexes (2 alerts). The heading pattern had `\s+` next to `(.+)`, which overlap, so the engine tried every split of the whitespace run before failing; it is `[ \t]+` and `(\S.*)` now. The quote author pattern wrapped a lazy group around an optional group — the quadratic case — and is an index split on the first separator now. The third regex, the bold/italic pass, is deliberately left alone. Rewriting it with a negated class removes the backtracking but breaks nesting: `**bold *and italic* here**` renders as `*<em>bold </em>and italic<em> here</em>*`. The input is Markdown from an authenticated admin, never a visitor, so the worst case is an author slowing down their own page. The comment in the code says so. Not addressed: 5 js/insufficient-password-hash alerts. They ask for a slow KDF where the code uses SHA-256/HMAC — correct in general, but the admin password comes from an environment variable and is never stored, so a stronger KDF protects nothing that is not already in plaintext in the environment. 399 unit tests pass (18 new), build and tsc clean. * fix(journal): split the quote author by scanning, not by pattern Cleaning up after myself. #439 replaced the quote author regex `/^(.*?)(?:\s+--\s+(.+))?$/` — a lazy group around an optional one, the quadratic case — with `/\s+--\s+/`, and CodeQL promptly flagged the replacement for the same reason. One reported pattern traded for another. splitQuoteAuthor() scans for the first `--` that has whitespace on both sides. Linear, and it needs no reasoning about the regex engine at all. Behaviour is identical to the original regex, checked case by case against it: separator, no separator, several separators, tabs, wide gaps, `a--b` without spaces, leading and trailing separators, empty string. All nine are covered by tests, plus one asserting it stays fast on a 50k whitespace run. * security(admin): derive the session signing key with scrypt getSigningKey() ran the admin password through a single SHA-256 digest. It is key derivation rather than password storage, so it was never a stored-hash problem — but if the derived key ever leaked, one fast hash makes recovering the password by brute force cheap. CodeQL flags it as js/insufficient-password-hash and, for this particular alert, has a point. scrypt now. Two details that matter: The salt has to be stable. A random salt would produce a different key on every call and invalidate every session; it is derived from AUTH_SECRET, which is deployment-specific. Verified across separate processes: same inputs produce a verifying token, so a restart or redeploy does not log everyone out. The result is cached for the process lifetime. scrypt is deliberately slow and getSigningKey() runs on every admin request — deriving per call would add ~24ms to each one. The cache key is a digest of secret plus password, so a rotation misses the cache and derives again, and no extra plaintext copy of the password is kept around. Measured: first derivation 24ms, subsequent calls 0.12ms. Password change and secret change both invalidate an existing token, checked in separate processes. Note the one-time effect: existing admin sessions are invalidated by the change in derivation, so everyone logs in once more. * security(admin): key the signing-key cache on its inputs, not a digest #441 removed the SHA-256 digest of the admin password from the key derivation and introduced a new one three lines above it, as the cache key. Same rule, same file: CodeQL reported it immediately. The comment justifying it was wrong too. It claimed no second plaintext copy of the password was retained, while building the digest input allocates exactly that in order to hash it. The cache now holds the two input strings and compares them directly. They are the same objects the env and install caches already hold, so nothing extra is retained, and no fast hash of the password exists in memory for the life of the process. Re-verified after the change, in separate processes: a token from one process verifies in another with the same inputs, a changed password or secret rejects it, first derivation 24ms, cached calls 0.001ms. That leaves scrypt as the only place the password is hashed here. The two HMACs further down operate on the derived key and on token data, not on the password; the constant-time comparison in verifyAdminPassword is the previously dismissed one. --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
2026-08-14 16:55:07 +02:00
/* .admin-listbox-popup is listed alongside .admin-layout because it is
portalled to <body>, outside the layout subtree. Without its own copy every
var below resolves to nothing there, and the popup paints transparent. */
.admin-layout,
.admin-listbox-popup {
fix: admin panel light/dark theme support, improved contrast, and backup confirmation a) Admin panel now respects the site's light/dark theme toggle via CSS custom properties that respond to [data-theme='light'] on <html>. All hardcoded dark colors replaced with semantic CSS variables. b) Improved contrast in dark mode: secondary text changed from #666/#555 to #a0a0a0, muted text from #555 to #707070. All text is now clearly readable against dark backgrounds. c) Backup system was already implemented in yaml-service.ts (creates timestamped backups in content/.backups/ before each save, keeps last 10 versions). Now the UI shows a confirmation message that a backup was created after each successful save.
2026-05-29 17:20:56 +02:00
/* Dark mode (default) */
--admin-bg: #111111;
--admin-bg-raised: #1a1a1a;
--admin-bg-elevated: #222222;
--admin-bg-input: #161616;
--admin-border: #2e2e2e;
--admin-border-hover: #444444;
--admin-border-focus: #666666;
--admin-text: #f0f0f0;
--admin-text-secondary: #a0a0a0;
--admin-text-muted: #707070;
--admin-accent: #f59e0b;
release: v0.11.0 — journal fixes, admin URLs, design system cleanup (#432) * fix(screenshots): sharp-Typen fuer 0.34 und 0.35 gleichzeitig (#410) sharp 0.35 ist von `export =` auf ESM umgestellt: der Modul-Namespace ist nicht mehr aufrufbar, die Factory sitzt unter .default. Der Type-Check brach damit in scripts/screenshots.ts weg, sobald der Next-Bump (#402) sharp von 0.34.5 auf 0.35.3 mitzieht -- sharp ist hier keine deklarierte Dependency, sondern kommt ueber Next mit. Die Form wird jetzt aus dem installierten Paket abgeleitet statt festgeschrieben, zur Laufzeit wie im Typ. Geprueft mit beiden Versionen: tsc laeuft mit 0.34.5 und mit 0.35.3 fehlerfrei durch. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(deps): bump the nextjs group across 1 directory with 2 updates (#402) Bumps the nextjs group with 2 updates in the / directory: [next](https://github.com/vercel/next.js) and [eslint-config-next](https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next). Updates `next` from 16.2.12 to 16.3.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/compare/v16.2.12...v16.3.0) Updates `eslint-config-next` from 16.2.12 to 16.3.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/commits/v16.3.0/packages/eslint-config-next) --- updated-dependencies: - dependency-name: eslint-config-next dependency-version: 16.3.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: nextjs - dependency-name: next dependency-version: 16.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nextjs ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps-dev): bump prettier from 3.8.3 to 3.9.6 (#405) Bumps [prettier](https://github.com/prettier/prettier) from 3.8.3 to 3.9.6. - [Release notes](https://github.com/prettier/prettier/releases) - [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md) - [Commits](https://github.com/prettier/prettier/compare/3.8.3...3.9.6) --- updated-dependencies: - dependency-name: prettier dependency-version: 3.9.6 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * docs(changelog): Unreleased-Sektion fuer die Bumps nach v0.10.0 (#413) Die Dependency-PRs sind nach dem Release auf dev gelandet, teils auch auf main. Ohne Eintrag waeren sie beim naechsten Release unsichtbar -- inklusive Next 16.3.0, das CVE-2025-13465 mitbringt. Ausserdem im 0.10.0-Abschnitt nachgetragen, dass der Trivy-Scan bis #409 nie gelaufen ist. Der Fix steckt im Tag v0.10.0, fehlte aber in der Aufzaehlung -- und "Images werden bei jedem Publish gescannt" stand im Changelog, waehrend der Job im Action-Setup abbrach. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(gallery): per-album sort order, independent of Immich (#408) (#414) Album order was dictated entirely by Immich: getAlbum() sorted by the album's own asc/desc flag, so a Folio album always mirrored the archive. A curated series has a narrative order that has nothing to do with capture time, and changing the Immich album's sort to fit the website changes it for the archive too. Adds an optional per-album `sort` in gallery.yaml, editable in /admin, defaulting to today's behaviour so every existing config is unchanged: immich (default) | newest | oldest | filename | manual `manual` is a pinned *prefix*: `assetOrder` lists only the photos placed by hand, everything else follows in the album's Immich order. A full permutation of a 2,000-photo album would be ~80 KB of UUIDs in a file that is rewritten and copied to content/.backups/ on every admin save. It also makes drift fall out for free — photos removed in Immich never match, new ones land in the tail rather than being hidden. Sorting is applied after the cache read, not before the cache write, so the LRU keeps one canonical Immich-ordered copy per album. That avoids putting the mode in the cache key, lets a config change take effect without depending on invalidation, and keeps the stale-serving path correct. cache.get() returns the stored object by reference, so withSort() returns a shallow clone with a new array — sorting in place would reorder the shared entry, and under request coalescing every concurrent caller would be sorting the same array. Also fixes a prerequisite bug: /api/admin/albums/[albumId]/assets read album.assets from GET /albums/:id, which Immich 3.x no longer populates (lib/immich.ts:507). The hero picker's "This Album" tab returned nothing and threw outright when the key was absent. It now goes through the client's paginated metadata search, with ?types=all to opt videos in for the reorder editor. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): drop decorative emoji from the sort select labels (#415) An <option> cannot contain markup, so the SVG set in Icons is not reachable there — but a decorative emoji is not a substitute for it. Plain text instead; the album card badge already uses a real icon. The remaining emoji in the admin panel (asset picker tabs, section headings, layout picker options) predate this branch and are left for a separate cleanup. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): replace emoji icons with the shared SVG icon set (#416) The admin panel mixed two icon conventions: inline SVGs from `Icons.tsx` in most components, and decorative emoji in the asset picker and a few PageBuilder labels. Emoji render inconsistently across platforms, ignore the accent colour, and cannot inherit the `.svg-icon` sizing rules. - Icons.tsx: add `IconStar` (filled — it marks a state, not an action) and `IconImage`. - AssetPicker: the three tab labels and the favourite tile badge now use IconFolder / IconStar / IconImage. - PageBuilder: the "Standalone Albums" and "Subpages" headings use the icon set instead of an emoji. - PageBuilder: the layout picker drops its emoji for plain text. An <option> cannot contain markup, so an SVG is impossible there and a decorative glyph is not a substitute. - admin.css: align icon and label in the picker tabs, and swap the favourite badge's text-shadow for drop-shadow, which is what applies to an inline SVG. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): fold PageBuilder's local icons into the shared Icons module (#418) * refactor(admin): fold PageBuilder's local icons into the shared module PageBuilder.tsx carried its own `Icons` object duplicating most of the glyphs already exported by Icons.tsx, with hardcoded sizes and slightly divergent paths. Migrate all 32 call sites to the shared module and delete the local object. Five glyphs had no counterpart and are added to Icons.tsx as 1:1 ports of the local paths: IconX, IconPlus, IconHome, IconCopy, IconImage. The local ExternalLink and Check are dropped rather than ported — both had zero call sites. Two glyphs change shape slightly, which is the point of consolidating: the shared IconCamera includes the viewfinder bump the local copy omitted, and drag handles now use IconGripVertical. IconGripVertical uses the module's square 24x24 viewBox, so `.svg-drag` goes from 12x18 to 18x18 — the old non-square box would letterbox the glyph down to 12x12 and shrink the handle. * fix(admin): resolve icon-module integration after #416 Merging dev brought in #416, which added a second IconImage to Icons.tsx and two <Icons.Camera>/<Icons.Folder> section headers that reference the local Icons object this PR removes. Git merged both cleanly but the result did not type-check. - drop the duplicate IconImage (both copies were byte-identical) - point the two section headers at the imported IconCamera/IconFolder - refresh the SORT_LABELS comment: the icon set is imported now, not declared below --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> * fix(config): allow an empty gallery, guard against a double /api suffix (#421) An empty gallery is now a valid, rendered state instead of a throw: deriveGallery() no longer requires at least one album or subpage, so a deployment with no albums yet renders a bare homepage the owner can fill in via /admin. getConfig() also stops appending /api to an Immich URL that already ends in it, which previously produced .../api/api and broke every upstream request. Includes a restore of the per-album sort test cases, which the branch had lost by being cut before #408/#414. * feat(admin): favicon upload, served from the content volume (#422) Adds a bundled default favicon, an upload widget in admin Settings > General, and a route that serves the icon from the writable content/ volume with a fallback to the bundled default. Raster uploads (PNG/ICO/JPEG) are wrapped in an SVG container; the response carries its own CSP so an uploaded SVG cannot execute script on the origin. The GET route revalidates with an ETag instead of caching immutably, so a newly uploaded icon shows up immediately. Uploads are written via temp file + rename, and a Reset button restores the bundled default. * ci: flag unformatted files in a PR, without blocking it (#424) Prettier is configured as an error rule in eslint.config.mjs but has never run in CI, so part of the tree predates it. A final CI step now diffs against the PR base, runs prettier --list-different over the changed files, and emits a warning annotation per offender plus a job summary. Advisory by design: it never fails the job. Blocking would turn a PR red for merely touching a file that was already unformatted, and normalising the tree in one commit would wreck git blame and conflict with the PRs in flight. Requires fetch-depth: 0, since diffing against the base needs its history. * feat(install): first-run wizard gated by a one-time setup token (#419) Adds /install, a four-step first-run wizard: connect to Immich, optionally pick albums, name the site, finish. It verifies the credentials against the Immich server before writing anything, then writes gallery.yaml, settings.yaml and a content/install.json carrying the Immich credentials and a generated site secret. install.json exists because a running process cannot pick up new env vars — the wizard has to write configuration that takes effect without a restart. getInstallCredentials() merges it under the real environment, so env vars always win and rotation stays a matter of setting one. Both the page and the API routes are gated by a one-time setup token printed to the server log, so a deployment that is reachable before gallery.yaml exists cannot be configured by whoever finds it first. The token is stored in content/.setup-token (0600) rather than a module variable: Next.js bundles the page and each route handler separately, so a module-level token left the page and the API disagreeing inside one process and the wizard stuck on step 1. It is removed once the install completes. The admin password is stored as an scrypt hash using the scheme lib/auth.ts already applies to album passwords; a plaintext ADMIN_PASSWORD env var keeps working. * docs: document the setup wizard, fix the read-only content mount (#425) Quick Start now leads with the /install wizard, with the hand-written YAML route kept alongside it, and a First-Run Setup section covers the setup token, the files the wizard writes, and env-var precedence. Two corrections: both Docker examples mounted content/ as :ro, which silently breaks the wizard, the admin panel and the backup rotation alike — docs/admin-panel.md already said so and the README contradicted it. And nothing documented that content/install.json holds the Immich API key, so a backup of content/ is a backup of credentials. Also adds a Contributors section crediting the people whose work is in the project. * feat(admin): floating save bar pinned to the bottom of the viewport (#426) The save bar was the first, static element inside .admin-main. Since the document itself scrolls, it left the viewport as soon as you scrolled down — editing a subpage section or a settings block far below gave no visible dirty hint and no reachable save button. Replace it with a bottom-pinned floating bar shared by both editors. It only mounts while there is something to act on (unsaved changes, an in-flight save, or a result message), so it never covers content while idle. The success message clears after 5s, which hides the bar again. - new SaveBar component, replacing the duplicated markup in PageBuilder and SettingsEditor - adopt the previously unused .floating-save-bar CSS: slide-in keyframes (carrying translateX(-50%)), dirty border, wrap/gap, mobile variant and a prefers-reduced-motion opt-out; z-index 900 keeps it below modals - .admin-main gains bottom padding so the bar never covers page content - drop the now-unreachable idle hints: the ⌘S hint becomes a button title, the Live Sync note becomes a static line above the settings layout - header "Site" link now bypasses the cache (/?fresh=1), so the preview stays reachable when the bar is hidden Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(admin): themed listbox for the album sort control (#427) The per-album "Photo order" control was a native <select>. Because an <option> cannot contain markup, its choices could not use the admin panel's currentColor SVG set — the reason #415 had to fall back to plain text after dropping the emoji labels. Adds a Listbox component implementing the ARIA combobox/listbox pattern, so options can render a glyph beside their label: - DOM focus stays on the trigger button; the active option is announced through aria-activedescendant, keeping focus management to one element - Keyboard: arrows (clamped at the ends, like a native select), Home/End, Enter/Space to commit, Escape to cancel, Tab commits and moves on, and prefix type-ahead with a repeat-key cycle - Outside dismissal on pointerdown, so a press starting outside closes the popup before the click retargets The sort options now carry an icon each: calendar, arrow-down, arrow-up, an A→Z marker, and the drag glyph for manual — matching the badge the album card already shows. SORT_LABELS stays plain text because the badge feeds it to a title attribute. Closes #417 Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(git): ignore generated design handoff folders * fix(admin): stop the album sort dropdown clipping, and simplify the panel (#428) * fix(admin): render listbox popup in a portal so it escapes modal clipping The sort control's popup was position:absolute inside three clipping ancestors (.album-drawer overflow:hidden > .album-drawer-body overflow-y:auto > .modal-right-column overflow-y:auto), so it was cut off at the bottom of the Edit Album Details modal. z-index could not help: clipping happens before stacking. It also always hung below the trigger, with no flip. Portal the popup to document.body and position it from the trigger's viewport rect, flipping above when there is more room there and capping max-height to the space available so it scrolls internally rather than overflowing. It is dismissed on scroll and resize, since the anchor is only measured on open. The outside-pointerdown handler now also treats the popup as inside; without that the portalled list counts as outside, and a click on an option would close it before the selection commits. * refactor(admin): single-column album details panel The left column spent 1.2fr on a cover thumbnail and three stat rows, two of which (Status, Custom Hero) only restated the form fields opposite them, while the form itself was squeezed into 1.8fr behind a second nested scroller. Stack the drawer in one column instead: cover as a banner, then the form at full width, with the UUID moved into the footer. The body is now the only scroll container, which also removes one of the ancestors that was clipping the sort popup. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> * fix(admin): give the portalled listbox its theme back, lock the page behind modals (#429) Two defects in the album editor. The sort listbox popup painted transparent. Every --admin-* variable is scoped to .admin-layout, and since the popup moved into document.body it sits outside that subtree, so background/border/text all resolved to nothing. It now carries its own copy of the palette in both colour schemes, plus the font it no longer inherits. Scrolling inside a modal also moved the page behind it. No admin modal ever locked body scroll: the overlay covers the page but does not absorb wheel events, so a scroll starting on the backdrop — or continuing past the end of the modal's own scroller — reaches the document. overscroll-behavior cannot cover that case on its own, because it only applies to scroll containers and the backdrop is not one. useScrollLock freezes body while a modal is open and compensates for the width the scrollbar gives up, so nothing shifts underneath. Each lock restores the inline value it found, which makes nesting work without a counter — a picker opened from the drawer restores the drawer's hidden state instead of clearing it. Applied to both drawers and all four picker modals, which share the defect. overscroll-behavior: contain on the scrollers stops the chaining they can handle themselves. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com> * fix(security): allow unsafe-eval in CSP script-src during dev mode * feat(journal): add Journal Studio with split-screen editor, live preview and dedicated routes * fix(build): separate client parser from server journal-service and fix build type errors * fix(journal): Fotos rendern, Layout und Lightbox-Steuerung korrigieren Fünf unabhängige Fehler in der öffentlichen Journal- und Essay-Ansicht: * Foto-Blöcke wurden nie angezeigt. EssayView löst ein Foto über PhotoItem.id auf, und das sind verschlüsselte Tokens — die Blöcke aus dem Markdown tragen aber rohe Asset-UUIDs. Jede Zuordnung lief ins Leere, und nicht auflösbare Blöcke werden still verworfen. Die IDs werden jetzt serverseitig übersetzt; damit verschwinden nebenbei die rohen UUIDs aus dem Client-Payload, die dort laut Projektregel nie auftauchen dürfen. Nicht auflösbare Referenzen werden geloggt. * Überschriften standen weiter links als der Fließtext. Jeder Block hatte einzeln `max-width: 68ch`, und `ch` ist relativ zur Schrift des Elements — die Serif-Überschrift ergab eine breitere Spalte. Ersetzt durch eine gemeinsame, font-unabhängige `--essay-measure`. * Fullbleed-Fotos bluteten nur nach links aus: `.essay-figure` ist `width: 100%`, wodurch die Box überbestimmt ist und der negative rechte Margin verworfen wird. * Foto-Paare stellten beide Bilder gleich breit dar, wodurch ein Hochformat neben einem Querformat doppelt so hoch wurde. Jetzt eine Justified-Reihe: Breite proportional zum Seitenverhältnis, dadurch exakt gleiche Höhen ohne Beschnitt. * Die Lightbox hatte im Journal keine Tastatursteuerung und keine Scroll-Sperre — beides lag in PhotoGrid, also nur im Album-Raster. Verlagert in die Lightbox selbst, der doppelte Handler in PhotoGrid entfernt (sonst wäre pro Pfeildruck zwei Bilder weitergesprungen). Zusätzlich sind Proofing-Herzen und das EXIF-Panel im redaktionellen Modus abschaltbar und im Journal aus: Client-Proofing ist ein Übergabe-Workflow für Alben, keine Funktion einer Reportage. Auf der Übersicht wurde der Untertitel doppelt gerendert, weil extractExcerpt() auf ihn zurückfällt. * feat(admin): eigene URLs für alle Bereiche und überarbeiteter Journal Studio Das Panel war eine einzige Client-Komponente, die ihre Tabs über useState umschaltet: keine Route pro Bereich, kein Deep-Link, kein Zurück-Button, und nach jedem Reload landete man wieder auf "Pages". Auch der Journal-Editor hatte keine eigene URL. Jetzt sieben echte Routen (/admin, /admin/pages, /admin/journal, /admin/journal/<slug>, /admin/settings, /admin/settings/<section>, /admin/analytics). Die Shell mit Auth-Prüfung und Kopfzeile sitzt im Layout und umschließt children — so bleibt die Session-Prüfung über Routenwechsel montiert, statt bei jedem Tab-Wechsel neu zu laufen und den Spinner aufblitzen zu lassen. Unbekannte Settings-Sections fallen auf General zurück. Im selben Zug der Journal Studio, der die Routing-Änderung ohnehin berührt: * Alle Eingabefelder nutzten die Klasse `admin-input`, die in keinem CSS definiert war — sie fielen auf Browser-Defaults zurück. Jetzt gestylt, gescoped, damit der generische Name nicht ins übrige Panel leckt. * Der Split View ist per Divider verschiebbar (Maus, Tastatur, Doppelklick zum Zurücksetzen), Breite in localStorage. * Das Studio bricht aus der 1120px-Spalte aus, die Preview hat Platz. * Die Preview zeigte für jedes Foto fest 3:2 und log damit über das Layout der veröffentlichten Seite; die echten Verhältnisse werden jetzt an den Thumbnails gemessen. * Blöcke mit alten positionsbasierten Foto-Referenzen werden markiert — die lassen sich auf einer eigenständigen Journal-Seite nicht auflösen und verschwanden bisher stillschweigend. * Blocktyp-Chips als gemeinsame Komponente, monochrom und per Icon unterschieden statt in einer eigenen Blau/Lila/Orange-Palette, die sonst nirgends im Panel vorkommt. * Emojis raus, SVG-Icons rein. * fix(admin): Designsystem-Lücken im Panel schließen Eine systematische Suche nach Klassen, die im TSX benutzt, aber in keinem CSS definiert sind, hat vier Stellen mit demselben Muster gefunden: * `admin-btn-secondary` und `admin-btn-danger` existierten nicht. Sämtliche Löschen-Buttons sahen aus wie normale Buttons — keine Warnwirkung. Als `.admin-btn.admin-btn-danger` geschrieben, weil die Varianten mit den Größenklassen kombiniert werden, die weiter unten ihren eigenen Hintergrund setzen. * `page-progress-fill` fehlte: die Balken im Analytics-Panel waren leere Rinnen, der Wert unsichtbar. Ebenso `analytics-empty` und `admin-loading-container`. * `subpage-drawer-section`, `subpage-drawer-title-group` und `input-with-icon` im PageBuilder waren wirkungslos und teils mit Inline-Styles notdürftig kompensiert. * `grid-card-preview` fehlte, wodurch alle Layout-Vorschauen auf Höhe null kollabierten. Nur "Showcase" war sichtbar — und das aus Versehen, weil sein Tile `hero-tile` hieß und damit die `aspect-ratio` einer fremden PageBuilder-Klasse erbte. Umbenannt. Dazu die Theme-Vorschauen, die praktisch identisch aussahen: alle sieben zeigten dieselben drei quadratischen Kacheln, einziger Unterschied war die Hintergrundfarbe. Sie spiegeln jetzt die echten Preset-Daten aus lib/config/theme.ts — Schriftcharakter, Eckradius, Rasterdichte, Passepartout bzw. Schatten. Die Kopfzeile richtet sich an einer gemeinsamen Steuerhöhe aus. Der "Site"-Link war höher als die Buttons daneben: `.admin-btn` hatte keine explizite line-height, und <button> bekommt box-sizing: border-box vom Browser, <a> nicht. Die Statusanzeige setzte weder Schriftfamilie noch -größe und fiel auf den Browser-Default zurück — sie war nie Teil des Designsystems. Jetzt gleiche Höhe und Typografie, Pillenform als Zustandsanzeige, Trenner zur Aktionsgruppe. Das dauerhafte Pulsieren des grünen Punkts entfällt; Animation bleibt den Zuständen vorbehalten, die Aufmerksamkeit brauchen. Restliche Emojis durch SVG-Icons ersetzt. * feat(admin): add scroll-to-top toggle and SVG arrow The back-to-top button was always on and drew its arrow with the ↑ text character. Add a `scrollToTop` setting (General section in the admin panel, defaults to on so existing sites are unaffected) and replace the glyph with a stroked SVG that inherits currentColor across all presets. Scroll handling is now rAF-throttled, and prefers-reduced-motion turns off both the hover lift and the smooth scroll. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * security(journal): escape author HTML instead of filtering it CodeQL flags 26 high-severity alerts on the release PR; the bulk of them point at sanitizeHtml(), a denylist of three regexes whose output goes into dangerouslySetInnerHTML. I reproduced the bypasses before changing anything — all four pass the old filter: <img src=x onerror=alert(1)> unquoted handler, regex wants quotes <img src=x onerror='alert(1)'> single quotes, same reason <svg onload=alert(1)> not a <script> tag javasjavascript:cript:alert(1) one-pass replace, the rest recombines Plus an attribute breakout in the link renderer, which interpolated the URL into href="${url}" unescaped: [x](" onmouseover=alert(1) x=") -> <a href="" onmouseover=alert(1" ...> Replaced with escaping. Every `&<>"'` in author text becomes an entity before any markdown rule runs, so the only tags in the output are the ones renderInlineMarkdown builds itself and a URL cannot leave its attribute. Link schemes are now an allowlist (http, https, mailto, tel, relative, anchor); anything else renders as plain text. The serializer needed decodeHtmlEntities to match: without it a save would write `&lt;` into the Markdown file and the next parse would escape the `&` again, corrupting the text further on every round trip. A test covers parse -> serialize -> parse stability. Two existing tests asserted the old behaviour and were rewritten rather than deleted: one expected the script tag to be *removed* from the output, the other expected the substring "onerror" to be absent. Both now assert the property that matters — that no tag can form — because `onerror` surviving as inert text is fine. Exploitation required admin access either way: journal and essay text comes from the studio or from content/*.md. This removes the weakness, it does not close an open door. * fix(journal): contain file paths, fix frontmatter escaping, defuse two regexes Follow-up to the CodeQL findings on release PR #432. I went through all 23 alerts individually; this addresses the ones that are worth addressing and documents the ones that are not. Path containment (12 alerts, all false positives). Every path built from a slug goes through isValidSlug(), a strict `/^[a-zA-Z0-9_-]+$/` allowlist — verified against `../../etc/passwd`, `foo/../../bar`, `a/b`, `..` and friends, all rejected. CodeQL cannot see it because the check lives in another module. Added a containedPath() helper that resolves the path and refuses anything landing outside the content directory: a second lock on a door that was already locked, and a barrier the analysis can follow. Also removed the dead `slug.endsWith('.md')` branches — isValidSlug rejects dots, so they could never be taken. Frontmatter escaping (1 alert, a real bug). The serializer escaped `"` but not `\`, and the parser never unescaped anything. A title containing either character gained a backslash on every save/load cycle: Path C:\Users "quoted" -> Path C:\\Users \"quoted\" -> ... Escaping now covers the backslash first and the parser undoes both. A round trip test covers quotes, backslashes, colons and apostrophes. Two of three ReDoS regexes (2 alerts). The heading pattern had `\s+` next to `(.+)`, which overlap, so the engine tried every split of the whitespace run before failing; it is `[ \t]+` and `(\S.*)` now. The quote author pattern wrapped a lazy group around an optional group — the quadratic case — and is an index split on the first separator now. The third regex, the bold/italic pass, is deliberately left alone. Rewriting it with a negated class removes the backtracking but breaks nesting: `**bold *and italic* here**` renders as `*<em>bold </em>and italic<em> here</em>*`. The input is Markdown from an authenticated admin, never a visitor, so the worst case is an author slowing down their own page. The comment in the code says so. Not addressed: 5 js/insufficient-password-hash alerts. They ask for a slow KDF where the code uses SHA-256/HMAC — correct in general, but the admin password comes from an environment variable and is never stored, so a stronger KDF protects nothing that is not already in plaintext in the environment. 399 unit tests pass (18 new), build and tsc clean. * fix(journal): split the quote author by scanning, not by pattern Cleaning up after myself. #439 replaced the quote author regex `/^(.*?)(?:\s+--\s+(.+))?$/` — a lazy group around an optional one, the quadratic case — with `/\s+--\s+/`, and CodeQL promptly flagged the replacement for the same reason. One reported pattern traded for another. splitQuoteAuthor() scans for the first `--` that has whitespace on both sides. Linear, and it needs no reasoning about the regex engine at all. Behaviour is identical to the original regex, checked case by case against it: separator, no separator, several separators, tabs, wide gaps, `a--b` without spaces, leading and trailing separators, empty string. All nine are covered by tests, plus one asserting it stays fast on a 50k whitespace run. * security(admin): derive the session signing key with scrypt getSigningKey() ran the admin password through a single SHA-256 digest. It is key derivation rather than password storage, so it was never a stored-hash problem — but if the derived key ever leaked, one fast hash makes recovering the password by brute force cheap. CodeQL flags it as js/insufficient-password-hash and, for this particular alert, has a point. scrypt now. Two details that matter: The salt has to be stable. A random salt would produce a different key on every call and invalidate every session; it is derived from AUTH_SECRET, which is deployment-specific. Verified across separate processes: same inputs produce a verifying token, so a restart or redeploy does not log everyone out. The result is cached for the process lifetime. scrypt is deliberately slow and getSigningKey() runs on every admin request — deriving per call would add ~24ms to each one. The cache key is a digest of secret plus password, so a rotation misses the cache and derives again, and no extra plaintext copy of the password is kept around. Measured: first derivation 24ms, subsequent calls 0.12ms. Password change and secret change both invalidate an existing token, checked in separate processes. Note the one-time effect: existing admin sessions are invalidated by the change in derivation, so everyone logs in once more. * security(admin): key the signing-key cache on its inputs, not a digest #441 removed the SHA-256 digest of the admin password from the key derivation and introduced a new one three lines above it, as the cache key. Same rule, same file: CodeQL reported it immediately. The comment justifying it was wrong too. It claimed no second plaintext copy of the password was retained, while building the digest input allocates exactly that in order to hash it. The cache now holds the two input strings and compares them directly. They are the same objects the env and install caches already hold, so nothing extra is retained, and no fast hash of the password exists in memory for the life of the process. Re-verified after the change, in separate processes: a token from one process verifies in another with the same inputs, a changed password or secret rejects it, first derivation 24ms, cached calls 0.001ms. That leaves scrypt as the only place the password is hashed here. The two HMACs further down operate on the derived key and on token data, not on the password; the constant-time comparison in verifyAdminPassword is the previously dismissed one. --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
2026-08-14 16:55:07 +02:00
/* One height for every control in the header row. */
--admin-control-height: 36px;
fix: admin panel light/dark theme support, improved contrast, and backup confirmation a) Admin panel now respects the site's light/dark theme toggle via CSS custom properties that respond to [data-theme='light'] on <html>. All hardcoded dark colors replaced with semantic CSS variables. b) Improved contrast in dark mode: secondary text changed from #666/#555 to #a0a0a0, muted text from #555 to #707070. All text is now clearly readable against dark backgrounds. c) Backup system was already implemented in yaml-service.ts (creates timestamped backups in content/.backups/ before each save, keeps last 10 versions). Now the UI shows a confirmation message that a backup was created after each successful save.
2026-05-29 17:20:56 +02:00
--admin-success: #4ade80;
--admin-error: #f87171;
--admin-error-bg: #2d1111;
--admin-error-border: #5c2020;
--admin-btn-primary-bg: #ffffff;
--admin-btn-primary-text: #000000;
--admin-btn-primary-hover: #e5e5e5;
--admin-overlay: rgba(0, 0, 0, 0.7);
}
release: v0.11.0 — journal fixes, admin URLs, design system cleanup (#432) * fix(screenshots): sharp-Typen fuer 0.34 und 0.35 gleichzeitig (#410) sharp 0.35 ist von `export =` auf ESM umgestellt: der Modul-Namespace ist nicht mehr aufrufbar, die Factory sitzt unter .default. Der Type-Check brach damit in scripts/screenshots.ts weg, sobald der Next-Bump (#402) sharp von 0.34.5 auf 0.35.3 mitzieht -- sharp ist hier keine deklarierte Dependency, sondern kommt ueber Next mit. Die Form wird jetzt aus dem installierten Paket abgeleitet statt festgeschrieben, zur Laufzeit wie im Typ. Geprueft mit beiden Versionen: tsc laeuft mit 0.34.5 und mit 0.35.3 fehlerfrei durch. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(deps): bump the nextjs group across 1 directory with 2 updates (#402) Bumps the nextjs group with 2 updates in the / directory: [next](https://github.com/vercel/next.js) and [eslint-config-next](https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next). Updates `next` from 16.2.12 to 16.3.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/compare/v16.2.12...v16.3.0) Updates `eslint-config-next` from 16.2.12 to 16.3.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/commits/v16.3.0/packages/eslint-config-next) --- updated-dependencies: - dependency-name: eslint-config-next dependency-version: 16.3.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: nextjs - dependency-name: next dependency-version: 16.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nextjs ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps-dev): bump prettier from 3.8.3 to 3.9.6 (#405) Bumps [prettier](https://github.com/prettier/prettier) from 3.8.3 to 3.9.6. - [Release notes](https://github.com/prettier/prettier/releases) - [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md) - [Commits](https://github.com/prettier/prettier/compare/3.8.3...3.9.6) --- updated-dependencies: - dependency-name: prettier dependency-version: 3.9.6 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * docs(changelog): Unreleased-Sektion fuer die Bumps nach v0.10.0 (#413) Die Dependency-PRs sind nach dem Release auf dev gelandet, teils auch auf main. Ohne Eintrag waeren sie beim naechsten Release unsichtbar -- inklusive Next 16.3.0, das CVE-2025-13465 mitbringt. Ausserdem im 0.10.0-Abschnitt nachgetragen, dass der Trivy-Scan bis #409 nie gelaufen ist. Der Fix steckt im Tag v0.10.0, fehlte aber in der Aufzaehlung -- und "Images werden bei jedem Publish gescannt" stand im Changelog, waehrend der Job im Action-Setup abbrach. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(gallery): per-album sort order, independent of Immich (#408) (#414) Album order was dictated entirely by Immich: getAlbum() sorted by the album's own asc/desc flag, so a Folio album always mirrored the archive. A curated series has a narrative order that has nothing to do with capture time, and changing the Immich album's sort to fit the website changes it for the archive too. Adds an optional per-album `sort` in gallery.yaml, editable in /admin, defaulting to today's behaviour so every existing config is unchanged: immich (default) | newest | oldest | filename | manual `manual` is a pinned *prefix*: `assetOrder` lists only the photos placed by hand, everything else follows in the album's Immich order. A full permutation of a 2,000-photo album would be ~80 KB of UUIDs in a file that is rewritten and copied to content/.backups/ on every admin save. It also makes drift fall out for free — photos removed in Immich never match, new ones land in the tail rather than being hidden. Sorting is applied after the cache read, not before the cache write, so the LRU keeps one canonical Immich-ordered copy per album. That avoids putting the mode in the cache key, lets a config change take effect without depending on invalidation, and keeps the stale-serving path correct. cache.get() returns the stored object by reference, so withSort() returns a shallow clone with a new array — sorting in place would reorder the shared entry, and under request coalescing every concurrent caller would be sorting the same array. Also fixes a prerequisite bug: /api/admin/albums/[albumId]/assets read album.assets from GET /albums/:id, which Immich 3.x no longer populates (lib/immich.ts:507). The hero picker's "This Album" tab returned nothing and threw outright when the key was absent. It now goes through the client's paginated metadata search, with ?types=all to opt videos in for the reorder editor. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): drop decorative emoji from the sort select labels (#415) An <option> cannot contain markup, so the SVG set in Icons is not reachable there — but a decorative emoji is not a substitute for it. Plain text instead; the album card badge already uses a real icon. The remaining emoji in the admin panel (asset picker tabs, section headings, layout picker options) predate this branch and are left for a separate cleanup. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): replace emoji icons with the shared SVG icon set (#416) The admin panel mixed two icon conventions: inline SVGs from `Icons.tsx` in most components, and decorative emoji in the asset picker and a few PageBuilder labels. Emoji render inconsistently across platforms, ignore the accent colour, and cannot inherit the `.svg-icon` sizing rules. - Icons.tsx: add `IconStar` (filled — it marks a state, not an action) and `IconImage`. - AssetPicker: the three tab labels and the favourite tile badge now use IconFolder / IconStar / IconImage. - PageBuilder: the "Standalone Albums" and "Subpages" headings use the icon set instead of an emoji. - PageBuilder: the layout picker drops its emoji for plain text. An <option> cannot contain markup, so an SVG is impossible there and a decorative glyph is not a substitute. - admin.css: align icon and label in the picker tabs, and swap the favourite badge's text-shadow for drop-shadow, which is what applies to an inline SVG. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): fold PageBuilder's local icons into the shared Icons module (#418) * refactor(admin): fold PageBuilder's local icons into the shared module PageBuilder.tsx carried its own `Icons` object duplicating most of the glyphs already exported by Icons.tsx, with hardcoded sizes and slightly divergent paths. Migrate all 32 call sites to the shared module and delete the local object. Five glyphs had no counterpart and are added to Icons.tsx as 1:1 ports of the local paths: IconX, IconPlus, IconHome, IconCopy, IconImage. The local ExternalLink and Check are dropped rather than ported — both had zero call sites. Two glyphs change shape slightly, which is the point of consolidating: the shared IconCamera includes the viewfinder bump the local copy omitted, and drag handles now use IconGripVertical. IconGripVertical uses the module's square 24x24 viewBox, so `.svg-drag` goes from 12x18 to 18x18 — the old non-square box would letterbox the glyph down to 12x12 and shrink the handle. * fix(admin): resolve icon-module integration after #416 Merging dev brought in #416, which added a second IconImage to Icons.tsx and two <Icons.Camera>/<Icons.Folder> section headers that reference the local Icons object this PR removes. Git merged both cleanly but the result did not type-check. - drop the duplicate IconImage (both copies were byte-identical) - point the two section headers at the imported IconCamera/IconFolder - refresh the SORT_LABELS comment: the icon set is imported now, not declared below --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> * fix(config): allow an empty gallery, guard against a double /api suffix (#421) An empty gallery is now a valid, rendered state instead of a throw: deriveGallery() no longer requires at least one album or subpage, so a deployment with no albums yet renders a bare homepage the owner can fill in via /admin. getConfig() also stops appending /api to an Immich URL that already ends in it, which previously produced .../api/api and broke every upstream request. Includes a restore of the per-album sort test cases, which the branch had lost by being cut before #408/#414. * feat(admin): favicon upload, served from the content volume (#422) Adds a bundled default favicon, an upload widget in admin Settings > General, and a route that serves the icon from the writable content/ volume with a fallback to the bundled default. Raster uploads (PNG/ICO/JPEG) are wrapped in an SVG container; the response carries its own CSP so an uploaded SVG cannot execute script on the origin. The GET route revalidates with an ETag instead of caching immutably, so a newly uploaded icon shows up immediately. Uploads are written via temp file + rename, and a Reset button restores the bundled default. * ci: flag unformatted files in a PR, without blocking it (#424) Prettier is configured as an error rule in eslint.config.mjs but has never run in CI, so part of the tree predates it. A final CI step now diffs against the PR base, runs prettier --list-different over the changed files, and emits a warning annotation per offender plus a job summary. Advisory by design: it never fails the job. Blocking would turn a PR red for merely touching a file that was already unformatted, and normalising the tree in one commit would wreck git blame and conflict with the PRs in flight. Requires fetch-depth: 0, since diffing against the base needs its history. * feat(install): first-run wizard gated by a one-time setup token (#419) Adds /install, a four-step first-run wizard: connect to Immich, optionally pick albums, name the site, finish. It verifies the credentials against the Immich server before writing anything, then writes gallery.yaml, settings.yaml and a content/install.json carrying the Immich credentials and a generated site secret. install.json exists because a running process cannot pick up new env vars — the wizard has to write configuration that takes effect without a restart. getInstallCredentials() merges it under the real environment, so env vars always win and rotation stays a matter of setting one. Both the page and the API routes are gated by a one-time setup token printed to the server log, so a deployment that is reachable before gallery.yaml exists cannot be configured by whoever finds it first. The token is stored in content/.setup-token (0600) rather than a module variable: Next.js bundles the page and each route handler separately, so a module-level token left the page and the API disagreeing inside one process and the wizard stuck on step 1. It is removed once the install completes. The admin password is stored as an scrypt hash using the scheme lib/auth.ts already applies to album passwords; a plaintext ADMIN_PASSWORD env var keeps working. * docs: document the setup wizard, fix the read-only content mount (#425) Quick Start now leads with the /install wizard, with the hand-written YAML route kept alongside it, and a First-Run Setup section covers the setup token, the files the wizard writes, and env-var precedence. Two corrections: both Docker examples mounted content/ as :ro, which silently breaks the wizard, the admin panel and the backup rotation alike — docs/admin-panel.md already said so and the README contradicted it. And nothing documented that content/install.json holds the Immich API key, so a backup of content/ is a backup of credentials. Also adds a Contributors section crediting the people whose work is in the project. * feat(admin): floating save bar pinned to the bottom of the viewport (#426) The save bar was the first, static element inside .admin-main. Since the document itself scrolls, it left the viewport as soon as you scrolled down — editing a subpage section or a settings block far below gave no visible dirty hint and no reachable save button. Replace it with a bottom-pinned floating bar shared by both editors. It only mounts while there is something to act on (unsaved changes, an in-flight save, or a result message), so it never covers content while idle. The success message clears after 5s, which hides the bar again. - new SaveBar component, replacing the duplicated markup in PageBuilder and SettingsEditor - adopt the previously unused .floating-save-bar CSS: slide-in keyframes (carrying translateX(-50%)), dirty border, wrap/gap, mobile variant and a prefers-reduced-motion opt-out; z-index 900 keeps it below modals - .admin-main gains bottom padding so the bar never covers page content - drop the now-unreachable idle hints: the ⌘S hint becomes a button title, the Live Sync note becomes a static line above the settings layout - header "Site" link now bypasses the cache (/?fresh=1), so the preview stays reachable when the bar is hidden Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(admin): themed listbox for the album sort control (#427) The per-album "Photo order" control was a native <select>. Because an <option> cannot contain markup, its choices could not use the admin panel's currentColor SVG set — the reason #415 had to fall back to plain text after dropping the emoji labels. Adds a Listbox component implementing the ARIA combobox/listbox pattern, so options can render a glyph beside their label: - DOM focus stays on the trigger button; the active option is announced through aria-activedescendant, keeping focus management to one element - Keyboard: arrows (clamped at the ends, like a native select), Home/End, Enter/Space to commit, Escape to cancel, Tab commits and moves on, and prefix type-ahead with a repeat-key cycle - Outside dismissal on pointerdown, so a press starting outside closes the popup before the click retargets The sort options now carry an icon each: calendar, arrow-down, arrow-up, an A→Z marker, and the drag glyph for manual — matching the badge the album card already shows. SORT_LABELS stays plain text because the badge feeds it to a title attribute. Closes #417 Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(git): ignore generated design handoff folders * fix(admin): stop the album sort dropdown clipping, and simplify the panel (#428) * fix(admin): render listbox popup in a portal so it escapes modal clipping The sort control's popup was position:absolute inside three clipping ancestors (.album-drawer overflow:hidden > .album-drawer-body overflow-y:auto > .modal-right-column overflow-y:auto), so it was cut off at the bottom of the Edit Album Details modal. z-index could not help: clipping happens before stacking. It also always hung below the trigger, with no flip. Portal the popup to document.body and position it from the trigger's viewport rect, flipping above when there is more room there and capping max-height to the space available so it scrolls internally rather than overflowing. It is dismissed on scroll and resize, since the anchor is only measured on open. The outside-pointerdown handler now also treats the popup as inside; without that the portalled list counts as outside, and a click on an option would close it before the selection commits. * refactor(admin): single-column album details panel The left column spent 1.2fr on a cover thumbnail and three stat rows, two of which (Status, Custom Hero) only restated the form fields opposite them, while the form itself was squeezed into 1.8fr behind a second nested scroller. Stack the drawer in one column instead: cover as a banner, then the form at full width, with the UUID moved into the footer. The body is now the only scroll container, which also removes one of the ancestors that was clipping the sort popup. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> * fix(admin): give the portalled listbox its theme back, lock the page behind modals (#429) Two defects in the album editor. The sort listbox popup painted transparent. Every --admin-* variable is scoped to .admin-layout, and since the popup moved into document.body it sits outside that subtree, so background/border/text all resolved to nothing. It now carries its own copy of the palette in both colour schemes, plus the font it no longer inherits. Scrolling inside a modal also moved the page behind it. No admin modal ever locked body scroll: the overlay covers the page but does not absorb wheel events, so a scroll starting on the backdrop — or continuing past the end of the modal's own scroller — reaches the document. overscroll-behavior cannot cover that case on its own, because it only applies to scroll containers and the backdrop is not one. useScrollLock freezes body while a modal is open and compensates for the width the scrollbar gives up, so nothing shifts underneath. Each lock restores the inline value it found, which makes nesting work without a counter — a picker opened from the drawer restores the drawer's hidden state instead of clearing it. Applied to both drawers and all four picker modals, which share the defect. overscroll-behavior: contain on the scrollers stops the chaining they can handle themselves. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com> * fix(security): allow unsafe-eval in CSP script-src during dev mode * feat(journal): add Journal Studio with split-screen editor, live preview and dedicated routes * fix(build): separate client parser from server journal-service and fix build type errors * fix(journal): Fotos rendern, Layout und Lightbox-Steuerung korrigieren Fünf unabhängige Fehler in der öffentlichen Journal- und Essay-Ansicht: * Foto-Blöcke wurden nie angezeigt. EssayView löst ein Foto über PhotoItem.id auf, und das sind verschlüsselte Tokens — die Blöcke aus dem Markdown tragen aber rohe Asset-UUIDs. Jede Zuordnung lief ins Leere, und nicht auflösbare Blöcke werden still verworfen. Die IDs werden jetzt serverseitig übersetzt; damit verschwinden nebenbei die rohen UUIDs aus dem Client-Payload, die dort laut Projektregel nie auftauchen dürfen. Nicht auflösbare Referenzen werden geloggt. * Überschriften standen weiter links als der Fließtext. Jeder Block hatte einzeln `max-width: 68ch`, und `ch` ist relativ zur Schrift des Elements — die Serif-Überschrift ergab eine breitere Spalte. Ersetzt durch eine gemeinsame, font-unabhängige `--essay-measure`. * Fullbleed-Fotos bluteten nur nach links aus: `.essay-figure` ist `width: 100%`, wodurch die Box überbestimmt ist und der negative rechte Margin verworfen wird. * Foto-Paare stellten beide Bilder gleich breit dar, wodurch ein Hochformat neben einem Querformat doppelt so hoch wurde. Jetzt eine Justified-Reihe: Breite proportional zum Seitenverhältnis, dadurch exakt gleiche Höhen ohne Beschnitt. * Die Lightbox hatte im Journal keine Tastatursteuerung und keine Scroll-Sperre — beides lag in PhotoGrid, also nur im Album-Raster. Verlagert in die Lightbox selbst, der doppelte Handler in PhotoGrid entfernt (sonst wäre pro Pfeildruck zwei Bilder weitergesprungen). Zusätzlich sind Proofing-Herzen und das EXIF-Panel im redaktionellen Modus abschaltbar und im Journal aus: Client-Proofing ist ein Übergabe-Workflow für Alben, keine Funktion einer Reportage. Auf der Übersicht wurde der Untertitel doppelt gerendert, weil extractExcerpt() auf ihn zurückfällt. * feat(admin): eigene URLs für alle Bereiche und überarbeiteter Journal Studio Das Panel war eine einzige Client-Komponente, die ihre Tabs über useState umschaltet: keine Route pro Bereich, kein Deep-Link, kein Zurück-Button, und nach jedem Reload landete man wieder auf "Pages". Auch der Journal-Editor hatte keine eigene URL. Jetzt sieben echte Routen (/admin, /admin/pages, /admin/journal, /admin/journal/<slug>, /admin/settings, /admin/settings/<section>, /admin/analytics). Die Shell mit Auth-Prüfung und Kopfzeile sitzt im Layout und umschließt children — so bleibt die Session-Prüfung über Routenwechsel montiert, statt bei jedem Tab-Wechsel neu zu laufen und den Spinner aufblitzen zu lassen. Unbekannte Settings-Sections fallen auf General zurück. Im selben Zug der Journal Studio, der die Routing-Änderung ohnehin berührt: * Alle Eingabefelder nutzten die Klasse `admin-input`, die in keinem CSS definiert war — sie fielen auf Browser-Defaults zurück. Jetzt gestylt, gescoped, damit der generische Name nicht ins übrige Panel leckt. * Der Split View ist per Divider verschiebbar (Maus, Tastatur, Doppelklick zum Zurücksetzen), Breite in localStorage. * Das Studio bricht aus der 1120px-Spalte aus, die Preview hat Platz. * Die Preview zeigte für jedes Foto fest 3:2 und log damit über das Layout der veröffentlichten Seite; die echten Verhältnisse werden jetzt an den Thumbnails gemessen. * Blöcke mit alten positionsbasierten Foto-Referenzen werden markiert — die lassen sich auf einer eigenständigen Journal-Seite nicht auflösen und verschwanden bisher stillschweigend. * Blocktyp-Chips als gemeinsame Komponente, monochrom und per Icon unterschieden statt in einer eigenen Blau/Lila/Orange-Palette, die sonst nirgends im Panel vorkommt. * Emojis raus, SVG-Icons rein. * fix(admin): Designsystem-Lücken im Panel schließen Eine systematische Suche nach Klassen, die im TSX benutzt, aber in keinem CSS definiert sind, hat vier Stellen mit demselben Muster gefunden: * `admin-btn-secondary` und `admin-btn-danger` existierten nicht. Sämtliche Löschen-Buttons sahen aus wie normale Buttons — keine Warnwirkung. Als `.admin-btn.admin-btn-danger` geschrieben, weil die Varianten mit den Größenklassen kombiniert werden, die weiter unten ihren eigenen Hintergrund setzen. * `page-progress-fill` fehlte: die Balken im Analytics-Panel waren leere Rinnen, der Wert unsichtbar. Ebenso `analytics-empty` und `admin-loading-container`. * `subpage-drawer-section`, `subpage-drawer-title-group` und `input-with-icon` im PageBuilder waren wirkungslos und teils mit Inline-Styles notdürftig kompensiert. * `grid-card-preview` fehlte, wodurch alle Layout-Vorschauen auf Höhe null kollabierten. Nur "Showcase" war sichtbar — und das aus Versehen, weil sein Tile `hero-tile` hieß und damit die `aspect-ratio` einer fremden PageBuilder-Klasse erbte. Umbenannt. Dazu die Theme-Vorschauen, die praktisch identisch aussahen: alle sieben zeigten dieselben drei quadratischen Kacheln, einziger Unterschied war die Hintergrundfarbe. Sie spiegeln jetzt die echten Preset-Daten aus lib/config/theme.ts — Schriftcharakter, Eckradius, Rasterdichte, Passepartout bzw. Schatten. Die Kopfzeile richtet sich an einer gemeinsamen Steuerhöhe aus. Der "Site"-Link war höher als die Buttons daneben: `.admin-btn` hatte keine explizite line-height, und <button> bekommt box-sizing: border-box vom Browser, <a> nicht. Die Statusanzeige setzte weder Schriftfamilie noch -größe und fiel auf den Browser-Default zurück — sie war nie Teil des Designsystems. Jetzt gleiche Höhe und Typografie, Pillenform als Zustandsanzeige, Trenner zur Aktionsgruppe. Das dauerhafte Pulsieren des grünen Punkts entfällt; Animation bleibt den Zuständen vorbehalten, die Aufmerksamkeit brauchen. Restliche Emojis durch SVG-Icons ersetzt. * feat(admin): add scroll-to-top toggle and SVG arrow The back-to-top button was always on and drew its arrow with the ↑ text character. Add a `scrollToTop` setting (General section in the admin panel, defaults to on so existing sites are unaffected) and replace the glyph with a stroked SVG that inherits currentColor across all presets. Scroll handling is now rAF-throttled, and prefers-reduced-motion turns off both the hover lift and the smooth scroll. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * security(journal): escape author HTML instead of filtering it CodeQL flags 26 high-severity alerts on the release PR; the bulk of them point at sanitizeHtml(), a denylist of three regexes whose output goes into dangerouslySetInnerHTML. I reproduced the bypasses before changing anything — all four pass the old filter: <img src=x onerror=alert(1)> unquoted handler, regex wants quotes <img src=x onerror='alert(1)'> single quotes, same reason <svg onload=alert(1)> not a <script> tag javasjavascript:cript:alert(1) one-pass replace, the rest recombines Plus an attribute breakout in the link renderer, which interpolated the URL into href="${url}" unescaped: [x](" onmouseover=alert(1) x=") -> <a href="" onmouseover=alert(1" ...> Replaced with escaping. Every `&<>"'` in author text becomes an entity before any markdown rule runs, so the only tags in the output are the ones renderInlineMarkdown builds itself and a URL cannot leave its attribute. Link schemes are now an allowlist (http, https, mailto, tel, relative, anchor); anything else renders as plain text. The serializer needed decodeHtmlEntities to match: without it a save would write `&lt;` into the Markdown file and the next parse would escape the `&` again, corrupting the text further on every round trip. A test covers parse -> serialize -> parse stability. Two existing tests asserted the old behaviour and were rewritten rather than deleted: one expected the script tag to be *removed* from the output, the other expected the substring "onerror" to be absent. Both now assert the property that matters — that no tag can form — because `onerror` surviving as inert text is fine. Exploitation required admin access either way: journal and essay text comes from the studio or from content/*.md. This removes the weakness, it does not close an open door. * fix(journal): contain file paths, fix frontmatter escaping, defuse two regexes Follow-up to the CodeQL findings on release PR #432. I went through all 23 alerts individually; this addresses the ones that are worth addressing and documents the ones that are not. Path containment (12 alerts, all false positives). Every path built from a slug goes through isValidSlug(), a strict `/^[a-zA-Z0-9_-]+$/` allowlist — verified against `../../etc/passwd`, `foo/../../bar`, `a/b`, `..` and friends, all rejected. CodeQL cannot see it because the check lives in another module. Added a containedPath() helper that resolves the path and refuses anything landing outside the content directory: a second lock on a door that was already locked, and a barrier the analysis can follow. Also removed the dead `slug.endsWith('.md')` branches — isValidSlug rejects dots, so they could never be taken. Frontmatter escaping (1 alert, a real bug). The serializer escaped `"` but not `\`, and the parser never unescaped anything. A title containing either character gained a backslash on every save/load cycle: Path C:\Users "quoted" -> Path C:\\Users \"quoted\" -> ... Escaping now covers the backslash first and the parser undoes both. A round trip test covers quotes, backslashes, colons and apostrophes. Two of three ReDoS regexes (2 alerts). The heading pattern had `\s+` next to `(.+)`, which overlap, so the engine tried every split of the whitespace run before failing; it is `[ \t]+` and `(\S.*)` now. The quote author pattern wrapped a lazy group around an optional group — the quadratic case — and is an index split on the first separator now. The third regex, the bold/italic pass, is deliberately left alone. Rewriting it with a negated class removes the backtracking but breaks nesting: `**bold *and italic* here**` renders as `*<em>bold </em>and italic<em> here</em>*`. The input is Markdown from an authenticated admin, never a visitor, so the worst case is an author slowing down their own page. The comment in the code says so. Not addressed: 5 js/insufficient-password-hash alerts. They ask for a slow KDF where the code uses SHA-256/HMAC — correct in general, but the admin password comes from an environment variable and is never stored, so a stronger KDF protects nothing that is not already in plaintext in the environment. 399 unit tests pass (18 new), build and tsc clean. * fix(journal): split the quote author by scanning, not by pattern Cleaning up after myself. #439 replaced the quote author regex `/^(.*?)(?:\s+--\s+(.+))?$/` — a lazy group around an optional one, the quadratic case — with `/\s+--\s+/`, and CodeQL promptly flagged the replacement for the same reason. One reported pattern traded for another. splitQuoteAuthor() scans for the first `--` that has whitespace on both sides. Linear, and it needs no reasoning about the regex engine at all. Behaviour is identical to the original regex, checked case by case against it: separator, no separator, several separators, tabs, wide gaps, `a--b` without spaces, leading and trailing separators, empty string. All nine are covered by tests, plus one asserting it stays fast on a 50k whitespace run. * security(admin): derive the session signing key with scrypt getSigningKey() ran the admin password through a single SHA-256 digest. It is key derivation rather than password storage, so it was never a stored-hash problem — but if the derived key ever leaked, one fast hash makes recovering the password by brute force cheap. CodeQL flags it as js/insufficient-password-hash and, for this particular alert, has a point. scrypt now. Two details that matter: The salt has to be stable. A random salt would produce a different key on every call and invalidate every session; it is derived from AUTH_SECRET, which is deployment-specific. Verified across separate processes: same inputs produce a verifying token, so a restart or redeploy does not log everyone out. The result is cached for the process lifetime. scrypt is deliberately slow and getSigningKey() runs on every admin request — deriving per call would add ~24ms to each one. The cache key is a digest of secret plus password, so a rotation misses the cache and derives again, and no extra plaintext copy of the password is kept around. Measured: first derivation 24ms, subsequent calls 0.12ms. Password change and secret change both invalidate an existing token, checked in separate processes. Note the one-time effect: existing admin sessions are invalidated by the change in derivation, so everyone logs in once more. * security(admin): key the signing-key cache on its inputs, not a digest #441 removed the SHA-256 digest of the admin password from the key derivation and introduced a new one three lines above it, as the cache key. Same rule, same file: CodeQL reported it immediately. The comment justifying it was wrong too. It claimed no second plaintext copy of the password was retained, while building the digest input allocates exactly that in order to hash it. The cache now holds the two input strings and compares them directly. They are the same objects the env and install caches already hold, so nothing extra is retained, and no fast hash of the password exists in memory for the life of the process. Re-verified after the change, in separate processes: a token from one process verifies in another with the same inputs, a changed password or secret rejects it, first derivation 24ms, cached calls 0.001ms. That leaves scrypt as the only place the password is hashed here. The two HMACs further down operate on the derived key and on token data, not on the password; the constant-time comparison in verifyAdminPassword is the previously dismissed one. --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
2026-08-14 16:55:07 +02:00
[data-theme='light'] .admin-layout,
[data-theme='light'] .admin-listbox-popup {
fix: admin panel light/dark theme support, improved contrast, and backup confirmation a) Admin panel now respects the site's light/dark theme toggle via CSS custom properties that respond to [data-theme='light'] on <html>. All hardcoded dark colors replaced with semantic CSS variables. b) Improved contrast in dark mode: secondary text changed from #666/#555 to #a0a0a0, muted text from #555 to #707070. All text is now clearly readable against dark backgrounds. c) Backup system was already implemented in yaml-service.ts (creates timestamped backups in content/.backups/ before each save, keeps last 10 versions). Now the UI shows a confirmation message that a backup was created after each successful save.
2026-05-29 17:20:56 +02:00
--admin-bg: #f8f8f8;
--admin-bg-raised: #ffffff;
--admin-bg-elevated: #f0f0f0;
--admin-bg-input: #ffffff;
--admin-border: #e0e0e0;
--admin-border-hover: #c0c0c0;
--admin-border-focus: #999999;
--admin-text: #1a1a1a;
--admin-text-secondary: #555555;
--admin-text-muted: #888888;
--admin-accent: #d97706;
--admin-success: #16a34a;
--admin-error: #dc2626;
--admin-error-bg: #fef2f2;
--admin-error-border: #fecaca;
--admin-btn-primary-bg: #1a1a1a;
--admin-btn-primary-text: #ffffff;
--admin-btn-primary-hover: #333333;
--admin-overlay: rgba(0, 0, 0, 0.4);
}
feat: add visual admin panel with page builder and settings editor - Add /admin route with password-protected visual page builder - Page Builder: manage hero images, standalone albums, subpages, and sections - Album Picker: browse all shared Immich albums with search and filtering - Settings Editor: theme, grid, footer, legal, SEO configuration - YAML service with atomic writes and automatic backups (content/.backups/) - HMAC-signed admin sessions (24h expiry, HttpOnly cookies) - API endpoints: /api/admin/{auth,gallery,settings,albums,reload} - Enable with ADMIN_PASSWORD env var; disabled by default - invalidateConfigCache() export for hot-reload after saves
2026-05-29 17:04:37 +02:00
.admin-layout {
min-height: 100vh;
fix: admin panel light/dark theme support, improved contrast, and backup confirmation a) Admin panel now respects the site's light/dark theme toggle via CSS custom properties that respond to [data-theme='light'] on <html>. All hardcoded dark colors replaced with semantic CSS variables. b) Improved contrast in dark mode: secondary text changed from #666/#555 to #a0a0a0, muted text from #555 to #707070. All text is now clearly readable against dark backgrounds. c) Backup system was already implemented in yaml-service.ts (creates timestamped backups in content/.backups/ before each save, keeps last 10 versions). Now the UI shows a confirmation message that a backup was created after each successful save.
2026-05-29 17:20:56 +02:00
background: var(--admin-bg);
color: var(--admin-text);
feat: add visual admin panel with page builder and settings editor - Add /admin route with password-protected visual page builder - Page Builder: manage hero images, standalone albums, subpages, and sections - Album Picker: browse all shared Immich albums with search and filtering - Settings Editor: theme, grid, footer, legal, SEO configuration - YAML service with atomic writes and automatic backups (content/.backups/) - HMAC-signed admin sessions (24h expiry, HttpOnly cookies) - API endpoints: /api/admin/{auth,gallery,settings,albums,reload} - Enable with ADMIN_PASSWORD env var; disabled by default - invalidateConfigCache() export for hot-reload after saves
2026-05-29 17:04:37 +02:00
font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', system-ui, sans-serif;
}
/* ── Loading / Disabled ─────────────────────────────────────── */
.admin-loading {
min-height: 100vh;
display: flex;
align-items: center;
justify-content: center;
}
.admin-spinner {
width: 24px;
height: 24px;
fix: admin panel light/dark theme support, improved contrast, and backup confirmation a) Admin panel now respects the site's light/dark theme toggle via CSS custom properties that respond to [data-theme='light'] on <html>. All hardcoded dark colors replaced with semantic CSS variables. b) Improved contrast in dark mode: secondary text changed from #666/#555 to #a0a0a0, muted text from #555 to #707070. All text is now clearly readable against dark backgrounds. c) Backup system was already implemented in yaml-service.ts (creates timestamped backups in content/.backups/ before each save, keeps last 10 versions). Now the UI shows a confirmation message that a backup was created after each successful save.
2026-05-29 17:20:56 +02:00
border: 2px solid var(--admin-border);
border-top-color: var(--admin-text);
feat: add visual admin panel with page builder and settings editor - Add /admin route with password-protected visual page builder - Page Builder: manage hero images, standalone albums, subpages, and sections - Album Picker: browse all shared Immich albums with search and filtering - Settings Editor: theme, grid, footer, legal, SEO configuration - YAML service with atomic writes and automatic backups (content/.backups/) - HMAC-signed admin sessions (24h expiry, HttpOnly cookies) - API endpoints: /api/admin/{auth,gallery,settings,albums,reload} - Enable with ADMIN_PASSWORD env var; disabled by default - invalidateConfigCache() export for hot-reload after saves
2026-05-29 17:04:37 +02:00
border-radius: 50%;
animation: spin 0.6s linear infinite;
}
@keyframes spin {
to {
transform: rotate(360deg);
}
}
.admin-disabled {
min-height: 100vh;
display: flex;
align-items: center;
justify-content: center;
padding: 2rem;
}
.admin-disabled-card {
max-width: 420px;
text-align: center;
}
.admin-disabled-card h1 {
font-size: 1.5rem;
margin-bottom: 0.75rem;
}
.admin-disabled-card code {
fix: admin panel light/dark theme support, improved contrast, and backup confirmation a) Admin panel now respects the site's light/dark theme toggle via CSS custom properties that respond to [data-theme='light'] on <html>. All hardcoded dark colors replaced with semantic CSS variables. b) Improved contrast in dark mode: secondary text changed from #666/#555 to #a0a0a0, muted text from #555 to #707070. All text is now clearly readable against dark backgrounds. c) Backup system was already implemented in yaml-service.ts (creates timestamped backups in content/.backups/ before each save, keeps last 10 versions). Now the UI shows a confirmation message that a backup was created after each successful save.
2026-05-29 17:20:56 +02:00
background: var(--admin-bg-raised);
feat: add visual admin panel with page builder and settings editor - Add /admin route with password-protected visual page builder - Page Builder: manage hero images, standalone albums, subpages, and sections - Album Picker: browse all shared Immich albums with search and filtering - Settings Editor: theme, grid, footer, legal, SEO configuration - YAML service with atomic writes and automatic backups (content/.backups/) - HMAC-signed admin sessions (24h expiry, HttpOnly cookies) - API endpoints: /api/admin/{auth,gallery,settings,albums,reload} - Enable with ADMIN_PASSWORD env var; disabled by default - invalidateConfigCache() export for hot-reload after saves
2026-05-29 17:04:37 +02:00
padding: 0.2em 0.5em;
border-radius: 4px;
font-size: 0.85em;
fix: admin panel light/dark theme support, improved contrast, and backup confirmation a) Admin panel now respects the site's light/dark theme toggle via CSS custom properties that respond to [data-theme='light'] on <html>. All hardcoded dark colors replaced with semantic CSS variables. b) Improved contrast in dark mode: secondary text changed from #666/#555 to #a0a0a0, muted text from #555 to #707070. All text is now clearly readable against dark backgrounds. c) Backup system was already implemented in yaml-service.ts (creates timestamped backups in content/.backups/ before each save, keeps last 10 versions). Now the UI shows a confirmation message that a backup was created after each successful save.
2026-05-29 17:20:56 +02:00
color: var(--admin-accent);
feat: add visual admin panel with page builder and settings editor - Add /admin route with password-protected visual page builder - Page Builder: manage hero images, standalone albums, subpages, and sections - Album Picker: browse all shared Immich albums with search and filtering - Settings Editor: theme, grid, footer, legal, SEO configuration - YAML service with atomic writes and automatic backups (content/.backups/) - HMAC-signed admin sessions (24h expiry, HttpOnly cookies) - API endpoints: /api/admin/{auth,gallery,settings,albums,reload} - Enable with ADMIN_PASSWORD env var; disabled by default - invalidateConfigCache() export for hot-reload after saves
2026-05-29 17:04:37 +02:00
}
/* ── Login ─────────────────────────────────────────────────── */
.admin-login {
min-height: 100vh;
display: flex;
align-items: center;
justify-content: center;
padding: 2rem;
}
.admin-login-card {
width: 100%;
max-width: 360px;
fix: admin panel light/dark theme support, improved contrast, and backup confirmation a) Admin panel now respects the site's light/dark theme toggle via CSS custom properties that respond to [data-theme='light'] on <html>. All hardcoded dark colors replaced with semantic CSS variables. b) Improved contrast in dark mode: secondary text changed from #666/#555 to #a0a0a0, muted text from #555 to #707070. All text is now clearly readable against dark backgrounds. c) Backup system was already implemented in yaml-service.ts (creates timestamped backups in content/.backups/ before each save, keeps last 10 versions). Now the UI shows a confirmation message that a backup was created after each successful save.
2026-05-29 17:20:56 +02:00
background: var(--admin-bg-raised);
border: 1px solid var(--admin-border);
feat: add visual admin panel with page builder and settings editor - Add /admin route with password-protected visual page builder - Page Builder: manage hero images, standalone albums, subpages, and sections - Album Picker: browse all shared Immich albums with search and filtering - Settings Editor: theme, grid, footer, legal, SEO configuration - YAML service with atomic writes and automatic backups (content/.backups/) - HMAC-signed admin sessions (24h expiry, HttpOnly cookies) - API endpoints: /api/admin/{auth,gallery,settings,albums,reload} - Enable with ADMIN_PASSWORD env var; disabled by default - invalidateConfigCache() export for hot-reload after saves
2026-05-29 17:04:37 +02:00
border-radius: 12px;
padding: 2rem;
}
.admin-login-header {
text-align: center;
margin-bottom: 1.5rem;
}
.admin-login-header h1 {
font-size: 1.25rem;
font-weight: 600;
margin: 0;
}
.admin-login-header p {
fix: admin panel light/dark theme support, improved contrast, and backup confirmation a) Admin panel now respects the site's light/dark theme toggle via CSS custom properties that respond to [data-theme='light'] on <html>. All hardcoded dark colors replaced with semantic CSS variables. b) Improved contrast in dark mode: secondary text changed from #666/#555 to #a0a0a0, muted text from #555 to #707070. All text is now clearly readable against dark backgrounds. c) Backup system was already implemented in yaml-service.ts (creates timestamped backups in content/.backups/ before each save, keeps last 10 versions). Now the UI shows a confirmation message that a backup was created after each successful save.
2026-05-29 17:20:56 +02:00
color: var(--admin-text-secondary);
feat: add visual admin panel with page builder and settings editor - Add /admin route with password-protected visual page builder - Page Builder: manage hero images, standalone albums, subpages, and sections - Album Picker: browse all shared Immich albums with search and filtering - Settings Editor: theme, grid, footer, legal, SEO configuration - YAML service with atomic writes and automatic backups (content/.backups/) - HMAC-signed admin sessions (24h expiry, HttpOnly cookies) - API endpoints: /api/admin/{auth,gallery,settings,albums,reload} - Enable with ADMIN_PASSWORD env var; disabled by default - invalidateConfigCache() export for hot-reload after saves
2026-05-29 17:04:37 +02:00
margin: 0.25rem 0 0;
font-size: 0.875rem;
}
/* ── Fields ─────────────────────────────────────────────────── */
.admin-field {
margin-bottom: 0.75rem;
}
.admin-field label {
display: block;
font-size: 0.75rem;
font-weight: 500;
fix: admin panel light/dark theme support, improved contrast, and backup confirmation a) Admin panel now respects the site's light/dark theme toggle via CSS custom properties that respond to [data-theme='light'] on <html>. All hardcoded dark colors replaced with semantic CSS variables. b) Improved contrast in dark mode: secondary text changed from #666/#555 to #a0a0a0, muted text from #555 to #707070. All text is now clearly readable against dark backgrounds. c) Backup system was already implemented in yaml-service.ts (creates timestamped backups in content/.backups/ before each save, keeps last 10 versions). Now the UI shows a confirmation message that a backup was created after each successful save.
2026-05-29 17:20:56 +02:00
color: var(--admin-text-secondary);
feat: add visual admin panel with page builder and settings editor - Add /admin route with password-protected visual page builder - Page Builder: manage hero images, standalone albums, subpages, and sections - Album Picker: browse all shared Immich albums with search and filtering - Settings Editor: theme, grid, footer, legal, SEO configuration - YAML service with atomic writes and automatic backups (content/.backups/) - HMAC-signed admin sessions (24h expiry, HttpOnly cookies) - API endpoints: /api/admin/{auth,gallery,settings,albums,reload} - Enable with ADMIN_PASSWORD env var; disabled by default - invalidateConfigCache() export for hot-reload after saves
2026-05-29 17:04:37 +02:00
margin-bottom: 0.3rem;
text-transform: uppercase;
letter-spacing: 0.03em;
}
.admin-field input,
.admin-field select,
.admin-field textarea {
width: 100%;
padding: 0.6rem 0.75rem;
fix: admin panel light/dark theme support, improved contrast, and backup confirmation a) Admin panel now respects the site's light/dark theme toggle via CSS custom properties that respond to [data-theme='light'] on <html>. All hardcoded dark colors replaced with semantic CSS variables. b) Improved contrast in dark mode: secondary text changed from #666/#555 to #a0a0a0, muted text from #555 to #707070. All text is now clearly readable against dark backgrounds. c) Backup system was already implemented in yaml-service.ts (creates timestamped backups in content/.backups/ before each save, keeps last 10 versions). Now the UI shows a confirmation message that a backup was created after each successful save.
2026-05-29 17:20:56 +02:00
background: var(--admin-bg-input);
border: 1px solid var(--admin-border);
feat: add visual admin panel with page builder and settings editor - Add /admin route with password-protected visual page builder - Page Builder: manage hero images, standalone albums, subpages, and sections - Album Picker: browse all shared Immich albums with search and filtering - Settings Editor: theme, grid, footer, legal, SEO configuration - YAML service with atomic writes and automatic backups (content/.backups/) - HMAC-signed admin sessions (24h expiry, HttpOnly cookies) - API endpoints: /api/admin/{auth,gallery,settings,albums,reload} - Enable with ADMIN_PASSWORD env var; disabled by default - invalidateConfigCache() export for hot-reload after saves
2026-05-29 17:04:37 +02:00
border-radius: 6px;
fix: admin panel light/dark theme support, improved contrast, and backup confirmation a) Admin panel now respects the site's light/dark theme toggle via CSS custom properties that respond to [data-theme='light'] on <html>. All hardcoded dark colors replaced with semantic CSS variables. b) Improved contrast in dark mode: secondary text changed from #666/#555 to #a0a0a0, muted text from #555 to #707070. All text is now clearly readable against dark backgrounds. c) Backup system was already implemented in yaml-service.ts (creates timestamped backups in content/.backups/ before each save, keeps last 10 versions). Now the UI shows a confirmation message that a backup was created after each successful save.
2026-05-29 17:20:56 +02:00
color: var(--admin-text);
feat: add visual admin panel with page builder and settings editor - Add /admin route with password-protected visual page builder - Page Builder: manage hero images, standalone albums, subpages, and sections - Album Picker: browse all shared Immich albums with search and filtering - Settings Editor: theme, grid, footer, legal, SEO configuration - YAML service with atomic writes and automatic backups (content/.backups/) - HMAC-signed admin sessions (24h expiry, HttpOnly cookies) - API endpoints: /api/admin/{auth,gallery,settings,albums,reload} - Enable with ADMIN_PASSWORD env var; disabled by default - invalidateConfigCache() export for hot-reload after saves
2026-05-29 17:04:37 +02:00
font-size: 0.875rem;
transition: border-color 0.15s;
}
.admin-field input:focus,
.admin-field select:focus,
.admin-field textarea:focus {
outline: none;
fix: admin panel light/dark theme support, improved contrast, and backup confirmation a) Admin panel now respects the site's light/dark theme toggle via CSS custom properties that respond to [data-theme='light'] on <html>. All hardcoded dark colors replaced with semantic CSS variables. b) Improved contrast in dark mode: secondary text changed from #666/#555 to #a0a0a0, muted text from #555 to #707070. All text is now clearly readable against dark backgrounds. c) Backup system was already implemented in yaml-service.ts (creates timestamped backups in content/.backups/ before each save, keeps last 10 versions). Now the UI shows a confirmation message that a backup was created after each successful save.
2026-05-29 17:20:56 +02:00
border-color: var(--admin-border-focus);
feat: add visual admin panel with page builder and settings editor - Add /admin route with password-protected visual page builder - Page Builder: manage hero images, standalone albums, subpages, and sections - Album Picker: browse all shared Immich albums with search and filtering - Settings Editor: theme, grid, footer, legal, SEO configuration - YAML service with atomic writes and automatic backups (content/.backups/) - HMAC-signed admin sessions (24h expiry, HttpOnly cookies) - API endpoints: /api/admin/{auth,gallery,settings,albums,reload} - Enable with ADMIN_PASSWORD env var; disabled by default - invalidateConfigCache() export for hot-reload after saves
2026-05-29 17:04:37 +02:00
}
.admin-field textarea {
resize: vertical;
min-height: 60px;
}
release: v0.11.0 — journal fixes, admin URLs, design system cleanup (#432) * fix(screenshots): sharp-Typen fuer 0.34 und 0.35 gleichzeitig (#410) sharp 0.35 ist von `export =` auf ESM umgestellt: der Modul-Namespace ist nicht mehr aufrufbar, die Factory sitzt unter .default. Der Type-Check brach damit in scripts/screenshots.ts weg, sobald der Next-Bump (#402) sharp von 0.34.5 auf 0.35.3 mitzieht -- sharp ist hier keine deklarierte Dependency, sondern kommt ueber Next mit. Die Form wird jetzt aus dem installierten Paket abgeleitet statt festgeschrieben, zur Laufzeit wie im Typ. Geprueft mit beiden Versionen: tsc laeuft mit 0.34.5 und mit 0.35.3 fehlerfrei durch. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(deps): bump the nextjs group across 1 directory with 2 updates (#402) Bumps the nextjs group with 2 updates in the / directory: [next](https://github.com/vercel/next.js) and [eslint-config-next](https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next). Updates `next` from 16.2.12 to 16.3.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/compare/v16.2.12...v16.3.0) Updates `eslint-config-next` from 16.2.12 to 16.3.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/commits/v16.3.0/packages/eslint-config-next) --- updated-dependencies: - dependency-name: eslint-config-next dependency-version: 16.3.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: nextjs - dependency-name: next dependency-version: 16.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nextjs ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps-dev): bump prettier from 3.8.3 to 3.9.6 (#405) Bumps [prettier](https://github.com/prettier/prettier) from 3.8.3 to 3.9.6. - [Release notes](https://github.com/prettier/prettier/releases) - [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md) - [Commits](https://github.com/prettier/prettier/compare/3.8.3...3.9.6) --- updated-dependencies: - dependency-name: prettier dependency-version: 3.9.6 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * docs(changelog): Unreleased-Sektion fuer die Bumps nach v0.10.0 (#413) Die Dependency-PRs sind nach dem Release auf dev gelandet, teils auch auf main. Ohne Eintrag waeren sie beim naechsten Release unsichtbar -- inklusive Next 16.3.0, das CVE-2025-13465 mitbringt. Ausserdem im 0.10.0-Abschnitt nachgetragen, dass der Trivy-Scan bis #409 nie gelaufen ist. Der Fix steckt im Tag v0.10.0, fehlte aber in der Aufzaehlung -- und "Images werden bei jedem Publish gescannt" stand im Changelog, waehrend der Job im Action-Setup abbrach. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(gallery): per-album sort order, independent of Immich (#408) (#414) Album order was dictated entirely by Immich: getAlbum() sorted by the album's own asc/desc flag, so a Folio album always mirrored the archive. A curated series has a narrative order that has nothing to do with capture time, and changing the Immich album's sort to fit the website changes it for the archive too. Adds an optional per-album `sort` in gallery.yaml, editable in /admin, defaulting to today's behaviour so every existing config is unchanged: immich (default) | newest | oldest | filename | manual `manual` is a pinned *prefix*: `assetOrder` lists only the photos placed by hand, everything else follows in the album's Immich order. A full permutation of a 2,000-photo album would be ~80 KB of UUIDs in a file that is rewritten and copied to content/.backups/ on every admin save. It also makes drift fall out for free — photos removed in Immich never match, new ones land in the tail rather than being hidden. Sorting is applied after the cache read, not before the cache write, so the LRU keeps one canonical Immich-ordered copy per album. That avoids putting the mode in the cache key, lets a config change take effect without depending on invalidation, and keeps the stale-serving path correct. cache.get() returns the stored object by reference, so withSort() returns a shallow clone with a new array — sorting in place would reorder the shared entry, and under request coalescing every concurrent caller would be sorting the same array. Also fixes a prerequisite bug: /api/admin/albums/[albumId]/assets read album.assets from GET /albums/:id, which Immich 3.x no longer populates (lib/immich.ts:507). The hero picker's "This Album" tab returned nothing and threw outright when the key was absent. It now goes through the client's paginated metadata search, with ?types=all to opt videos in for the reorder editor. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): drop decorative emoji from the sort select labels (#415) An <option> cannot contain markup, so the SVG set in Icons is not reachable there — but a decorative emoji is not a substitute for it. Plain text instead; the album card badge already uses a real icon. The remaining emoji in the admin panel (asset picker tabs, section headings, layout picker options) predate this branch and are left for a separate cleanup. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): replace emoji icons with the shared SVG icon set (#416) The admin panel mixed two icon conventions: inline SVGs from `Icons.tsx` in most components, and decorative emoji in the asset picker and a few PageBuilder labels. Emoji render inconsistently across platforms, ignore the accent colour, and cannot inherit the `.svg-icon` sizing rules. - Icons.tsx: add `IconStar` (filled — it marks a state, not an action) and `IconImage`. - AssetPicker: the three tab labels and the favourite tile badge now use IconFolder / IconStar / IconImage. - PageBuilder: the "Standalone Albums" and "Subpages" headings use the icon set instead of an emoji. - PageBuilder: the layout picker drops its emoji for plain text. An <option> cannot contain markup, so an SVG is impossible there and a decorative glyph is not a substitute. - admin.css: align icon and label in the picker tabs, and swap the favourite badge's text-shadow for drop-shadow, which is what applies to an inline SVG. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): fold PageBuilder's local icons into the shared Icons module (#418) * refactor(admin): fold PageBuilder's local icons into the shared module PageBuilder.tsx carried its own `Icons` object duplicating most of the glyphs already exported by Icons.tsx, with hardcoded sizes and slightly divergent paths. Migrate all 32 call sites to the shared module and delete the local object. Five glyphs had no counterpart and are added to Icons.tsx as 1:1 ports of the local paths: IconX, IconPlus, IconHome, IconCopy, IconImage. The local ExternalLink and Check are dropped rather than ported — both had zero call sites. Two glyphs change shape slightly, which is the point of consolidating: the shared IconCamera includes the viewfinder bump the local copy omitted, and drag handles now use IconGripVertical. IconGripVertical uses the module's square 24x24 viewBox, so `.svg-drag` goes from 12x18 to 18x18 — the old non-square box would letterbox the glyph down to 12x12 and shrink the handle. * fix(admin): resolve icon-module integration after #416 Merging dev brought in #416, which added a second IconImage to Icons.tsx and two <Icons.Camera>/<Icons.Folder> section headers that reference the local Icons object this PR removes. Git merged both cleanly but the result did not type-check. - drop the duplicate IconImage (both copies were byte-identical) - point the two section headers at the imported IconCamera/IconFolder - refresh the SORT_LABELS comment: the icon set is imported now, not declared below --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> * fix(config): allow an empty gallery, guard against a double /api suffix (#421) An empty gallery is now a valid, rendered state instead of a throw: deriveGallery() no longer requires at least one album or subpage, so a deployment with no albums yet renders a bare homepage the owner can fill in via /admin. getConfig() also stops appending /api to an Immich URL that already ends in it, which previously produced .../api/api and broke every upstream request. Includes a restore of the per-album sort test cases, which the branch had lost by being cut before #408/#414. * feat(admin): favicon upload, served from the content volume (#422) Adds a bundled default favicon, an upload widget in admin Settings > General, and a route that serves the icon from the writable content/ volume with a fallback to the bundled default. Raster uploads (PNG/ICO/JPEG) are wrapped in an SVG container; the response carries its own CSP so an uploaded SVG cannot execute script on the origin. The GET route revalidates with an ETag instead of caching immutably, so a newly uploaded icon shows up immediately. Uploads are written via temp file + rename, and a Reset button restores the bundled default. * ci: flag unformatted files in a PR, without blocking it (#424) Prettier is configured as an error rule in eslint.config.mjs but has never run in CI, so part of the tree predates it. A final CI step now diffs against the PR base, runs prettier --list-different over the changed files, and emits a warning annotation per offender plus a job summary. Advisory by design: it never fails the job. Blocking would turn a PR red for merely touching a file that was already unformatted, and normalising the tree in one commit would wreck git blame and conflict with the PRs in flight. Requires fetch-depth: 0, since diffing against the base needs its history. * feat(install): first-run wizard gated by a one-time setup token (#419) Adds /install, a four-step first-run wizard: connect to Immich, optionally pick albums, name the site, finish. It verifies the credentials against the Immich server before writing anything, then writes gallery.yaml, settings.yaml and a content/install.json carrying the Immich credentials and a generated site secret. install.json exists because a running process cannot pick up new env vars — the wizard has to write configuration that takes effect without a restart. getInstallCredentials() merges it under the real environment, so env vars always win and rotation stays a matter of setting one. Both the page and the API routes are gated by a one-time setup token printed to the server log, so a deployment that is reachable before gallery.yaml exists cannot be configured by whoever finds it first. The token is stored in content/.setup-token (0600) rather than a module variable: Next.js bundles the page and each route handler separately, so a module-level token left the page and the API disagreeing inside one process and the wizard stuck on step 1. It is removed once the install completes. The admin password is stored as an scrypt hash using the scheme lib/auth.ts already applies to album passwords; a plaintext ADMIN_PASSWORD env var keeps working. * docs: document the setup wizard, fix the read-only content mount (#425) Quick Start now leads with the /install wizard, with the hand-written YAML route kept alongside it, and a First-Run Setup section covers the setup token, the files the wizard writes, and env-var precedence. Two corrections: both Docker examples mounted content/ as :ro, which silently breaks the wizard, the admin panel and the backup rotation alike — docs/admin-panel.md already said so and the README contradicted it. And nothing documented that content/install.json holds the Immich API key, so a backup of content/ is a backup of credentials. Also adds a Contributors section crediting the people whose work is in the project. * feat(admin): floating save bar pinned to the bottom of the viewport (#426) The save bar was the first, static element inside .admin-main. Since the document itself scrolls, it left the viewport as soon as you scrolled down — editing a subpage section or a settings block far below gave no visible dirty hint and no reachable save button. Replace it with a bottom-pinned floating bar shared by both editors. It only mounts while there is something to act on (unsaved changes, an in-flight save, or a result message), so it never covers content while idle. The success message clears after 5s, which hides the bar again. - new SaveBar component, replacing the duplicated markup in PageBuilder and SettingsEditor - adopt the previously unused .floating-save-bar CSS: slide-in keyframes (carrying translateX(-50%)), dirty border, wrap/gap, mobile variant and a prefers-reduced-motion opt-out; z-index 900 keeps it below modals - .admin-main gains bottom padding so the bar never covers page content - drop the now-unreachable idle hints: the ⌘S hint becomes a button title, the Live Sync note becomes a static line above the settings layout - header "Site" link now bypasses the cache (/?fresh=1), so the preview stays reachable when the bar is hidden Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(admin): themed listbox for the album sort control (#427) The per-album "Photo order" control was a native <select>. Because an <option> cannot contain markup, its choices could not use the admin panel's currentColor SVG set — the reason #415 had to fall back to plain text after dropping the emoji labels. Adds a Listbox component implementing the ARIA combobox/listbox pattern, so options can render a glyph beside their label: - DOM focus stays on the trigger button; the active option is announced through aria-activedescendant, keeping focus management to one element - Keyboard: arrows (clamped at the ends, like a native select), Home/End, Enter/Space to commit, Escape to cancel, Tab commits and moves on, and prefix type-ahead with a repeat-key cycle - Outside dismissal on pointerdown, so a press starting outside closes the popup before the click retargets The sort options now carry an icon each: calendar, arrow-down, arrow-up, an A→Z marker, and the drag glyph for manual — matching the badge the album card already shows. SORT_LABELS stays plain text because the badge feeds it to a title attribute. Closes #417 Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(git): ignore generated design handoff folders * fix(admin): stop the album sort dropdown clipping, and simplify the panel (#428) * fix(admin): render listbox popup in a portal so it escapes modal clipping The sort control's popup was position:absolute inside three clipping ancestors (.album-drawer overflow:hidden > .album-drawer-body overflow-y:auto > .modal-right-column overflow-y:auto), so it was cut off at the bottom of the Edit Album Details modal. z-index could not help: clipping happens before stacking. It also always hung below the trigger, with no flip. Portal the popup to document.body and position it from the trigger's viewport rect, flipping above when there is more room there and capping max-height to the space available so it scrolls internally rather than overflowing. It is dismissed on scroll and resize, since the anchor is only measured on open. The outside-pointerdown handler now also treats the popup as inside; without that the portalled list counts as outside, and a click on an option would close it before the selection commits. * refactor(admin): single-column album details panel The left column spent 1.2fr on a cover thumbnail and three stat rows, two of which (Status, Custom Hero) only restated the form fields opposite them, while the form itself was squeezed into 1.8fr behind a second nested scroller. Stack the drawer in one column instead: cover as a banner, then the form at full width, with the UUID moved into the footer. The body is now the only scroll container, which also removes one of the ancestors that was clipping the sort popup. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> * fix(admin): give the portalled listbox its theme back, lock the page behind modals (#429) Two defects in the album editor. The sort listbox popup painted transparent. Every --admin-* variable is scoped to .admin-layout, and since the popup moved into document.body it sits outside that subtree, so background/border/text all resolved to nothing. It now carries its own copy of the palette in both colour schemes, plus the font it no longer inherits. Scrolling inside a modal also moved the page behind it. No admin modal ever locked body scroll: the overlay covers the page but does not absorb wheel events, so a scroll starting on the backdrop — or continuing past the end of the modal's own scroller — reaches the document. overscroll-behavior cannot cover that case on its own, because it only applies to scroll containers and the backdrop is not one. useScrollLock freezes body while a modal is open and compensates for the width the scrollbar gives up, so nothing shifts underneath. Each lock restores the inline value it found, which makes nesting work without a counter — a picker opened from the drawer restores the drawer's hidden state instead of clearing it. Applied to both drawers and all four picker modals, which share the defect. overscroll-behavior: contain on the scrollers stops the chaining they can handle themselves. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com> * fix(security): allow unsafe-eval in CSP script-src during dev mode * feat(journal): add Journal Studio with split-screen editor, live preview and dedicated routes * fix(build): separate client parser from server journal-service and fix build type errors * fix(journal): Fotos rendern, Layout und Lightbox-Steuerung korrigieren Fünf unabhängige Fehler in der öffentlichen Journal- und Essay-Ansicht: * Foto-Blöcke wurden nie angezeigt. EssayView löst ein Foto über PhotoItem.id auf, und das sind verschlüsselte Tokens — die Blöcke aus dem Markdown tragen aber rohe Asset-UUIDs. Jede Zuordnung lief ins Leere, und nicht auflösbare Blöcke werden still verworfen. Die IDs werden jetzt serverseitig übersetzt; damit verschwinden nebenbei die rohen UUIDs aus dem Client-Payload, die dort laut Projektregel nie auftauchen dürfen. Nicht auflösbare Referenzen werden geloggt. * Überschriften standen weiter links als der Fließtext. Jeder Block hatte einzeln `max-width: 68ch`, und `ch` ist relativ zur Schrift des Elements — die Serif-Überschrift ergab eine breitere Spalte. Ersetzt durch eine gemeinsame, font-unabhängige `--essay-measure`. * Fullbleed-Fotos bluteten nur nach links aus: `.essay-figure` ist `width: 100%`, wodurch die Box überbestimmt ist und der negative rechte Margin verworfen wird. * Foto-Paare stellten beide Bilder gleich breit dar, wodurch ein Hochformat neben einem Querformat doppelt so hoch wurde. Jetzt eine Justified-Reihe: Breite proportional zum Seitenverhältnis, dadurch exakt gleiche Höhen ohne Beschnitt. * Die Lightbox hatte im Journal keine Tastatursteuerung und keine Scroll-Sperre — beides lag in PhotoGrid, also nur im Album-Raster. Verlagert in die Lightbox selbst, der doppelte Handler in PhotoGrid entfernt (sonst wäre pro Pfeildruck zwei Bilder weitergesprungen). Zusätzlich sind Proofing-Herzen und das EXIF-Panel im redaktionellen Modus abschaltbar und im Journal aus: Client-Proofing ist ein Übergabe-Workflow für Alben, keine Funktion einer Reportage. Auf der Übersicht wurde der Untertitel doppelt gerendert, weil extractExcerpt() auf ihn zurückfällt. * feat(admin): eigene URLs für alle Bereiche und überarbeiteter Journal Studio Das Panel war eine einzige Client-Komponente, die ihre Tabs über useState umschaltet: keine Route pro Bereich, kein Deep-Link, kein Zurück-Button, und nach jedem Reload landete man wieder auf "Pages". Auch der Journal-Editor hatte keine eigene URL. Jetzt sieben echte Routen (/admin, /admin/pages, /admin/journal, /admin/journal/<slug>, /admin/settings, /admin/settings/<section>, /admin/analytics). Die Shell mit Auth-Prüfung und Kopfzeile sitzt im Layout und umschließt children — so bleibt die Session-Prüfung über Routenwechsel montiert, statt bei jedem Tab-Wechsel neu zu laufen und den Spinner aufblitzen zu lassen. Unbekannte Settings-Sections fallen auf General zurück. Im selben Zug der Journal Studio, der die Routing-Änderung ohnehin berührt: * Alle Eingabefelder nutzten die Klasse `admin-input`, die in keinem CSS definiert war — sie fielen auf Browser-Defaults zurück. Jetzt gestylt, gescoped, damit der generische Name nicht ins übrige Panel leckt. * Der Split View ist per Divider verschiebbar (Maus, Tastatur, Doppelklick zum Zurücksetzen), Breite in localStorage. * Das Studio bricht aus der 1120px-Spalte aus, die Preview hat Platz. * Die Preview zeigte für jedes Foto fest 3:2 und log damit über das Layout der veröffentlichten Seite; die echten Verhältnisse werden jetzt an den Thumbnails gemessen. * Blöcke mit alten positionsbasierten Foto-Referenzen werden markiert — die lassen sich auf einer eigenständigen Journal-Seite nicht auflösen und verschwanden bisher stillschweigend. * Blocktyp-Chips als gemeinsame Komponente, monochrom und per Icon unterschieden statt in einer eigenen Blau/Lila/Orange-Palette, die sonst nirgends im Panel vorkommt. * Emojis raus, SVG-Icons rein. * fix(admin): Designsystem-Lücken im Panel schließen Eine systematische Suche nach Klassen, die im TSX benutzt, aber in keinem CSS definiert sind, hat vier Stellen mit demselben Muster gefunden: * `admin-btn-secondary` und `admin-btn-danger` existierten nicht. Sämtliche Löschen-Buttons sahen aus wie normale Buttons — keine Warnwirkung. Als `.admin-btn.admin-btn-danger` geschrieben, weil die Varianten mit den Größenklassen kombiniert werden, die weiter unten ihren eigenen Hintergrund setzen. * `page-progress-fill` fehlte: die Balken im Analytics-Panel waren leere Rinnen, der Wert unsichtbar. Ebenso `analytics-empty` und `admin-loading-container`. * `subpage-drawer-section`, `subpage-drawer-title-group` und `input-with-icon` im PageBuilder waren wirkungslos und teils mit Inline-Styles notdürftig kompensiert. * `grid-card-preview` fehlte, wodurch alle Layout-Vorschauen auf Höhe null kollabierten. Nur "Showcase" war sichtbar — und das aus Versehen, weil sein Tile `hero-tile` hieß und damit die `aspect-ratio` einer fremden PageBuilder-Klasse erbte. Umbenannt. Dazu die Theme-Vorschauen, die praktisch identisch aussahen: alle sieben zeigten dieselben drei quadratischen Kacheln, einziger Unterschied war die Hintergrundfarbe. Sie spiegeln jetzt die echten Preset-Daten aus lib/config/theme.ts — Schriftcharakter, Eckradius, Rasterdichte, Passepartout bzw. Schatten. Die Kopfzeile richtet sich an einer gemeinsamen Steuerhöhe aus. Der "Site"-Link war höher als die Buttons daneben: `.admin-btn` hatte keine explizite line-height, und <button> bekommt box-sizing: border-box vom Browser, <a> nicht. Die Statusanzeige setzte weder Schriftfamilie noch -größe und fiel auf den Browser-Default zurück — sie war nie Teil des Designsystems. Jetzt gleiche Höhe und Typografie, Pillenform als Zustandsanzeige, Trenner zur Aktionsgruppe. Das dauerhafte Pulsieren des grünen Punkts entfällt; Animation bleibt den Zuständen vorbehalten, die Aufmerksamkeit brauchen. Restliche Emojis durch SVG-Icons ersetzt. * feat(admin): add scroll-to-top toggle and SVG arrow The back-to-top button was always on and drew its arrow with the ↑ text character. Add a `scrollToTop` setting (General section in the admin panel, defaults to on so existing sites are unaffected) and replace the glyph with a stroked SVG that inherits currentColor across all presets. Scroll handling is now rAF-throttled, and prefers-reduced-motion turns off both the hover lift and the smooth scroll. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * security(journal): escape author HTML instead of filtering it CodeQL flags 26 high-severity alerts on the release PR; the bulk of them point at sanitizeHtml(), a denylist of three regexes whose output goes into dangerouslySetInnerHTML. I reproduced the bypasses before changing anything — all four pass the old filter: <img src=x onerror=alert(1)> unquoted handler, regex wants quotes <img src=x onerror='alert(1)'> single quotes, same reason <svg onload=alert(1)> not a <script> tag javasjavascript:cript:alert(1) one-pass replace, the rest recombines Plus an attribute breakout in the link renderer, which interpolated the URL into href="${url}" unescaped: [x](" onmouseover=alert(1) x=") -> <a href="" onmouseover=alert(1" ...> Replaced with escaping. Every `&<>"'` in author text becomes an entity before any markdown rule runs, so the only tags in the output are the ones renderInlineMarkdown builds itself and a URL cannot leave its attribute. Link schemes are now an allowlist (http, https, mailto, tel, relative, anchor); anything else renders as plain text. The serializer needed decodeHtmlEntities to match: without it a save would write `&lt;` into the Markdown file and the next parse would escape the `&` again, corrupting the text further on every round trip. A test covers parse -> serialize -> parse stability. Two existing tests asserted the old behaviour and were rewritten rather than deleted: one expected the script tag to be *removed* from the output, the other expected the substring "onerror" to be absent. Both now assert the property that matters — that no tag can form — because `onerror` surviving as inert text is fine. Exploitation required admin access either way: journal and essay text comes from the studio or from content/*.md. This removes the weakness, it does not close an open door. * fix(journal): contain file paths, fix frontmatter escaping, defuse two regexes Follow-up to the CodeQL findings on release PR #432. I went through all 23 alerts individually; this addresses the ones that are worth addressing and documents the ones that are not. Path containment (12 alerts, all false positives). Every path built from a slug goes through isValidSlug(), a strict `/^[a-zA-Z0-9_-]+$/` allowlist — verified against `../../etc/passwd`, `foo/../../bar`, `a/b`, `..` and friends, all rejected. CodeQL cannot see it because the check lives in another module. Added a containedPath() helper that resolves the path and refuses anything landing outside the content directory: a second lock on a door that was already locked, and a barrier the analysis can follow. Also removed the dead `slug.endsWith('.md')` branches — isValidSlug rejects dots, so they could never be taken. Frontmatter escaping (1 alert, a real bug). The serializer escaped `"` but not `\`, and the parser never unescaped anything. A title containing either character gained a backslash on every save/load cycle: Path C:\Users "quoted" -> Path C:\\Users \"quoted\" -> ... Escaping now covers the backslash first and the parser undoes both. A round trip test covers quotes, backslashes, colons and apostrophes. Two of three ReDoS regexes (2 alerts). The heading pattern had `\s+` next to `(.+)`, which overlap, so the engine tried every split of the whitespace run before failing; it is `[ \t]+` and `(\S.*)` now. The quote author pattern wrapped a lazy group around an optional group — the quadratic case — and is an index split on the first separator now. The third regex, the bold/italic pass, is deliberately left alone. Rewriting it with a negated class removes the backtracking but breaks nesting: `**bold *and italic* here**` renders as `*<em>bold </em>and italic<em> here</em>*`. The input is Markdown from an authenticated admin, never a visitor, so the worst case is an author slowing down their own page. The comment in the code says so. Not addressed: 5 js/insufficient-password-hash alerts. They ask for a slow KDF where the code uses SHA-256/HMAC — correct in general, but the admin password comes from an environment variable and is never stored, so a stronger KDF protects nothing that is not already in plaintext in the environment. 399 unit tests pass (18 new), build and tsc clean. * fix(journal): split the quote author by scanning, not by pattern Cleaning up after myself. #439 replaced the quote author regex `/^(.*?)(?:\s+--\s+(.+))?$/` — a lazy group around an optional one, the quadratic case — with `/\s+--\s+/`, and CodeQL promptly flagged the replacement for the same reason. One reported pattern traded for another. splitQuoteAuthor() scans for the first `--` that has whitespace on both sides. Linear, and it needs no reasoning about the regex engine at all. Behaviour is identical to the original regex, checked case by case against it: separator, no separator, several separators, tabs, wide gaps, `a--b` without spaces, leading and trailing separators, empty string. All nine are covered by tests, plus one asserting it stays fast on a 50k whitespace run. * security(admin): derive the session signing key with scrypt getSigningKey() ran the admin password through a single SHA-256 digest. It is key derivation rather than password storage, so it was never a stored-hash problem — but if the derived key ever leaked, one fast hash makes recovering the password by brute force cheap. CodeQL flags it as js/insufficient-password-hash and, for this particular alert, has a point. scrypt now. Two details that matter: The salt has to be stable. A random salt would produce a different key on every call and invalidate every session; it is derived from AUTH_SECRET, which is deployment-specific. Verified across separate processes: same inputs produce a verifying token, so a restart or redeploy does not log everyone out. The result is cached for the process lifetime. scrypt is deliberately slow and getSigningKey() runs on every admin request — deriving per call would add ~24ms to each one. The cache key is a digest of secret plus password, so a rotation misses the cache and derives again, and no extra plaintext copy of the password is kept around. Measured: first derivation 24ms, subsequent calls 0.12ms. Password change and secret change both invalidate an existing token, checked in separate processes. Note the one-time effect: existing admin sessions are invalidated by the change in derivation, so everyone logs in once more. * security(admin): key the signing-key cache on its inputs, not a digest #441 removed the SHA-256 digest of the admin password from the key derivation and introduced a new one three lines above it, as the cache key. Same rule, same file: CodeQL reported it immediately. The comment justifying it was wrong too. It claimed no second plaintext copy of the password was retained, while building the digest input allocates exactly that in order to hash it. The cache now holds the two input strings and compares them directly. They are the same objects the env and install caches already hold, so nothing extra is retained, and no fast hash of the password exists in memory for the life of the process. Re-verified after the change, in separate processes: a token from one process verifies in another with the same inputs, a changed password or secret rejects it, first derivation 24ms, cached calls 0.001ms. That leaves scrypt as the only place the password is hashed here. The two HMACs further down operate on the derived key and on token data, not on the password; the constant-time comparison in verifyAdminPassword is the previously dismissed one. --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
2026-08-14 16:55:07 +02:00
/* ── Listbox (select replacement that can render SVG icons) ────── */
.admin-listbox {
position: relative;
width: 100%;
}
.admin-listbox-trigger {
display: flex;
align-items: center;
justify-content: space-between;
gap: 0.5rem;
width: 100%;
padding: 0.6rem 0.75rem;
background: var(--admin-bg-input);
border: 1px solid var(--admin-border);
border-radius: 6px;
color: var(--admin-text);
font-size: 0.875rem;
font-family: inherit;
text-align: left;
cursor: pointer;
transition: border-color 0.15s;
}
.admin-listbox-trigger:hover:not(:disabled) {
border-color: var(--admin-border-hover);
}
.admin-listbox-trigger:focus-visible {
outline: none;
border-color: var(--admin-border-focus);
}
.admin-listbox-trigger:disabled {
opacity: 0.5;
cursor: not-allowed;
}
.admin-listbox-value {
display: inline-flex;
align-items: center;
gap: 0.5rem;
min-width: 0;
}
.admin-listbox-value > span {
overflow: hidden;
text-overflow: ellipsis;
white-space: nowrap;
}
.admin-listbox-value .svg-icon,
.admin-listbox-option > .svg-icon {
color: var(--admin-text-secondary);
}
.admin-listbox-caret {
color: var(--admin-text-secondary);
transition: transform 0.15s ease;
}
.admin-listbox-trigger[aria-expanded='true'] .admin-listbox-caret {
transform: rotate(180deg);
}
/* Portalled to <body>, so it escapes the overflow of any scrolling ancestor.
left/top/bottom/width/max-height are measured from the trigger and set inline
by the component; the z-index clears the modal overlay (1000). */
.admin-listbox-popup {
position: fixed;
z-index: 1100;
overflow-y: auto;
/* A long list scrolls internally; without this, reaching its end hands the
wheel to whatever is behind the modal. */
overscroll-behavior: contain;
margin: 0;
padding: 0.25rem;
list-style: none;
/* Also outside .admin-layout, so the font does not inherit either. */
font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', system-ui, sans-serif;
background: var(--admin-bg-elevated);
border: 1px solid var(--admin-border);
border-radius: 8px;
box-shadow: 0 12px 32px rgba(0, 0, 0, 0.35);
}
[data-theme='light'] .admin-listbox-popup {
box-shadow: 0 12px 32px rgba(0, 0, 0, 0.12);
}
.admin-listbox-option {
display: flex;
align-items: center;
gap: 0.5rem;
padding: 0.45rem 0.5rem;
border-radius: 5px;
color: var(--admin-text);
font-size: 0.875rem;
cursor: pointer;
}
.admin-listbox-option.is-active {
background: var(--admin-bg-raised);
}
.admin-listbox-option.is-selected {
color: var(--admin-accent);
}
.admin-listbox-option.is-selected > .svg-icon {
color: var(--admin-accent);
}
.admin-listbox-option-label {
flex: 1;
min-width: 0;
overflow: hidden;
text-overflow: ellipsis;
white-space: nowrap;
}
.admin-listbox-check {
color: var(--admin-accent);
}
feat: add visual admin panel with page builder and settings editor - Add /admin route with password-protected visual page builder - Page Builder: manage hero images, standalone albums, subpages, and sections - Album Picker: browse all shared Immich albums with search and filtering - Settings Editor: theme, grid, footer, legal, SEO configuration - YAML service with atomic writes and automatic backups (content/.backups/) - HMAC-signed admin sessions (24h expiry, HttpOnly cookies) - API endpoints: /api/admin/{auth,gallery,settings,albums,reload} - Enable with ADMIN_PASSWORD env var; disabled by default - invalidateConfigCache() export for hot-reload after saves
2026-05-29 17:04:37 +02:00
.admin-field-row {
display: grid;
grid-template-columns: 1fr 1fr;
gap: 0.75rem;
}
.admin-field-checks {
display: flex;
flex-direction: column;
gap: 0.5rem;
margin: 0.75rem 0;
}
.admin-field-checks label {
display: flex;
align-items: center;
gap: 0.5rem;
font-size: 0.875rem;
fix: admin panel light/dark theme support, improved contrast, and backup confirmation a) Admin panel now respects the site's light/dark theme toggle via CSS custom properties that respond to [data-theme='light'] on <html>. All hardcoded dark colors replaced with semantic CSS variables. b) Improved contrast in dark mode: secondary text changed from #666/#555 to #a0a0a0, muted text from #555 to #707070. All text is now clearly readable against dark backgrounds. c) Backup system was already implemented in yaml-service.ts (creates timestamped backups in content/.backups/ before each save, keeps last 10 versions). Now the UI shows a confirmation message that a backup was created after each successful save.
2026-05-29 17:20:56 +02:00
color: var(--admin-text);
feat: add visual admin panel with page builder and settings editor - Add /admin route with password-protected visual page builder - Page Builder: manage hero images, standalone albums, subpages, and sections - Album Picker: browse all shared Immich albums with search and filtering - Settings Editor: theme, grid, footer, legal, SEO configuration - YAML service with atomic writes and automatic backups (content/.backups/) - HMAC-signed admin sessions (24h expiry, HttpOnly cookies) - API endpoints: /api/admin/{auth,gallery,settings,albums,reload} - Enable with ADMIN_PASSWORD env var; disabled by default - invalidateConfigCache() export for hot-reload after saves
2026-05-29 17:04:37 +02:00
cursor: pointer;
text-transform: none;
letter-spacing: 0;
}
.admin-field-checks input[type='checkbox'] {
width: 16px;
height: 16px;
fix: admin panel light/dark theme support, improved contrast, and backup confirmation a) Admin panel now respects the site's light/dark theme toggle via CSS custom properties that respond to [data-theme='light'] on <html>. All hardcoded dark colors replaced with semantic CSS variables. b) Improved contrast in dark mode: secondary text changed from #666/#555 to #a0a0a0, muted text from #555 to #707070. All text is now clearly readable against dark backgrounds. c) Backup system was already implemented in yaml-service.ts (creates timestamped backups in content/.backups/ before each save, keeps last 10 versions). Now the UI shows a confirmation message that a backup was created after each successful save.
2026-05-29 17:20:56 +02:00
accent-color: var(--admin-btn-primary-bg);
feat: add visual admin panel with page builder and settings editor - Add /admin route with password-protected visual page builder - Page Builder: manage hero images, standalone albums, subpages, and sections - Album Picker: browse all shared Immich albums with search and filtering - Settings Editor: theme, grid, footer, legal, SEO configuration - YAML service with atomic writes and automatic backups (content/.backups/) - HMAC-signed admin sessions (24h expiry, HttpOnly cookies) - API endpoints: /api/admin/{auth,gallery,settings,albums,reload} - Enable with ADMIN_PASSWORD env var; disabled by default - invalidateConfigCache() export for hot-reload after saves
2026-05-29 17:04:37 +02:00
}
/* ── Error ─────────────────────────────────────────────────── */
.admin-error {
fix: admin panel light/dark theme support, improved contrast, and backup confirmation a) Admin panel now respects the site's light/dark theme toggle via CSS custom properties that respond to [data-theme='light'] on <html>. All hardcoded dark colors replaced with semantic CSS variables. b) Improved contrast in dark mode: secondary text changed from #666/#555 to #a0a0a0, muted text from #555 to #707070. All text is now clearly readable against dark backgrounds. c) Backup system was already implemented in yaml-service.ts (creates timestamped backups in content/.backups/ before each save, keeps last 10 versions). Now the UI shows a confirmation message that a backup was created after each successful save.
2026-05-29 17:20:56 +02:00
background: var(--admin-error-bg);
border: 1px solid var(--admin-error-border);
color: var(--admin-error);
feat: add visual admin panel with page builder and settings editor - Add /admin route with password-protected visual page builder - Page Builder: manage hero images, standalone albums, subpages, and sections - Album Picker: browse all shared Immich albums with search and filtering - Settings Editor: theme, grid, footer, legal, SEO configuration - YAML service with atomic writes and automatic backups (content/.backups/) - HMAC-signed admin sessions (24h expiry, HttpOnly cookies) - API endpoints: /api/admin/{auth,gallery,settings,albums,reload} - Enable with ADMIN_PASSWORD env var; disabled by default - invalidateConfigCache() export for hot-reload after saves
2026-05-29 17:04:37 +02:00
padding: 0.5rem 0.75rem;
border-radius: 6px;
font-size: 0.8rem;
margin-bottom: 0.75rem;
}
/* ── Buttons ───────────────────────────────────────────────── */
.admin-btn {
display: inline-flex;
align-items: center;
justify-content: center;
gap: 0.4rem;
release: v0.11.0 — journal fixes, admin URLs, design system cleanup (#432) * fix(screenshots): sharp-Typen fuer 0.34 und 0.35 gleichzeitig (#410) sharp 0.35 ist von `export =` auf ESM umgestellt: der Modul-Namespace ist nicht mehr aufrufbar, die Factory sitzt unter .default. Der Type-Check brach damit in scripts/screenshots.ts weg, sobald der Next-Bump (#402) sharp von 0.34.5 auf 0.35.3 mitzieht -- sharp ist hier keine deklarierte Dependency, sondern kommt ueber Next mit. Die Form wird jetzt aus dem installierten Paket abgeleitet statt festgeschrieben, zur Laufzeit wie im Typ. Geprueft mit beiden Versionen: tsc laeuft mit 0.34.5 und mit 0.35.3 fehlerfrei durch. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(deps): bump the nextjs group across 1 directory with 2 updates (#402) Bumps the nextjs group with 2 updates in the / directory: [next](https://github.com/vercel/next.js) and [eslint-config-next](https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next). Updates `next` from 16.2.12 to 16.3.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/compare/v16.2.12...v16.3.0) Updates `eslint-config-next` from 16.2.12 to 16.3.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/commits/v16.3.0/packages/eslint-config-next) --- updated-dependencies: - dependency-name: eslint-config-next dependency-version: 16.3.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: nextjs - dependency-name: next dependency-version: 16.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nextjs ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps-dev): bump prettier from 3.8.3 to 3.9.6 (#405) Bumps [prettier](https://github.com/prettier/prettier) from 3.8.3 to 3.9.6. - [Release notes](https://github.com/prettier/prettier/releases) - [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md) - [Commits](https://github.com/prettier/prettier/compare/3.8.3...3.9.6) --- updated-dependencies: - dependency-name: prettier dependency-version: 3.9.6 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * docs(changelog): Unreleased-Sektion fuer die Bumps nach v0.10.0 (#413) Die Dependency-PRs sind nach dem Release auf dev gelandet, teils auch auf main. Ohne Eintrag waeren sie beim naechsten Release unsichtbar -- inklusive Next 16.3.0, das CVE-2025-13465 mitbringt. Ausserdem im 0.10.0-Abschnitt nachgetragen, dass der Trivy-Scan bis #409 nie gelaufen ist. Der Fix steckt im Tag v0.10.0, fehlte aber in der Aufzaehlung -- und "Images werden bei jedem Publish gescannt" stand im Changelog, waehrend der Job im Action-Setup abbrach. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(gallery): per-album sort order, independent of Immich (#408) (#414) Album order was dictated entirely by Immich: getAlbum() sorted by the album's own asc/desc flag, so a Folio album always mirrored the archive. A curated series has a narrative order that has nothing to do with capture time, and changing the Immich album's sort to fit the website changes it for the archive too. Adds an optional per-album `sort` in gallery.yaml, editable in /admin, defaulting to today's behaviour so every existing config is unchanged: immich (default) | newest | oldest | filename | manual `manual` is a pinned *prefix*: `assetOrder` lists only the photos placed by hand, everything else follows in the album's Immich order. A full permutation of a 2,000-photo album would be ~80 KB of UUIDs in a file that is rewritten and copied to content/.backups/ on every admin save. It also makes drift fall out for free — photos removed in Immich never match, new ones land in the tail rather than being hidden. Sorting is applied after the cache read, not before the cache write, so the LRU keeps one canonical Immich-ordered copy per album. That avoids putting the mode in the cache key, lets a config change take effect without depending on invalidation, and keeps the stale-serving path correct. cache.get() returns the stored object by reference, so withSort() returns a shallow clone with a new array — sorting in place would reorder the shared entry, and under request coalescing every concurrent caller would be sorting the same array. Also fixes a prerequisite bug: /api/admin/albums/[albumId]/assets read album.assets from GET /albums/:id, which Immich 3.x no longer populates (lib/immich.ts:507). The hero picker's "This Album" tab returned nothing and threw outright when the key was absent. It now goes through the client's paginated metadata search, with ?types=all to opt videos in for the reorder editor. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): drop decorative emoji from the sort select labels (#415) An <option> cannot contain markup, so the SVG set in Icons is not reachable there — but a decorative emoji is not a substitute for it. Plain text instead; the album card badge already uses a real icon. The remaining emoji in the admin panel (asset picker tabs, section headings, layout picker options) predate this branch and are left for a separate cleanup. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): replace emoji icons with the shared SVG icon set (#416) The admin panel mixed two icon conventions: inline SVGs from `Icons.tsx` in most components, and decorative emoji in the asset picker and a few PageBuilder labels. Emoji render inconsistently across platforms, ignore the accent colour, and cannot inherit the `.svg-icon` sizing rules. - Icons.tsx: add `IconStar` (filled — it marks a state, not an action) and `IconImage`. - AssetPicker: the three tab labels and the favourite tile badge now use IconFolder / IconStar / IconImage. - PageBuilder: the "Standalone Albums" and "Subpages" headings use the icon set instead of an emoji. - PageBuilder: the layout picker drops its emoji for plain text. An <option> cannot contain markup, so an SVG is impossible there and a decorative glyph is not a substitute. - admin.css: align icon and label in the picker tabs, and swap the favourite badge's text-shadow for drop-shadow, which is what applies to an inline SVG. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): fold PageBuilder's local icons into the shared Icons module (#418) * refactor(admin): fold PageBuilder's local icons into the shared module PageBuilder.tsx carried its own `Icons` object duplicating most of the glyphs already exported by Icons.tsx, with hardcoded sizes and slightly divergent paths. Migrate all 32 call sites to the shared module and delete the local object. Five glyphs had no counterpart and are added to Icons.tsx as 1:1 ports of the local paths: IconX, IconPlus, IconHome, IconCopy, IconImage. The local ExternalLink and Check are dropped rather than ported — both had zero call sites. Two glyphs change shape slightly, which is the point of consolidating: the shared IconCamera includes the viewfinder bump the local copy omitted, and drag handles now use IconGripVertical. IconGripVertical uses the module's square 24x24 viewBox, so `.svg-drag` goes from 12x18 to 18x18 — the old non-square box would letterbox the glyph down to 12x12 and shrink the handle. * fix(admin): resolve icon-module integration after #416 Merging dev brought in #416, which added a second IconImage to Icons.tsx and two <Icons.Camera>/<Icons.Folder> section headers that reference the local Icons object this PR removes. Git merged both cleanly but the result did not type-check. - drop the duplicate IconImage (both copies were byte-identical) - point the two section headers at the imported IconCamera/IconFolder - refresh the SORT_LABELS comment: the icon set is imported now, not declared below --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> * fix(config): allow an empty gallery, guard against a double /api suffix (#421) An empty gallery is now a valid, rendered state instead of a throw: deriveGallery() no longer requires at least one album or subpage, so a deployment with no albums yet renders a bare homepage the owner can fill in via /admin. getConfig() also stops appending /api to an Immich URL that already ends in it, which previously produced .../api/api and broke every upstream request. Includes a restore of the per-album sort test cases, which the branch had lost by being cut before #408/#414. * feat(admin): favicon upload, served from the content volume (#422) Adds a bundled default favicon, an upload widget in admin Settings > General, and a route that serves the icon from the writable content/ volume with a fallback to the bundled default. Raster uploads (PNG/ICO/JPEG) are wrapped in an SVG container; the response carries its own CSP so an uploaded SVG cannot execute script on the origin. The GET route revalidates with an ETag instead of caching immutably, so a newly uploaded icon shows up immediately. Uploads are written via temp file + rename, and a Reset button restores the bundled default. * ci: flag unformatted files in a PR, without blocking it (#424) Prettier is configured as an error rule in eslint.config.mjs but has never run in CI, so part of the tree predates it. A final CI step now diffs against the PR base, runs prettier --list-different over the changed files, and emits a warning annotation per offender plus a job summary. Advisory by design: it never fails the job. Blocking would turn a PR red for merely touching a file that was already unformatted, and normalising the tree in one commit would wreck git blame and conflict with the PRs in flight. Requires fetch-depth: 0, since diffing against the base needs its history. * feat(install): first-run wizard gated by a one-time setup token (#419) Adds /install, a four-step first-run wizard: connect to Immich, optionally pick albums, name the site, finish. It verifies the credentials against the Immich server before writing anything, then writes gallery.yaml, settings.yaml and a content/install.json carrying the Immich credentials and a generated site secret. install.json exists because a running process cannot pick up new env vars — the wizard has to write configuration that takes effect without a restart. getInstallCredentials() merges it under the real environment, so env vars always win and rotation stays a matter of setting one. Both the page and the API routes are gated by a one-time setup token printed to the server log, so a deployment that is reachable before gallery.yaml exists cannot be configured by whoever finds it first. The token is stored in content/.setup-token (0600) rather than a module variable: Next.js bundles the page and each route handler separately, so a module-level token left the page and the API disagreeing inside one process and the wizard stuck on step 1. It is removed once the install completes. The admin password is stored as an scrypt hash using the scheme lib/auth.ts already applies to album passwords; a plaintext ADMIN_PASSWORD env var keeps working. * docs: document the setup wizard, fix the read-only content mount (#425) Quick Start now leads with the /install wizard, with the hand-written YAML route kept alongside it, and a First-Run Setup section covers the setup token, the files the wizard writes, and env-var precedence. Two corrections: both Docker examples mounted content/ as :ro, which silently breaks the wizard, the admin panel and the backup rotation alike — docs/admin-panel.md already said so and the README contradicted it. And nothing documented that content/install.json holds the Immich API key, so a backup of content/ is a backup of credentials. Also adds a Contributors section crediting the people whose work is in the project. * feat(admin): floating save bar pinned to the bottom of the viewport (#426) The save bar was the first, static element inside .admin-main. Since the document itself scrolls, it left the viewport as soon as you scrolled down — editing a subpage section or a settings block far below gave no visible dirty hint and no reachable save button. Replace it with a bottom-pinned floating bar shared by both editors. It only mounts while there is something to act on (unsaved changes, an in-flight save, or a result message), so it never covers content while idle. The success message clears after 5s, which hides the bar again. - new SaveBar component, replacing the duplicated markup in PageBuilder and SettingsEditor - adopt the previously unused .floating-save-bar CSS: slide-in keyframes (carrying translateX(-50%)), dirty border, wrap/gap, mobile variant and a prefers-reduced-motion opt-out; z-index 900 keeps it below modals - .admin-main gains bottom padding so the bar never covers page content - drop the now-unreachable idle hints: the ⌘S hint becomes a button title, the Live Sync note becomes a static line above the settings layout - header "Site" link now bypasses the cache (/?fresh=1), so the preview stays reachable when the bar is hidden Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(admin): themed listbox for the album sort control (#427) The per-album "Photo order" control was a native <select>. Because an <option> cannot contain markup, its choices could not use the admin panel's currentColor SVG set — the reason #415 had to fall back to plain text after dropping the emoji labels. Adds a Listbox component implementing the ARIA combobox/listbox pattern, so options can render a glyph beside their label: - DOM focus stays on the trigger button; the active option is announced through aria-activedescendant, keeping focus management to one element - Keyboard: arrows (clamped at the ends, like a native select), Home/End, Enter/Space to commit, Escape to cancel, Tab commits and moves on, and prefix type-ahead with a repeat-key cycle - Outside dismissal on pointerdown, so a press starting outside closes the popup before the click retargets The sort options now carry an icon each: calendar, arrow-down, arrow-up, an A→Z marker, and the drag glyph for manual — matching the badge the album card already shows. SORT_LABELS stays plain text because the badge feeds it to a title attribute. Closes #417 Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(git): ignore generated design handoff folders * fix(admin): stop the album sort dropdown clipping, and simplify the panel (#428) * fix(admin): render listbox popup in a portal so it escapes modal clipping The sort control's popup was position:absolute inside three clipping ancestors (.album-drawer overflow:hidden > .album-drawer-body overflow-y:auto > .modal-right-column overflow-y:auto), so it was cut off at the bottom of the Edit Album Details modal. z-index could not help: clipping happens before stacking. It also always hung below the trigger, with no flip. Portal the popup to document.body and position it from the trigger's viewport rect, flipping above when there is more room there and capping max-height to the space available so it scrolls internally rather than overflowing. It is dismissed on scroll and resize, since the anchor is only measured on open. The outside-pointerdown handler now also treats the popup as inside; without that the portalled list counts as outside, and a click on an option would close it before the selection commits. * refactor(admin): single-column album details panel The left column spent 1.2fr on a cover thumbnail and three stat rows, two of which (Status, Custom Hero) only restated the form fields opposite them, while the form itself was squeezed into 1.8fr behind a second nested scroller. Stack the drawer in one column instead: cover as a banner, then the form at full width, with the UUID moved into the footer. The body is now the only scroll container, which also removes one of the ancestors that was clipping the sort popup. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> * fix(admin): give the portalled listbox its theme back, lock the page behind modals (#429) Two defects in the album editor. The sort listbox popup painted transparent. Every --admin-* variable is scoped to .admin-layout, and since the popup moved into document.body it sits outside that subtree, so background/border/text all resolved to nothing. It now carries its own copy of the palette in both colour schemes, plus the font it no longer inherits. Scrolling inside a modal also moved the page behind it. No admin modal ever locked body scroll: the overlay covers the page but does not absorb wheel events, so a scroll starting on the backdrop — or continuing past the end of the modal's own scroller — reaches the document. overscroll-behavior cannot cover that case on its own, because it only applies to scroll containers and the backdrop is not one. useScrollLock freezes body while a modal is open and compensates for the width the scrollbar gives up, so nothing shifts underneath. Each lock restores the inline value it found, which makes nesting work without a counter — a picker opened from the drawer restores the drawer's hidden state instead of clearing it. Applied to both drawers and all four picker modals, which share the defect. overscroll-behavior: contain on the scrollers stops the chaining they can handle themselves. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com> * fix(security): allow unsafe-eval in CSP script-src during dev mode * feat(journal): add Journal Studio with split-screen editor, live preview and dedicated routes * fix(build): separate client parser from server journal-service and fix build type errors * fix(journal): Fotos rendern, Layout und Lightbox-Steuerung korrigieren Fünf unabhängige Fehler in der öffentlichen Journal- und Essay-Ansicht: * Foto-Blöcke wurden nie angezeigt. EssayView löst ein Foto über PhotoItem.id auf, und das sind verschlüsselte Tokens — die Blöcke aus dem Markdown tragen aber rohe Asset-UUIDs. Jede Zuordnung lief ins Leere, und nicht auflösbare Blöcke werden still verworfen. Die IDs werden jetzt serverseitig übersetzt; damit verschwinden nebenbei die rohen UUIDs aus dem Client-Payload, die dort laut Projektregel nie auftauchen dürfen. Nicht auflösbare Referenzen werden geloggt. * Überschriften standen weiter links als der Fließtext. Jeder Block hatte einzeln `max-width: 68ch`, und `ch` ist relativ zur Schrift des Elements — die Serif-Überschrift ergab eine breitere Spalte. Ersetzt durch eine gemeinsame, font-unabhängige `--essay-measure`. * Fullbleed-Fotos bluteten nur nach links aus: `.essay-figure` ist `width: 100%`, wodurch die Box überbestimmt ist und der negative rechte Margin verworfen wird. * Foto-Paare stellten beide Bilder gleich breit dar, wodurch ein Hochformat neben einem Querformat doppelt so hoch wurde. Jetzt eine Justified-Reihe: Breite proportional zum Seitenverhältnis, dadurch exakt gleiche Höhen ohne Beschnitt. * Die Lightbox hatte im Journal keine Tastatursteuerung und keine Scroll-Sperre — beides lag in PhotoGrid, also nur im Album-Raster. Verlagert in die Lightbox selbst, der doppelte Handler in PhotoGrid entfernt (sonst wäre pro Pfeildruck zwei Bilder weitergesprungen). Zusätzlich sind Proofing-Herzen und das EXIF-Panel im redaktionellen Modus abschaltbar und im Journal aus: Client-Proofing ist ein Übergabe-Workflow für Alben, keine Funktion einer Reportage. Auf der Übersicht wurde der Untertitel doppelt gerendert, weil extractExcerpt() auf ihn zurückfällt. * feat(admin): eigene URLs für alle Bereiche und überarbeiteter Journal Studio Das Panel war eine einzige Client-Komponente, die ihre Tabs über useState umschaltet: keine Route pro Bereich, kein Deep-Link, kein Zurück-Button, und nach jedem Reload landete man wieder auf "Pages". Auch der Journal-Editor hatte keine eigene URL. Jetzt sieben echte Routen (/admin, /admin/pages, /admin/journal, /admin/journal/<slug>, /admin/settings, /admin/settings/<section>, /admin/analytics). Die Shell mit Auth-Prüfung und Kopfzeile sitzt im Layout und umschließt children — so bleibt die Session-Prüfung über Routenwechsel montiert, statt bei jedem Tab-Wechsel neu zu laufen und den Spinner aufblitzen zu lassen. Unbekannte Settings-Sections fallen auf General zurück. Im selben Zug der Journal Studio, der die Routing-Änderung ohnehin berührt: * Alle Eingabefelder nutzten die Klasse `admin-input`, die in keinem CSS definiert war — sie fielen auf Browser-Defaults zurück. Jetzt gestylt, gescoped, damit der generische Name nicht ins übrige Panel leckt. * Der Split View ist per Divider verschiebbar (Maus, Tastatur, Doppelklick zum Zurücksetzen), Breite in localStorage. * Das Studio bricht aus der 1120px-Spalte aus, die Preview hat Platz. * Die Preview zeigte für jedes Foto fest 3:2 und log damit über das Layout der veröffentlichten Seite; die echten Verhältnisse werden jetzt an den Thumbnails gemessen. * Blöcke mit alten positionsbasierten Foto-Referenzen werden markiert — die lassen sich auf einer eigenständigen Journal-Seite nicht auflösen und verschwanden bisher stillschweigend. * Blocktyp-Chips als gemeinsame Komponente, monochrom und per Icon unterschieden statt in einer eigenen Blau/Lila/Orange-Palette, die sonst nirgends im Panel vorkommt. * Emojis raus, SVG-Icons rein. * fix(admin): Designsystem-Lücken im Panel schließen Eine systematische Suche nach Klassen, die im TSX benutzt, aber in keinem CSS definiert sind, hat vier Stellen mit demselben Muster gefunden: * `admin-btn-secondary` und `admin-btn-danger` existierten nicht. Sämtliche Löschen-Buttons sahen aus wie normale Buttons — keine Warnwirkung. Als `.admin-btn.admin-btn-danger` geschrieben, weil die Varianten mit den Größenklassen kombiniert werden, die weiter unten ihren eigenen Hintergrund setzen. * `page-progress-fill` fehlte: die Balken im Analytics-Panel waren leere Rinnen, der Wert unsichtbar. Ebenso `analytics-empty` und `admin-loading-container`. * `subpage-drawer-section`, `subpage-drawer-title-group` und `input-with-icon` im PageBuilder waren wirkungslos und teils mit Inline-Styles notdürftig kompensiert. * `grid-card-preview` fehlte, wodurch alle Layout-Vorschauen auf Höhe null kollabierten. Nur "Showcase" war sichtbar — und das aus Versehen, weil sein Tile `hero-tile` hieß und damit die `aspect-ratio` einer fremden PageBuilder-Klasse erbte. Umbenannt. Dazu die Theme-Vorschauen, die praktisch identisch aussahen: alle sieben zeigten dieselben drei quadratischen Kacheln, einziger Unterschied war die Hintergrundfarbe. Sie spiegeln jetzt die echten Preset-Daten aus lib/config/theme.ts — Schriftcharakter, Eckradius, Rasterdichte, Passepartout bzw. Schatten. Die Kopfzeile richtet sich an einer gemeinsamen Steuerhöhe aus. Der "Site"-Link war höher als die Buttons daneben: `.admin-btn` hatte keine explizite line-height, und <button> bekommt box-sizing: border-box vom Browser, <a> nicht. Die Statusanzeige setzte weder Schriftfamilie noch -größe und fiel auf den Browser-Default zurück — sie war nie Teil des Designsystems. Jetzt gleiche Höhe und Typografie, Pillenform als Zustandsanzeige, Trenner zur Aktionsgruppe. Das dauerhafte Pulsieren des grünen Punkts entfällt; Animation bleibt den Zuständen vorbehalten, die Aufmerksamkeit brauchen. Restliche Emojis durch SVG-Icons ersetzt. * feat(admin): add scroll-to-top toggle and SVG arrow The back-to-top button was always on and drew its arrow with the ↑ text character. Add a `scrollToTop` setting (General section in the admin panel, defaults to on so existing sites are unaffected) and replace the glyph with a stroked SVG that inherits currentColor across all presets. Scroll handling is now rAF-throttled, and prefers-reduced-motion turns off both the hover lift and the smooth scroll. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * security(journal): escape author HTML instead of filtering it CodeQL flags 26 high-severity alerts on the release PR; the bulk of them point at sanitizeHtml(), a denylist of three regexes whose output goes into dangerouslySetInnerHTML. I reproduced the bypasses before changing anything — all four pass the old filter: <img src=x onerror=alert(1)> unquoted handler, regex wants quotes <img src=x onerror='alert(1)'> single quotes, same reason <svg onload=alert(1)> not a <script> tag javasjavascript:cript:alert(1) one-pass replace, the rest recombines Plus an attribute breakout in the link renderer, which interpolated the URL into href="${url}" unescaped: [x](" onmouseover=alert(1) x=") -> <a href="" onmouseover=alert(1" ...> Replaced with escaping. Every `&<>"'` in author text becomes an entity before any markdown rule runs, so the only tags in the output are the ones renderInlineMarkdown builds itself and a URL cannot leave its attribute. Link schemes are now an allowlist (http, https, mailto, tel, relative, anchor); anything else renders as plain text. The serializer needed decodeHtmlEntities to match: without it a save would write `&lt;` into the Markdown file and the next parse would escape the `&` again, corrupting the text further on every round trip. A test covers parse -> serialize -> parse stability. Two existing tests asserted the old behaviour and were rewritten rather than deleted: one expected the script tag to be *removed* from the output, the other expected the substring "onerror" to be absent. Both now assert the property that matters — that no tag can form — because `onerror` surviving as inert text is fine. Exploitation required admin access either way: journal and essay text comes from the studio or from content/*.md. This removes the weakness, it does not close an open door. * fix(journal): contain file paths, fix frontmatter escaping, defuse two regexes Follow-up to the CodeQL findings on release PR #432. I went through all 23 alerts individually; this addresses the ones that are worth addressing and documents the ones that are not. Path containment (12 alerts, all false positives). Every path built from a slug goes through isValidSlug(), a strict `/^[a-zA-Z0-9_-]+$/` allowlist — verified against `../../etc/passwd`, `foo/../../bar`, `a/b`, `..` and friends, all rejected. CodeQL cannot see it because the check lives in another module. Added a containedPath() helper that resolves the path and refuses anything landing outside the content directory: a second lock on a door that was already locked, and a barrier the analysis can follow. Also removed the dead `slug.endsWith('.md')` branches — isValidSlug rejects dots, so they could never be taken. Frontmatter escaping (1 alert, a real bug). The serializer escaped `"` but not `\`, and the parser never unescaped anything. A title containing either character gained a backslash on every save/load cycle: Path C:\Users "quoted" -> Path C:\\Users \"quoted\" -> ... Escaping now covers the backslash first and the parser undoes both. A round trip test covers quotes, backslashes, colons and apostrophes. Two of three ReDoS regexes (2 alerts). The heading pattern had `\s+` next to `(.+)`, which overlap, so the engine tried every split of the whitespace run before failing; it is `[ \t]+` and `(\S.*)` now. The quote author pattern wrapped a lazy group around an optional group — the quadratic case — and is an index split on the first separator now. The third regex, the bold/italic pass, is deliberately left alone. Rewriting it with a negated class removes the backtracking but breaks nesting: `**bold *and italic* here**` renders as `*<em>bold </em>and italic<em> here</em>*`. The input is Markdown from an authenticated admin, never a visitor, so the worst case is an author slowing down their own page. The comment in the code says so. Not addressed: 5 js/insufficient-password-hash alerts. They ask for a slow KDF where the code uses SHA-256/HMAC — correct in general, but the admin password comes from an environment variable and is never stored, so a stronger KDF protects nothing that is not already in plaintext in the environment. 399 unit tests pass (18 new), build and tsc clean. * fix(journal): split the quote author by scanning, not by pattern Cleaning up after myself. #439 replaced the quote author regex `/^(.*?)(?:\s+--\s+(.+))?$/` — a lazy group around an optional one, the quadratic case — with `/\s+--\s+/`, and CodeQL promptly flagged the replacement for the same reason. One reported pattern traded for another. splitQuoteAuthor() scans for the first `--` that has whitespace on both sides. Linear, and it needs no reasoning about the regex engine at all. Behaviour is identical to the original regex, checked case by case against it: separator, no separator, several separators, tabs, wide gaps, `a--b` without spaces, leading and trailing separators, empty string. All nine are covered by tests, plus one asserting it stays fast on a 50k whitespace run. * security(admin): derive the session signing key with scrypt getSigningKey() ran the admin password through a single SHA-256 digest. It is key derivation rather than password storage, so it was never a stored-hash problem — but if the derived key ever leaked, one fast hash makes recovering the password by brute force cheap. CodeQL flags it as js/insufficient-password-hash and, for this particular alert, has a point. scrypt now. Two details that matter: The salt has to be stable. A random salt would produce a different key on every call and invalidate every session; it is derived from AUTH_SECRET, which is deployment-specific. Verified across separate processes: same inputs produce a verifying token, so a restart or redeploy does not log everyone out. The result is cached for the process lifetime. scrypt is deliberately slow and getSigningKey() runs on every admin request — deriving per call would add ~24ms to each one. The cache key is a digest of secret plus password, so a rotation misses the cache and derives again, and no extra plaintext copy of the password is kept around. Measured: first derivation 24ms, subsequent calls 0.12ms. Password change and secret change both invalidate an existing token, checked in separate processes. Note the one-time effect: existing admin sessions are invalidated by the change in derivation, so everyone logs in once more. * security(admin): key the signing-key cache on its inputs, not a digest #441 removed the SHA-256 digest of the admin password from the key derivation and introduced a new one three lines above it, as the cache key. Same rule, same file: CodeQL reported it immediately. The comment justifying it was wrong too. It claimed no second plaintext copy of the password was retained, while building the digest input allocates exactly that in order to hash it. The cache now holds the two input strings and compares them directly. They are the same objects the env and install caches already hold, so nothing extra is retained, and no fast hash of the password exists in memory for the life of the process. Re-verified after the change, in separate processes: a token from one process verifies in another with the same inputs, a changed password or secret rejects it, first derivation 24ms, cached calls 0.001ms. That leaves scrypt as the only place the password is hashed here. The two HMACs further down operate on the derived key and on token data, not on the password; the constant-time comparison in verifyAdminPassword is the previously dismissed one. --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
2026-08-14 16:55:07 +02:00
padding: 0 1.2rem;
min-height: var(--admin-control-height);
/* <button> gets this from the UA stylesheet, <a> does not — without it the
* ghost border pushed the "Site" link 2px past its neighbours. */
box-sizing: border-box;
feat: add visual admin panel with page builder and settings editor - Add /admin route with password-protected visual page builder - Page Builder: manage hero images, standalone albums, subpages, and sections - Album Picker: browse all shared Immich albums with search and filtering - Settings Editor: theme, grid, footer, legal, SEO configuration - YAML service with atomic writes and automatic backups (content/.backups/) - HMAC-signed admin sessions (24h expiry, HttpOnly cookies) - API endpoints: /api/admin/{auth,gallery,settings,albums,reload} - Enable with ADMIN_PASSWORD env var; disabled by default - invalidateConfigCache() export for hot-reload after saves
2026-05-29 17:04:37 +02:00
border: none;
border-radius: 6px;
release: v0.11.0 — journal fixes, admin URLs, design system cleanup (#432) * fix(screenshots): sharp-Typen fuer 0.34 und 0.35 gleichzeitig (#410) sharp 0.35 ist von `export =` auf ESM umgestellt: der Modul-Namespace ist nicht mehr aufrufbar, die Factory sitzt unter .default. Der Type-Check brach damit in scripts/screenshots.ts weg, sobald der Next-Bump (#402) sharp von 0.34.5 auf 0.35.3 mitzieht -- sharp ist hier keine deklarierte Dependency, sondern kommt ueber Next mit. Die Form wird jetzt aus dem installierten Paket abgeleitet statt festgeschrieben, zur Laufzeit wie im Typ. Geprueft mit beiden Versionen: tsc laeuft mit 0.34.5 und mit 0.35.3 fehlerfrei durch. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(deps): bump the nextjs group across 1 directory with 2 updates (#402) Bumps the nextjs group with 2 updates in the / directory: [next](https://github.com/vercel/next.js) and [eslint-config-next](https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next). Updates `next` from 16.2.12 to 16.3.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/compare/v16.2.12...v16.3.0) Updates `eslint-config-next` from 16.2.12 to 16.3.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/commits/v16.3.0/packages/eslint-config-next) --- updated-dependencies: - dependency-name: eslint-config-next dependency-version: 16.3.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: nextjs - dependency-name: next dependency-version: 16.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nextjs ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps-dev): bump prettier from 3.8.3 to 3.9.6 (#405) Bumps [prettier](https://github.com/prettier/prettier) from 3.8.3 to 3.9.6. - [Release notes](https://github.com/prettier/prettier/releases) - [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md) - [Commits](https://github.com/prettier/prettier/compare/3.8.3...3.9.6) --- updated-dependencies: - dependency-name: prettier dependency-version: 3.9.6 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * docs(changelog): Unreleased-Sektion fuer die Bumps nach v0.10.0 (#413) Die Dependency-PRs sind nach dem Release auf dev gelandet, teils auch auf main. Ohne Eintrag waeren sie beim naechsten Release unsichtbar -- inklusive Next 16.3.0, das CVE-2025-13465 mitbringt. Ausserdem im 0.10.0-Abschnitt nachgetragen, dass der Trivy-Scan bis #409 nie gelaufen ist. Der Fix steckt im Tag v0.10.0, fehlte aber in der Aufzaehlung -- und "Images werden bei jedem Publish gescannt" stand im Changelog, waehrend der Job im Action-Setup abbrach. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(gallery): per-album sort order, independent of Immich (#408) (#414) Album order was dictated entirely by Immich: getAlbum() sorted by the album's own asc/desc flag, so a Folio album always mirrored the archive. A curated series has a narrative order that has nothing to do with capture time, and changing the Immich album's sort to fit the website changes it for the archive too. Adds an optional per-album `sort` in gallery.yaml, editable in /admin, defaulting to today's behaviour so every existing config is unchanged: immich (default) | newest | oldest | filename | manual `manual` is a pinned *prefix*: `assetOrder` lists only the photos placed by hand, everything else follows in the album's Immich order. A full permutation of a 2,000-photo album would be ~80 KB of UUIDs in a file that is rewritten and copied to content/.backups/ on every admin save. It also makes drift fall out for free — photos removed in Immich never match, new ones land in the tail rather than being hidden. Sorting is applied after the cache read, not before the cache write, so the LRU keeps one canonical Immich-ordered copy per album. That avoids putting the mode in the cache key, lets a config change take effect without depending on invalidation, and keeps the stale-serving path correct. cache.get() returns the stored object by reference, so withSort() returns a shallow clone with a new array — sorting in place would reorder the shared entry, and under request coalescing every concurrent caller would be sorting the same array. Also fixes a prerequisite bug: /api/admin/albums/[albumId]/assets read album.assets from GET /albums/:id, which Immich 3.x no longer populates (lib/immich.ts:507). The hero picker's "This Album" tab returned nothing and threw outright when the key was absent. It now goes through the client's paginated metadata search, with ?types=all to opt videos in for the reorder editor. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): drop decorative emoji from the sort select labels (#415) An <option> cannot contain markup, so the SVG set in Icons is not reachable there — but a decorative emoji is not a substitute for it. Plain text instead; the album card badge already uses a real icon. The remaining emoji in the admin panel (asset picker tabs, section headings, layout picker options) predate this branch and are left for a separate cleanup. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): replace emoji icons with the shared SVG icon set (#416) The admin panel mixed two icon conventions: inline SVGs from `Icons.tsx` in most components, and decorative emoji in the asset picker and a few PageBuilder labels. Emoji render inconsistently across platforms, ignore the accent colour, and cannot inherit the `.svg-icon` sizing rules. - Icons.tsx: add `IconStar` (filled — it marks a state, not an action) and `IconImage`. - AssetPicker: the three tab labels and the favourite tile badge now use IconFolder / IconStar / IconImage. - PageBuilder: the "Standalone Albums" and "Subpages" headings use the icon set instead of an emoji. - PageBuilder: the layout picker drops its emoji for plain text. An <option> cannot contain markup, so an SVG is impossible there and a decorative glyph is not a substitute. - admin.css: align icon and label in the picker tabs, and swap the favourite badge's text-shadow for drop-shadow, which is what applies to an inline SVG. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): fold PageBuilder's local icons into the shared Icons module (#418) * refactor(admin): fold PageBuilder's local icons into the shared module PageBuilder.tsx carried its own `Icons` object duplicating most of the glyphs already exported by Icons.tsx, with hardcoded sizes and slightly divergent paths. Migrate all 32 call sites to the shared module and delete the local object. Five glyphs had no counterpart and are added to Icons.tsx as 1:1 ports of the local paths: IconX, IconPlus, IconHome, IconCopy, IconImage. The local ExternalLink and Check are dropped rather than ported — both had zero call sites. Two glyphs change shape slightly, which is the point of consolidating: the shared IconCamera includes the viewfinder bump the local copy omitted, and drag handles now use IconGripVertical. IconGripVertical uses the module's square 24x24 viewBox, so `.svg-drag` goes from 12x18 to 18x18 — the old non-square box would letterbox the glyph down to 12x12 and shrink the handle. * fix(admin): resolve icon-module integration after #416 Merging dev brought in #416, which added a second IconImage to Icons.tsx and two <Icons.Camera>/<Icons.Folder> section headers that reference the local Icons object this PR removes. Git merged both cleanly but the result did not type-check. - drop the duplicate IconImage (both copies were byte-identical) - point the two section headers at the imported IconCamera/IconFolder - refresh the SORT_LABELS comment: the icon set is imported now, not declared below --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> * fix(config): allow an empty gallery, guard against a double /api suffix (#421) An empty gallery is now a valid, rendered state instead of a throw: deriveGallery() no longer requires at least one album or subpage, so a deployment with no albums yet renders a bare homepage the owner can fill in via /admin. getConfig() also stops appending /api to an Immich URL that already ends in it, which previously produced .../api/api and broke every upstream request. Includes a restore of the per-album sort test cases, which the branch had lost by being cut before #408/#414. * feat(admin): favicon upload, served from the content volume (#422) Adds a bundled default favicon, an upload widget in admin Settings > General, and a route that serves the icon from the writable content/ volume with a fallback to the bundled default. Raster uploads (PNG/ICO/JPEG) are wrapped in an SVG container; the response carries its own CSP so an uploaded SVG cannot execute script on the origin. The GET route revalidates with an ETag instead of caching immutably, so a newly uploaded icon shows up immediately. Uploads are written via temp file + rename, and a Reset button restores the bundled default. * ci: flag unformatted files in a PR, without blocking it (#424) Prettier is configured as an error rule in eslint.config.mjs but has never run in CI, so part of the tree predates it. A final CI step now diffs against the PR base, runs prettier --list-different over the changed files, and emits a warning annotation per offender plus a job summary. Advisory by design: it never fails the job. Blocking would turn a PR red for merely touching a file that was already unformatted, and normalising the tree in one commit would wreck git blame and conflict with the PRs in flight. Requires fetch-depth: 0, since diffing against the base needs its history. * feat(install): first-run wizard gated by a one-time setup token (#419) Adds /install, a four-step first-run wizard: connect to Immich, optionally pick albums, name the site, finish. It verifies the credentials against the Immich server before writing anything, then writes gallery.yaml, settings.yaml and a content/install.json carrying the Immich credentials and a generated site secret. install.json exists because a running process cannot pick up new env vars — the wizard has to write configuration that takes effect without a restart. getInstallCredentials() merges it under the real environment, so env vars always win and rotation stays a matter of setting one. Both the page and the API routes are gated by a one-time setup token printed to the server log, so a deployment that is reachable before gallery.yaml exists cannot be configured by whoever finds it first. The token is stored in content/.setup-token (0600) rather than a module variable: Next.js bundles the page and each route handler separately, so a module-level token left the page and the API disagreeing inside one process and the wizard stuck on step 1. It is removed once the install completes. The admin password is stored as an scrypt hash using the scheme lib/auth.ts already applies to album passwords; a plaintext ADMIN_PASSWORD env var keeps working. * docs: document the setup wizard, fix the read-only content mount (#425) Quick Start now leads with the /install wizard, with the hand-written YAML route kept alongside it, and a First-Run Setup section covers the setup token, the files the wizard writes, and env-var precedence. Two corrections: both Docker examples mounted content/ as :ro, which silently breaks the wizard, the admin panel and the backup rotation alike — docs/admin-panel.md already said so and the README contradicted it. And nothing documented that content/install.json holds the Immich API key, so a backup of content/ is a backup of credentials. Also adds a Contributors section crediting the people whose work is in the project. * feat(admin): floating save bar pinned to the bottom of the viewport (#426) The save bar was the first, static element inside .admin-main. Since the document itself scrolls, it left the viewport as soon as you scrolled down — editing a subpage section or a settings block far below gave no visible dirty hint and no reachable save button. Replace it with a bottom-pinned floating bar shared by both editors. It only mounts while there is something to act on (unsaved changes, an in-flight save, or a result message), so it never covers content while idle. The success message clears after 5s, which hides the bar again. - new SaveBar component, replacing the duplicated markup in PageBuilder and SettingsEditor - adopt the previously unused .floating-save-bar CSS: slide-in keyframes (carrying translateX(-50%)), dirty border, wrap/gap, mobile variant and a prefers-reduced-motion opt-out; z-index 900 keeps it below modals - .admin-main gains bottom padding so the bar never covers page content - drop the now-unreachable idle hints: the ⌘S hint becomes a button title, the Live Sync note becomes a static line above the settings layout - header "Site" link now bypasses the cache (/?fresh=1), so the preview stays reachable when the bar is hidden Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(admin): themed listbox for the album sort control (#427) The per-album "Photo order" control was a native <select>. Because an <option> cannot contain markup, its choices could not use the admin panel's currentColor SVG set — the reason #415 had to fall back to plain text after dropping the emoji labels. Adds a Listbox component implementing the ARIA combobox/listbox pattern, so options can render a glyph beside their label: - DOM focus stays on the trigger button; the active option is announced through aria-activedescendant, keeping focus management to one element - Keyboard: arrows (clamped at the ends, like a native select), Home/End, Enter/Space to commit, Escape to cancel, Tab commits and moves on, and prefix type-ahead with a repeat-key cycle - Outside dismissal on pointerdown, so a press starting outside closes the popup before the click retargets The sort options now carry an icon each: calendar, arrow-down, arrow-up, an A→Z marker, and the drag glyph for manual — matching the badge the album card already shows. SORT_LABELS stays plain text because the badge feeds it to a title attribute. Closes #417 Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(git): ignore generated design handoff folders * fix(admin): stop the album sort dropdown clipping, and simplify the panel (#428) * fix(admin): render listbox popup in a portal so it escapes modal clipping The sort control's popup was position:absolute inside three clipping ancestors (.album-drawer overflow:hidden > .album-drawer-body overflow-y:auto > .modal-right-column overflow-y:auto), so it was cut off at the bottom of the Edit Album Details modal. z-index could not help: clipping happens before stacking. It also always hung below the trigger, with no flip. Portal the popup to document.body and position it from the trigger's viewport rect, flipping above when there is more room there and capping max-height to the space available so it scrolls internally rather than overflowing. It is dismissed on scroll and resize, since the anchor is only measured on open. The outside-pointerdown handler now also treats the popup as inside; without that the portalled list counts as outside, and a click on an option would close it before the selection commits. * refactor(admin): single-column album details panel The left column spent 1.2fr on a cover thumbnail and three stat rows, two of which (Status, Custom Hero) only restated the form fields opposite them, while the form itself was squeezed into 1.8fr behind a second nested scroller. Stack the drawer in one column instead: cover as a banner, then the form at full width, with the UUID moved into the footer. The body is now the only scroll container, which also removes one of the ancestors that was clipping the sort popup. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> * fix(admin): give the portalled listbox its theme back, lock the page behind modals (#429) Two defects in the album editor. The sort listbox popup painted transparent. Every --admin-* variable is scoped to .admin-layout, and since the popup moved into document.body it sits outside that subtree, so background/border/text all resolved to nothing. It now carries its own copy of the palette in both colour schemes, plus the font it no longer inherits. Scrolling inside a modal also moved the page behind it. No admin modal ever locked body scroll: the overlay covers the page but does not absorb wheel events, so a scroll starting on the backdrop — or continuing past the end of the modal's own scroller — reaches the document. overscroll-behavior cannot cover that case on its own, because it only applies to scroll containers and the backdrop is not one. useScrollLock freezes body while a modal is open and compensates for the width the scrollbar gives up, so nothing shifts underneath. Each lock restores the inline value it found, which makes nesting work without a counter — a picker opened from the drawer restores the drawer's hidden state instead of clearing it. Applied to both drawers and all four picker modals, which share the defect. overscroll-behavior: contain on the scrollers stops the chaining they can handle themselves. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com> * fix(security): allow unsafe-eval in CSP script-src during dev mode * feat(journal): add Journal Studio with split-screen editor, live preview and dedicated routes * fix(build): separate client parser from server journal-service and fix build type errors * fix(journal): Fotos rendern, Layout und Lightbox-Steuerung korrigieren Fünf unabhängige Fehler in der öffentlichen Journal- und Essay-Ansicht: * Foto-Blöcke wurden nie angezeigt. EssayView löst ein Foto über PhotoItem.id auf, und das sind verschlüsselte Tokens — die Blöcke aus dem Markdown tragen aber rohe Asset-UUIDs. Jede Zuordnung lief ins Leere, und nicht auflösbare Blöcke werden still verworfen. Die IDs werden jetzt serverseitig übersetzt; damit verschwinden nebenbei die rohen UUIDs aus dem Client-Payload, die dort laut Projektregel nie auftauchen dürfen. Nicht auflösbare Referenzen werden geloggt. * Überschriften standen weiter links als der Fließtext. Jeder Block hatte einzeln `max-width: 68ch`, und `ch` ist relativ zur Schrift des Elements — die Serif-Überschrift ergab eine breitere Spalte. Ersetzt durch eine gemeinsame, font-unabhängige `--essay-measure`. * Fullbleed-Fotos bluteten nur nach links aus: `.essay-figure` ist `width: 100%`, wodurch die Box überbestimmt ist und der negative rechte Margin verworfen wird. * Foto-Paare stellten beide Bilder gleich breit dar, wodurch ein Hochformat neben einem Querformat doppelt so hoch wurde. Jetzt eine Justified-Reihe: Breite proportional zum Seitenverhältnis, dadurch exakt gleiche Höhen ohne Beschnitt. * Die Lightbox hatte im Journal keine Tastatursteuerung und keine Scroll-Sperre — beides lag in PhotoGrid, also nur im Album-Raster. Verlagert in die Lightbox selbst, der doppelte Handler in PhotoGrid entfernt (sonst wäre pro Pfeildruck zwei Bilder weitergesprungen). Zusätzlich sind Proofing-Herzen und das EXIF-Panel im redaktionellen Modus abschaltbar und im Journal aus: Client-Proofing ist ein Übergabe-Workflow für Alben, keine Funktion einer Reportage. Auf der Übersicht wurde der Untertitel doppelt gerendert, weil extractExcerpt() auf ihn zurückfällt. * feat(admin): eigene URLs für alle Bereiche und überarbeiteter Journal Studio Das Panel war eine einzige Client-Komponente, die ihre Tabs über useState umschaltet: keine Route pro Bereich, kein Deep-Link, kein Zurück-Button, und nach jedem Reload landete man wieder auf "Pages". Auch der Journal-Editor hatte keine eigene URL. Jetzt sieben echte Routen (/admin, /admin/pages, /admin/journal, /admin/journal/<slug>, /admin/settings, /admin/settings/<section>, /admin/analytics). Die Shell mit Auth-Prüfung und Kopfzeile sitzt im Layout und umschließt children — so bleibt die Session-Prüfung über Routenwechsel montiert, statt bei jedem Tab-Wechsel neu zu laufen und den Spinner aufblitzen zu lassen. Unbekannte Settings-Sections fallen auf General zurück. Im selben Zug der Journal Studio, der die Routing-Änderung ohnehin berührt: * Alle Eingabefelder nutzten die Klasse `admin-input`, die in keinem CSS definiert war — sie fielen auf Browser-Defaults zurück. Jetzt gestylt, gescoped, damit der generische Name nicht ins übrige Panel leckt. * Der Split View ist per Divider verschiebbar (Maus, Tastatur, Doppelklick zum Zurücksetzen), Breite in localStorage. * Das Studio bricht aus der 1120px-Spalte aus, die Preview hat Platz. * Die Preview zeigte für jedes Foto fest 3:2 und log damit über das Layout der veröffentlichten Seite; die echten Verhältnisse werden jetzt an den Thumbnails gemessen. * Blöcke mit alten positionsbasierten Foto-Referenzen werden markiert — die lassen sich auf einer eigenständigen Journal-Seite nicht auflösen und verschwanden bisher stillschweigend. * Blocktyp-Chips als gemeinsame Komponente, monochrom und per Icon unterschieden statt in einer eigenen Blau/Lila/Orange-Palette, die sonst nirgends im Panel vorkommt. * Emojis raus, SVG-Icons rein. * fix(admin): Designsystem-Lücken im Panel schließen Eine systematische Suche nach Klassen, die im TSX benutzt, aber in keinem CSS definiert sind, hat vier Stellen mit demselben Muster gefunden: * `admin-btn-secondary` und `admin-btn-danger` existierten nicht. Sämtliche Löschen-Buttons sahen aus wie normale Buttons — keine Warnwirkung. Als `.admin-btn.admin-btn-danger` geschrieben, weil die Varianten mit den Größenklassen kombiniert werden, die weiter unten ihren eigenen Hintergrund setzen. * `page-progress-fill` fehlte: die Balken im Analytics-Panel waren leere Rinnen, der Wert unsichtbar. Ebenso `analytics-empty` und `admin-loading-container`. * `subpage-drawer-section`, `subpage-drawer-title-group` und `input-with-icon` im PageBuilder waren wirkungslos und teils mit Inline-Styles notdürftig kompensiert. * `grid-card-preview` fehlte, wodurch alle Layout-Vorschauen auf Höhe null kollabierten. Nur "Showcase" war sichtbar — und das aus Versehen, weil sein Tile `hero-tile` hieß und damit die `aspect-ratio` einer fremden PageBuilder-Klasse erbte. Umbenannt. Dazu die Theme-Vorschauen, die praktisch identisch aussahen: alle sieben zeigten dieselben drei quadratischen Kacheln, einziger Unterschied war die Hintergrundfarbe. Sie spiegeln jetzt die echten Preset-Daten aus lib/config/theme.ts — Schriftcharakter, Eckradius, Rasterdichte, Passepartout bzw. Schatten. Die Kopfzeile richtet sich an einer gemeinsamen Steuerhöhe aus. Der "Site"-Link war höher als die Buttons daneben: `.admin-btn` hatte keine explizite line-height, und <button> bekommt box-sizing: border-box vom Browser, <a> nicht. Die Statusanzeige setzte weder Schriftfamilie noch -größe und fiel auf den Browser-Default zurück — sie war nie Teil des Designsystems. Jetzt gleiche Höhe und Typografie, Pillenform als Zustandsanzeige, Trenner zur Aktionsgruppe. Das dauerhafte Pulsieren des grünen Punkts entfällt; Animation bleibt den Zuständen vorbehalten, die Aufmerksamkeit brauchen. Restliche Emojis durch SVG-Icons ersetzt. * feat(admin): add scroll-to-top toggle and SVG arrow The back-to-top button was always on and drew its arrow with the ↑ text character. Add a `scrollToTop` setting (General section in the admin panel, defaults to on so existing sites are unaffected) and replace the glyph with a stroked SVG that inherits currentColor across all presets. Scroll handling is now rAF-throttled, and prefers-reduced-motion turns off both the hover lift and the smooth scroll. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * security(journal): escape author HTML instead of filtering it CodeQL flags 26 high-severity alerts on the release PR; the bulk of them point at sanitizeHtml(), a denylist of three regexes whose output goes into dangerouslySetInnerHTML. I reproduced the bypasses before changing anything — all four pass the old filter: <img src=x onerror=alert(1)> unquoted handler, regex wants quotes <img src=x onerror='alert(1)'> single quotes, same reason <svg onload=alert(1)> not a <script> tag javasjavascript:cript:alert(1) one-pass replace, the rest recombines Plus an attribute breakout in the link renderer, which interpolated the URL into href="${url}" unescaped: [x](" onmouseover=alert(1) x=") -> <a href="" onmouseover=alert(1" ...> Replaced with escaping. Every `&<>"'` in author text becomes an entity before any markdown rule runs, so the only tags in the output are the ones renderInlineMarkdown builds itself and a URL cannot leave its attribute. Link schemes are now an allowlist (http, https, mailto, tel, relative, anchor); anything else renders as plain text. The serializer needed decodeHtmlEntities to match: without it a save would write `&lt;` into the Markdown file and the next parse would escape the `&` again, corrupting the text further on every round trip. A test covers parse -> serialize -> parse stability. Two existing tests asserted the old behaviour and were rewritten rather than deleted: one expected the script tag to be *removed* from the output, the other expected the substring "onerror" to be absent. Both now assert the property that matters — that no tag can form — because `onerror` surviving as inert text is fine. Exploitation required admin access either way: journal and essay text comes from the studio or from content/*.md. This removes the weakness, it does not close an open door. * fix(journal): contain file paths, fix frontmatter escaping, defuse two regexes Follow-up to the CodeQL findings on release PR #432. I went through all 23 alerts individually; this addresses the ones that are worth addressing and documents the ones that are not. Path containment (12 alerts, all false positives). Every path built from a slug goes through isValidSlug(), a strict `/^[a-zA-Z0-9_-]+$/` allowlist — verified against `../../etc/passwd`, `foo/../../bar`, `a/b`, `..` and friends, all rejected. CodeQL cannot see it because the check lives in another module. Added a containedPath() helper that resolves the path and refuses anything landing outside the content directory: a second lock on a door that was already locked, and a barrier the analysis can follow. Also removed the dead `slug.endsWith('.md')` branches — isValidSlug rejects dots, so they could never be taken. Frontmatter escaping (1 alert, a real bug). The serializer escaped `"` but not `\`, and the parser never unescaped anything. A title containing either character gained a backslash on every save/load cycle: Path C:\Users "quoted" -> Path C:\\Users \"quoted\" -> ... Escaping now covers the backslash first and the parser undoes both. A round trip test covers quotes, backslashes, colons and apostrophes. Two of three ReDoS regexes (2 alerts). The heading pattern had `\s+` next to `(.+)`, which overlap, so the engine tried every split of the whitespace run before failing; it is `[ \t]+` and `(\S.*)` now. The quote author pattern wrapped a lazy group around an optional group — the quadratic case — and is an index split on the first separator now. The third regex, the bold/italic pass, is deliberately left alone. Rewriting it with a negated class removes the backtracking but breaks nesting: `**bold *and italic* here**` renders as `*<em>bold </em>and italic<em> here</em>*`. The input is Markdown from an authenticated admin, never a visitor, so the worst case is an author slowing down their own page. The comment in the code says so. Not addressed: 5 js/insufficient-password-hash alerts. They ask for a slow KDF where the code uses SHA-256/HMAC — correct in general, but the admin password comes from an environment variable and is never stored, so a stronger KDF protects nothing that is not already in plaintext in the environment. 399 unit tests pass (18 new), build and tsc clean. * fix(journal): split the quote author by scanning, not by pattern Cleaning up after myself. #439 replaced the quote author regex `/^(.*?)(?:\s+--\s+(.+))?$/` — a lazy group around an optional one, the quadratic case — with `/\s+--\s+/`, and CodeQL promptly flagged the replacement for the same reason. One reported pattern traded for another. splitQuoteAuthor() scans for the first `--` that has whitespace on both sides. Linear, and it needs no reasoning about the regex engine at all. Behaviour is identical to the original regex, checked case by case against it: separator, no separator, several separators, tabs, wide gaps, `a--b` without spaces, leading and trailing separators, empty string. All nine are covered by tests, plus one asserting it stays fast on a 50k whitespace run. * security(admin): derive the session signing key with scrypt getSigningKey() ran the admin password through a single SHA-256 digest. It is key derivation rather than password storage, so it was never a stored-hash problem — but if the derived key ever leaked, one fast hash makes recovering the password by brute force cheap. CodeQL flags it as js/insufficient-password-hash and, for this particular alert, has a point. scrypt now. Two details that matter: The salt has to be stable. A random salt would produce a different key on every call and invalidate every session; it is derived from AUTH_SECRET, which is deployment-specific. Verified across separate processes: same inputs produce a verifying token, so a restart or redeploy does not log everyone out. The result is cached for the process lifetime. scrypt is deliberately slow and getSigningKey() runs on every admin request — deriving per call would add ~24ms to each one. The cache key is a digest of secret plus password, so a rotation misses the cache and derives again, and no extra plaintext copy of the password is kept around. Measured: first derivation 24ms, subsequent calls 0.12ms. Password change and secret change both invalidate an existing token, checked in separate processes. Note the one-time effect: existing admin sessions are invalidated by the change in derivation, so everyone logs in once more. * security(admin): key the signing-key cache on its inputs, not a digest #441 removed the SHA-256 digest of the admin password from the key derivation and introduced a new one three lines above it, as the cache key. Same rule, same file: CodeQL reported it immediately. The comment justifying it was wrong too. It claimed no second plaintext copy of the password was retained, while building the digest input allocates exactly that in order to hash it. The cache now holds the two input strings and compares them directly. They are the same objects the env and install caches already hold, so nothing extra is retained, and no fast hash of the password exists in memory for the life of the process. Re-verified after the change, in separate processes: a token from one process verifies in another with the same inputs, a changed password or secret rejects it, first derivation 24ms, cached calls 0.001ms. That leaves scrypt as the only place the password is hashed here. The two HMACs further down operate on the derived key and on token data, not on the password; the constant-time comparison in verifyAdminPassword is the previously dismissed one. --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
2026-08-14 16:55:07 +02:00
font-family: inherit;
feat: add visual admin panel with page builder and settings editor - Add /admin route with password-protected visual page builder - Page Builder: manage hero images, standalone albums, subpages, and sections - Album Picker: browse all shared Immich albums with search and filtering - Settings Editor: theme, grid, footer, legal, SEO configuration - YAML service with atomic writes and automatic backups (content/.backups/) - HMAC-signed admin sessions (24h expiry, HttpOnly cookies) - API endpoints: /api/admin/{auth,gallery,settings,albums,reload} - Enable with ADMIN_PASSWORD env var; disabled by default - invalidateConfigCache() export for hot-reload after saves
2026-05-29 17:04:37 +02:00
font-size: 0.875rem;
font-weight: 500;
release: v0.11.0 — journal fixes, admin URLs, design system cleanup (#432) * fix(screenshots): sharp-Typen fuer 0.34 und 0.35 gleichzeitig (#410) sharp 0.35 ist von `export =` auf ESM umgestellt: der Modul-Namespace ist nicht mehr aufrufbar, die Factory sitzt unter .default. Der Type-Check brach damit in scripts/screenshots.ts weg, sobald der Next-Bump (#402) sharp von 0.34.5 auf 0.35.3 mitzieht -- sharp ist hier keine deklarierte Dependency, sondern kommt ueber Next mit. Die Form wird jetzt aus dem installierten Paket abgeleitet statt festgeschrieben, zur Laufzeit wie im Typ. Geprueft mit beiden Versionen: tsc laeuft mit 0.34.5 und mit 0.35.3 fehlerfrei durch. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(deps): bump the nextjs group across 1 directory with 2 updates (#402) Bumps the nextjs group with 2 updates in the / directory: [next](https://github.com/vercel/next.js) and [eslint-config-next](https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next). Updates `next` from 16.2.12 to 16.3.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/compare/v16.2.12...v16.3.0) Updates `eslint-config-next` from 16.2.12 to 16.3.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/commits/v16.3.0/packages/eslint-config-next) --- updated-dependencies: - dependency-name: eslint-config-next dependency-version: 16.3.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: nextjs - dependency-name: next dependency-version: 16.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nextjs ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps-dev): bump prettier from 3.8.3 to 3.9.6 (#405) Bumps [prettier](https://github.com/prettier/prettier) from 3.8.3 to 3.9.6. - [Release notes](https://github.com/prettier/prettier/releases) - [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md) - [Commits](https://github.com/prettier/prettier/compare/3.8.3...3.9.6) --- updated-dependencies: - dependency-name: prettier dependency-version: 3.9.6 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * docs(changelog): Unreleased-Sektion fuer die Bumps nach v0.10.0 (#413) Die Dependency-PRs sind nach dem Release auf dev gelandet, teils auch auf main. Ohne Eintrag waeren sie beim naechsten Release unsichtbar -- inklusive Next 16.3.0, das CVE-2025-13465 mitbringt. Ausserdem im 0.10.0-Abschnitt nachgetragen, dass der Trivy-Scan bis #409 nie gelaufen ist. Der Fix steckt im Tag v0.10.0, fehlte aber in der Aufzaehlung -- und "Images werden bei jedem Publish gescannt" stand im Changelog, waehrend der Job im Action-Setup abbrach. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(gallery): per-album sort order, independent of Immich (#408) (#414) Album order was dictated entirely by Immich: getAlbum() sorted by the album's own asc/desc flag, so a Folio album always mirrored the archive. A curated series has a narrative order that has nothing to do with capture time, and changing the Immich album's sort to fit the website changes it for the archive too. Adds an optional per-album `sort` in gallery.yaml, editable in /admin, defaulting to today's behaviour so every existing config is unchanged: immich (default) | newest | oldest | filename | manual `manual` is a pinned *prefix*: `assetOrder` lists only the photos placed by hand, everything else follows in the album's Immich order. A full permutation of a 2,000-photo album would be ~80 KB of UUIDs in a file that is rewritten and copied to content/.backups/ on every admin save. It also makes drift fall out for free — photos removed in Immich never match, new ones land in the tail rather than being hidden. Sorting is applied after the cache read, not before the cache write, so the LRU keeps one canonical Immich-ordered copy per album. That avoids putting the mode in the cache key, lets a config change take effect without depending on invalidation, and keeps the stale-serving path correct. cache.get() returns the stored object by reference, so withSort() returns a shallow clone with a new array — sorting in place would reorder the shared entry, and under request coalescing every concurrent caller would be sorting the same array. Also fixes a prerequisite bug: /api/admin/albums/[albumId]/assets read album.assets from GET /albums/:id, which Immich 3.x no longer populates (lib/immich.ts:507). The hero picker's "This Album" tab returned nothing and threw outright when the key was absent. It now goes through the client's paginated metadata search, with ?types=all to opt videos in for the reorder editor. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): drop decorative emoji from the sort select labels (#415) An <option> cannot contain markup, so the SVG set in Icons is not reachable there — but a decorative emoji is not a substitute for it. Plain text instead; the album card badge already uses a real icon. The remaining emoji in the admin panel (asset picker tabs, section headings, layout picker options) predate this branch and are left for a separate cleanup. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): replace emoji icons with the shared SVG icon set (#416) The admin panel mixed two icon conventions: inline SVGs from `Icons.tsx` in most components, and decorative emoji in the asset picker and a few PageBuilder labels. Emoji render inconsistently across platforms, ignore the accent colour, and cannot inherit the `.svg-icon` sizing rules. - Icons.tsx: add `IconStar` (filled — it marks a state, not an action) and `IconImage`. - AssetPicker: the three tab labels and the favourite tile badge now use IconFolder / IconStar / IconImage. - PageBuilder: the "Standalone Albums" and "Subpages" headings use the icon set instead of an emoji. - PageBuilder: the layout picker drops its emoji for plain text. An <option> cannot contain markup, so an SVG is impossible there and a decorative glyph is not a substitute. - admin.css: align icon and label in the picker tabs, and swap the favourite badge's text-shadow for drop-shadow, which is what applies to an inline SVG. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): fold PageBuilder's local icons into the shared Icons module (#418) * refactor(admin): fold PageBuilder's local icons into the shared module PageBuilder.tsx carried its own `Icons` object duplicating most of the glyphs already exported by Icons.tsx, with hardcoded sizes and slightly divergent paths. Migrate all 32 call sites to the shared module and delete the local object. Five glyphs had no counterpart and are added to Icons.tsx as 1:1 ports of the local paths: IconX, IconPlus, IconHome, IconCopy, IconImage. The local ExternalLink and Check are dropped rather than ported — both had zero call sites. Two glyphs change shape slightly, which is the point of consolidating: the shared IconCamera includes the viewfinder bump the local copy omitted, and drag handles now use IconGripVertical. IconGripVertical uses the module's square 24x24 viewBox, so `.svg-drag` goes from 12x18 to 18x18 — the old non-square box would letterbox the glyph down to 12x12 and shrink the handle. * fix(admin): resolve icon-module integration after #416 Merging dev brought in #416, which added a second IconImage to Icons.tsx and two <Icons.Camera>/<Icons.Folder> section headers that reference the local Icons object this PR removes. Git merged both cleanly but the result did not type-check. - drop the duplicate IconImage (both copies were byte-identical) - point the two section headers at the imported IconCamera/IconFolder - refresh the SORT_LABELS comment: the icon set is imported now, not declared below --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> * fix(config): allow an empty gallery, guard against a double /api suffix (#421) An empty gallery is now a valid, rendered state instead of a throw: deriveGallery() no longer requires at least one album or subpage, so a deployment with no albums yet renders a bare homepage the owner can fill in via /admin. getConfig() also stops appending /api to an Immich URL that already ends in it, which previously produced .../api/api and broke every upstream request. Includes a restore of the per-album sort test cases, which the branch had lost by being cut before #408/#414. * feat(admin): favicon upload, served from the content volume (#422) Adds a bundled default favicon, an upload widget in admin Settings > General, and a route that serves the icon from the writable content/ volume with a fallback to the bundled default. Raster uploads (PNG/ICO/JPEG) are wrapped in an SVG container; the response carries its own CSP so an uploaded SVG cannot execute script on the origin. The GET route revalidates with an ETag instead of caching immutably, so a newly uploaded icon shows up immediately. Uploads are written via temp file + rename, and a Reset button restores the bundled default. * ci: flag unformatted files in a PR, without blocking it (#424) Prettier is configured as an error rule in eslint.config.mjs but has never run in CI, so part of the tree predates it. A final CI step now diffs against the PR base, runs prettier --list-different over the changed files, and emits a warning annotation per offender plus a job summary. Advisory by design: it never fails the job. Blocking would turn a PR red for merely touching a file that was already unformatted, and normalising the tree in one commit would wreck git blame and conflict with the PRs in flight. Requires fetch-depth: 0, since diffing against the base needs its history. * feat(install): first-run wizard gated by a one-time setup token (#419) Adds /install, a four-step first-run wizard: connect to Immich, optionally pick albums, name the site, finish. It verifies the credentials against the Immich server before writing anything, then writes gallery.yaml, settings.yaml and a content/install.json carrying the Immich credentials and a generated site secret. install.json exists because a running process cannot pick up new env vars — the wizard has to write configuration that takes effect without a restart. getInstallCredentials() merges it under the real environment, so env vars always win and rotation stays a matter of setting one. Both the page and the API routes are gated by a one-time setup token printed to the server log, so a deployment that is reachable before gallery.yaml exists cannot be configured by whoever finds it first. The token is stored in content/.setup-token (0600) rather than a module variable: Next.js bundles the page and each route handler separately, so a module-level token left the page and the API disagreeing inside one process and the wizard stuck on step 1. It is removed once the install completes. The admin password is stored as an scrypt hash using the scheme lib/auth.ts already applies to album passwords; a plaintext ADMIN_PASSWORD env var keeps working. * docs: document the setup wizard, fix the read-only content mount (#425) Quick Start now leads with the /install wizard, with the hand-written YAML route kept alongside it, and a First-Run Setup section covers the setup token, the files the wizard writes, and env-var precedence. Two corrections: both Docker examples mounted content/ as :ro, which silently breaks the wizard, the admin panel and the backup rotation alike — docs/admin-panel.md already said so and the README contradicted it. And nothing documented that content/install.json holds the Immich API key, so a backup of content/ is a backup of credentials. Also adds a Contributors section crediting the people whose work is in the project. * feat(admin): floating save bar pinned to the bottom of the viewport (#426) The save bar was the first, static element inside .admin-main. Since the document itself scrolls, it left the viewport as soon as you scrolled down — editing a subpage section or a settings block far below gave no visible dirty hint and no reachable save button. Replace it with a bottom-pinned floating bar shared by both editors. It only mounts while there is something to act on (unsaved changes, an in-flight save, or a result message), so it never covers content while idle. The success message clears after 5s, which hides the bar again. - new SaveBar component, replacing the duplicated markup in PageBuilder and SettingsEditor - adopt the previously unused .floating-save-bar CSS: slide-in keyframes (carrying translateX(-50%)), dirty border, wrap/gap, mobile variant and a prefers-reduced-motion opt-out; z-index 900 keeps it below modals - .admin-main gains bottom padding so the bar never covers page content - drop the now-unreachable idle hints: the ⌘S hint becomes a button title, the Live Sync note becomes a static line above the settings layout - header "Site" link now bypasses the cache (/?fresh=1), so the preview stays reachable when the bar is hidden Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(admin): themed listbox for the album sort control (#427) The per-album "Photo order" control was a native <select>. Because an <option> cannot contain markup, its choices could not use the admin panel's currentColor SVG set — the reason #415 had to fall back to plain text after dropping the emoji labels. Adds a Listbox component implementing the ARIA combobox/listbox pattern, so options can render a glyph beside their label: - DOM focus stays on the trigger button; the active option is announced through aria-activedescendant, keeping focus management to one element - Keyboard: arrows (clamped at the ends, like a native select), Home/End, Enter/Space to commit, Escape to cancel, Tab commits and moves on, and prefix type-ahead with a repeat-key cycle - Outside dismissal on pointerdown, so a press starting outside closes the popup before the click retargets The sort options now carry an icon each: calendar, arrow-down, arrow-up, an A→Z marker, and the drag glyph for manual — matching the badge the album card already shows. SORT_LABELS stays plain text because the badge feeds it to a title attribute. Closes #417 Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(git): ignore generated design handoff folders * fix(admin): stop the album sort dropdown clipping, and simplify the panel (#428) * fix(admin): render listbox popup in a portal so it escapes modal clipping The sort control's popup was position:absolute inside three clipping ancestors (.album-drawer overflow:hidden > .album-drawer-body overflow-y:auto > .modal-right-column overflow-y:auto), so it was cut off at the bottom of the Edit Album Details modal. z-index could not help: clipping happens before stacking. It also always hung below the trigger, with no flip. Portal the popup to document.body and position it from the trigger's viewport rect, flipping above when there is more room there and capping max-height to the space available so it scrolls internally rather than overflowing. It is dismissed on scroll and resize, since the anchor is only measured on open. The outside-pointerdown handler now also treats the popup as inside; without that the portalled list counts as outside, and a click on an option would close it before the selection commits. * refactor(admin): single-column album details panel The left column spent 1.2fr on a cover thumbnail and three stat rows, two of which (Status, Custom Hero) only restated the form fields opposite them, while the form itself was squeezed into 1.8fr behind a second nested scroller. Stack the drawer in one column instead: cover as a banner, then the form at full width, with the UUID moved into the footer. The body is now the only scroll container, which also removes one of the ancestors that was clipping the sort popup. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> * fix(admin): give the portalled listbox its theme back, lock the page behind modals (#429) Two defects in the album editor. The sort listbox popup painted transparent. Every --admin-* variable is scoped to .admin-layout, and since the popup moved into document.body it sits outside that subtree, so background/border/text all resolved to nothing. It now carries its own copy of the palette in both colour schemes, plus the font it no longer inherits. Scrolling inside a modal also moved the page behind it. No admin modal ever locked body scroll: the overlay covers the page but does not absorb wheel events, so a scroll starting on the backdrop — or continuing past the end of the modal's own scroller — reaches the document. overscroll-behavior cannot cover that case on its own, because it only applies to scroll containers and the backdrop is not one. useScrollLock freezes body while a modal is open and compensates for the width the scrollbar gives up, so nothing shifts underneath. Each lock restores the inline value it found, which makes nesting work without a counter — a picker opened from the drawer restores the drawer's hidden state instead of clearing it. Applied to both drawers and all four picker modals, which share the defect. overscroll-behavior: contain on the scrollers stops the chaining they can handle themselves. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com> * fix(security): allow unsafe-eval in CSP script-src during dev mode * feat(journal): add Journal Studio with split-screen editor, live preview and dedicated routes * fix(build): separate client parser from server journal-service and fix build type errors * fix(journal): Fotos rendern, Layout und Lightbox-Steuerung korrigieren Fünf unabhängige Fehler in der öffentlichen Journal- und Essay-Ansicht: * Foto-Blöcke wurden nie angezeigt. EssayView löst ein Foto über PhotoItem.id auf, und das sind verschlüsselte Tokens — die Blöcke aus dem Markdown tragen aber rohe Asset-UUIDs. Jede Zuordnung lief ins Leere, und nicht auflösbare Blöcke werden still verworfen. Die IDs werden jetzt serverseitig übersetzt; damit verschwinden nebenbei die rohen UUIDs aus dem Client-Payload, die dort laut Projektregel nie auftauchen dürfen. Nicht auflösbare Referenzen werden geloggt. * Überschriften standen weiter links als der Fließtext. Jeder Block hatte einzeln `max-width: 68ch`, und `ch` ist relativ zur Schrift des Elements — die Serif-Überschrift ergab eine breitere Spalte. Ersetzt durch eine gemeinsame, font-unabhängige `--essay-measure`. * Fullbleed-Fotos bluteten nur nach links aus: `.essay-figure` ist `width: 100%`, wodurch die Box überbestimmt ist und der negative rechte Margin verworfen wird. * Foto-Paare stellten beide Bilder gleich breit dar, wodurch ein Hochformat neben einem Querformat doppelt so hoch wurde. Jetzt eine Justified-Reihe: Breite proportional zum Seitenverhältnis, dadurch exakt gleiche Höhen ohne Beschnitt. * Die Lightbox hatte im Journal keine Tastatursteuerung und keine Scroll-Sperre — beides lag in PhotoGrid, also nur im Album-Raster. Verlagert in die Lightbox selbst, der doppelte Handler in PhotoGrid entfernt (sonst wäre pro Pfeildruck zwei Bilder weitergesprungen). Zusätzlich sind Proofing-Herzen und das EXIF-Panel im redaktionellen Modus abschaltbar und im Journal aus: Client-Proofing ist ein Übergabe-Workflow für Alben, keine Funktion einer Reportage. Auf der Übersicht wurde der Untertitel doppelt gerendert, weil extractExcerpt() auf ihn zurückfällt. * feat(admin): eigene URLs für alle Bereiche und überarbeiteter Journal Studio Das Panel war eine einzige Client-Komponente, die ihre Tabs über useState umschaltet: keine Route pro Bereich, kein Deep-Link, kein Zurück-Button, und nach jedem Reload landete man wieder auf "Pages". Auch der Journal-Editor hatte keine eigene URL. Jetzt sieben echte Routen (/admin, /admin/pages, /admin/journal, /admin/journal/<slug>, /admin/settings, /admin/settings/<section>, /admin/analytics). Die Shell mit Auth-Prüfung und Kopfzeile sitzt im Layout und umschließt children — so bleibt die Session-Prüfung über Routenwechsel montiert, statt bei jedem Tab-Wechsel neu zu laufen und den Spinner aufblitzen zu lassen. Unbekannte Settings-Sections fallen auf General zurück. Im selben Zug der Journal Studio, der die Routing-Änderung ohnehin berührt: * Alle Eingabefelder nutzten die Klasse `admin-input`, die in keinem CSS definiert war — sie fielen auf Browser-Defaults zurück. Jetzt gestylt, gescoped, damit der generische Name nicht ins übrige Panel leckt. * Der Split View ist per Divider verschiebbar (Maus, Tastatur, Doppelklick zum Zurücksetzen), Breite in localStorage. * Das Studio bricht aus der 1120px-Spalte aus, die Preview hat Platz. * Die Preview zeigte für jedes Foto fest 3:2 und log damit über das Layout der veröffentlichten Seite; die echten Verhältnisse werden jetzt an den Thumbnails gemessen. * Blöcke mit alten positionsbasierten Foto-Referenzen werden markiert — die lassen sich auf einer eigenständigen Journal-Seite nicht auflösen und verschwanden bisher stillschweigend. * Blocktyp-Chips als gemeinsame Komponente, monochrom und per Icon unterschieden statt in einer eigenen Blau/Lila/Orange-Palette, die sonst nirgends im Panel vorkommt. * Emojis raus, SVG-Icons rein. * fix(admin): Designsystem-Lücken im Panel schließen Eine systematische Suche nach Klassen, die im TSX benutzt, aber in keinem CSS definiert sind, hat vier Stellen mit demselben Muster gefunden: * `admin-btn-secondary` und `admin-btn-danger` existierten nicht. Sämtliche Löschen-Buttons sahen aus wie normale Buttons — keine Warnwirkung. Als `.admin-btn.admin-btn-danger` geschrieben, weil die Varianten mit den Größenklassen kombiniert werden, die weiter unten ihren eigenen Hintergrund setzen. * `page-progress-fill` fehlte: die Balken im Analytics-Panel waren leere Rinnen, der Wert unsichtbar. Ebenso `analytics-empty` und `admin-loading-container`. * `subpage-drawer-section`, `subpage-drawer-title-group` und `input-with-icon` im PageBuilder waren wirkungslos und teils mit Inline-Styles notdürftig kompensiert. * `grid-card-preview` fehlte, wodurch alle Layout-Vorschauen auf Höhe null kollabierten. Nur "Showcase" war sichtbar — und das aus Versehen, weil sein Tile `hero-tile` hieß und damit die `aspect-ratio` einer fremden PageBuilder-Klasse erbte. Umbenannt. Dazu die Theme-Vorschauen, die praktisch identisch aussahen: alle sieben zeigten dieselben drei quadratischen Kacheln, einziger Unterschied war die Hintergrundfarbe. Sie spiegeln jetzt die echten Preset-Daten aus lib/config/theme.ts — Schriftcharakter, Eckradius, Rasterdichte, Passepartout bzw. Schatten. Die Kopfzeile richtet sich an einer gemeinsamen Steuerhöhe aus. Der "Site"-Link war höher als die Buttons daneben: `.admin-btn` hatte keine explizite line-height, und <button> bekommt box-sizing: border-box vom Browser, <a> nicht. Die Statusanzeige setzte weder Schriftfamilie noch -größe und fiel auf den Browser-Default zurück — sie war nie Teil des Designsystems. Jetzt gleiche Höhe und Typografie, Pillenform als Zustandsanzeige, Trenner zur Aktionsgruppe. Das dauerhafte Pulsieren des grünen Punkts entfällt; Animation bleibt den Zuständen vorbehalten, die Aufmerksamkeit brauchen. Restliche Emojis durch SVG-Icons ersetzt. * feat(admin): add scroll-to-top toggle and SVG arrow The back-to-top button was always on and drew its arrow with the ↑ text character. Add a `scrollToTop` setting (General section in the admin panel, defaults to on so existing sites are unaffected) and replace the glyph with a stroked SVG that inherits currentColor across all presets. Scroll handling is now rAF-throttled, and prefers-reduced-motion turns off both the hover lift and the smooth scroll. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * security(journal): escape author HTML instead of filtering it CodeQL flags 26 high-severity alerts on the release PR; the bulk of them point at sanitizeHtml(), a denylist of three regexes whose output goes into dangerouslySetInnerHTML. I reproduced the bypasses before changing anything — all four pass the old filter: <img src=x onerror=alert(1)> unquoted handler, regex wants quotes <img src=x onerror='alert(1)'> single quotes, same reason <svg onload=alert(1)> not a <script> tag javasjavascript:cript:alert(1) one-pass replace, the rest recombines Plus an attribute breakout in the link renderer, which interpolated the URL into href="${url}" unescaped: [x](" onmouseover=alert(1) x=") -> <a href="" onmouseover=alert(1" ...> Replaced with escaping. Every `&<>"'` in author text becomes an entity before any markdown rule runs, so the only tags in the output are the ones renderInlineMarkdown builds itself and a URL cannot leave its attribute. Link schemes are now an allowlist (http, https, mailto, tel, relative, anchor); anything else renders as plain text. The serializer needed decodeHtmlEntities to match: without it a save would write `&lt;` into the Markdown file and the next parse would escape the `&` again, corrupting the text further on every round trip. A test covers parse -> serialize -> parse stability. Two existing tests asserted the old behaviour and were rewritten rather than deleted: one expected the script tag to be *removed* from the output, the other expected the substring "onerror" to be absent. Both now assert the property that matters — that no tag can form — because `onerror` surviving as inert text is fine. Exploitation required admin access either way: journal and essay text comes from the studio or from content/*.md. This removes the weakness, it does not close an open door. * fix(journal): contain file paths, fix frontmatter escaping, defuse two regexes Follow-up to the CodeQL findings on release PR #432. I went through all 23 alerts individually; this addresses the ones that are worth addressing and documents the ones that are not. Path containment (12 alerts, all false positives). Every path built from a slug goes through isValidSlug(), a strict `/^[a-zA-Z0-9_-]+$/` allowlist — verified against `../../etc/passwd`, `foo/../../bar`, `a/b`, `..` and friends, all rejected. CodeQL cannot see it because the check lives in another module. Added a containedPath() helper that resolves the path and refuses anything landing outside the content directory: a second lock on a door that was already locked, and a barrier the analysis can follow. Also removed the dead `slug.endsWith('.md')` branches — isValidSlug rejects dots, so they could never be taken. Frontmatter escaping (1 alert, a real bug). The serializer escaped `"` but not `\`, and the parser never unescaped anything. A title containing either character gained a backslash on every save/load cycle: Path C:\Users "quoted" -> Path C:\\Users \"quoted\" -> ... Escaping now covers the backslash first and the parser undoes both. A round trip test covers quotes, backslashes, colons and apostrophes. Two of three ReDoS regexes (2 alerts). The heading pattern had `\s+` next to `(.+)`, which overlap, so the engine tried every split of the whitespace run before failing; it is `[ \t]+` and `(\S.*)` now. The quote author pattern wrapped a lazy group around an optional group — the quadratic case — and is an index split on the first separator now. The third regex, the bold/italic pass, is deliberately left alone. Rewriting it with a negated class removes the backtracking but breaks nesting: `**bold *and italic* here**` renders as `*<em>bold </em>and italic<em> here</em>*`. The input is Markdown from an authenticated admin, never a visitor, so the worst case is an author slowing down their own page. The comment in the code says so. Not addressed: 5 js/insufficient-password-hash alerts. They ask for a slow KDF where the code uses SHA-256/HMAC — correct in general, but the admin password comes from an environment variable and is never stored, so a stronger KDF protects nothing that is not already in plaintext in the environment. 399 unit tests pass (18 new), build and tsc clean. * fix(journal): split the quote author by scanning, not by pattern Cleaning up after myself. #439 replaced the quote author regex `/^(.*?)(?:\s+--\s+(.+))?$/` — a lazy group around an optional one, the quadratic case — with `/\s+--\s+/`, and CodeQL promptly flagged the replacement for the same reason. One reported pattern traded for another. splitQuoteAuthor() scans for the first `--` that has whitespace on both sides. Linear, and it needs no reasoning about the regex engine at all. Behaviour is identical to the original regex, checked case by case against it: separator, no separator, several separators, tabs, wide gaps, `a--b` without spaces, leading and trailing separators, empty string. All nine are covered by tests, plus one asserting it stays fast on a 50k whitespace run. * security(admin): derive the session signing key with scrypt getSigningKey() ran the admin password through a single SHA-256 digest. It is key derivation rather than password storage, so it was never a stored-hash problem — but if the derived key ever leaked, one fast hash makes recovering the password by brute force cheap. CodeQL flags it as js/insufficient-password-hash and, for this particular alert, has a point. scrypt now. Two details that matter: The salt has to be stable. A random salt would produce a different key on every call and invalidate every session; it is derived from AUTH_SECRET, which is deployment-specific. Verified across separate processes: same inputs produce a verifying token, so a restart or redeploy does not log everyone out. The result is cached for the process lifetime. scrypt is deliberately slow and getSigningKey() runs on every admin request — deriving per call would add ~24ms to each one. The cache key is a digest of secret plus password, so a rotation misses the cache and derives again, and no extra plaintext copy of the password is kept around. Measured: first derivation 24ms, subsequent calls 0.12ms. Password change and secret change both invalidate an existing token, checked in separate processes. Note the one-time effect: existing admin sessions are invalidated by the change in derivation, so everyone logs in once more. * security(admin): key the signing-key cache on its inputs, not a digest #441 removed the SHA-256 digest of the admin password from the key derivation and introduced a new one three lines above it, as the cache key. Same rule, same file: CodeQL reported it immediately. The comment justifying it was wrong too. It claimed no second plaintext copy of the password was retained, while building the digest input allocates exactly that in order to hash it. The cache now holds the two input strings and compares them directly. They are the same objects the env and install caches already hold, so nothing extra is retained, and no fast hash of the password exists in memory for the life of the process. Re-verified after the change, in separate processes: a token from one process verifies in another with the same inputs, a changed password or secret rejects it, first derivation 24ms, cached calls 0.001ms. That leaves scrypt as the only place the password is hashed here. The two HMACs further down operate on the derived key and on token data, not on the password; the constant-time comparison in verifyAdminPassword is the previously dismissed one. --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
2026-08-14 16:55:07 +02:00
/*
* Explicit, because <a class="admin-btn"> and <button class="admin-btn">
* otherwise resolve `normal` against different inline boxes — the "Site" link
* ended up half a pixel taller than the buttons next to it.
*/
line-height: 1;
feat: add visual admin panel with page builder and settings editor - Add /admin route with password-protected visual page builder - Page Builder: manage hero images, standalone albums, subpages, and sections - Album Picker: browse all shared Immich albums with search and filtering - Settings Editor: theme, grid, footer, legal, SEO configuration - YAML service with atomic writes and automatic backups (content/.backups/) - HMAC-signed admin sessions (24h expiry, HttpOnly cookies) - API endpoints: /api/admin/{auth,gallery,settings,albums,reload} - Enable with ADMIN_PASSWORD env var; disabled by default - invalidateConfigCache() export for hot-reload after saves
2026-05-29 17:04:37 +02:00
cursor: pointer;
transition: all 0.15s;
}
.admin-btn:disabled {
opacity: 0.5;
cursor: not-allowed;
}
.admin-btn-primary {
fix: admin panel light/dark theme support, improved contrast, and backup confirmation a) Admin panel now respects the site's light/dark theme toggle via CSS custom properties that respond to [data-theme='light'] on <html>. All hardcoded dark colors replaced with semantic CSS variables. b) Improved contrast in dark mode: secondary text changed from #666/#555 to #a0a0a0, muted text from #555 to #707070. All text is now clearly readable against dark backgrounds. c) Backup system was already implemented in yaml-service.ts (creates timestamped backups in content/.backups/ before each save, keeps last 10 versions). Now the UI shows a confirmation message that a backup was created after each successful save.
2026-05-29 17:20:56 +02:00
background: var(--admin-btn-primary-bg);
color: var(--admin-btn-primary-text);
feat: add visual admin panel with page builder and settings editor - Add /admin route with password-protected visual page builder - Page Builder: manage hero images, standalone albums, subpages, and sections - Album Picker: browse all shared Immich albums with search and filtering - Settings Editor: theme, grid, footer, legal, SEO configuration - YAML service with atomic writes and automatic backups (content/.backups/) - HMAC-signed admin sessions (24h expiry, HttpOnly cookies) - API endpoints: /api/admin/{auth,gallery,settings,albums,reload} - Enable with ADMIN_PASSWORD env var; disabled by default - invalidateConfigCache() export for hot-reload after saves
2026-05-29 17:04:37 +02:00
}
.admin-btn-primary:hover:not(:disabled) {
fix: admin panel light/dark theme support, improved contrast, and backup confirmation a) Admin panel now respects the site's light/dark theme toggle via CSS custom properties that respond to [data-theme='light'] on <html>. All hardcoded dark colors replaced with semantic CSS variables. b) Improved contrast in dark mode: secondary text changed from #666/#555 to #a0a0a0, muted text from #555 to #707070. All text is now clearly readable against dark backgrounds. c) Backup system was already implemented in yaml-service.ts (creates timestamped backups in content/.backups/ before each save, keeps last 10 versions). Now the UI shows a confirmation message that a backup was created after each successful save.
2026-05-29 17:20:56 +02:00
background: var(--admin-btn-primary-hover);
feat: add visual admin panel with page builder and settings editor - Add /admin route with password-protected visual page builder - Page Builder: manage hero images, standalone albums, subpages, and sections - Album Picker: browse all shared Immich albums with search and filtering - Settings Editor: theme, grid, footer, legal, SEO configuration - YAML service with atomic writes and automatic backups (content/.backups/) - HMAC-signed admin sessions (24h expiry, HttpOnly cookies) - API endpoints: /api/admin/{auth,gallery,settings,albums,reload} - Enable with ADMIN_PASSWORD env var; disabled by default - invalidateConfigCache() export for hot-reload after saves
2026-05-29 17:04:37 +02:00
}
.admin-btn-ghost {
background: transparent;
fix: admin panel light/dark theme support, improved contrast, and backup confirmation a) Admin panel now respects the site's light/dark theme toggle via CSS custom properties that respond to [data-theme='light'] on <html>. All hardcoded dark colors replaced with semantic CSS variables. b) Improved contrast in dark mode: secondary text changed from #666/#555 to #a0a0a0, muted text from #555 to #707070. All text is now clearly readable against dark backgrounds. c) Backup system was already implemented in yaml-service.ts (creates timestamped backups in content/.backups/ before each save, keeps last 10 versions). Now the UI shows a confirmation message that a backup was created after each successful save.
2026-05-29 17:20:56 +02:00
color: var(--admin-text-secondary);
border: 1px solid var(--admin-border);
feat: add visual admin panel with page builder and settings editor - Add /admin route with password-protected visual page builder - Page Builder: manage hero images, standalone albums, subpages, and sections - Album Picker: browse all shared Immich albums with search and filtering - Settings Editor: theme, grid, footer, legal, SEO configuration - YAML service with atomic writes and automatic backups (content/.backups/) - HMAC-signed admin sessions (24h expiry, HttpOnly cookies) - API endpoints: /api/admin/{auth,gallery,settings,albums,reload} - Enable with ADMIN_PASSWORD env var; disabled by default - invalidateConfigCache() export for hot-reload after saves
2026-05-29 17:04:37 +02:00
}
.admin-btn-ghost:hover:not(:disabled) {
fix: admin panel light/dark theme support, improved contrast, and backup confirmation a) Admin panel now respects the site's light/dark theme toggle via CSS custom properties that respond to [data-theme='light'] on <html>. All hardcoded dark colors replaced with semantic CSS variables. b) Improved contrast in dark mode: secondary text changed from #666/#555 to #a0a0a0, muted text from #555 to #707070. All text is now clearly readable against dark backgrounds. c) Backup system was already implemented in yaml-service.ts (creates timestamped backups in content/.backups/ before each save, keeps last 10 versions). Now the UI shows a confirmation message that a backup was created after each successful save.
2026-05-29 17:20:56 +02:00
color: var(--admin-text);
border-color: var(--admin-border-hover);
feat: add visual admin panel with page builder and settings editor - Add /admin route with password-protected visual page builder - Page Builder: manage hero images, standalone albums, subpages, and sections - Album Picker: browse all shared Immich albums with search and filtering - Settings Editor: theme, grid, footer, legal, SEO configuration - YAML service with atomic writes and automatic backups (content/.backups/) - HMAC-signed admin sessions (24h expiry, HttpOnly cookies) - API endpoints: /api/admin/{auth,gallery,settings,albums,reload} - Enable with ADMIN_PASSWORD env var; disabled by default - invalidateConfigCache() export for hot-reload after saves
2026-05-29 17:04:37 +02:00
}
release: v0.11.0 — journal fixes, admin URLs, design system cleanup (#432) * fix(screenshots): sharp-Typen fuer 0.34 und 0.35 gleichzeitig (#410) sharp 0.35 ist von `export =` auf ESM umgestellt: der Modul-Namespace ist nicht mehr aufrufbar, die Factory sitzt unter .default. Der Type-Check brach damit in scripts/screenshots.ts weg, sobald der Next-Bump (#402) sharp von 0.34.5 auf 0.35.3 mitzieht -- sharp ist hier keine deklarierte Dependency, sondern kommt ueber Next mit. Die Form wird jetzt aus dem installierten Paket abgeleitet statt festgeschrieben, zur Laufzeit wie im Typ. Geprueft mit beiden Versionen: tsc laeuft mit 0.34.5 und mit 0.35.3 fehlerfrei durch. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(deps): bump the nextjs group across 1 directory with 2 updates (#402) Bumps the nextjs group with 2 updates in the / directory: [next](https://github.com/vercel/next.js) and [eslint-config-next](https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next). Updates `next` from 16.2.12 to 16.3.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/compare/v16.2.12...v16.3.0) Updates `eslint-config-next` from 16.2.12 to 16.3.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/commits/v16.3.0/packages/eslint-config-next) --- updated-dependencies: - dependency-name: eslint-config-next dependency-version: 16.3.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: nextjs - dependency-name: next dependency-version: 16.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nextjs ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps-dev): bump prettier from 3.8.3 to 3.9.6 (#405) Bumps [prettier](https://github.com/prettier/prettier) from 3.8.3 to 3.9.6. - [Release notes](https://github.com/prettier/prettier/releases) - [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md) - [Commits](https://github.com/prettier/prettier/compare/3.8.3...3.9.6) --- updated-dependencies: - dependency-name: prettier dependency-version: 3.9.6 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * docs(changelog): Unreleased-Sektion fuer die Bumps nach v0.10.0 (#413) Die Dependency-PRs sind nach dem Release auf dev gelandet, teils auch auf main. Ohne Eintrag waeren sie beim naechsten Release unsichtbar -- inklusive Next 16.3.0, das CVE-2025-13465 mitbringt. Ausserdem im 0.10.0-Abschnitt nachgetragen, dass der Trivy-Scan bis #409 nie gelaufen ist. Der Fix steckt im Tag v0.10.0, fehlte aber in der Aufzaehlung -- und "Images werden bei jedem Publish gescannt" stand im Changelog, waehrend der Job im Action-Setup abbrach. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(gallery): per-album sort order, independent of Immich (#408) (#414) Album order was dictated entirely by Immich: getAlbum() sorted by the album's own asc/desc flag, so a Folio album always mirrored the archive. A curated series has a narrative order that has nothing to do with capture time, and changing the Immich album's sort to fit the website changes it for the archive too. Adds an optional per-album `sort` in gallery.yaml, editable in /admin, defaulting to today's behaviour so every existing config is unchanged: immich (default) | newest | oldest | filename | manual `manual` is a pinned *prefix*: `assetOrder` lists only the photos placed by hand, everything else follows in the album's Immich order. A full permutation of a 2,000-photo album would be ~80 KB of UUIDs in a file that is rewritten and copied to content/.backups/ on every admin save. It also makes drift fall out for free — photos removed in Immich never match, new ones land in the tail rather than being hidden. Sorting is applied after the cache read, not before the cache write, so the LRU keeps one canonical Immich-ordered copy per album. That avoids putting the mode in the cache key, lets a config change take effect without depending on invalidation, and keeps the stale-serving path correct. cache.get() returns the stored object by reference, so withSort() returns a shallow clone with a new array — sorting in place would reorder the shared entry, and under request coalescing every concurrent caller would be sorting the same array. Also fixes a prerequisite bug: /api/admin/albums/[albumId]/assets read album.assets from GET /albums/:id, which Immich 3.x no longer populates (lib/immich.ts:507). The hero picker's "This Album" tab returned nothing and threw outright when the key was absent. It now goes through the client's paginated metadata search, with ?types=all to opt videos in for the reorder editor. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): drop decorative emoji from the sort select labels (#415) An <option> cannot contain markup, so the SVG set in Icons is not reachable there — but a decorative emoji is not a substitute for it. Plain text instead; the album card badge already uses a real icon. The remaining emoji in the admin panel (asset picker tabs, section headings, layout picker options) predate this branch and are left for a separate cleanup. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): replace emoji icons with the shared SVG icon set (#416) The admin panel mixed two icon conventions: inline SVGs from `Icons.tsx` in most components, and decorative emoji in the asset picker and a few PageBuilder labels. Emoji render inconsistently across platforms, ignore the accent colour, and cannot inherit the `.svg-icon` sizing rules. - Icons.tsx: add `IconStar` (filled — it marks a state, not an action) and `IconImage`. - AssetPicker: the three tab labels and the favourite tile badge now use IconFolder / IconStar / IconImage. - PageBuilder: the "Standalone Albums" and "Subpages" headings use the icon set instead of an emoji. - PageBuilder: the layout picker drops its emoji for plain text. An <option> cannot contain markup, so an SVG is impossible there and a decorative glyph is not a substitute. - admin.css: align icon and label in the picker tabs, and swap the favourite badge's text-shadow for drop-shadow, which is what applies to an inline SVG. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): fold PageBuilder's local icons into the shared Icons module (#418) * refactor(admin): fold PageBuilder's local icons into the shared module PageBuilder.tsx carried its own `Icons` object duplicating most of the glyphs already exported by Icons.tsx, with hardcoded sizes and slightly divergent paths. Migrate all 32 call sites to the shared module and delete the local object. Five glyphs had no counterpart and are added to Icons.tsx as 1:1 ports of the local paths: IconX, IconPlus, IconHome, IconCopy, IconImage. The local ExternalLink and Check are dropped rather than ported — both had zero call sites. Two glyphs change shape slightly, which is the point of consolidating: the shared IconCamera includes the viewfinder bump the local copy omitted, and drag handles now use IconGripVertical. IconGripVertical uses the module's square 24x24 viewBox, so `.svg-drag` goes from 12x18 to 18x18 — the old non-square box would letterbox the glyph down to 12x12 and shrink the handle. * fix(admin): resolve icon-module integration after #416 Merging dev brought in #416, which added a second IconImage to Icons.tsx and two <Icons.Camera>/<Icons.Folder> section headers that reference the local Icons object this PR removes. Git merged both cleanly but the result did not type-check. - drop the duplicate IconImage (both copies were byte-identical) - point the two section headers at the imported IconCamera/IconFolder - refresh the SORT_LABELS comment: the icon set is imported now, not declared below --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> * fix(config): allow an empty gallery, guard against a double /api suffix (#421) An empty gallery is now a valid, rendered state instead of a throw: deriveGallery() no longer requires at least one album or subpage, so a deployment with no albums yet renders a bare homepage the owner can fill in via /admin. getConfig() also stops appending /api to an Immich URL that already ends in it, which previously produced .../api/api and broke every upstream request. Includes a restore of the per-album sort test cases, which the branch had lost by being cut before #408/#414. * feat(admin): favicon upload, served from the content volume (#422) Adds a bundled default favicon, an upload widget in admin Settings > General, and a route that serves the icon from the writable content/ volume with a fallback to the bundled default. Raster uploads (PNG/ICO/JPEG) are wrapped in an SVG container; the response carries its own CSP so an uploaded SVG cannot execute script on the origin. The GET route revalidates with an ETag instead of caching immutably, so a newly uploaded icon shows up immediately. Uploads are written via temp file + rename, and a Reset button restores the bundled default. * ci: flag unformatted files in a PR, without blocking it (#424) Prettier is configured as an error rule in eslint.config.mjs but has never run in CI, so part of the tree predates it. A final CI step now diffs against the PR base, runs prettier --list-different over the changed files, and emits a warning annotation per offender plus a job summary. Advisory by design: it never fails the job. Blocking would turn a PR red for merely touching a file that was already unformatted, and normalising the tree in one commit would wreck git blame and conflict with the PRs in flight. Requires fetch-depth: 0, since diffing against the base needs its history. * feat(install): first-run wizard gated by a one-time setup token (#419) Adds /install, a four-step first-run wizard: connect to Immich, optionally pick albums, name the site, finish. It verifies the credentials against the Immich server before writing anything, then writes gallery.yaml, settings.yaml and a content/install.json carrying the Immich credentials and a generated site secret. install.json exists because a running process cannot pick up new env vars — the wizard has to write configuration that takes effect without a restart. getInstallCredentials() merges it under the real environment, so env vars always win and rotation stays a matter of setting one. Both the page and the API routes are gated by a one-time setup token printed to the server log, so a deployment that is reachable before gallery.yaml exists cannot be configured by whoever finds it first. The token is stored in content/.setup-token (0600) rather than a module variable: Next.js bundles the page and each route handler separately, so a module-level token left the page and the API disagreeing inside one process and the wizard stuck on step 1. It is removed once the install completes. The admin password is stored as an scrypt hash using the scheme lib/auth.ts already applies to album passwords; a plaintext ADMIN_PASSWORD env var keeps working. * docs: document the setup wizard, fix the read-only content mount (#425) Quick Start now leads with the /install wizard, with the hand-written YAML route kept alongside it, and a First-Run Setup section covers the setup token, the files the wizard writes, and env-var precedence. Two corrections: both Docker examples mounted content/ as :ro, which silently breaks the wizard, the admin panel and the backup rotation alike — docs/admin-panel.md already said so and the README contradicted it. And nothing documented that content/install.json holds the Immich API key, so a backup of content/ is a backup of credentials. Also adds a Contributors section crediting the people whose work is in the project. * feat(admin): floating save bar pinned to the bottom of the viewport (#426) The save bar was the first, static element inside .admin-main. Since the document itself scrolls, it left the viewport as soon as you scrolled down — editing a subpage section or a settings block far below gave no visible dirty hint and no reachable save button. Replace it with a bottom-pinned floating bar shared by both editors. It only mounts while there is something to act on (unsaved changes, an in-flight save, or a result message), so it never covers content while idle. The success message clears after 5s, which hides the bar again. - new SaveBar component, replacing the duplicated markup in PageBuilder and SettingsEditor - adopt the previously unused .floating-save-bar CSS: slide-in keyframes (carrying translateX(-50%)), dirty border, wrap/gap, mobile variant and a prefers-reduced-motion opt-out; z-index 900 keeps it below modals - .admin-main gains bottom padding so the bar never covers page content - drop the now-unreachable idle hints: the ⌘S hint becomes a button title, the Live Sync note becomes a static line above the settings layout - header "Site" link now bypasses the cache (/?fresh=1), so the preview stays reachable when the bar is hidden Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(admin): themed listbox for the album sort control (#427) The per-album "Photo order" control was a native <select>. Because an <option> cannot contain markup, its choices could not use the admin panel's currentColor SVG set — the reason #415 had to fall back to plain text after dropping the emoji labels. Adds a Listbox component implementing the ARIA combobox/listbox pattern, so options can render a glyph beside their label: - DOM focus stays on the trigger button; the active option is announced through aria-activedescendant, keeping focus management to one element - Keyboard: arrows (clamped at the ends, like a native select), Home/End, Enter/Space to commit, Escape to cancel, Tab commits and moves on, and prefix type-ahead with a repeat-key cycle - Outside dismissal on pointerdown, so a press starting outside closes the popup before the click retargets The sort options now carry an icon each: calendar, arrow-down, arrow-up, an A→Z marker, and the drag glyph for manual — matching the badge the album card already shows. SORT_LABELS stays plain text because the badge feeds it to a title attribute. Closes #417 Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(git): ignore generated design handoff folders * fix(admin): stop the album sort dropdown clipping, and simplify the panel (#428) * fix(admin): render listbox popup in a portal so it escapes modal clipping The sort control's popup was position:absolute inside three clipping ancestors (.album-drawer overflow:hidden > .album-drawer-body overflow-y:auto > .modal-right-column overflow-y:auto), so it was cut off at the bottom of the Edit Album Details modal. z-index could not help: clipping happens before stacking. It also always hung below the trigger, with no flip. Portal the popup to document.body and position it from the trigger's viewport rect, flipping above when there is more room there and capping max-height to the space available so it scrolls internally rather than overflowing. It is dismissed on scroll and resize, since the anchor is only measured on open. The outside-pointerdown handler now also treats the popup as inside; without that the portalled list counts as outside, and a click on an option would close it before the selection commits. * refactor(admin): single-column album details panel The left column spent 1.2fr on a cover thumbnail and three stat rows, two of which (Status, Custom Hero) only restated the form fields opposite them, while the form itself was squeezed into 1.8fr behind a second nested scroller. Stack the drawer in one column instead: cover as a banner, then the form at full width, with the UUID moved into the footer. The body is now the only scroll container, which also removes one of the ancestors that was clipping the sort popup. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> * fix(admin): give the portalled listbox its theme back, lock the page behind modals (#429) Two defects in the album editor. The sort listbox popup painted transparent. Every --admin-* variable is scoped to .admin-layout, and since the popup moved into document.body it sits outside that subtree, so background/border/text all resolved to nothing. It now carries its own copy of the palette in both colour schemes, plus the font it no longer inherits. Scrolling inside a modal also moved the page behind it. No admin modal ever locked body scroll: the overlay covers the page but does not absorb wheel events, so a scroll starting on the backdrop — or continuing past the end of the modal's own scroller — reaches the document. overscroll-behavior cannot cover that case on its own, because it only applies to scroll containers and the backdrop is not one. useScrollLock freezes body while a modal is open and compensates for the width the scrollbar gives up, so nothing shifts underneath. Each lock restores the inline value it found, which makes nesting work without a counter — a picker opened from the drawer restores the drawer's hidden state instead of clearing it. Applied to both drawers and all four picker modals, which share the defect. overscroll-behavior: contain on the scrollers stops the chaining they can handle themselves. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com> * fix(security): allow unsafe-eval in CSP script-src during dev mode * feat(journal): add Journal Studio with split-screen editor, live preview and dedicated routes * fix(build): separate client parser from server journal-service and fix build type errors * fix(journal): Fotos rendern, Layout und Lightbox-Steuerung korrigieren Fünf unabhängige Fehler in der öffentlichen Journal- und Essay-Ansicht: * Foto-Blöcke wurden nie angezeigt. EssayView löst ein Foto über PhotoItem.id auf, und das sind verschlüsselte Tokens — die Blöcke aus dem Markdown tragen aber rohe Asset-UUIDs. Jede Zuordnung lief ins Leere, und nicht auflösbare Blöcke werden still verworfen. Die IDs werden jetzt serverseitig übersetzt; damit verschwinden nebenbei die rohen UUIDs aus dem Client-Payload, die dort laut Projektregel nie auftauchen dürfen. Nicht auflösbare Referenzen werden geloggt. * Überschriften standen weiter links als der Fließtext. Jeder Block hatte einzeln `max-width: 68ch`, und `ch` ist relativ zur Schrift des Elements — die Serif-Überschrift ergab eine breitere Spalte. Ersetzt durch eine gemeinsame, font-unabhängige `--essay-measure`. * Fullbleed-Fotos bluteten nur nach links aus: `.essay-figure` ist `width: 100%`, wodurch die Box überbestimmt ist und der negative rechte Margin verworfen wird. * Foto-Paare stellten beide Bilder gleich breit dar, wodurch ein Hochformat neben einem Querformat doppelt so hoch wurde. Jetzt eine Justified-Reihe: Breite proportional zum Seitenverhältnis, dadurch exakt gleiche Höhen ohne Beschnitt. * Die Lightbox hatte im Journal keine Tastatursteuerung und keine Scroll-Sperre — beides lag in PhotoGrid, also nur im Album-Raster. Verlagert in die Lightbox selbst, der doppelte Handler in PhotoGrid entfernt (sonst wäre pro Pfeildruck zwei Bilder weitergesprungen). Zusätzlich sind Proofing-Herzen und das EXIF-Panel im redaktionellen Modus abschaltbar und im Journal aus: Client-Proofing ist ein Übergabe-Workflow für Alben, keine Funktion einer Reportage. Auf der Übersicht wurde der Untertitel doppelt gerendert, weil extractExcerpt() auf ihn zurückfällt. * feat(admin): eigene URLs für alle Bereiche und überarbeiteter Journal Studio Das Panel war eine einzige Client-Komponente, die ihre Tabs über useState umschaltet: keine Route pro Bereich, kein Deep-Link, kein Zurück-Button, und nach jedem Reload landete man wieder auf "Pages". Auch der Journal-Editor hatte keine eigene URL. Jetzt sieben echte Routen (/admin, /admin/pages, /admin/journal, /admin/journal/<slug>, /admin/settings, /admin/settings/<section>, /admin/analytics). Die Shell mit Auth-Prüfung und Kopfzeile sitzt im Layout und umschließt children — so bleibt die Session-Prüfung über Routenwechsel montiert, statt bei jedem Tab-Wechsel neu zu laufen und den Spinner aufblitzen zu lassen. Unbekannte Settings-Sections fallen auf General zurück. Im selben Zug der Journal Studio, der die Routing-Änderung ohnehin berührt: * Alle Eingabefelder nutzten die Klasse `admin-input`, die in keinem CSS definiert war — sie fielen auf Browser-Defaults zurück. Jetzt gestylt, gescoped, damit der generische Name nicht ins übrige Panel leckt. * Der Split View ist per Divider verschiebbar (Maus, Tastatur, Doppelklick zum Zurücksetzen), Breite in localStorage. * Das Studio bricht aus der 1120px-Spalte aus, die Preview hat Platz. * Die Preview zeigte für jedes Foto fest 3:2 und log damit über das Layout der veröffentlichten Seite; die echten Verhältnisse werden jetzt an den Thumbnails gemessen. * Blöcke mit alten positionsbasierten Foto-Referenzen werden markiert — die lassen sich auf einer eigenständigen Journal-Seite nicht auflösen und verschwanden bisher stillschweigend. * Blocktyp-Chips als gemeinsame Komponente, monochrom und per Icon unterschieden statt in einer eigenen Blau/Lila/Orange-Palette, die sonst nirgends im Panel vorkommt. * Emojis raus, SVG-Icons rein. * fix(admin): Designsystem-Lücken im Panel schließen Eine systematische Suche nach Klassen, die im TSX benutzt, aber in keinem CSS definiert sind, hat vier Stellen mit demselben Muster gefunden: * `admin-btn-secondary` und `admin-btn-danger` existierten nicht. Sämtliche Löschen-Buttons sahen aus wie normale Buttons — keine Warnwirkung. Als `.admin-btn.admin-btn-danger` geschrieben, weil die Varianten mit den Größenklassen kombiniert werden, die weiter unten ihren eigenen Hintergrund setzen. * `page-progress-fill` fehlte: die Balken im Analytics-Panel waren leere Rinnen, der Wert unsichtbar. Ebenso `analytics-empty` und `admin-loading-container`. * `subpage-drawer-section`, `subpage-drawer-title-group` und `input-with-icon` im PageBuilder waren wirkungslos und teils mit Inline-Styles notdürftig kompensiert. * `grid-card-preview` fehlte, wodurch alle Layout-Vorschauen auf Höhe null kollabierten. Nur "Showcase" war sichtbar — und das aus Versehen, weil sein Tile `hero-tile` hieß und damit die `aspect-ratio` einer fremden PageBuilder-Klasse erbte. Umbenannt. Dazu die Theme-Vorschauen, die praktisch identisch aussahen: alle sieben zeigten dieselben drei quadratischen Kacheln, einziger Unterschied war die Hintergrundfarbe. Sie spiegeln jetzt die echten Preset-Daten aus lib/config/theme.ts — Schriftcharakter, Eckradius, Rasterdichte, Passepartout bzw. Schatten. Die Kopfzeile richtet sich an einer gemeinsamen Steuerhöhe aus. Der "Site"-Link war höher als die Buttons daneben: `.admin-btn` hatte keine explizite line-height, und <button> bekommt box-sizing: border-box vom Browser, <a> nicht. Die Statusanzeige setzte weder Schriftfamilie noch -größe und fiel auf den Browser-Default zurück — sie war nie Teil des Designsystems. Jetzt gleiche Höhe und Typografie, Pillenform als Zustandsanzeige, Trenner zur Aktionsgruppe. Das dauerhafte Pulsieren des grünen Punkts entfällt; Animation bleibt den Zuständen vorbehalten, die Aufmerksamkeit brauchen. Restliche Emojis durch SVG-Icons ersetzt. * feat(admin): add scroll-to-top toggle and SVG arrow The back-to-top button was always on and drew its arrow with the ↑ text character. Add a `scrollToTop` setting (General section in the admin panel, defaults to on so existing sites are unaffected) and replace the glyph with a stroked SVG that inherits currentColor across all presets. Scroll handling is now rAF-throttled, and prefers-reduced-motion turns off both the hover lift and the smooth scroll. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * security(journal): escape author HTML instead of filtering it CodeQL flags 26 high-severity alerts on the release PR; the bulk of them point at sanitizeHtml(), a denylist of three regexes whose output goes into dangerouslySetInnerHTML. I reproduced the bypasses before changing anything — all four pass the old filter: <img src=x onerror=alert(1)> unquoted handler, regex wants quotes <img src=x onerror='alert(1)'> single quotes, same reason <svg onload=alert(1)> not a <script> tag javasjavascript:cript:alert(1) one-pass replace, the rest recombines Plus an attribute breakout in the link renderer, which interpolated the URL into href="${url}" unescaped: [x](" onmouseover=alert(1) x=") -> <a href="" onmouseover=alert(1" ...> Replaced with escaping. Every `&<>"'` in author text becomes an entity before any markdown rule runs, so the only tags in the output are the ones renderInlineMarkdown builds itself and a URL cannot leave its attribute. Link schemes are now an allowlist (http, https, mailto, tel, relative, anchor); anything else renders as plain text. The serializer needed decodeHtmlEntities to match: without it a save would write `&lt;` into the Markdown file and the next parse would escape the `&` again, corrupting the text further on every round trip. A test covers parse -> serialize -> parse stability. Two existing tests asserted the old behaviour and were rewritten rather than deleted: one expected the script tag to be *removed* from the output, the other expected the substring "onerror" to be absent. Both now assert the property that matters — that no tag can form — because `onerror` surviving as inert text is fine. Exploitation required admin access either way: journal and essay text comes from the studio or from content/*.md. This removes the weakness, it does not close an open door. * fix(journal): contain file paths, fix frontmatter escaping, defuse two regexes Follow-up to the CodeQL findings on release PR #432. I went through all 23 alerts individually; this addresses the ones that are worth addressing and documents the ones that are not. Path containment (12 alerts, all false positives). Every path built from a slug goes through isValidSlug(), a strict `/^[a-zA-Z0-9_-]+$/` allowlist — verified against `../../etc/passwd`, `foo/../../bar`, `a/b`, `..` and friends, all rejected. CodeQL cannot see it because the check lives in another module. Added a containedPath() helper that resolves the path and refuses anything landing outside the content directory: a second lock on a door that was already locked, and a barrier the analysis can follow. Also removed the dead `slug.endsWith('.md')` branches — isValidSlug rejects dots, so they could never be taken. Frontmatter escaping (1 alert, a real bug). The serializer escaped `"` but not `\`, and the parser never unescaped anything. A title containing either character gained a backslash on every save/load cycle: Path C:\Users "quoted" -> Path C:\\Users \"quoted\" -> ... Escaping now covers the backslash first and the parser undoes both. A round trip test covers quotes, backslashes, colons and apostrophes. Two of three ReDoS regexes (2 alerts). The heading pattern had `\s+` next to `(.+)`, which overlap, so the engine tried every split of the whitespace run before failing; it is `[ \t]+` and `(\S.*)` now. The quote author pattern wrapped a lazy group around an optional group — the quadratic case — and is an index split on the first separator now. The third regex, the bold/italic pass, is deliberately left alone. Rewriting it with a negated class removes the backtracking but breaks nesting: `**bold *and italic* here**` renders as `*<em>bold </em>and italic<em> here</em>*`. The input is Markdown from an authenticated admin, never a visitor, so the worst case is an author slowing down their own page. The comment in the code says so. Not addressed: 5 js/insufficient-password-hash alerts. They ask for a slow KDF where the code uses SHA-256/HMAC — correct in general, but the admin password comes from an environment variable and is never stored, so a stronger KDF protects nothing that is not already in plaintext in the environment. 399 unit tests pass (18 new), build and tsc clean. * fix(journal): split the quote author by scanning, not by pattern Cleaning up after myself. #439 replaced the quote author regex `/^(.*?)(?:\s+--\s+(.+))?$/` — a lazy group around an optional one, the quadratic case — with `/\s+--\s+/`, and CodeQL promptly flagged the replacement for the same reason. One reported pattern traded for another. splitQuoteAuthor() scans for the first `--` that has whitespace on both sides. Linear, and it needs no reasoning about the regex engine at all. Behaviour is identical to the original regex, checked case by case against it: separator, no separator, several separators, tabs, wide gaps, `a--b` without spaces, leading and trailing separators, empty string. All nine are covered by tests, plus one asserting it stays fast on a 50k whitespace run. * security(admin): derive the session signing key with scrypt getSigningKey() ran the admin password through a single SHA-256 digest. It is key derivation rather than password storage, so it was never a stored-hash problem — but if the derived key ever leaked, one fast hash makes recovering the password by brute force cheap. CodeQL flags it as js/insufficient-password-hash and, for this particular alert, has a point. scrypt now. Two details that matter: The salt has to be stable. A random salt would produce a different key on every call and invalidate every session; it is derived from AUTH_SECRET, which is deployment-specific. Verified across separate processes: same inputs produce a verifying token, so a restart or redeploy does not log everyone out. The result is cached for the process lifetime. scrypt is deliberately slow and getSigningKey() runs on every admin request — deriving per call would add ~24ms to each one. The cache key is a digest of secret plus password, so a rotation misses the cache and derives again, and no extra plaintext copy of the password is kept around. Measured: first derivation 24ms, subsequent calls 0.12ms. Password change and secret change both invalidate an existing token, checked in separate processes. Note the one-time effect: existing admin sessions are invalidated by the change in derivation, so everyone logs in once more. * security(admin): key the signing-key cache on its inputs, not a digest #441 removed the SHA-256 digest of the admin password from the key derivation and introduced a new one three lines above it, as the cache key. Same rule, same file: CodeQL reported it immediately. The comment justifying it was wrong too. It claimed no second plaintext copy of the password was retained, while building the digest input allocates exactly that in order to hash it. The cache now holds the two input strings and compares them directly. They are the same objects the env and install caches already hold, so nothing extra is retained, and no fast hash of the password exists in memory for the life of the process. Re-verified after the change, in separate processes: a token from one process verifies in another with the same inputs, a changed password or secret rejects it, first derivation 24ms, cached calls 0.001ms. That leaves scrypt as the only place the password is hashed here. The two HMACs further down operate on the derived key and on token data, not on the password; the constant-time comparison in verifyAdminPassword is the previously dismissed one. --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
2026-08-14 16:55:07 +02:00
/*
* Written as `.admin-btn.admin-btn-*` on purpose: these variants are combined
* with the size classes (`admin-btn-sm`, `admin-btn-xs`), which set their own
* background further down. The doubled class outranks them whatever the order.
*/
/* Neutral action next to a primary one. */
.admin-btn.admin-btn-secondary {
background: var(--admin-bg-elevated);
color: var(--admin-text);
border: 1px solid var(--admin-border);
}
.admin-btn.admin-btn-secondary:hover:not(:disabled) {
background: var(--admin-bg-raised);
border-color: var(--admin-border-hover);
}
/* Destructive action — must read as destructive before it is clicked. */
.admin-btn.admin-btn-danger {
background: transparent;
color: #f87171;
border: 1px solid rgba(239, 68, 68, 0.35);
}
.admin-btn.admin-btn-danger:hover:not(:disabled) {
background: rgba(239, 68, 68, 0.14);
border-color: rgba(239, 68, 68, 0.6);
color: #fca5a5;
}
feat: add visual admin panel with page builder and settings editor - Add /admin route with password-protected visual page builder - Page Builder: manage hero images, standalone albums, subpages, and sections - Album Picker: browse all shared Immich albums with search and filtering - Settings Editor: theme, grid, footer, legal, SEO configuration - YAML service with atomic writes and automatic backups (content/.backups/) - HMAC-signed admin sessions (24h expiry, HttpOnly cookies) - API endpoints: /api/admin/{auth,gallery,settings,albums,reload} - Enable with ADMIN_PASSWORD env var; disabled by default - invalidateConfigCache() export for hot-reload after saves
2026-05-29 17:04:37 +02:00
.admin-btn-sm {
release: v0.11.0 — journal fixes, admin URLs, design system cleanup (#432) * fix(screenshots): sharp-Typen fuer 0.34 und 0.35 gleichzeitig (#410) sharp 0.35 ist von `export =` auf ESM umgestellt: der Modul-Namespace ist nicht mehr aufrufbar, die Factory sitzt unter .default. Der Type-Check brach damit in scripts/screenshots.ts weg, sobald der Next-Bump (#402) sharp von 0.34.5 auf 0.35.3 mitzieht -- sharp ist hier keine deklarierte Dependency, sondern kommt ueber Next mit. Die Form wird jetzt aus dem installierten Paket abgeleitet statt festgeschrieben, zur Laufzeit wie im Typ. Geprueft mit beiden Versionen: tsc laeuft mit 0.34.5 und mit 0.35.3 fehlerfrei durch. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(deps): bump the nextjs group across 1 directory with 2 updates (#402) Bumps the nextjs group with 2 updates in the / directory: [next](https://github.com/vercel/next.js) and [eslint-config-next](https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next). Updates `next` from 16.2.12 to 16.3.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/compare/v16.2.12...v16.3.0) Updates `eslint-config-next` from 16.2.12 to 16.3.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/commits/v16.3.0/packages/eslint-config-next) --- updated-dependencies: - dependency-name: eslint-config-next dependency-version: 16.3.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: nextjs - dependency-name: next dependency-version: 16.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nextjs ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps-dev): bump prettier from 3.8.3 to 3.9.6 (#405) Bumps [prettier](https://github.com/prettier/prettier) from 3.8.3 to 3.9.6. - [Release notes](https://github.com/prettier/prettier/releases) - [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md) - [Commits](https://github.com/prettier/prettier/compare/3.8.3...3.9.6) --- updated-dependencies: - dependency-name: prettier dependency-version: 3.9.6 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * docs(changelog): Unreleased-Sektion fuer die Bumps nach v0.10.0 (#413) Die Dependency-PRs sind nach dem Release auf dev gelandet, teils auch auf main. Ohne Eintrag waeren sie beim naechsten Release unsichtbar -- inklusive Next 16.3.0, das CVE-2025-13465 mitbringt. Ausserdem im 0.10.0-Abschnitt nachgetragen, dass der Trivy-Scan bis #409 nie gelaufen ist. Der Fix steckt im Tag v0.10.0, fehlte aber in der Aufzaehlung -- und "Images werden bei jedem Publish gescannt" stand im Changelog, waehrend der Job im Action-Setup abbrach. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(gallery): per-album sort order, independent of Immich (#408) (#414) Album order was dictated entirely by Immich: getAlbum() sorted by the album's own asc/desc flag, so a Folio album always mirrored the archive. A curated series has a narrative order that has nothing to do with capture time, and changing the Immich album's sort to fit the website changes it for the archive too. Adds an optional per-album `sort` in gallery.yaml, editable in /admin, defaulting to today's behaviour so every existing config is unchanged: immich (default) | newest | oldest | filename | manual `manual` is a pinned *prefix*: `assetOrder` lists only the photos placed by hand, everything else follows in the album's Immich order. A full permutation of a 2,000-photo album would be ~80 KB of UUIDs in a file that is rewritten and copied to content/.backups/ on every admin save. It also makes drift fall out for free — photos removed in Immich never match, new ones land in the tail rather than being hidden. Sorting is applied after the cache read, not before the cache write, so the LRU keeps one canonical Immich-ordered copy per album. That avoids putting the mode in the cache key, lets a config change take effect without depending on invalidation, and keeps the stale-serving path correct. cache.get() returns the stored object by reference, so withSort() returns a shallow clone with a new array — sorting in place would reorder the shared entry, and under request coalescing every concurrent caller would be sorting the same array. Also fixes a prerequisite bug: /api/admin/albums/[albumId]/assets read album.assets from GET /albums/:id, which Immich 3.x no longer populates (lib/immich.ts:507). The hero picker's "This Album" tab returned nothing and threw outright when the key was absent. It now goes through the client's paginated metadata search, with ?types=all to opt videos in for the reorder editor. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): drop decorative emoji from the sort select labels (#415) An <option> cannot contain markup, so the SVG set in Icons is not reachable there — but a decorative emoji is not a substitute for it. Plain text instead; the album card badge already uses a real icon. The remaining emoji in the admin panel (asset picker tabs, section headings, layout picker options) predate this branch and are left for a separate cleanup. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): replace emoji icons with the shared SVG icon set (#416) The admin panel mixed two icon conventions: inline SVGs from `Icons.tsx` in most components, and decorative emoji in the asset picker and a few PageBuilder labels. Emoji render inconsistently across platforms, ignore the accent colour, and cannot inherit the `.svg-icon` sizing rules. - Icons.tsx: add `IconStar` (filled — it marks a state, not an action) and `IconImage`. - AssetPicker: the three tab labels and the favourite tile badge now use IconFolder / IconStar / IconImage. - PageBuilder: the "Standalone Albums" and "Subpages" headings use the icon set instead of an emoji. - PageBuilder: the layout picker drops its emoji for plain text. An <option> cannot contain markup, so an SVG is impossible there and a decorative glyph is not a substitute. - admin.css: align icon and label in the picker tabs, and swap the favourite badge's text-shadow for drop-shadow, which is what applies to an inline SVG. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): fold PageBuilder's local icons into the shared Icons module (#418) * refactor(admin): fold PageBuilder's local icons into the shared module PageBuilder.tsx carried its own `Icons` object duplicating most of the glyphs already exported by Icons.tsx, with hardcoded sizes and slightly divergent paths. Migrate all 32 call sites to the shared module and delete the local object. Five glyphs had no counterpart and are added to Icons.tsx as 1:1 ports of the local paths: IconX, IconPlus, IconHome, IconCopy, IconImage. The local ExternalLink and Check are dropped rather than ported — both had zero call sites. Two glyphs change shape slightly, which is the point of consolidating: the shared IconCamera includes the viewfinder bump the local copy omitted, and drag handles now use IconGripVertical. IconGripVertical uses the module's square 24x24 viewBox, so `.svg-drag` goes from 12x18 to 18x18 — the old non-square box would letterbox the glyph down to 12x12 and shrink the handle. * fix(admin): resolve icon-module integration after #416 Merging dev brought in #416, which added a second IconImage to Icons.tsx and two <Icons.Camera>/<Icons.Folder> section headers that reference the local Icons object this PR removes. Git merged both cleanly but the result did not type-check. - drop the duplicate IconImage (both copies were byte-identical) - point the two section headers at the imported IconCamera/IconFolder - refresh the SORT_LABELS comment: the icon set is imported now, not declared below --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> * fix(config): allow an empty gallery, guard against a double /api suffix (#421) An empty gallery is now a valid, rendered state instead of a throw: deriveGallery() no longer requires at least one album or subpage, so a deployment with no albums yet renders a bare homepage the owner can fill in via /admin. getConfig() also stops appending /api to an Immich URL that already ends in it, which previously produced .../api/api and broke every upstream request. Includes a restore of the per-album sort test cases, which the branch had lost by being cut before #408/#414. * feat(admin): favicon upload, served from the content volume (#422) Adds a bundled default favicon, an upload widget in admin Settings > General, and a route that serves the icon from the writable content/ volume with a fallback to the bundled default. Raster uploads (PNG/ICO/JPEG) are wrapped in an SVG container; the response carries its own CSP so an uploaded SVG cannot execute script on the origin. The GET route revalidates with an ETag instead of caching immutably, so a newly uploaded icon shows up immediately. Uploads are written via temp file + rename, and a Reset button restores the bundled default. * ci: flag unformatted files in a PR, without blocking it (#424) Prettier is configured as an error rule in eslint.config.mjs but has never run in CI, so part of the tree predates it. A final CI step now diffs against the PR base, runs prettier --list-different over the changed files, and emits a warning annotation per offender plus a job summary. Advisory by design: it never fails the job. Blocking would turn a PR red for merely touching a file that was already unformatted, and normalising the tree in one commit would wreck git blame and conflict with the PRs in flight. Requires fetch-depth: 0, since diffing against the base needs its history. * feat(install): first-run wizard gated by a one-time setup token (#419) Adds /install, a four-step first-run wizard: connect to Immich, optionally pick albums, name the site, finish. It verifies the credentials against the Immich server before writing anything, then writes gallery.yaml, settings.yaml and a content/install.json carrying the Immich credentials and a generated site secret. install.json exists because a running process cannot pick up new env vars — the wizard has to write configuration that takes effect without a restart. getInstallCredentials() merges it under the real environment, so env vars always win and rotation stays a matter of setting one. Both the page and the API routes are gated by a one-time setup token printed to the server log, so a deployment that is reachable before gallery.yaml exists cannot be configured by whoever finds it first. The token is stored in content/.setup-token (0600) rather than a module variable: Next.js bundles the page and each route handler separately, so a module-level token left the page and the API disagreeing inside one process and the wizard stuck on step 1. It is removed once the install completes. The admin password is stored as an scrypt hash using the scheme lib/auth.ts already applies to album passwords; a plaintext ADMIN_PASSWORD env var keeps working. * docs: document the setup wizard, fix the read-only content mount (#425) Quick Start now leads with the /install wizard, with the hand-written YAML route kept alongside it, and a First-Run Setup section covers the setup token, the files the wizard writes, and env-var precedence. Two corrections: both Docker examples mounted content/ as :ro, which silently breaks the wizard, the admin panel and the backup rotation alike — docs/admin-panel.md already said so and the README contradicted it. And nothing documented that content/install.json holds the Immich API key, so a backup of content/ is a backup of credentials. Also adds a Contributors section crediting the people whose work is in the project. * feat(admin): floating save bar pinned to the bottom of the viewport (#426) The save bar was the first, static element inside .admin-main. Since the document itself scrolls, it left the viewport as soon as you scrolled down — editing a subpage section or a settings block far below gave no visible dirty hint and no reachable save button. Replace it with a bottom-pinned floating bar shared by both editors. It only mounts while there is something to act on (unsaved changes, an in-flight save, or a result message), so it never covers content while idle. The success message clears after 5s, which hides the bar again. - new SaveBar component, replacing the duplicated markup in PageBuilder and SettingsEditor - adopt the previously unused .floating-save-bar CSS: slide-in keyframes (carrying translateX(-50%)), dirty border, wrap/gap, mobile variant and a prefers-reduced-motion opt-out; z-index 900 keeps it below modals - .admin-main gains bottom padding so the bar never covers page content - drop the now-unreachable idle hints: the ⌘S hint becomes a button title, the Live Sync note becomes a static line above the settings layout - header "Site" link now bypasses the cache (/?fresh=1), so the preview stays reachable when the bar is hidden Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(admin): themed listbox for the album sort control (#427) The per-album "Photo order" control was a native <select>. Because an <option> cannot contain markup, its choices could not use the admin panel's currentColor SVG set — the reason #415 had to fall back to plain text after dropping the emoji labels. Adds a Listbox component implementing the ARIA combobox/listbox pattern, so options can render a glyph beside their label: - DOM focus stays on the trigger button; the active option is announced through aria-activedescendant, keeping focus management to one element - Keyboard: arrows (clamped at the ends, like a native select), Home/End, Enter/Space to commit, Escape to cancel, Tab commits and moves on, and prefix type-ahead with a repeat-key cycle - Outside dismissal on pointerdown, so a press starting outside closes the popup before the click retargets The sort options now carry an icon each: calendar, arrow-down, arrow-up, an A→Z marker, and the drag glyph for manual — matching the badge the album card already shows. SORT_LABELS stays plain text because the badge feeds it to a title attribute. Closes #417 Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(git): ignore generated design handoff folders * fix(admin): stop the album sort dropdown clipping, and simplify the panel (#428) * fix(admin): render listbox popup in a portal so it escapes modal clipping The sort control's popup was position:absolute inside three clipping ancestors (.album-drawer overflow:hidden > .album-drawer-body overflow-y:auto > .modal-right-column overflow-y:auto), so it was cut off at the bottom of the Edit Album Details modal. z-index could not help: clipping happens before stacking. It also always hung below the trigger, with no flip. Portal the popup to document.body and position it from the trigger's viewport rect, flipping above when there is more room there and capping max-height to the space available so it scrolls internally rather than overflowing. It is dismissed on scroll and resize, since the anchor is only measured on open. The outside-pointerdown handler now also treats the popup as inside; without that the portalled list counts as outside, and a click on an option would close it before the selection commits. * refactor(admin): single-column album details panel The left column spent 1.2fr on a cover thumbnail and three stat rows, two of which (Status, Custom Hero) only restated the form fields opposite them, while the form itself was squeezed into 1.8fr behind a second nested scroller. Stack the drawer in one column instead: cover as a banner, then the form at full width, with the UUID moved into the footer. The body is now the only scroll container, which also removes one of the ancestors that was clipping the sort popup. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> * fix(admin): give the portalled listbox its theme back, lock the page behind modals (#429) Two defects in the album editor. The sort listbox popup painted transparent. Every --admin-* variable is scoped to .admin-layout, and since the popup moved into document.body it sits outside that subtree, so background/border/text all resolved to nothing. It now carries its own copy of the palette in both colour schemes, plus the font it no longer inherits. Scrolling inside a modal also moved the page behind it. No admin modal ever locked body scroll: the overlay covers the page but does not absorb wheel events, so a scroll starting on the backdrop — or continuing past the end of the modal's own scroller — reaches the document. overscroll-behavior cannot cover that case on its own, because it only applies to scroll containers and the backdrop is not one. useScrollLock freezes body while a modal is open and compensates for the width the scrollbar gives up, so nothing shifts underneath. Each lock restores the inline value it found, which makes nesting work without a counter — a picker opened from the drawer restores the drawer's hidden state instead of clearing it. Applied to both drawers and all four picker modals, which share the defect. overscroll-behavior: contain on the scrollers stops the chaining they can handle themselves. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com> * fix(security): allow unsafe-eval in CSP script-src during dev mode * feat(journal): add Journal Studio with split-screen editor, live preview and dedicated routes * fix(build): separate client parser from server journal-service and fix build type errors * fix(journal): Fotos rendern, Layout und Lightbox-Steuerung korrigieren Fünf unabhängige Fehler in der öffentlichen Journal- und Essay-Ansicht: * Foto-Blöcke wurden nie angezeigt. EssayView löst ein Foto über PhotoItem.id auf, und das sind verschlüsselte Tokens — die Blöcke aus dem Markdown tragen aber rohe Asset-UUIDs. Jede Zuordnung lief ins Leere, und nicht auflösbare Blöcke werden still verworfen. Die IDs werden jetzt serverseitig übersetzt; damit verschwinden nebenbei die rohen UUIDs aus dem Client-Payload, die dort laut Projektregel nie auftauchen dürfen. Nicht auflösbare Referenzen werden geloggt. * Überschriften standen weiter links als der Fließtext. Jeder Block hatte einzeln `max-width: 68ch`, und `ch` ist relativ zur Schrift des Elements — die Serif-Überschrift ergab eine breitere Spalte. Ersetzt durch eine gemeinsame, font-unabhängige `--essay-measure`. * Fullbleed-Fotos bluteten nur nach links aus: `.essay-figure` ist `width: 100%`, wodurch die Box überbestimmt ist und der negative rechte Margin verworfen wird. * Foto-Paare stellten beide Bilder gleich breit dar, wodurch ein Hochformat neben einem Querformat doppelt so hoch wurde. Jetzt eine Justified-Reihe: Breite proportional zum Seitenverhältnis, dadurch exakt gleiche Höhen ohne Beschnitt. * Die Lightbox hatte im Journal keine Tastatursteuerung und keine Scroll-Sperre — beides lag in PhotoGrid, also nur im Album-Raster. Verlagert in die Lightbox selbst, der doppelte Handler in PhotoGrid entfernt (sonst wäre pro Pfeildruck zwei Bilder weitergesprungen). Zusätzlich sind Proofing-Herzen und das EXIF-Panel im redaktionellen Modus abschaltbar und im Journal aus: Client-Proofing ist ein Übergabe-Workflow für Alben, keine Funktion einer Reportage. Auf der Übersicht wurde der Untertitel doppelt gerendert, weil extractExcerpt() auf ihn zurückfällt. * feat(admin): eigene URLs für alle Bereiche und überarbeiteter Journal Studio Das Panel war eine einzige Client-Komponente, die ihre Tabs über useState umschaltet: keine Route pro Bereich, kein Deep-Link, kein Zurück-Button, und nach jedem Reload landete man wieder auf "Pages". Auch der Journal-Editor hatte keine eigene URL. Jetzt sieben echte Routen (/admin, /admin/pages, /admin/journal, /admin/journal/<slug>, /admin/settings, /admin/settings/<section>, /admin/analytics). Die Shell mit Auth-Prüfung und Kopfzeile sitzt im Layout und umschließt children — so bleibt die Session-Prüfung über Routenwechsel montiert, statt bei jedem Tab-Wechsel neu zu laufen und den Spinner aufblitzen zu lassen. Unbekannte Settings-Sections fallen auf General zurück. Im selben Zug der Journal Studio, der die Routing-Änderung ohnehin berührt: * Alle Eingabefelder nutzten die Klasse `admin-input`, die in keinem CSS definiert war — sie fielen auf Browser-Defaults zurück. Jetzt gestylt, gescoped, damit der generische Name nicht ins übrige Panel leckt. * Der Split View ist per Divider verschiebbar (Maus, Tastatur, Doppelklick zum Zurücksetzen), Breite in localStorage. * Das Studio bricht aus der 1120px-Spalte aus, die Preview hat Platz. * Die Preview zeigte für jedes Foto fest 3:2 und log damit über das Layout der veröffentlichten Seite; die echten Verhältnisse werden jetzt an den Thumbnails gemessen. * Blöcke mit alten positionsbasierten Foto-Referenzen werden markiert — die lassen sich auf einer eigenständigen Journal-Seite nicht auflösen und verschwanden bisher stillschweigend. * Blocktyp-Chips als gemeinsame Komponente, monochrom und per Icon unterschieden statt in einer eigenen Blau/Lila/Orange-Palette, die sonst nirgends im Panel vorkommt. * Emojis raus, SVG-Icons rein. * fix(admin): Designsystem-Lücken im Panel schließen Eine systematische Suche nach Klassen, die im TSX benutzt, aber in keinem CSS definiert sind, hat vier Stellen mit demselben Muster gefunden: * `admin-btn-secondary` und `admin-btn-danger` existierten nicht. Sämtliche Löschen-Buttons sahen aus wie normale Buttons — keine Warnwirkung. Als `.admin-btn.admin-btn-danger` geschrieben, weil die Varianten mit den Größenklassen kombiniert werden, die weiter unten ihren eigenen Hintergrund setzen. * `page-progress-fill` fehlte: die Balken im Analytics-Panel waren leere Rinnen, der Wert unsichtbar. Ebenso `analytics-empty` und `admin-loading-container`. * `subpage-drawer-section`, `subpage-drawer-title-group` und `input-with-icon` im PageBuilder waren wirkungslos und teils mit Inline-Styles notdürftig kompensiert. * `grid-card-preview` fehlte, wodurch alle Layout-Vorschauen auf Höhe null kollabierten. Nur "Showcase" war sichtbar — und das aus Versehen, weil sein Tile `hero-tile` hieß und damit die `aspect-ratio` einer fremden PageBuilder-Klasse erbte. Umbenannt. Dazu die Theme-Vorschauen, die praktisch identisch aussahen: alle sieben zeigten dieselben drei quadratischen Kacheln, einziger Unterschied war die Hintergrundfarbe. Sie spiegeln jetzt die echten Preset-Daten aus lib/config/theme.ts — Schriftcharakter, Eckradius, Rasterdichte, Passepartout bzw. Schatten. Die Kopfzeile richtet sich an einer gemeinsamen Steuerhöhe aus. Der "Site"-Link war höher als die Buttons daneben: `.admin-btn` hatte keine explizite line-height, und <button> bekommt box-sizing: border-box vom Browser, <a> nicht. Die Statusanzeige setzte weder Schriftfamilie noch -größe und fiel auf den Browser-Default zurück — sie war nie Teil des Designsystems. Jetzt gleiche Höhe und Typografie, Pillenform als Zustandsanzeige, Trenner zur Aktionsgruppe. Das dauerhafte Pulsieren des grünen Punkts entfällt; Animation bleibt den Zuständen vorbehalten, die Aufmerksamkeit brauchen. Restliche Emojis durch SVG-Icons ersetzt. * feat(admin): add scroll-to-top toggle and SVG arrow The back-to-top button was always on and drew its arrow with the ↑ text character. Add a `scrollToTop` setting (General section in the admin panel, defaults to on so existing sites are unaffected) and replace the glyph with a stroked SVG that inherits currentColor across all presets. Scroll handling is now rAF-throttled, and prefers-reduced-motion turns off both the hover lift and the smooth scroll. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * security(journal): escape author HTML instead of filtering it CodeQL flags 26 high-severity alerts on the release PR; the bulk of them point at sanitizeHtml(), a denylist of three regexes whose output goes into dangerouslySetInnerHTML. I reproduced the bypasses before changing anything — all four pass the old filter: <img src=x onerror=alert(1)> unquoted handler, regex wants quotes <img src=x onerror='alert(1)'> single quotes, same reason <svg onload=alert(1)> not a <script> tag javasjavascript:cript:alert(1) one-pass replace, the rest recombines Plus an attribute breakout in the link renderer, which interpolated the URL into href="${url}" unescaped: [x](" onmouseover=alert(1) x=") -> <a href="" onmouseover=alert(1" ...> Replaced with escaping. Every `&<>"'` in author text becomes an entity before any markdown rule runs, so the only tags in the output are the ones renderInlineMarkdown builds itself and a URL cannot leave its attribute. Link schemes are now an allowlist (http, https, mailto, tel, relative, anchor); anything else renders as plain text. The serializer needed decodeHtmlEntities to match: without it a save would write `&lt;` into the Markdown file and the next parse would escape the `&` again, corrupting the text further on every round trip. A test covers parse -> serialize -> parse stability. Two existing tests asserted the old behaviour and were rewritten rather than deleted: one expected the script tag to be *removed* from the output, the other expected the substring "onerror" to be absent. Both now assert the property that matters — that no tag can form — because `onerror` surviving as inert text is fine. Exploitation required admin access either way: journal and essay text comes from the studio or from content/*.md. This removes the weakness, it does not close an open door. * fix(journal): contain file paths, fix frontmatter escaping, defuse two regexes Follow-up to the CodeQL findings on release PR #432. I went through all 23 alerts individually; this addresses the ones that are worth addressing and documents the ones that are not. Path containment (12 alerts, all false positives). Every path built from a slug goes through isValidSlug(), a strict `/^[a-zA-Z0-9_-]+$/` allowlist — verified against `../../etc/passwd`, `foo/../../bar`, `a/b`, `..` and friends, all rejected. CodeQL cannot see it because the check lives in another module. Added a containedPath() helper that resolves the path and refuses anything landing outside the content directory: a second lock on a door that was already locked, and a barrier the analysis can follow. Also removed the dead `slug.endsWith('.md')` branches — isValidSlug rejects dots, so they could never be taken. Frontmatter escaping (1 alert, a real bug). The serializer escaped `"` but not `\`, and the parser never unescaped anything. A title containing either character gained a backslash on every save/load cycle: Path C:\Users "quoted" -> Path C:\\Users \"quoted\" -> ... Escaping now covers the backslash first and the parser undoes both. A round trip test covers quotes, backslashes, colons and apostrophes. Two of three ReDoS regexes (2 alerts). The heading pattern had `\s+` next to `(.+)`, which overlap, so the engine tried every split of the whitespace run before failing; it is `[ \t]+` and `(\S.*)` now. The quote author pattern wrapped a lazy group around an optional group — the quadratic case — and is an index split on the first separator now. The third regex, the bold/italic pass, is deliberately left alone. Rewriting it with a negated class removes the backtracking but breaks nesting: `**bold *and italic* here**` renders as `*<em>bold </em>and italic<em> here</em>*`. The input is Markdown from an authenticated admin, never a visitor, so the worst case is an author slowing down their own page. The comment in the code says so. Not addressed: 5 js/insufficient-password-hash alerts. They ask for a slow KDF where the code uses SHA-256/HMAC — correct in general, but the admin password comes from an environment variable and is never stored, so a stronger KDF protects nothing that is not already in plaintext in the environment. 399 unit tests pass (18 new), build and tsc clean. * fix(journal): split the quote author by scanning, not by pattern Cleaning up after myself. #439 replaced the quote author regex `/^(.*?)(?:\s+--\s+(.+))?$/` — a lazy group around an optional one, the quadratic case — with `/\s+--\s+/`, and CodeQL promptly flagged the replacement for the same reason. One reported pattern traded for another. splitQuoteAuthor() scans for the first `--` that has whitespace on both sides. Linear, and it needs no reasoning about the regex engine at all. Behaviour is identical to the original regex, checked case by case against it: separator, no separator, several separators, tabs, wide gaps, `a--b` without spaces, leading and trailing separators, empty string. All nine are covered by tests, plus one asserting it stays fast on a 50k whitespace run. * security(admin): derive the session signing key with scrypt getSigningKey() ran the admin password through a single SHA-256 digest. It is key derivation rather than password storage, so it was never a stored-hash problem — but if the derived key ever leaked, one fast hash makes recovering the password by brute force cheap. CodeQL flags it as js/insufficient-password-hash and, for this particular alert, has a point. scrypt now. Two details that matter: The salt has to be stable. A random salt would produce a different key on every call and invalidate every session; it is derived from AUTH_SECRET, which is deployment-specific. Verified across separate processes: same inputs produce a verifying token, so a restart or redeploy does not log everyone out. The result is cached for the process lifetime. scrypt is deliberately slow and getSigningKey() runs on every admin request — deriving per call would add ~24ms to each one. The cache key is a digest of secret plus password, so a rotation misses the cache and derives again, and no extra plaintext copy of the password is kept around. Measured: first derivation 24ms, subsequent calls 0.12ms. Password change and secret change both invalidate an existing token, checked in separate processes. Note the one-time effect: existing admin sessions are invalidated by the change in derivation, so everyone logs in once more. * security(admin): key the signing-key cache on its inputs, not a digest #441 removed the SHA-256 digest of the admin password from the key derivation and introduced a new one three lines above it, as the cache key. Same rule, same file: CodeQL reported it immediately. The comment justifying it was wrong too. It claimed no second plaintext copy of the password was retained, while building the digest input allocates exactly that in order to hash it. The cache now holds the two input strings and compares them directly. They are the same objects the env and install caches already hold, so nothing extra is retained, and no fast hash of the password exists in memory for the life of the process. Re-verified after the change, in separate processes: a token from one process verifies in another with the same inputs, a changed password or secret rejects it, first derivation 24ms, cached calls 0.001ms. That leaves scrypt as the only place the password is hashed here. The two HMACs further down operate on the derived key and on token data, not on the password; the constant-time comparison in verifyAdminPassword is the previously dismissed one. --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
2026-08-14 16:55:07 +02:00
padding: 0 0.8rem;
min-height: 30px;
feat: add visual admin panel with page builder and settings editor - Add /admin route with password-protected visual page builder - Page Builder: manage hero images, standalone albums, subpages, and sections - Album Picker: browse all shared Immich albums with search and filtering - Settings Editor: theme, grid, footer, legal, SEO configuration - YAML service with atomic writes and automatic backups (content/.backups/) - HMAC-signed admin sessions (24h expiry, HttpOnly cookies) - API endpoints: /api/admin/{auth,gallery,settings,albums,reload} - Enable with ADMIN_PASSWORD env var; disabled by default - invalidateConfigCache() export for hot-reload after saves
2026-05-29 17:04:37 +02:00
font-size: 0.8rem;
fix: admin panel light/dark theme support, improved contrast, and backup confirmation a) Admin panel now respects the site's light/dark theme toggle via CSS custom properties that respond to [data-theme='light'] on <html>. All hardcoded dark colors replaced with semantic CSS variables. b) Improved contrast in dark mode: secondary text changed from #666/#555 to #a0a0a0, muted text from #555 to #707070. All text is now clearly readable against dark backgrounds. c) Backup system was already implemented in yaml-service.ts (creates timestamped backups in content/.backups/ before each save, keeps last 10 versions). Now the UI shows a confirmation message that a backup was created after each successful save.
2026-05-29 17:20:56 +02:00
background: var(--admin-bg-elevated);
color: var(--admin-text-secondary);
border: 1px solid var(--admin-border);
feat: add visual admin panel with page builder and settings editor - Add /admin route with password-protected visual page builder - Page Builder: manage hero images, standalone albums, subpages, and sections - Album Picker: browse all shared Immich albums with search and filtering - Settings Editor: theme, grid, footer, legal, SEO configuration - YAML service with atomic writes and automatic backups (content/.backups/) - HMAC-signed admin sessions (24h expiry, HttpOnly cookies) - API endpoints: /api/admin/{auth,gallery,settings,albums,reload} - Enable with ADMIN_PASSWORD env var; disabled by default - invalidateConfigCache() export for hot-reload after saves
2026-05-29 17:04:37 +02:00
}
.admin-btn-sm:hover {
fix: admin panel light/dark theme support, improved contrast, and backup confirmation a) Admin panel now respects the site's light/dark theme toggle via CSS custom properties that respond to [data-theme='light'] on <html>. All hardcoded dark colors replaced with semantic CSS variables. b) Improved contrast in dark mode: secondary text changed from #666/#555 to #a0a0a0, muted text from #555 to #707070. All text is now clearly readable against dark backgrounds. c) Backup system was already implemented in yaml-service.ts (creates timestamped backups in content/.backups/ before each save, keeps last 10 versions). Now the UI shows a confirmation message that a backup was created after each successful save.
2026-05-29 17:20:56 +02:00
background: var(--admin-border);
border-color: var(--admin-border-hover);
color: var(--admin-text);
feat: add visual admin panel with page builder and settings editor - Add /admin route with password-protected visual page builder - Page Builder: manage hero images, standalone albums, subpages, and sections - Album Picker: browse all shared Immich albums with search and filtering - Settings Editor: theme, grid, footer, legal, SEO configuration - YAML service with atomic writes and automatic backups (content/.backups/) - HMAC-signed admin sessions (24h expiry, HttpOnly cookies) - API endpoints: /api/admin/{auth,gallery,settings,albums,reload} - Enable with ADMIN_PASSWORD env var; disabled by default - invalidateConfigCache() export for hot-reload after saves
2026-05-29 17:04:37 +02:00
}
.admin-btn-xs {
release: v0.11.0 — journal fixes, admin URLs, design system cleanup (#432) * fix(screenshots): sharp-Typen fuer 0.34 und 0.35 gleichzeitig (#410) sharp 0.35 ist von `export =` auf ESM umgestellt: der Modul-Namespace ist nicht mehr aufrufbar, die Factory sitzt unter .default. Der Type-Check brach damit in scripts/screenshots.ts weg, sobald der Next-Bump (#402) sharp von 0.34.5 auf 0.35.3 mitzieht -- sharp ist hier keine deklarierte Dependency, sondern kommt ueber Next mit. Die Form wird jetzt aus dem installierten Paket abgeleitet statt festgeschrieben, zur Laufzeit wie im Typ. Geprueft mit beiden Versionen: tsc laeuft mit 0.34.5 und mit 0.35.3 fehlerfrei durch. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(deps): bump the nextjs group across 1 directory with 2 updates (#402) Bumps the nextjs group with 2 updates in the / directory: [next](https://github.com/vercel/next.js) and [eslint-config-next](https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next). Updates `next` from 16.2.12 to 16.3.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/compare/v16.2.12...v16.3.0) Updates `eslint-config-next` from 16.2.12 to 16.3.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/commits/v16.3.0/packages/eslint-config-next) --- updated-dependencies: - dependency-name: eslint-config-next dependency-version: 16.3.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: nextjs - dependency-name: next dependency-version: 16.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nextjs ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps-dev): bump prettier from 3.8.3 to 3.9.6 (#405) Bumps [prettier](https://github.com/prettier/prettier) from 3.8.3 to 3.9.6. - [Release notes](https://github.com/prettier/prettier/releases) - [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md) - [Commits](https://github.com/prettier/prettier/compare/3.8.3...3.9.6) --- updated-dependencies: - dependency-name: prettier dependency-version: 3.9.6 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * docs(changelog): Unreleased-Sektion fuer die Bumps nach v0.10.0 (#413) Die Dependency-PRs sind nach dem Release auf dev gelandet, teils auch auf main. Ohne Eintrag waeren sie beim naechsten Release unsichtbar -- inklusive Next 16.3.0, das CVE-2025-13465 mitbringt. Ausserdem im 0.10.0-Abschnitt nachgetragen, dass der Trivy-Scan bis #409 nie gelaufen ist. Der Fix steckt im Tag v0.10.0, fehlte aber in der Aufzaehlung -- und "Images werden bei jedem Publish gescannt" stand im Changelog, waehrend der Job im Action-Setup abbrach. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(gallery): per-album sort order, independent of Immich (#408) (#414) Album order was dictated entirely by Immich: getAlbum() sorted by the album's own asc/desc flag, so a Folio album always mirrored the archive. A curated series has a narrative order that has nothing to do with capture time, and changing the Immich album's sort to fit the website changes it for the archive too. Adds an optional per-album `sort` in gallery.yaml, editable in /admin, defaulting to today's behaviour so every existing config is unchanged: immich (default) | newest | oldest | filename | manual `manual` is a pinned *prefix*: `assetOrder` lists only the photos placed by hand, everything else follows in the album's Immich order. A full permutation of a 2,000-photo album would be ~80 KB of UUIDs in a file that is rewritten and copied to content/.backups/ on every admin save. It also makes drift fall out for free — photos removed in Immich never match, new ones land in the tail rather than being hidden. Sorting is applied after the cache read, not before the cache write, so the LRU keeps one canonical Immich-ordered copy per album. That avoids putting the mode in the cache key, lets a config change take effect without depending on invalidation, and keeps the stale-serving path correct. cache.get() returns the stored object by reference, so withSort() returns a shallow clone with a new array — sorting in place would reorder the shared entry, and under request coalescing every concurrent caller would be sorting the same array. Also fixes a prerequisite bug: /api/admin/albums/[albumId]/assets read album.assets from GET /albums/:id, which Immich 3.x no longer populates (lib/immich.ts:507). The hero picker's "This Album" tab returned nothing and threw outright when the key was absent. It now goes through the client's paginated metadata search, with ?types=all to opt videos in for the reorder editor. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): drop decorative emoji from the sort select labels (#415) An <option> cannot contain markup, so the SVG set in Icons is not reachable there — but a decorative emoji is not a substitute for it. Plain text instead; the album card badge already uses a real icon. The remaining emoji in the admin panel (asset picker tabs, section headings, layout picker options) predate this branch and are left for a separate cleanup. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): replace emoji icons with the shared SVG icon set (#416) The admin panel mixed two icon conventions: inline SVGs from `Icons.tsx` in most components, and decorative emoji in the asset picker and a few PageBuilder labels. Emoji render inconsistently across platforms, ignore the accent colour, and cannot inherit the `.svg-icon` sizing rules. - Icons.tsx: add `IconStar` (filled — it marks a state, not an action) and `IconImage`. - AssetPicker: the three tab labels and the favourite tile badge now use IconFolder / IconStar / IconImage. - PageBuilder: the "Standalone Albums" and "Subpages" headings use the icon set instead of an emoji. - PageBuilder: the layout picker drops its emoji for plain text. An <option> cannot contain markup, so an SVG is impossible there and a decorative glyph is not a substitute. - admin.css: align icon and label in the picker tabs, and swap the favourite badge's text-shadow for drop-shadow, which is what applies to an inline SVG. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): fold PageBuilder's local icons into the shared Icons module (#418) * refactor(admin): fold PageBuilder's local icons into the shared module PageBuilder.tsx carried its own `Icons` object duplicating most of the glyphs already exported by Icons.tsx, with hardcoded sizes and slightly divergent paths. Migrate all 32 call sites to the shared module and delete the local object. Five glyphs had no counterpart and are added to Icons.tsx as 1:1 ports of the local paths: IconX, IconPlus, IconHome, IconCopy, IconImage. The local ExternalLink and Check are dropped rather than ported — both had zero call sites. Two glyphs change shape slightly, which is the point of consolidating: the shared IconCamera includes the viewfinder bump the local copy omitted, and drag handles now use IconGripVertical. IconGripVertical uses the module's square 24x24 viewBox, so `.svg-drag` goes from 12x18 to 18x18 — the old non-square box would letterbox the glyph down to 12x12 and shrink the handle. * fix(admin): resolve icon-module integration after #416 Merging dev brought in #416, which added a second IconImage to Icons.tsx and two <Icons.Camera>/<Icons.Folder> section headers that reference the local Icons object this PR removes. Git merged both cleanly but the result did not type-check. - drop the duplicate IconImage (both copies were byte-identical) - point the two section headers at the imported IconCamera/IconFolder - refresh the SORT_LABELS comment: the icon set is imported now, not declared below --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> * fix(config): allow an empty gallery, guard against a double /api suffix (#421) An empty gallery is now a valid, rendered state instead of a throw: deriveGallery() no longer requires at least one album or subpage, so a deployment with no albums yet renders a bare homepage the owner can fill in via /admin. getConfig() also stops appending /api to an Immich URL that already ends in it, which previously produced .../api/api and broke every upstream request. Includes a restore of the per-album sort test cases, which the branch had lost by being cut before #408/#414. * feat(admin): favicon upload, served from the content volume (#422) Adds a bundled default favicon, an upload widget in admin Settings > General, and a route that serves the icon from the writable content/ volume with a fallback to the bundled default. Raster uploads (PNG/ICO/JPEG) are wrapped in an SVG container; the response carries its own CSP so an uploaded SVG cannot execute script on the origin. The GET route revalidates with an ETag instead of caching immutably, so a newly uploaded icon shows up immediately. Uploads are written via temp file + rename, and a Reset button restores the bundled default. * ci: flag unformatted files in a PR, without blocking it (#424) Prettier is configured as an error rule in eslint.config.mjs but has never run in CI, so part of the tree predates it. A final CI step now diffs against the PR base, runs prettier --list-different over the changed files, and emits a warning annotation per offender plus a job summary. Advisory by design: it never fails the job. Blocking would turn a PR red for merely touching a file that was already unformatted, and normalising the tree in one commit would wreck git blame and conflict with the PRs in flight. Requires fetch-depth: 0, since diffing against the base needs its history. * feat(install): first-run wizard gated by a one-time setup token (#419) Adds /install, a four-step first-run wizard: connect to Immich, optionally pick albums, name the site, finish. It verifies the credentials against the Immich server before writing anything, then writes gallery.yaml, settings.yaml and a content/install.json carrying the Immich credentials and a generated site secret. install.json exists because a running process cannot pick up new env vars — the wizard has to write configuration that takes effect without a restart. getInstallCredentials() merges it under the real environment, so env vars always win and rotation stays a matter of setting one. Both the page and the API routes are gated by a one-time setup token printed to the server log, so a deployment that is reachable before gallery.yaml exists cannot be configured by whoever finds it first. The token is stored in content/.setup-token (0600) rather than a module variable: Next.js bundles the page and each route handler separately, so a module-level token left the page and the API disagreeing inside one process and the wizard stuck on step 1. It is removed once the install completes. The admin password is stored as an scrypt hash using the scheme lib/auth.ts already applies to album passwords; a plaintext ADMIN_PASSWORD env var keeps working. * docs: document the setup wizard, fix the read-only content mount (#425) Quick Start now leads with the /install wizard, with the hand-written YAML route kept alongside it, and a First-Run Setup section covers the setup token, the files the wizard writes, and env-var precedence. Two corrections: both Docker examples mounted content/ as :ro, which silently breaks the wizard, the admin panel and the backup rotation alike — docs/admin-panel.md already said so and the README contradicted it. And nothing documented that content/install.json holds the Immich API key, so a backup of content/ is a backup of credentials. Also adds a Contributors section crediting the people whose work is in the project. * feat(admin): floating save bar pinned to the bottom of the viewport (#426) The save bar was the first, static element inside .admin-main. Since the document itself scrolls, it left the viewport as soon as you scrolled down — editing a subpage section or a settings block far below gave no visible dirty hint and no reachable save button. Replace it with a bottom-pinned floating bar shared by both editors. It only mounts while there is something to act on (unsaved changes, an in-flight save, or a result message), so it never covers content while idle. The success message clears after 5s, which hides the bar again. - new SaveBar component, replacing the duplicated markup in PageBuilder and SettingsEditor - adopt the previously unused .floating-save-bar CSS: slide-in keyframes (carrying translateX(-50%)), dirty border, wrap/gap, mobile variant and a prefers-reduced-motion opt-out; z-index 900 keeps it below modals - .admin-main gains bottom padding so the bar never covers page content - drop the now-unreachable idle hints: the ⌘S hint becomes a button title, the Live Sync note becomes a static line above the settings layout - header "Site" link now bypasses the cache (/?fresh=1), so the preview stays reachable when the bar is hidden Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(admin): themed listbox for the album sort control (#427) The per-album "Photo order" control was a native <select>. Because an <option> cannot contain markup, its choices could not use the admin panel's currentColor SVG set — the reason #415 had to fall back to plain text after dropping the emoji labels. Adds a Listbox component implementing the ARIA combobox/listbox pattern, so options can render a glyph beside their label: - DOM focus stays on the trigger button; the active option is announced through aria-activedescendant, keeping focus management to one element - Keyboard: arrows (clamped at the ends, like a native select), Home/End, Enter/Space to commit, Escape to cancel, Tab commits and moves on, and prefix type-ahead with a repeat-key cycle - Outside dismissal on pointerdown, so a press starting outside closes the popup before the click retargets The sort options now carry an icon each: calendar, arrow-down, arrow-up, an A→Z marker, and the drag glyph for manual — matching the badge the album card already shows. SORT_LABELS stays plain text because the badge feeds it to a title attribute. Closes #417 Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(git): ignore generated design handoff folders * fix(admin): stop the album sort dropdown clipping, and simplify the panel (#428) * fix(admin): render listbox popup in a portal so it escapes modal clipping The sort control's popup was position:absolute inside three clipping ancestors (.album-drawer overflow:hidden > .album-drawer-body overflow-y:auto > .modal-right-column overflow-y:auto), so it was cut off at the bottom of the Edit Album Details modal. z-index could not help: clipping happens before stacking. It also always hung below the trigger, with no flip. Portal the popup to document.body and position it from the trigger's viewport rect, flipping above when there is more room there and capping max-height to the space available so it scrolls internally rather than overflowing. It is dismissed on scroll and resize, since the anchor is only measured on open. The outside-pointerdown handler now also treats the popup as inside; without that the portalled list counts as outside, and a click on an option would close it before the selection commits. * refactor(admin): single-column album details panel The left column spent 1.2fr on a cover thumbnail and three stat rows, two of which (Status, Custom Hero) only restated the form fields opposite them, while the form itself was squeezed into 1.8fr behind a second nested scroller. Stack the drawer in one column instead: cover as a banner, then the form at full width, with the UUID moved into the footer. The body is now the only scroll container, which also removes one of the ancestors that was clipping the sort popup. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> * fix(admin): give the portalled listbox its theme back, lock the page behind modals (#429) Two defects in the album editor. The sort listbox popup painted transparent. Every --admin-* variable is scoped to .admin-layout, and since the popup moved into document.body it sits outside that subtree, so background/border/text all resolved to nothing. It now carries its own copy of the palette in both colour schemes, plus the font it no longer inherits. Scrolling inside a modal also moved the page behind it. No admin modal ever locked body scroll: the overlay covers the page but does not absorb wheel events, so a scroll starting on the backdrop — or continuing past the end of the modal's own scroller — reaches the document. overscroll-behavior cannot cover that case on its own, because it only applies to scroll containers and the backdrop is not one. useScrollLock freezes body while a modal is open and compensates for the width the scrollbar gives up, so nothing shifts underneath. Each lock restores the inline value it found, which makes nesting work without a counter — a picker opened from the drawer restores the drawer's hidden state instead of clearing it. Applied to both drawers and all four picker modals, which share the defect. overscroll-behavior: contain on the scrollers stops the chaining they can handle themselves. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com> * fix(security): allow unsafe-eval in CSP script-src during dev mode * feat(journal): add Journal Studio with split-screen editor, live preview and dedicated routes * fix(build): separate client parser from server journal-service and fix build type errors * fix(journal): Fotos rendern, Layout und Lightbox-Steuerung korrigieren Fünf unabhängige Fehler in der öffentlichen Journal- und Essay-Ansicht: * Foto-Blöcke wurden nie angezeigt. EssayView löst ein Foto über PhotoItem.id auf, und das sind verschlüsselte Tokens — die Blöcke aus dem Markdown tragen aber rohe Asset-UUIDs. Jede Zuordnung lief ins Leere, und nicht auflösbare Blöcke werden still verworfen. Die IDs werden jetzt serverseitig übersetzt; damit verschwinden nebenbei die rohen UUIDs aus dem Client-Payload, die dort laut Projektregel nie auftauchen dürfen. Nicht auflösbare Referenzen werden geloggt. * Überschriften standen weiter links als der Fließtext. Jeder Block hatte einzeln `max-width: 68ch`, und `ch` ist relativ zur Schrift des Elements — die Serif-Überschrift ergab eine breitere Spalte. Ersetzt durch eine gemeinsame, font-unabhängige `--essay-measure`. * Fullbleed-Fotos bluteten nur nach links aus: `.essay-figure` ist `width: 100%`, wodurch die Box überbestimmt ist und der negative rechte Margin verworfen wird. * Foto-Paare stellten beide Bilder gleich breit dar, wodurch ein Hochformat neben einem Querformat doppelt so hoch wurde. Jetzt eine Justified-Reihe: Breite proportional zum Seitenverhältnis, dadurch exakt gleiche Höhen ohne Beschnitt. * Die Lightbox hatte im Journal keine Tastatursteuerung und keine Scroll-Sperre — beides lag in PhotoGrid, also nur im Album-Raster. Verlagert in die Lightbox selbst, der doppelte Handler in PhotoGrid entfernt (sonst wäre pro Pfeildruck zwei Bilder weitergesprungen). Zusätzlich sind Proofing-Herzen und das EXIF-Panel im redaktionellen Modus abschaltbar und im Journal aus: Client-Proofing ist ein Übergabe-Workflow für Alben, keine Funktion einer Reportage. Auf der Übersicht wurde der Untertitel doppelt gerendert, weil extractExcerpt() auf ihn zurückfällt. * feat(admin): eigene URLs für alle Bereiche und überarbeiteter Journal Studio Das Panel war eine einzige Client-Komponente, die ihre Tabs über useState umschaltet: keine Route pro Bereich, kein Deep-Link, kein Zurück-Button, und nach jedem Reload landete man wieder auf "Pages". Auch der Journal-Editor hatte keine eigene URL. Jetzt sieben echte Routen (/admin, /admin/pages, /admin/journal, /admin/journal/<slug>, /admin/settings, /admin/settings/<section>, /admin/analytics). Die Shell mit Auth-Prüfung und Kopfzeile sitzt im Layout und umschließt children — so bleibt die Session-Prüfung über Routenwechsel montiert, statt bei jedem Tab-Wechsel neu zu laufen und den Spinner aufblitzen zu lassen. Unbekannte Settings-Sections fallen auf General zurück. Im selben Zug der Journal Studio, der die Routing-Änderung ohnehin berührt: * Alle Eingabefelder nutzten die Klasse `admin-input`, die in keinem CSS definiert war — sie fielen auf Browser-Defaults zurück. Jetzt gestylt, gescoped, damit der generische Name nicht ins übrige Panel leckt. * Der Split View ist per Divider verschiebbar (Maus, Tastatur, Doppelklick zum Zurücksetzen), Breite in localStorage. * Das Studio bricht aus der 1120px-Spalte aus, die Preview hat Platz. * Die Preview zeigte für jedes Foto fest 3:2 und log damit über das Layout der veröffentlichten Seite; die echten Verhältnisse werden jetzt an den Thumbnails gemessen. * Blöcke mit alten positionsbasierten Foto-Referenzen werden markiert — die lassen sich auf einer eigenständigen Journal-Seite nicht auflösen und verschwanden bisher stillschweigend. * Blocktyp-Chips als gemeinsame Komponente, monochrom und per Icon unterschieden statt in einer eigenen Blau/Lila/Orange-Palette, die sonst nirgends im Panel vorkommt. * Emojis raus, SVG-Icons rein. * fix(admin): Designsystem-Lücken im Panel schließen Eine systematische Suche nach Klassen, die im TSX benutzt, aber in keinem CSS definiert sind, hat vier Stellen mit demselben Muster gefunden: * `admin-btn-secondary` und `admin-btn-danger` existierten nicht. Sämtliche Löschen-Buttons sahen aus wie normale Buttons — keine Warnwirkung. Als `.admin-btn.admin-btn-danger` geschrieben, weil die Varianten mit den Größenklassen kombiniert werden, die weiter unten ihren eigenen Hintergrund setzen. * `page-progress-fill` fehlte: die Balken im Analytics-Panel waren leere Rinnen, der Wert unsichtbar. Ebenso `analytics-empty` und `admin-loading-container`. * `subpage-drawer-section`, `subpage-drawer-title-group` und `input-with-icon` im PageBuilder waren wirkungslos und teils mit Inline-Styles notdürftig kompensiert. * `grid-card-preview` fehlte, wodurch alle Layout-Vorschauen auf Höhe null kollabierten. Nur "Showcase" war sichtbar — und das aus Versehen, weil sein Tile `hero-tile` hieß und damit die `aspect-ratio` einer fremden PageBuilder-Klasse erbte. Umbenannt. Dazu die Theme-Vorschauen, die praktisch identisch aussahen: alle sieben zeigten dieselben drei quadratischen Kacheln, einziger Unterschied war die Hintergrundfarbe. Sie spiegeln jetzt die echten Preset-Daten aus lib/config/theme.ts — Schriftcharakter, Eckradius, Rasterdichte, Passepartout bzw. Schatten. Die Kopfzeile richtet sich an einer gemeinsamen Steuerhöhe aus. Der "Site"-Link war höher als die Buttons daneben: `.admin-btn` hatte keine explizite line-height, und <button> bekommt box-sizing: border-box vom Browser, <a> nicht. Die Statusanzeige setzte weder Schriftfamilie noch -größe und fiel auf den Browser-Default zurück — sie war nie Teil des Designsystems. Jetzt gleiche Höhe und Typografie, Pillenform als Zustandsanzeige, Trenner zur Aktionsgruppe. Das dauerhafte Pulsieren des grünen Punkts entfällt; Animation bleibt den Zuständen vorbehalten, die Aufmerksamkeit brauchen. Restliche Emojis durch SVG-Icons ersetzt. * feat(admin): add scroll-to-top toggle and SVG arrow The back-to-top button was always on and drew its arrow with the ↑ text character. Add a `scrollToTop` setting (General section in the admin panel, defaults to on so existing sites are unaffected) and replace the glyph with a stroked SVG that inherits currentColor across all presets. Scroll handling is now rAF-throttled, and prefers-reduced-motion turns off both the hover lift and the smooth scroll. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * security(journal): escape author HTML instead of filtering it CodeQL flags 26 high-severity alerts on the release PR; the bulk of them point at sanitizeHtml(), a denylist of three regexes whose output goes into dangerouslySetInnerHTML. I reproduced the bypasses before changing anything — all four pass the old filter: <img src=x onerror=alert(1)> unquoted handler, regex wants quotes <img src=x onerror='alert(1)'> single quotes, same reason <svg onload=alert(1)> not a <script> tag javasjavascript:cript:alert(1) one-pass replace, the rest recombines Plus an attribute breakout in the link renderer, which interpolated the URL into href="${url}" unescaped: [x](" onmouseover=alert(1) x=") -> <a href="" onmouseover=alert(1" ...> Replaced with escaping. Every `&<>"'` in author text becomes an entity before any markdown rule runs, so the only tags in the output are the ones renderInlineMarkdown builds itself and a URL cannot leave its attribute. Link schemes are now an allowlist (http, https, mailto, tel, relative, anchor); anything else renders as plain text. The serializer needed decodeHtmlEntities to match: without it a save would write `&lt;` into the Markdown file and the next parse would escape the `&` again, corrupting the text further on every round trip. A test covers parse -> serialize -> parse stability. Two existing tests asserted the old behaviour and were rewritten rather than deleted: one expected the script tag to be *removed* from the output, the other expected the substring "onerror" to be absent. Both now assert the property that matters — that no tag can form — because `onerror` surviving as inert text is fine. Exploitation required admin access either way: journal and essay text comes from the studio or from content/*.md. This removes the weakness, it does not close an open door. * fix(journal): contain file paths, fix frontmatter escaping, defuse two regexes Follow-up to the CodeQL findings on release PR #432. I went through all 23 alerts individually; this addresses the ones that are worth addressing and documents the ones that are not. Path containment (12 alerts, all false positives). Every path built from a slug goes through isValidSlug(), a strict `/^[a-zA-Z0-9_-]+$/` allowlist — verified against `../../etc/passwd`, `foo/../../bar`, `a/b`, `..` and friends, all rejected. CodeQL cannot see it because the check lives in another module. Added a containedPath() helper that resolves the path and refuses anything landing outside the content directory: a second lock on a door that was already locked, and a barrier the analysis can follow. Also removed the dead `slug.endsWith('.md')` branches — isValidSlug rejects dots, so they could never be taken. Frontmatter escaping (1 alert, a real bug). The serializer escaped `"` but not `\`, and the parser never unescaped anything. A title containing either character gained a backslash on every save/load cycle: Path C:\Users "quoted" -> Path C:\\Users \"quoted\" -> ... Escaping now covers the backslash first and the parser undoes both. A round trip test covers quotes, backslashes, colons and apostrophes. Two of three ReDoS regexes (2 alerts). The heading pattern had `\s+` next to `(.+)`, which overlap, so the engine tried every split of the whitespace run before failing; it is `[ \t]+` and `(\S.*)` now. The quote author pattern wrapped a lazy group around an optional group — the quadratic case — and is an index split on the first separator now. The third regex, the bold/italic pass, is deliberately left alone. Rewriting it with a negated class removes the backtracking but breaks nesting: `**bold *and italic* here**` renders as `*<em>bold </em>and italic<em> here</em>*`. The input is Markdown from an authenticated admin, never a visitor, so the worst case is an author slowing down their own page. The comment in the code says so. Not addressed: 5 js/insufficient-password-hash alerts. They ask for a slow KDF where the code uses SHA-256/HMAC — correct in general, but the admin password comes from an environment variable and is never stored, so a stronger KDF protects nothing that is not already in plaintext in the environment. 399 unit tests pass (18 new), build and tsc clean. * fix(journal): split the quote author by scanning, not by pattern Cleaning up after myself. #439 replaced the quote author regex `/^(.*?)(?:\s+--\s+(.+))?$/` — a lazy group around an optional one, the quadratic case — with `/\s+--\s+/`, and CodeQL promptly flagged the replacement for the same reason. One reported pattern traded for another. splitQuoteAuthor() scans for the first `--` that has whitespace on both sides. Linear, and it needs no reasoning about the regex engine at all. Behaviour is identical to the original regex, checked case by case against it: separator, no separator, several separators, tabs, wide gaps, `a--b` without spaces, leading and trailing separators, empty string. All nine are covered by tests, plus one asserting it stays fast on a 50k whitespace run. * security(admin): derive the session signing key with scrypt getSigningKey() ran the admin password through a single SHA-256 digest. It is key derivation rather than password storage, so it was never a stored-hash problem — but if the derived key ever leaked, one fast hash makes recovering the password by brute force cheap. CodeQL flags it as js/insufficient-password-hash and, for this particular alert, has a point. scrypt now. Two details that matter: The salt has to be stable. A random salt would produce a different key on every call and invalidate every session; it is derived from AUTH_SECRET, which is deployment-specific. Verified across separate processes: same inputs produce a verifying token, so a restart or redeploy does not log everyone out. The result is cached for the process lifetime. scrypt is deliberately slow and getSigningKey() runs on every admin request — deriving per call would add ~24ms to each one. The cache key is a digest of secret plus password, so a rotation misses the cache and derives again, and no extra plaintext copy of the password is kept around. Measured: first derivation 24ms, subsequent calls 0.12ms. Password change and secret change both invalidate an existing token, checked in separate processes. Note the one-time effect: existing admin sessions are invalidated by the change in derivation, so everyone logs in once more. * security(admin): key the signing-key cache on its inputs, not a digest #441 removed the SHA-256 digest of the admin password from the key derivation and introduced a new one three lines above it, as the cache key. Same rule, same file: CodeQL reported it immediately. The comment justifying it was wrong too. It claimed no second plaintext copy of the password was retained, while building the digest input allocates exactly that in order to hash it. The cache now holds the two input strings and compares them directly. They are the same objects the env and install caches already hold, so nothing extra is retained, and no fast hash of the password exists in memory for the life of the process. Re-verified after the change, in separate processes: a token from one process verifies in another with the same inputs, a changed password or secret rejects it, first derivation 24ms, cached calls 0.001ms. That leaves scrypt as the only place the password is hashed here. The two HMACs further down operate on the derived key and on token data, not on the password; the constant-time comparison in verifyAdminPassword is the previously dismissed one. --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
2026-08-14 16:55:07 +02:00
padding: 0 0.6rem;
min-height: 26px;
feat: add visual admin panel with page builder and settings editor - Add /admin route with password-protected visual page builder - Page Builder: manage hero images, standalone albums, subpages, and sections - Album Picker: browse all shared Immich albums with search and filtering - Settings Editor: theme, grid, footer, legal, SEO configuration - YAML service with atomic writes and automatic backups (content/.backups/) - HMAC-signed admin sessions (24h expiry, HttpOnly cookies) - API endpoints: /api/admin/{auth,gallery,settings,albums,reload} - Enable with ADMIN_PASSWORD env var; disabled by default - invalidateConfigCache() export for hot-reload after saves
2026-05-29 17:04:37 +02:00
font-size: 0.75rem;
fix: admin panel light/dark theme support, improved contrast, and backup confirmation a) Admin panel now respects the site's light/dark theme toggle via CSS custom properties that respond to [data-theme='light'] on <html>. All hardcoded dark colors replaced with semantic CSS variables. b) Improved contrast in dark mode: secondary text changed from #666/#555 to #a0a0a0, muted text from #555 to #707070. All text is now clearly readable against dark backgrounds. c) Backup system was already implemented in yaml-service.ts (creates timestamped backups in content/.backups/ before each save, keeps last 10 versions). Now the UI shows a confirmation message that a backup was created after each successful save.
2026-05-29 17:20:56 +02:00
background: var(--admin-bg-raised);
color: var(--admin-text-secondary);
border: 1px solid var(--admin-border);
feat: add visual admin panel with page builder and settings editor - Add /admin route with password-protected visual page builder - Page Builder: manage hero images, standalone albums, subpages, and sections - Album Picker: browse all shared Immich albums with search and filtering - Settings Editor: theme, grid, footer, legal, SEO configuration - YAML service with atomic writes and automatic backups (content/.backups/) - HMAC-signed admin sessions (24h expiry, HttpOnly cookies) - API endpoints: /api/admin/{auth,gallery,settings,albums,reload} - Enable with ADMIN_PASSWORD env var; disabled by default - invalidateConfigCache() export for hot-reload after saves
2026-05-29 17:04:37 +02:00
}
.admin-btn-xs:hover {
fix: admin panel light/dark theme support, improved contrast, and backup confirmation a) Admin panel now respects the site's light/dark theme toggle via CSS custom properties that respond to [data-theme='light'] on <html>. All hardcoded dark colors replaced with semantic CSS variables. b) Improved contrast in dark mode: secondary text changed from #666/#555 to #a0a0a0, muted text from #555 to #707070. All text is now clearly readable against dark backgrounds. c) Backup system was already implemented in yaml-service.ts (creates timestamped backups in content/.backups/ before each save, keeps last 10 versions). Now the UI shows a confirmation message that a backup was created after each successful save.
2026-05-29 17:20:56 +02:00
color: var(--admin-text);
border-color: var(--admin-border-hover);
feat: add visual admin panel with page builder and settings editor - Add /admin route with password-protected visual page builder - Page Builder: manage hero images, standalone albums, subpages, and sections - Album Picker: browse all shared Immich albums with search and filtering - Settings Editor: theme, grid, footer, legal, SEO configuration - YAML service with atomic writes and automatic backups (content/.backups/) - HMAC-signed admin sessions (24h expiry, HttpOnly cookies) - API endpoints: /api/admin/{auth,gallery,settings,albums,reload} - Enable with ADMIN_PASSWORD env var; disabled by default - invalidateConfigCache() export for hot-reload after saves
2026-05-29 17:04:37 +02:00
}
.admin-btn-icon {
background: none;
border: none;
fix: admin panel light/dark theme support, improved contrast, and backup confirmation a) Admin panel now respects the site's light/dark theme toggle via CSS custom properties that respond to [data-theme='light'] on <html>. All hardcoded dark colors replaced with semantic CSS variables. b) Improved contrast in dark mode: secondary text changed from #666/#555 to #a0a0a0, muted text from #555 to #707070. All text is now clearly readable against dark backgrounds. c) Backup system was already implemented in yaml-service.ts (creates timestamped backups in content/.backups/ before each save, keeps last 10 versions). Now the UI shows a confirmation message that a backup was created after each successful save.
2026-05-29 17:20:56 +02:00
color: var(--admin-text-muted);
feat: add visual admin panel with page builder and settings editor - Add /admin route with password-protected visual page builder - Page Builder: manage hero images, standalone albums, subpages, and sections - Album Picker: browse all shared Immich albums with search and filtering - Settings Editor: theme, grid, footer, legal, SEO configuration - YAML service with atomic writes and automatic backups (content/.backups/) - HMAC-signed admin sessions (24h expiry, HttpOnly cookies) - API endpoints: /api/admin/{auth,gallery,settings,albums,reload} - Enable with ADMIN_PASSWORD env var; disabled by default - invalidateConfigCache() export for hot-reload after saves
2026-05-29 17:04:37 +02:00
cursor: pointer;
font-size: 1rem;
padding: 0.25rem;
border-radius: 4px;
transition: color 0.15s;
}
.admin-btn-icon:hover {
fix: admin panel light/dark theme support, improved contrast, and backup confirmation a) Admin panel now respects the site's light/dark theme toggle via CSS custom properties that respond to [data-theme='light'] on <html>. All hardcoded dark colors replaced with semantic CSS variables. b) Improved contrast in dark mode: secondary text changed from #666/#555 to #a0a0a0, muted text from #555 to #707070. All text is now clearly readable against dark backgrounds. c) Backup system was already implemented in yaml-service.ts (creates timestamped backups in content/.backups/ before each save, keeps last 10 versions). Now the UI shows a confirmation message that a backup was created after each successful save.
2026-05-29 17:20:56 +02:00
color: var(--admin-text);
feat: add visual admin panel with page builder and settings editor - Add /admin route with password-protected visual page builder - Page Builder: manage hero images, standalone albums, subpages, and sections - Album Picker: browse all shared Immich albums with search and filtering - Settings Editor: theme, grid, footer, legal, SEO configuration - YAML service with atomic writes and automatic backups (content/.backups/) - HMAC-signed admin sessions (24h expiry, HttpOnly cookies) - API endpoints: /api/admin/{auth,gallery,settings,albums,reload} - Enable with ADMIN_PASSWORD env var; disabled by default - invalidateConfigCache() export for hot-reload after saves
2026-05-29 17:04:37 +02:00
}
.admin-btn-icon:disabled {
opacity: 0.3;
cursor: not-allowed;
}
/* ── Dashboard Layout ──────────────────────────────────────── */
.admin-dashboard {
min-height: 100vh;
display: flex;
flex-direction: column;
}
.admin-header {
position: sticky;
top: 0;
z-index: 100;
display: flex;
align-items: center;
justify-content: space-between;
padding: 0.75rem 1.5rem;
fix: admin panel light/dark theme support, improved contrast, and backup confirmation a) Admin panel now respects the site's light/dark theme toggle via CSS custom properties that respond to [data-theme='light'] on <html>. All hardcoded dark colors replaced with semantic CSS variables. b) Improved contrast in dark mode: secondary text changed from #666/#555 to #a0a0a0, muted text from #555 to #707070. All text is now clearly readable against dark backgrounds. c) Backup system was already implemented in yaml-service.ts (creates timestamped backups in content/.backups/ before each save, keeps last 10 versions). Now the UI shows a confirmation message that a backup was created after each successful save.
2026-05-29 17:20:56 +02:00
background: var(--admin-bg);
border-bottom: 1px solid var(--admin-border);
feat: add visual admin panel with page builder and settings editor - Add /admin route with password-protected visual page builder - Page Builder: manage hero images, standalone albums, subpages, and sections - Album Picker: browse all shared Immich albums with search and filtering - Settings Editor: theme, grid, footer, legal, SEO configuration - YAML service with atomic writes and automatic backups (content/.backups/) - HMAC-signed admin sessions (24h expiry, HttpOnly cookies) - API endpoints: /api/admin/{auth,gallery,settings,albums,reload} - Enable with ADMIN_PASSWORD env var; disabled by default - invalidateConfigCache() export for hot-reload after saves
2026-05-29 17:04:37 +02:00
backdrop-filter: blur(8px);
}
.admin-header h1 {
font-size: 1rem;
font-weight: 600;
margin: 0;
white-space: nowrap;
}
.admin-header-left {
display: flex;
align-items: center;
gap: 1.5rem;
}
.admin-header-right {
display: flex;
align-items: center;
gap: 0.5rem;
}
release: v0.11.0 — journal fixes, admin URLs, design system cleanup (#432) * fix(screenshots): sharp-Typen fuer 0.34 und 0.35 gleichzeitig (#410) sharp 0.35 ist von `export =` auf ESM umgestellt: der Modul-Namespace ist nicht mehr aufrufbar, die Factory sitzt unter .default. Der Type-Check brach damit in scripts/screenshots.ts weg, sobald der Next-Bump (#402) sharp von 0.34.5 auf 0.35.3 mitzieht -- sharp ist hier keine deklarierte Dependency, sondern kommt ueber Next mit. Die Form wird jetzt aus dem installierten Paket abgeleitet statt festgeschrieben, zur Laufzeit wie im Typ. Geprueft mit beiden Versionen: tsc laeuft mit 0.34.5 und mit 0.35.3 fehlerfrei durch. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(deps): bump the nextjs group across 1 directory with 2 updates (#402) Bumps the nextjs group with 2 updates in the / directory: [next](https://github.com/vercel/next.js) and [eslint-config-next](https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next). Updates `next` from 16.2.12 to 16.3.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/compare/v16.2.12...v16.3.0) Updates `eslint-config-next` from 16.2.12 to 16.3.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/commits/v16.3.0/packages/eslint-config-next) --- updated-dependencies: - dependency-name: eslint-config-next dependency-version: 16.3.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: nextjs - dependency-name: next dependency-version: 16.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nextjs ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps-dev): bump prettier from 3.8.3 to 3.9.6 (#405) Bumps [prettier](https://github.com/prettier/prettier) from 3.8.3 to 3.9.6. - [Release notes](https://github.com/prettier/prettier/releases) - [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md) - [Commits](https://github.com/prettier/prettier/compare/3.8.3...3.9.6) --- updated-dependencies: - dependency-name: prettier dependency-version: 3.9.6 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * docs(changelog): Unreleased-Sektion fuer die Bumps nach v0.10.0 (#413) Die Dependency-PRs sind nach dem Release auf dev gelandet, teils auch auf main. Ohne Eintrag waeren sie beim naechsten Release unsichtbar -- inklusive Next 16.3.0, das CVE-2025-13465 mitbringt. Ausserdem im 0.10.0-Abschnitt nachgetragen, dass der Trivy-Scan bis #409 nie gelaufen ist. Der Fix steckt im Tag v0.10.0, fehlte aber in der Aufzaehlung -- und "Images werden bei jedem Publish gescannt" stand im Changelog, waehrend der Job im Action-Setup abbrach. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(gallery): per-album sort order, independent of Immich (#408) (#414) Album order was dictated entirely by Immich: getAlbum() sorted by the album's own asc/desc flag, so a Folio album always mirrored the archive. A curated series has a narrative order that has nothing to do with capture time, and changing the Immich album's sort to fit the website changes it for the archive too. Adds an optional per-album `sort` in gallery.yaml, editable in /admin, defaulting to today's behaviour so every existing config is unchanged: immich (default) | newest | oldest | filename | manual `manual` is a pinned *prefix*: `assetOrder` lists only the photos placed by hand, everything else follows in the album's Immich order. A full permutation of a 2,000-photo album would be ~80 KB of UUIDs in a file that is rewritten and copied to content/.backups/ on every admin save. It also makes drift fall out for free — photos removed in Immich never match, new ones land in the tail rather than being hidden. Sorting is applied after the cache read, not before the cache write, so the LRU keeps one canonical Immich-ordered copy per album. That avoids putting the mode in the cache key, lets a config change take effect without depending on invalidation, and keeps the stale-serving path correct. cache.get() returns the stored object by reference, so withSort() returns a shallow clone with a new array — sorting in place would reorder the shared entry, and under request coalescing every concurrent caller would be sorting the same array. Also fixes a prerequisite bug: /api/admin/albums/[albumId]/assets read album.assets from GET /albums/:id, which Immich 3.x no longer populates (lib/immich.ts:507). The hero picker's "This Album" tab returned nothing and threw outright when the key was absent. It now goes through the client's paginated metadata search, with ?types=all to opt videos in for the reorder editor. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): drop decorative emoji from the sort select labels (#415) An <option> cannot contain markup, so the SVG set in Icons is not reachable there — but a decorative emoji is not a substitute for it. Plain text instead; the album card badge already uses a real icon. The remaining emoji in the admin panel (asset picker tabs, section headings, layout picker options) predate this branch and are left for a separate cleanup. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): replace emoji icons with the shared SVG icon set (#416) The admin panel mixed two icon conventions: inline SVGs from `Icons.tsx` in most components, and decorative emoji in the asset picker and a few PageBuilder labels. Emoji render inconsistently across platforms, ignore the accent colour, and cannot inherit the `.svg-icon` sizing rules. - Icons.tsx: add `IconStar` (filled — it marks a state, not an action) and `IconImage`. - AssetPicker: the three tab labels and the favourite tile badge now use IconFolder / IconStar / IconImage. - PageBuilder: the "Standalone Albums" and "Subpages" headings use the icon set instead of an emoji. - PageBuilder: the layout picker drops its emoji for plain text. An <option> cannot contain markup, so an SVG is impossible there and a decorative glyph is not a substitute. - admin.css: align icon and label in the picker tabs, and swap the favourite badge's text-shadow for drop-shadow, which is what applies to an inline SVG. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): fold PageBuilder's local icons into the shared Icons module (#418) * refactor(admin): fold PageBuilder's local icons into the shared module PageBuilder.tsx carried its own `Icons` object duplicating most of the glyphs already exported by Icons.tsx, with hardcoded sizes and slightly divergent paths. Migrate all 32 call sites to the shared module and delete the local object. Five glyphs had no counterpart and are added to Icons.tsx as 1:1 ports of the local paths: IconX, IconPlus, IconHome, IconCopy, IconImage. The local ExternalLink and Check are dropped rather than ported — both had zero call sites. Two glyphs change shape slightly, which is the point of consolidating: the shared IconCamera includes the viewfinder bump the local copy omitted, and drag handles now use IconGripVertical. IconGripVertical uses the module's square 24x24 viewBox, so `.svg-drag` goes from 12x18 to 18x18 — the old non-square box would letterbox the glyph down to 12x12 and shrink the handle. * fix(admin): resolve icon-module integration after #416 Merging dev brought in #416, which added a second IconImage to Icons.tsx and two <Icons.Camera>/<Icons.Folder> section headers that reference the local Icons object this PR removes. Git merged both cleanly but the result did not type-check. - drop the duplicate IconImage (both copies were byte-identical) - point the two section headers at the imported IconCamera/IconFolder - refresh the SORT_LABELS comment: the icon set is imported now, not declared below --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> * fix(config): allow an empty gallery, guard against a double /api suffix (#421) An empty gallery is now a valid, rendered state instead of a throw: deriveGallery() no longer requires at least one album or subpage, so a deployment with no albums yet renders a bare homepage the owner can fill in via /admin. getConfig() also stops appending /api to an Immich URL that already ends in it, which previously produced .../api/api and broke every upstream request. Includes a restore of the per-album sort test cases, which the branch had lost by being cut before #408/#414. * feat(admin): favicon upload, served from the content volume (#422) Adds a bundled default favicon, an upload widget in admin Settings > General, and a route that serves the icon from the writable content/ volume with a fallback to the bundled default. Raster uploads (PNG/ICO/JPEG) are wrapped in an SVG container; the response carries its own CSP so an uploaded SVG cannot execute script on the origin. The GET route revalidates with an ETag instead of caching immutably, so a newly uploaded icon shows up immediately. Uploads are written via temp file + rename, and a Reset button restores the bundled default. * ci: flag unformatted files in a PR, without blocking it (#424) Prettier is configured as an error rule in eslint.config.mjs but has never run in CI, so part of the tree predates it. A final CI step now diffs against the PR base, runs prettier --list-different over the changed files, and emits a warning annotation per offender plus a job summary. Advisory by design: it never fails the job. Blocking would turn a PR red for merely touching a file that was already unformatted, and normalising the tree in one commit would wreck git blame and conflict with the PRs in flight. Requires fetch-depth: 0, since diffing against the base needs its history. * feat(install): first-run wizard gated by a one-time setup token (#419) Adds /install, a four-step first-run wizard: connect to Immich, optionally pick albums, name the site, finish. It verifies the credentials against the Immich server before writing anything, then writes gallery.yaml, settings.yaml and a content/install.json carrying the Immich credentials and a generated site secret. install.json exists because a running process cannot pick up new env vars — the wizard has to write configuration that takes effect without a restart. getInstallCredentials() merges it under the real environment, so env vars always win and rotation stays a matter of setting one. Both the page and the API routes are gated by a one-time setup token printed to the server log, so a deployment that is reachable before gallery.yaml exists cannot be configured by whoever finds it first. The token is stored in content/.setup-token (0600) rather than a module variable: Next.js bundles the page and each route handler separately, so a module-level token left the page and the API disagreeing inside one process and the wizard stuck on step 1. It is removed once the install completes. The admin password is stored as an scrypt hash using the scheme lib/auth.ts already applies to album passwords; a plaintext ADMIN_PASSWORD env var keeps working. * docs: document the setup wizard, fix the read-only content mount (#425) Quick Start now leads with the /install wizard, with the hand-written YAML route kept alongside it, and a First-Run Setup section covers the setup token, the files the wizard writes, and env-var precedence. Two corrections: both Docker examples mounted content/ as :ro, which silently breaks the wizard, the admin panel and the backup rotation alike — docs/admin-panel.md already said so and the README contradicted it. And nothing documented that content/install.json holds the Immich API key, so a backup of content/ is a backup of credentials. Also adds a Contributors section crediting the people whose work is in the project. * feat(admin): floating save bar pinned to the bottom of the viewport (#426) The save bar was the first, static element inside .admin-main. Since the document itself scrolls, it left the viewport as soon as you scrolled down — editing a subpage section or a settings block far below gave no visible dirty hint and no reachable save button. Replace it with a bottom-pinned floating bar shared by both editors. It only mounts while there is something to act on (unsaved changes, an in-flight save, or a result message), so it never covers content while idle. The success message clears after 5s, which hides the bar again. - new SaveBar component, replacing the duplicated markup in PageBuilder and SettingsEditor - adopt the previously unused .floating-save-bar CSS: slide-in keyframes (carrying translateX(-50%)), dirty border, wrap/gap, mobile variant and a prefers-reduced-motion opt-out; z-index 900 keeps it below modals - .admin-main gains bottom padding so the bar never covers page content - drop the now-unreachable idle hints: the ⌘S hint becomes a button title, the Live Sync note becomes a static line above the settings layout - header "Site" link now bypasses the cache (/?fresh=1), so the preview stays reachable when the bar is hidden Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(admin): themed listbox for the album sort control (#427) The per-album "Photo order" control was a native <select>. Because an <option> cannot contain markup, its choices could not use the admin panel's currentColor SVG set — the reason #415 had to fall back to plain text after dropping the emoji labels. Adds a Listbox component implementing the ARIA combobox/listbox pattern, so options can render a glyph beside their label: - DOM focus stays on the trigger button; the active option is announced through aria-activedescendant, keeping focus management to one element - Keyboard: arrows (clamped at the ends, like a native select), Home/End, Enter/Space to commit, Escape to cancel, Tab commits and moves on, and prefix type-ahead with a repeat-key cycle - Outside dismissal on pointerdown, so a press starting outside closes the popup before the click retargets The sort options now carry an icon each: calendar, arrow-down, arrow-up, an A→Z marker, and the drag glyph for manual — matching the badge the album card already shows. SORT_LABELS stays plain text because the badge feeds it to a title attribute. Closes #417 Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(git): ignore generated design handoff folders * fix(admin): stop the album sort dropdown clipping, and simplify the panel (#428) * fix(admin): render listbox popup in a portal so it escapes modal clipping The sort control's popup was position:absolute inside three clipping ancestors (.album-drawer overflow:hidden > .album-drawer-body overflow-y:auto > .modal-right-column overflow-y:auto), so it was cut off at the bottom of the Edit Album Details modal. z-index could not help: clipping happens before stacking. It also always hung below the trigger, with no flip. Portal the popup to document.body and position it from the trigger's viewport rect, flipping above when there is more room there and capping max-height to the space available so it scrolls internally rather than overflowing. It is dismissed on scroll and resize, since the anchor is only measured on open. The outside-pointerdown handler now also treats the popup as inside; without that the portalled list counts as outside, and a click on an option would close it before the selection commits. * refactor(admin): single-column album details panel The left column spent 1.2fr on a cover thumbnail and three stat rows, two of which (Status, Custom Hero) only restated the form fields opposite them, while the form itself was squeezed into 1.8fr behind a second nested scroller. Stack the drawer in one column instead: cover as a banner, then the form at full width, with the UUID moved into the footer. The body is now the only scroll container, which also removes one of the ancestors that was clipping the sort popup. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> * fix(admin): give the portalled listbox its theme back, lock the page behind modals (#429) Two defects in the album editor. The sort listbox popup painted transparent. Every --admin-* variable is scoped to .admin-layout, and since the popup moved into document.body it sits outside that subtree, so background/border/text all resolved to nothing. It now carries its own copy of the palette in both colour schemes, plus the font it no longer inherits. Scrolling inside a modal also moved the page behind it. No admin modal ever locked body scroll: the overlay covers the page but does not absorb wheel events, so a scroll starting on the backdrop — or continuing past the end of the modal's own scroller — reaches the document. overscroll-behavior cannot cover that case on its own, because it only applies to scroll containers and the backdrop is not one. useScrollLock freezes body while a modal is open and compensates for the width the scrollbar gives up, so nothing shifts underneath. Each lock restores the inline value it found, which makes nesting work without a counter — a picker opened from the drawer restores the drawer's hidden state instead of clearing it. Applied to both drawers and all four picker modals, which share the defect. overscroll-behavior: contain on the scrollers stops the chaining they can handle themselves. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com> * fix(security): allow unsafe-eval in CSP script-src during dev mode * feat(journal): add Journal Studio with split-screen editor, live preview and dedicated routes * fix(build): separate client parser from server journal-service and fix build type errors * fix(journal): Fotos rendern, Layout und Lightbox-Steuerung korrigieren Fünf unabhängige Fehler in der öffentlichen Journal- und Essay-Ansicht: * Foto-Blöcke wurden nie angezeigt. EssayView löst ein Foto über PhotoItem.id auf, und das sind verschlüsselte Tokens — die Blöcke aus dem Markdown tragen aber rohe Asset-UUIDs. Jede Zuordnung lief ins Leere, und nicht auflösbare Blöcke werden still verworfen. Die IDs werden jetzt serverseitig übersetzt; damit verschwinden nebenbei die rohen UUIDs aus dem Client-Payload, die dort laut Projektregel nie auftauchen dürfen. Nicht auflösbare Referenzen werden geloggt. * Überschriften standen weiter links als der Fließtext. Jeder Block hatte einzeln `max-width: 68ch`, und `ch` ist relativ zur Schrift des Elements — die Serif-Überschrift ergab eine breitere Spalte. Ersetzt durch eine gemeinsame, font-unabhängige `--essay-measure`. * Fullbleed-Fotos bluteten nur nach links aus: `.essay-figure` ist `width: 100%`, wodurch die Box überbestimmt ist und der negative rechte Margin verworfen wird. * Foto-Paare stellten beide Bilder gleich breit dar, wodurch ein Hochformat neben einem Querformat doppelt so hoch wurde. Jetzt eine Justified-Reihe: Breite proportional zum Seitenverhältnis, dadurch exakt gleiche Höhen ohne Beschnitt. * Die Lightbox hatte im Journal keine Tastatursteuerung und keine Scroll-Sperre — beides lag in PhotoGrid, also nur im Album-Raster. Verlagert in die Lightbox selbst, der doppelte Handler in PhotoGrid entfernt (sonst wäre pro Pfeildruck zwei Bilder weitergesprungen). Zusätzlich sind Proofing-Herzen und das EXIF-Panel im redaktionellen Modus abschaltbar und im Journal aus: Client-Proofing ist ein Übergabe-Workflow für Alben, keine Funktion einer Reportage. Auf der Übersicht wurde der Untertitel doppelt gerendert, weil extractExcerpt() auf ihn zurückfällt. * feat(admin): eigene URLs für alle Bereiche und überarbeiteter Journal Studio Das Panel war eine einzige Client-Komponente, die ihre Tabs über useState umschaltet: keine Route pro Bereich, kein Deep-Link, kein Zurück-Button, und nach jedem Reload landete man wieder auf "Pages". Auch der Journal-Editor hatte keine eigene URL. Jetzt sieben echte Routen (/admin, /admin/pages, /admin/journal, /admin/journal/<slug>, /admin/settings, /admin/settings/<section>, /admin/analytics). Die Shell mit Auth-Prüfung und Kopfzeile sitzt im Layout und umschließt children — so bleibt die Session-Prüfung über Routenwechsel montiert, statt bei jedem Tab-Wechsel neu zu laufen und den Spinner aufblitzen zu lassen. Unbekannte Settings-Sections fallen auf General zurück. Im selben Zug der Journal Studio, der die Routing-Änderung ohnehin berührt: * Alle Eingabefelder nutzten die Klasse `admin-input`, die in keinem CSS definiert war — sie fielen auf Browser-Defaults zurück. Jetzt gestylt, gescoped, damit der generische Name nicht ins übrige Panel leckt. * Der Split View ist per Divider verschiebbar (Maus, Tastatur, Doppelklick zum Zurücksetzen), Breite in localStorage. * Das Studio bricht aus der 1120px-Spalte aus, die Preview hat Platz. * Die Preview zeigte für jedes Foto fest 3:2 und log damit über das Layout der veröffentlichten Seite; die echten Verhältnisse werden jetzt an den Thumbnails gemessen. * Blöcke mit alten positionsbasierten Foto-Referenzen werden markiert — die lassen sich auf einer eigenständigen Journal-Seite nicht auflösen und verschwanden bisher stillschweigend. * Blocktyp-Chips als gemeinsame Komponente, monochrom und per Icon unterschieden statt in einer eigenen Blau/Lila/Orange-Palette, die sonst nirgends im Panel vorkommt. * Emojis raus, SVG-Icons rein. * fix(admin): Designsystem-Lücken im Panel schließen Eine systematische Suche nach Klassen, die im TSX benutzt, aber in keinem CSS definiert sind, hat vier Stellen mit demselben Muster gefunden: * `admin-btn-secondary` und `admin-btn-danger` existierten nicht. Sämtliche Löschen-Buttons sahen aus wie normale Buttons — keine Warnwirkung. Als `.admin-btn.admin-btn-danger` geschrieben, weil die Varianten mit den Größenklassen kombiniert werden, die weiter unten ihren eigenen Hintergrund setzen. * `page-progress-fill` fehlte: die Balken im Analytics-Panel waren leere Rinnen, der Wert unsichtbar. Ebenso `analytics-empty` und `admin-loading-container`. * `subpage-drawer-section`, `subpage-drawer-title-group` und `input-with-icon` im PageBuilder waren wirkungslos und teils mit Inline-Styles notdürftig kompensiert. * `grid-card-preview` fehlte, wodurch alle Layout-Vorschauen auf Höhe null kollabierten. Nur "Showcase" war sichtbar — und das aus Versehen, weil sein Tile `hero-tile` hieß und damit die `aspect-ratio` einer fremden PageBuilder-Klasse erbte. Umbenannt. Dazu die Theme-Vorschauen, die praktisch identisch aussahen: alle sieben zeigten dieselben drei quadratischen Kacheln, einziger Unterschied war die Hintergrundfarbe. Sie spiegeln jetzt die echten Preset-Daten aus lib/config/theme.ts — Schriftcharakter, Eckradius, Rasterdichte, Passepartout bzw. Schatten. Die Kopfzeile richtet sich an einer gemeinsamen Steuerhöhe aus. Der "Site"-Link war höher als die Buttons daneben: `.admin-btn` hatte keine explizite line-height, und <button> bekommt box-sizing: border-box vom Browser, <a> nicht. Die Statusanzeige setzte weder Schriftfamilie noch -größe und fiel auf den Browser-Default zurück — sie war nie Teil des Designsystems. Jetzt gleiche Höhe und Typografie, Pillenform als Zustandsanzeige, Trenner zur Aktionsgruppe. Das dauerhafte Pulsieren des grünen Punkts entfällt; Animation bleibt den Zuständen vorbehalten, die Aufmerksamkeit brauchen. Restliche Emojis durch SVG-Icons ersetzt. * feat(admin): add scroll-to-top toggle and SVG arrow The back-to-top button was always on and drew its arrow with the ↑ text character. Add a `scrollToTop` setting (General section in the admin panel, defaults to on so existing sites are unaffected) and replace the glyph with a stroked SVG that inherits currentColor across all presets. Scroll handling is now rAF-throttled, and prefers-reduced-motion turns off both the hover lift and the smooth scroll. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * security(journal): escape author HTML instead of filtering it CodeQL flags 26 high-severity alerts on the release PR; the bulk of them point at sanitizeHtml(), a denylist of three regexes whose output goes into dangerouslySetInnerHTML. I reproduced the bypasses before changing anything — all four pass the old filter: <img src=x onerror=alert(1)> unquoted handler, regex wants quotes <img src=x onerror='alert(1)'> single quotes, same reason <svg onload=alert(1)> not a <script> tag javasjavascript:cript:alert(1) one-pass replace, the rest recombines Plus an attribute breakout in the link renderer, which interpolated the URL into href="${url}" unescaped: [x](" onmouseover=alert(1) x=") -> <a href="" onmouseover=alert(1" ...> Replaced with escaping. Every `&<>"'` in author text becomes an entity before any markdown rule runs, so the only tags in the output are the ones renderInlineMarkdown builds itself and a URL cannot leave its attribute. Link schemes are now an allowlist (http, https, mailto, tel, relative, anchor); anything else renders as plain text. The serializer needed decodeHtmlEntities to match: without it a save would write `&lt;` into the Markdown file and the next parse would escape the `&` again, corrupting the text further on every round trip. A test covers parse -> serialize -> parse stability. Two existing tests asserted the old behaviour and were rewritten rather than deleted: one expected the script tag to be *removed* from the output, the other expected the substring "onerror" to be absent. Both now assert the property that matters — that no tag can form — because `onerror` surviving as inert text is fine. Exploitation required admin access either way: journal and essay text comes from the studio or from content/*.md. This removes the weakness, it does not close an open door. * fix(journal): contain file paths, fix frontmatter escaping, defuse two regexes Follow-up to the CodeQL findings on release PR #432. I went through all 23 alerts individually; this addresses the ones that are worth addressing and documents the ones that are not. Path containment (12 alerts, all false positives). Every path built from a slug goes through isValidSlug(), a strict `/^[a-zA-Z0-9_-]+$/` allowlist — verified against `../../etc/passwd`, `foo/../../bar`, `a/b`, `..` and friends, all rejected. CodeQL cannot see it because the check lives in another module. Added a containedPath() helper that resolves the path and refuses anything landing outside the content directory: a second lock on a door that was already locked, and a barrier the analysis can follow. Also removed the dead `slug.endsWith('.md')` branches — isValidSlug rejects dots, so they could never be taken. Frontmatter escaping (1 alert, a real bug). The serializer escaped `"` but not `\`, and the parser never unescaped anything. A title containing either character gained a backslash on every save/load cycle: Path C:\Users "quoted" -> Path C:\\Users \"quoted\" -> ... Escaping now covers the backslash first and the parser undoes both. A round trip test covers quotes, backslashes, colons and apostrophes. Two of three ReDoS regexes (2 alerts). The heading pattern had `\s+` next to `(.+)`, which overlap, so the engine tried every split of the whitespace run before failing; it is `[ \t]+` and `(\S.*)` now. The quote author pattern wrapped a lazy group around an optional group — the quadratic case — and is an index split on the first separator now. The third regex, the bold/italic pass, is deliberately left alone. Rewriting it with a negated class removes the backtracking but breaks nesting: `**bold *and italic* here**` renders as `*<em>bold </em>and italic<em> here</em>*`. The input is Markdown from an authenticated admin, never a visitor, so the worst case is an author slowing down their own page. The comment in the code says so. Not addressed: 5 js/insufficient-password-hash alerts. They ask for a slow KDF where the code uses SHA-256/HMAC — correct in general, but the admin password comes from an environment variable and is never stored, so a stronger KDF protects nothing that is not already in plaintext in the environment. 399 unit tests pass (18 new), build and tsc clean. * fix(journal): split the quote author by scanning, not by pattern Cleaning up after myself. #439 replaced the quote author regex `/^(.*?)(?:\s+--\s+(.+))?$/` — a lazy group around an optional one, the quadratic case — with `/\s+--\s+/`, and CodeQL promptly flagged the replacement for the same reason. One reported pattern traded for another. splitQuoteAuthor() scans for the first `--` that has whitespace on both sides. Linear, and it needs no reasoning about the regex engine at all. Behaviour is identical to the original regex, checked case by case against it: separator, no separator, several separators, tabs, wide gaps, `a--b` without spaces, leading and trailing separators, empty string. All nine are covered by tests, plus one asserting it stays fast on a 50k whitespace run. * security(admin): derive the session signing key with scrypt getSigningKey() ran the admin password through a single SHA-256 digest. It is key derivation rather than password storage, so it was never a stored-hash problem — but if the derived key ever leaked, one fast hash makes recovering the password by brute force cheap. CodeQL flags it as js/insufficient-password-hash and, for this particular alert, has a point. scrypt now. Two details that matter: The salt has to be stable. A random salt would produce a different key on every call and invalidate every session; it is derived from AUTH_SECRET, which is deployment-specific. Verified across separate processes: same inputs produce a verifying token, so a restart or redeploy does not log everyone out. The result is cached for the process lifetime. scrypt is deliberately slow and getSigningKey() runs on every admin request — deriving per call would add ~24ms to each one. The cache key is a digest of secret plus password, so a rotation misses the cache and derives again, and no extra plaintext copy of the password is kept around. Measured: first derivation 24ms, subsequent calls 0.12ms. Password change and secret change both invalidate an existing token, checked in separate processes. Note the one-time effect: existing admin sessions are invalidated by the change in derivation, so everyone logs in once more. * security(admin): key the signing-key cache on its inputs, not a digest #441 removed the SHA-256 digest of the admin password from the key derivation and introduced a new one three lines above it, as the cache key. Same rule, same file: CodeQL reported it immediately. The comment justifying it was wrong too. It claimed no second plaintext copy of the password was retained, while building the digest input allocates exactly that in order to hash it. The cache now holds the two input strings and compares them directly. They are the same objects the env and install caches already hold, so nothing extra is retained, and no fast hash of the password exists in memory for the life of the process. Re-verified after the change, in separate processes: a token from one process verifies in another with the same inputs, a changed password or secret rejects it, first derivation 24ms, cached calls 0.001ms. That leaves scrypt as the only place the password is hashed here. The two HMACs further down operate on the derived key and on token data, not on the password; the constant-time comparison in verifyAdminPassword is the previously dismissed one. --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
2026-08-14 16:55:07 +02:00
.admin-header-divider {
width: 1px;
height: 20px;
background: var(--admin-border);
margin: 0 0.25rem;
}
feat: add visual admin panel with page builder and settings editor - Add /admin route with password-protected visual page builder - Page Builder: manage hero images, standalone albums, subpages, and sections - Album Picker: browse all shared Immich albums with search and filtering - Settings Editor: theme, grid, footer, legal, SEO configuration - YAML service with atomic writes and automatic backups (content/.backups/) - HMAC-signed admin sessions (24h expiry, HttpOnly cookies) - API endpoints: /api/admin/{auth,gallery,settings,albums,reload} - Enable with ADMIN_PASSWORD env var; disabled by default - invalidateConfigCache() export for hot-reload after saves
2026-05-29 17:04:37 +02:00
.admin-tabs {
display: flex;
gap: 0;
}
release: v0.11.0 — journal fixes, admin URLs, design system cleanup (#432) * fix(screenshots): sharp-Typen fuer 0.34 und 0.35 gleichzeitig (#410) sharp 0.35 ist von `export =` auf ESM umgestellt: der Modul-Namespace ist nicht mehr aufrufbar, die Factory sitzt unter .default. Der Type-Check brach damit in scripts/screenshots.ts weg, sobald der Next-Bump (#402) sharp von 0.34.5 auf 0.35.3 mitzieht -- sharp ist hier keine deklarierte Dependency, sondern kommt ueber Next mit. Die Form wird jetzt aus dem installierten Paket abgeleitet statt festgeschrieben, zur Laufzeit wie im Typ. Geprueft mit beiden Versionen: tsc laeuft mit 0.34.5 und mit 0.35.3 fehlerfrei durch. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(deps): bump the nextjs group across 1 directory with 2 updates (#402) Bumps the nextjs group with 2 updates in the / directory: [next](https://github.com/vercel/next.js) and [eslint-config-next](https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next). Updates `next` from 16.2.12 to 16.3.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/compare/v16.2.12...v16.3.0) Updates `eslint-config-next` from 16.2.12 to 16.3.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/commits/v16.3.0/packages/eslint-config-next) --- updated-dependencies: - dependency-name: eslint-config-next dependency-version: 16.3.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: nextjs - dependency-name: next dependency-version: 16.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nextjs ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps-dev): bump prettier from 3.8.3 to 3.9.6 (#405) Bumps [prettier](https://github.com/prettier/prettier) from 3.8.3 to 3.9.6. - [Release notes](https://github.com/prettier/prettier/releases) - [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md) - [Commits](https://github.com/prettier/prettier/compare/3.8.3...3.9.6) --- updated-dependencies: - dependency-name: prettier dependency-version: 3.9.6 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * docs(changelog): Unreleased-Sektion fuer die Bumps nach v0.10.0 (#413) Die Dependency-PRs sind nach dem Release auf dev gelandet, teils auch auf main. Ohne Eintrag waeren sie beim naechsten Release unsichtbar -- inklusive Next 16.3.0, das CVE-2025-13465 mitbringt. Ausserdem im 0.10.0-Abschnitt nachgetragen, dass der Trivy-Scan bis #409 nie gelaufen ist. Der Fix steckt im Tag v0.10.0, fehlte aber in der Aufzaehlung -- und "Images werden bei jedem Publish gescannt" stand im Changelog, waehrend der Job im Action-Setup abbrach. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(gallery): per-album sort order, independent of Immich (#408) (#414) Album order was dictated entirely by Immich: getAlbum() sorted by the album's own asc/desc flag, so a Folio album always mirrored the archive. A curated series has a narrative order that has nothing to do with capture time, and changing the Immich album's sort to fit the website changes it for the archive too. Adds an optional per-album `sort` in gallery.yaml, editable in /admin, defaulting to today's behaviour so every existing config is unchanged: immich (default) | newest | oldest | filename | manual `manual` is a pinned *prefix*: `assetOrder` lists only the photos placed by hand, everything else follows in the album's Immich order. A full permutation of a 2,000-photo album would be ~80 KB of UUIDs in a file that is rewritten and copied to content/.backups/ on every admin save. It also makes drift fall out for free — photos removed in Immich never match, new ones land in the tail rather than being hidden. Sorting is applied after the cache read, not before the cache write, so the LRU keeps one canonical Immich-ordered copy per album. That avoids putting the mode in the cache key, lets a config change take effect without depending on invalidation, and keeps the stale-serving path correct. cache.get() returns the stored object by reference, so withSort() returns a shallow clone with a new array — sorting in place would reorder the shared entry, and under request coalescing every concurrent caller would be sorting the same array. Also fixes a prerequisite bug: /api/admin/albums/[albumId]/assets read album.assets from GET /albums/:id, which Immich 3.x no longer populates (lib/immich.ts:507). The hero picker's "This Album" tab returned nothing and threw outright when the key was absent. It now goes through the client's paginated metadata search, with ?types=all to opt videos in for the reorder editor. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): drop decorative emoji from the sort select labels (#415) An <option> cannot contain markup, so the SVG set in Icons is not reachable there — but a decorative emoji is not a substitute for it. Plain text instead; the album card badge already uses a real icon. The remaining emoji in the admin panel (asset picker tabs, section headings, layout picker options) predate this branch and are left for a separate cleanup. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): replace emoji icons with the shared SVG icon set (#416) The admin panel mixed two icon conventions: inline SVGs from `Icons.tsx` in most components, and decorative emoji in the asset picker and a few PageBuilder labels. Emoji render inconsistently across platforms, ignore the accent colour, and cannot inherit the `.svg-icon` sizing rules. - Icons.tsx: add `IconStar` (filled — it marks a state, not an action) and `IconImage`. - AssetPicker: the three tab labels and the favourite tile badge now use IconFolder / IconStar / IconImage. - PageBuilder: the "Standalone Albums" and "Subpages" headings use the icon set instead of an emoji. - PageBuilder: the layout picker drops its emoji for plain text. An <option> cannot contain markup, so an SVG is impossible there and a decorative glyph is not a substitute. - admin.css: align icon and label in the picker tabs, and swap the favourite badge's text-shadow for drop-shadow, which is what applies to an inline SVG. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): fold PageBuilder's local icons into the shared Icons module (#418) * refactor(admin): fold PageBuilder's local icons into the shared module PageBuilder.tsx carried its own `Icons` object duplicating most of the glyphs already exported by Icons.tsx, with hardcoded sizes and slightly divergent paths. Migrate all 32 call sites to the shared module and delete the local object. Five glyphs had no counterpart and are added to Icons.tsx as 1:1 ports of the local paths: IconX, IconPlus, IconHome, IconCopy, IconImage. The local ExternalLink and Check are dropped rather than ported — both had zero call sites. Two glyphs change shape slightly, which is the point of consolidating: the shared IconCamera includes the viewfinder bump the local copy omitted, and drag handles now use IconGripVertical. IconGripVertical uses the module's square 24x24 viewBox, so `.svg-drag` goes from 12x18 to 18x18 — the old non-square box would letterbox the glyph down to 12x12 and shrink the handle. * fix(admin): resolve icon-module integration after #416 Merging dev brought in #416, which added a second IconImage to Icons.tsx and two <Icons.Camera>/<Icons.Folder> section headers that reference the local Icons object this PR removes. Git merged both cleanly but the result did not type-check. - drop the duplicate IconImage (both copies were byte-identical) - point the two section headers at the imported IconCamera/IconFolder - refresh the SORT_LABELS comment: the icon set is imported now, not declared below --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> * fix(config): allow an empty gallery, guard against a double /api suffix (#421) An empty gallery is now a valid, rendered state instead of a throw: deriveGallery() no longer requires at least one album or subpage, so a deployment with no albums yet renders a bare homepage the owner can fill in via /admin. getConfig() also stops appending /api to an Immich URL that already ends in it, which previously produced .../api/api and broke every upstream request. Includes a restore of the per-album sort test cases, which the branch had lost by being cut before #408/#414. * feat(admin): favicon upload, served from the content volume (#422) Adds a bundled default favicon, an upload widget in admin Settings > General, and a route that serves the icon from the writable content/ volume with a fallback to the bundled default. Raster uploads (PNG/ICO/JPEG) are wrapped in an SVG container; the response carries its own CSP so an uploaded SVG cannot execute script on the origin. The GET route revalidates with an ETag instead of caching immutably, so a newly uploaded icon shows up immediately. Uploads are written via temp file + rename, and a Reset button restores the bundled default. * ci: flag unformatted files in a PR, without blocking it (#424) Prettier is configured as an error rule in eslint.config.mjs but has never run in CI, so part of the tree predates it. A final CI step now diffs against the PR base, runs prettier --list-different over the changed files, and emits a warning annotation per offender plus a job summary. Advisory by design: it never fails the job. Blocking would turn a PR red for merely touching a file that was already unformatted, and normalising the tree in one commit would wreck git blame and conflict with the PRs in flight. Requires fetch-depth: 0, since diffing against the base needs its history. * feat(install): first-run wizard gated by a one-time setup token (#419) Adds /install, a four-step first-run wizard: connect to Immich, optionally pick albums, name the site, finish. It verifies the credentials against the Immich server before writing anything, then writes gallery.yaml, settings.yaml and a content/install.json carrying the Immich credentials and a generated site secret. install.json exists because a running process cannot pick up new env vars — the wizard has to write configuration that takes effect without a restart. getInstallCredentials() merges it under the real environment, so env vars always win and rotation stays a matter of setting one. Both the page and the API routes are gated by a one-time setup token printed to the server log, so a deployment that is reachable before gallery.yaml exists cannot be configured by whoever finds it first. The token is stored in content/.setup-token (0600) rather than a module variable: Next.js bundles the page and each route handler separately, so a module-level token left the page and the API disagreeing inside one process and the wizard stuck on step 1. It is removed once the install completes. The admin password is stored as an scrypt hash using the scheme lib/auth.ts already applies to album passwords; a plaintext ADMIN_PASSWORD env var keeps working. * docs: document the setup wizard, fix the read-only content mount (#425) Quick Start now leads with the /install wizard, with the hand-written YAML route kept alongside it, and a First-Run Setup section covers the setup token, the files the wizard writes, and env-var precedence. Two corrections: both Docker examples mounted content/ as :ro, which silently breaks the wizard, the admin panel and the backup rotation alike — docs/admin-panel.md already said so and the README contradicted it. And nothing documented that content/install.json holds the Immich API key, so a backup of content/ is a backup of credentials. Also adds a Contributors section crediting the people whose work is in the project. * feat(admin): floating save bar pinned to the bottom of the viewport (#426) The save bar was the first, static element inside .admin-main. Since the document itself scrolls, it left the viewport as soon as you scrolled down — editing a subpage section or a settings block far below gave no visible dirty hint and no reachable save button. Replace it with a bottom-pinned floating bar shared by both editors. It only mounts while there is something to act on (unsaved changes, an in-flight save, or a result message), so it never covers content while idle. The success message clears after 5s, which hides the bar again. - new SaveBar component, replacing the duplicated markup in PageBuilder and SettingsEditor - adopt the previously unused .floating-save-bar CSS: slide-in keyframes (carrying translateX(-50%)), dirty border, wrap/gap, mobile variant and a prefers-reduced-motion opt-out; z-index 900 keeps it below modals - .admin-main gains bottom padding so the bar never covers page content - drop the now-unreachable idle hints: the ⌘S hint becomes a button title, the Live Sync note becomes a static line above the settings layout - header "Site" link now bypasses the cache (/?fresh=1), so the preview stays reachable when the bar is hidden Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(admin): themed listbox for the album sort control (#427) The per-album "Photo order" control was a native <select>. Because an <option> cannot contain markup, its choices could not use the admin panel's currentColor SVG set — the reason #415 had to fall back to plain text after dropping the emoji labels. Adds a Listbox component implementing the ARIA combobox/listbox pattern, so options can render a glyph beside their label: - DOM focus stays on the trigger button; the active option is announced through aria-activedescendant, keeping focus management to one element - Keyboard: arrows (clamped at the ends, like a native select), Home/End, Enter/Space to commit, Escape to cancel, Tab commits and moves on, and prefix type-ahead with a repeat-key cycle - Outside dismissal on pointerdown, so a press starting outside closes the popup before the click retargets The sort options now carry an icon each: calendar, arrow-down, arrow-up, an A→Z marker, and the drag glyph for manual — matching the badge the album card already shows. SORT_LABELS stays plain text because the badge feeds it to a title attribute. Closes #417 Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(git): ignore generated design handoff folders * fix(admin): stop the album sort dropdown clipping, and simplify the panel (#428) * fix(admin): render listbox popup in a portal so it escapes modal clipping The sort control's popup was position:absolute inside three clipping ancestors (.album-drawer overflow:hidden > .album-drawer-body overflow-y:auto > .modal-right-column overflow-y:auto), so it was cut off at the bottom of the Edit Album Details modal. z-index could not help: clipping happens before stacking. It also always hung below the trigger, with no flip. Portal the popup to document.body and position it from the trigger's viewport rect, flipping above when there is more room there and capping max-height to the space available so it scrolls internally rather than overflowing. It is dismissed on scroll and resize, since the anchor is only measured on open. The outside-pointerdown handler now also treats the popup as inside; without that the portalled list counts as outside, and a click on an option would close it before the selection commits. * refactor(admin): single-column album details panel The left column spent 1.2fr on a cover thumbnail and three stat rows, two of which (Status, Custom Hero) only restated the form fields opposite them, while the form itself was squeezed into 1.8fr behind a second nested scroller. Stack the drawer in one column instead: cover as a banner, then the form at full width, with the UUID moved into the footer. The body is now the only scroll container, which also removes one of the ancestors that was clipping the sort popup. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> * fix(admin): give the portalled listbox its theme back, lock the page behind modals (#429) Two defects in the album editor. The sort listbox popup painted transparent. Every --admin-* variable is scoped to .admin-layout, and since the popup moved into document.body it sits outside that subtree, so background/border/text all resolved to nothing. It now carries its own copy of the palette in both colour schemes, plus the font it no longer inherits. Scrolling inside a modal also moved the page behind it. No admin modal ever locked body scroll: the overlay covers the page but does not absorb wheel events, so a scroll starting on the backdrop — or continuing past the end of the modal's own scroller — reaches the document. overscroll-behavior cannot cover that case on its own, because it only applies to scroll containers and the backdrop is not one. useScrollLock freezes body while a modal is open and compensates for the width the scrollbar gives up, so nothing shifts underneath. Each lock restores the inline value it found, which makes nesting work without a counter — a picker opened from the drawer restores the drawer's hidden state instead of clearing it. Applied to both drawers and all four picker modals, which share the defect. overscroll-behavior: contain on the scrollers stops the chaining they can handle themselves. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com> * fix(security): allow unsafe-eval in CSP script-src during dev mode * feat(journal): add Journal Studio with split-screen editor, live preview and dedicated routes * fix(build): separate client parser from server journal-service and fix build type errors * fix(journal): Fotos rendern, Layout und Lightbox-Steuerung korrigieren Fünf unabhängige Fehler in der öffentlichen Journal- und Essay-Ansicht: * Foto-Blöcke wurden nie angezeigt. EssayView löst ein Foto über PhotoItem.id auf, und das sind verschlüsselte Tokens — die Blöcke aus dem Markdown tragen aber rohe Asset-UUIDs. Jede Zuordnung lief ins Leere, und nicht auflösbare Blöcke werden still verworfen. Die IDs werden jetzt serverseitig übersetzt; damit verschwinden nebenbei die rohen UUIDs aus dem Client-Payload, die dort laut Projektregel nie auftauchen dürfen. Nicht auflösbare Referenzen werden geloggt. * Überschriften standen weiter links als der Fließtext. Jeder Block hatte einzeln `max-width: 68ch`, und `ch` ist relativ zur Schrift des Elements — die Serif-Überschrift ergab eine breitere Spalte. Ersetzt durch eine gemeinsame, font-unabhängige `--essay-measure`. * Fullbleed-Fotos bluteten nur nach links aus: `.essay-figure` ist `width: 100%`, wodurch die Box überbestimmt ist und der negative rechte Margin verworfen wird. * Foto-Paare stellten beide Bilder gleich breit dar, wodurch ein Hochformat neben einem Querformat doppelt so hoch wurde. Jetzt eine Justified-Reihe: Breite proportional zum Seitenverhältnis, dadurch exakt gleiche Höhen ohne Beschnitt. * Die Lightbox hatte im Journal keine Tastatursteuerung und keine Scroll-Sperre — beides lag in PhotoGrid, also nur im Album-Raster. Verlagert in die Lightbox selbst, der doppelte Handler in PhotoGrid entfernt (sonst wäre pro Pfeildruck zwei Bilder weitergesprungen). Zusätzlich sind Proofing-Herzen und das EXIF-Panel im redaktionellen Modus abschaltbar und im Journal aus: Client-Proofing ist ein Übergabe-Workflow für Alben, keine Funktion einer Reportage. Auf der Übersicht wurde der Untertitel doppelt gerendert, weil extractExcerpt() auf ihn zurückfällt. * feat(admin): eigene URLs für alle Bereiche und überarbeiteter Journal Studio Das Panel war eine einzige Client-Komponente, die ihre Tabs über useState umschaltet: keine Route pro Bereich, kein Deep-Link, kein Zurück-Button, und nach jedem Reload landete man wieder auf "Pages". Auch der Journal-Editor hatte keine eigene URL. Jetzt sieben echte Routen (/admin, /admin/pages, /admin/journal, /admin/journal/<slug>, /admin/settings, /admin/settings/<section>, /admin/analytics). Die Shell mit Auth-Prüfung und Kopfzeile sitzt im Layout und umschließt children — so bleibt die Session-Prüfung über Routenwechsel montiert, statt bei jedem Tab-Wechsel neu zu laufen und den Spinner aufblitzen zu lassen. Unbekannte Settings-Sections fallen auf General zurück. Im selben Zug der Journal Studio, der die Routing-Änderung ohnehin berührt: * Alle Eingabefelder nutzten die Klasse `admin-input`, die in keinem CSS definiert war — sie fielen auf Browser-Defaults zurück. Jetzt gestylt, gescoped, damit der generische Name nicht ins übrige Panel leckt. * Der Split View ist per Divider verschiebbar (Maus, Tastatur, Doppelklick zum Zurücksetzen), Breite in localStorage. * Das Studio bricht aus der 1120px-Spalte aus, die Preview hat Platz. * Die Preview zeigte für jedes Foto fest 3:2 und log damit über das Layout der veröffentlichten Seite; die echten Verhältnisse werden jetzt an den Thumbnails gemessen. * Blöcke mit alten positionsbasierten Foto-Referenzen werden markiert — die lassen sich auf einer eigenständigen Journal-Seite nicht auflösen und verschwanden bisher stillschweigend. * Blocktyp-Chips als gemeinsame Komponente, monochrom und per Icon unterschieden statt in einer eigenen Blau/Lila/Orange-Palette, die sonst nirgends im Panel vorkommt. * Emojis raus, SVG-Icons rein. * fix(admin): Designsystem-Lücken im Panel schließen Eine systematische Suche nach Klassen, die im TSX benutzt, aber in keinem CSS definiert sind, hat vier Stellen mit demselben Muster gefunden: * `admin-btn-secondary` und `admin-btn-danger` existierten nicht. Sämtliche Löschen-Buttons sahen aus wie normale Buttons — keine Warnwirkung. Als `.admin-btn.admin-btn-danger` geschrieben, weil die Varianten mit den Größenklassen kombiniert werden, die weiter unten ihren eigenen Hintergrund setzen. * `page-progress-fill` fehlte: die Balken im Analytics-Panel waren leere Rinnen, der Wert unsichtbar. Ebenso `analytics-empty` und `admin-loading-container`. * `subpage-drawer-section`, `subpage-drawer-title-group` und `input-with-icon` im PageBuilder waren wirkungslos und teils mit Inline-Styles notdürftig kompensiert. * `grid-card-preview` fehlte, wodurch alle Layout-Vorschauen auf Höhe null kollabierten. Nur "Showcase" war sichtbar — und das aus Versehen, weil sein Tile `hero-tile` hieß und damit die `aspect-ratio` einer fremden PageBuilder-Klasse erbte. Umbenannt. Dazu die Theme-Vorschauen, die praktisch identisch aussahen: alle sieben zeigten dieselben drei quadratischen Kacheln, einziger Unterschied war die Hintergrundfarbe. Sie spiegeln jetzt die echten Preset-Daten aus lib/config/theme.ts — Schriftcharakter, Eckradius, Rasterdichte, Passepartout bzw. Schatten. Die Kopfzeile richtet sich an einer gemeinsamen Steuerhöhe aus. Der "Site"-Link war höher als die Buttons daneben: `.admin-btn` hatte keine explizite line-height, und <button> bekommt box-sizing: border-box vom Browser, <a> nicht. Die Statusanzeige setzte weder Schriftfamilie noch -größe und fiel auf den Browser-Default zurück — sie war nie Teil des Designsystems. Jetzt gleiche Höhe und Typografie, Pillenform als Zustandsanzeige, Trenner zur Aktionsgruppe. Das dauerhafte Pulsieren des grünen Punkts entfällt; Animation bleibt den Zuständen vorbehalten, die Aufmerksamkeit brauchen. Restliche Emojis durch SVG-Icons ersetzt. * feat(admin): add scroll-to-top toggle and SVG arrow The back-to-top button was always on and drew its arrow with the ↑ text character. Add a `scrollToTop` setting (General section in the admin panel, defaults to on so existing sites are unaffected) and replace the glyph with a stroked SVG that inherits currentColor across all presets. Scroll handling is now rAF-throttled, and prefers-reduced-motion turns off both the hover lift and the smooth scroll. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * security(journal): escape author HTML instead of filtering it CodeQL flags 26 high-severity alerts on the release PR; the bulk of them point at sanitizeHtml(), a denylist of three regexes whose output goes into dangerouslySetInnerHTML. I reproduced the bypasses before changing anything — all four pass the old filter: <img src=x onerror=alert(1)> unquoted handler, regex wants quotes <img src=x onerror='alert(1)'> single quotes, same reason <svg onload=alert(1)> not a <script> tag javasjavascript:cript:alert(1) one-pass replace, the rest recombines Plus an attribute breakout in the link renderer, which interpolated the URL into href="${url}" unescaped: [x](" onmouseover=alert(1) x=") -> <a href="" onmouseover=alert(1" ...> Replaced with escaping. Every `&<>"'` in author text becomes an entity before any markdown rule runs, so the only tags in the output are the ones renderInlineMarkdown builds itself and a URL cannot leave its attribute. Link schemes are now an allowlist (http, https, mailto, tel, relative, anchor); anything else renders as plain text. The serializer needed decodeHtmlEntities to match: without it a save would write `&lt;` into the Markdown file and the next parse would escape the `&` again, corrupting the text further on every round trip. A test covers parse -> serialize -> parse stability. Two existing tests asserted the old behaviour and were rewritten rather than deleted: one expected the script tag to be *removed* from the output, the other expected the substring "onerror" to be absent. Both now assert the property that matters — that no tag can form — because `onerror` surviving as inert text is fine. Exploitation required admin access either way: journal and essay text comes from the studio or from content/*.md. This removes the weakness, it does not close an open door. * fix(journal): contain file paths, fix frontmatter escaping, defuse two regexes Follow-up to the CodeQL findings on release PR #432. I went through all 23 alerts individually; this addresses the ones that are worth addressing and documents the ones that are not. Path containment (12 alerts, all false positives). Every path built from a slug goes through isValidSlug(), a strict `/^[a-zA-Z0-9_-]+$/` allowlist — verified against `../../etc/passwd`, `foo/../../bar`, `a/b`, `..` and friends, all rejected. CodeQL cannot see it because the check lives in another module. Added a containedPath() helper that resolves the path and refuses anything landing outside the content directory: a second lock on a door that was already locked, and a barrier the analysis can follow. Also removed the dead `slug.endsWith('.md')` branches — isValidSlug rejects dots, so they could never be taken. Frontmatter escaping (1 alert, a real bug). The serializer escaped `"` but not `\`, and the parser never unescaped anything. A title containing either character gained a backslash on every save/load cycle: Path C:\Users "quoted" -> Path C:\\Users \"quoted\" -> ... Escaping now covers the backslash first and the parser undoes both. A round trip test covers quotes, backslashes, colons and apostrophes. Two of three ReDoS regexes (2 alerts). The heading pattern had `\s+` next to `(.+)`, which overlap, so the engine tried every split of the whitespace run before failing; it is `[ \t]+` and `(\S.*)` now. The quote author pattern wrapped a lazy group around an optional group — the quadratic case — and is an index split on the first separator now. The third regex, the bold/italic pass, is deliberately left alone. Rewriting it with a negated class removes the backtracking but breaks nesting: `**bold *and italic* here**` renders as `*<em>bold </em>and italic<em> here</em>*`. The input is Markdown from an authenticated admin, never a visitor, so the worst case is an author slowing down their own page. The comment in the code says so. Not addressed: 5 js/insufficient-password-hash alerts. They ask for a slow KDF where the code uses SHA-256/HMAC — correct in general, but the admin password comes from an environment variable and is never stored, so a stronger KDF protects nothing that is not already in plaintext in the environment. 399 unit tests pass (18 new), build and tsc clean. * fix(journal): split the quote author by scanning, not by pattern Cleaning up after myself. #439 replaced the quote author regex `/^(.*?)(?:\s+--\s+(.+))?$/` — a lazy group around an optional one, the quadratic case — with `/\s+--\s+/`, and CodeQL promptly flagged the replacement for the same reason. One reported pattern traded for another. splitQuoteAuthor() scans for the first `--` that has whitespace on both sides. Linear, and it needs no reasoning about the regex engine at all. Behaviour is identical to the original regex, checked case by case against it: separator, no separator, several separators, tabs, wide gaps, `a--b` without spaces, leading and trailing separators, empty string. All nine are covered by tests, plus one asserting it stays fast on a 50k whitespace run. * security(admin): derive the session signing key with scrypt getSigningKey() ran the admin password through a single SHA-256 digest. It is key derivation rather than password storage, so it was never a stored-hash problem — but if the derived key ever leaked, one fast hash makes recovering the password by brute force cheap. CodeQL flags it as js/insufficient-password-hash and, for this particular alert, has a point. scrypt now. Two details that matter: The salt has to be stable. A random salt would produce a different key on every call and invalidate every session; it is derived from AUTH_SECRET, which is deployment-specific. Verified across separate processes: same inputs produce a verifying token, so a restart or redeploy does not log everyone out. The result is cached for the process lifetime. scrypt is deliberately slow and getSigningKey() runs on every admin request — deriving per call would add ~24ms to each one. The cache key is a digest of secret plus password, so a rotation misses the cache and derives again, and no extra plaintext copy of the password is kept around. Measured: first derivation 24ms, subsequent calls 0.12ms. Password change and secret change both invalidate an existing token, checked in separate processes. Note the one-time effect: existing admin sessions are invalidated by the change in derivation, so everyone logs in once more. * security(admin): key the signing-key cache on its inputs, not a digest #441 removed the SHA-256 digest of the admin password from the key derivation and introduced a new one three lines above it, as the cache key. Same rule, same file: CodeQL reported it immediately. The comment justifying it was wrong too. It claimed no second plaintext copy of the password was retained, while building the digest input allocates exactly that in order to hash it. The cache now holds the two input strings and compares them directly. They are the same objects the env and install caches already hold, so nothing extra is retained, and no fast hash of the password exists in memory for the life of the process. Re-verified after the change, in separate processes: a token from one process verifies in another with the same inputs, a changed password or secret rejects it, first derivation 24ms, cached calls 0.001ms. That leaves scrypt as the only place the password is hashed here. The two HMACs further down operate on the derived key and on token data, not on the password; the constant-time comparison in verifyAdminPassword is the previously dismissed one. --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
2026-08-14 16:55:07 +02:00
/* Rendered as an <a> — each tab is its own route. */
feat: add visual admin panel with page builder and settings editor - Add /admin route with password-protected visual page builder - Page Builder: manage hero images, standalone albums, subpages, and sections - Album Picker: browse all shared Immich albums with search and filtering - Settings Editor: theme, grid, footer, legal, SEO configuration - YAML service with atomic writes and automatic backups (content/.backups/) - HMAC-signed admin sessions (24h expiry, HttpOnly cookies) - API endpoints: /api/admin/{auth,gallery,settings,albums,reload} - Enable with ADMIN_PASSWORD env var; disabled by default - invalidateConfigCache() export for hot-reload after saves
2026-05-29 17:04:37 +02:00
.admin-tab {
background: none;
border: none;
fix: admin panel light/dark theme support, improved contrast, and backup confirmation a) Admin panel now respects the site's light/dark theme toggle via CSS custom properties that respond to [data-theme='light'] on <html>. All hardcoded dark colors replaced with semantic CSS variables. b) Improved contrast in dark mode: secondary text changed from #666/#555 to #a0a0a0, muted text from #555 to #707070. All text is now clearly readable against dark backgrounds. c) Backup system was already implemented in yaml-service.ts (creates timestamped backups in content/.backups/ before each save, keeps last 10 versions). Now the UI shows a confirmation message that a backup was created after each successful save.
2026-05-29 17:20:56 +02:00
color: var(--admin-text-muted);
feat: add visual admin panel with page builder and settings editor - Add /admin route with password-protected visual page builder - Page Builder: manage hero images, standalone albums, subpages, and sections - Album Picker: browse all shared Immich albums with search and filtering - Settings Editor: theme, grid, footer, legal, SEO configuration - YAML service with atomic writes and automatic backups (content/.backups/) - HMAC-signed admin sessions (24h expiry, HttpOnly cookies) - API endpoints: /api/admin/{auth,gallery,settings,albums,reload} - Enable with ADMIN_PASSWORD env var; disabled by default - invalidateConfigCache() export for hot-reload after saves
2026-05-29 17:04:37 +02:00
padding: 0.5rem 1rem;
font-size: 0.85rem;
cursor: pointer;
border-bottom: 2px solid transparent;
transition: all 0.15s;
release: v0.11.0 — journal fixes, admin URLs, design system cleanup (#432) * fix(screenshots): sharp-Typen fuer 0.34 und 0.35 gleichzeitig (#410) sharp 0.35 ist von `export =` auf ESM umgestellt: der Modul-Namespace ist nicht mehr aufrufbar, die Factory sitzt unter .default. Der Type-Check brach damit in scripts/screenshots.ts weg, sobald der Next-Bump (#402) sharp von 0.34.5 auf 0.35.3 mitzieht -- sharp ist hier keine deklarierte Dependency, sondern kommt ueber Next mit. Die Form wird jetzt aus dem installierten Paket abgeleitet statt festgeschrieben, zur Laufzeit wie im Typ. Geprueft mit beiden Versionen: tsc laeuft mit 0.34.5 und mit 0.35.3 fehlerfrei durch. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(deps): bump the nextjs group across 1 directory with 2 updates (#402) Bumps the nextjs group with 2 updates in the / directory: [next](https://github.com/vercel/next.js) and [eslint-config-next](https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next). Updates `next` from 16.2.12 to 16.3.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/compare/v16.2.12...v16.3.0) Updates `eslint-config-next` from 16.2.12 to 16.3.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/commits/v16.3.0/packages/eslint-config-next) --- updated-dependencies: - dependency-name: eslint-config-next dependency-version: 16.3.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: nextjs - dependency-name: next dependency-version: 16.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nextjs ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps-dev): bump prettier from 3.8.3 to 3.9.6 (#405) Bumps [prettier](https://github.com/prettier/prettier) from 3.8.3 to 3.9.6. - [Release notes](https://github.com/prettier/prettier/releases) - [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md) - [Commits](https://github.com/prettier/prettier/compare/3.8.3...3.9.6) --- updated-dependencies: - dependency-name: prettier dependency-version: 3.9.6 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * docs(changelog): Unreleased-Sektion fuer die Bumps nach v0.10.0 (#413) Die Dependency-PRs sind nach dem Release auf dev gelandet, teils auch auf main. Ohne Eintrag waeren sie beim naechsten Release unsichtbar -- inklusive Next 16.3.0, das CVE-2025-13465 mitbringt. Ausserdem im 0.10.0-Abschnitt nachgetragen, dass der Trivy-Scan bis #409 nie gelaufen ist. Der Fix steckt im Tag v0.10.0, fehlte aber in der Aufzaehlung -- und "Images werden bei jedem Publish gescannt" stand im Changelog, waehrend der Job im Action-Setup abbrach. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(gallery): per-album sort order, independent of Immich (#408) (#414) Album order was dictated entirely by Immich: getAlbum() sorted by the album's own asc/desc flag, so a Folio album always mirrored the archive. A curated series has a narrative order that has nothing to do with capture time, and changing the Immich album's sort to fit the website changes it for the archive too. Adds an optional per-album `sort` in gallery.yaml, editable in /admin, defaulting to today's behaviour so every existing config is unchanged: immich (default) | newest | oldest | filename | manual `manual` is a pinned *prefix*: `assetOrder` lists only the photos placed by hand, everything else follows in the album's Immich order. A full permutation of a 2,000-photo album would be ~80 KB of UUIDs in a file that is rewritten and copied to content/.backups/ on every admin save. It also makes drift fall out for free — photos removed in Immich never match, new ones land in the tail rather than being hidden. Sorting is applied after the cache read, not before the cache write, so the LRU keeps one canonical Immich-ordered copy per album. That avoids putting the mode in the cache key, lets a config change take effect without depending on invalidation, and keeps the stale-serving path correct. cache.get() returns the stored object by reference, so withSort() returns a shallow clone with a new array — sorting in place would reorder the shared entry, and under request coalescing every concurrent caller would be sorting the same array. Also fixes a prerequisite bug: /api/admin/albums/[albumId]/assets read album.assets from GET /albums/:id, which Immich 3.x no longer populates (lib/immich.ts:507). The hero picker's "This Album" tab returned nothing and threw outright when the key was absent. It now goes through the client's paginated metadata search, with ?types=all to opt videos in for the reorder editor. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): drop decorative emoji from the sort select labels (#415) An <option> cannot contain markup, so the SVG set in Icons is not reachable there — but a decorative emoji is not a substitute for it. Plain text instead; the album card badge already uses a real icon. The remaining emoji in the admin panel (asset picker tabs, section headings, layout picker options) predate this branch and are left for a separate cleanup. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): replace emoji icons with the shared SVG icon set (#416) The admin panel mixed two icon conventions: inline SVGs from `Icons.tsx` in most components, and decorative emoji in the asset picker and a few PageBuilder labels. Emoji render inconsistently across platforms, ignore the accent colour, and cannot inherit the `.svg-icon` sizing rules. - Icons.tsx: add `IconStar` (filled — it marks a state, not an action) and `IconImage`. - AssetPicker: the three tab labels and the favourite tile badge now use IconFolder / IconStar / IconImage. - PageBuilder: the "Standalone Albums" and "Subpages" headings use the icon set instead of an emoji. - PageBuilder: the layout picker drops its emoji for plain text. An <option> cannot contain markup, so an SVG is impossible there and a decorative glyph is not a substitute. - admin.css: align icon and label in the picker tabs, and swap the favourite badge's text-shadow for drop-shadow, which is what applies to an inline SVG. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): fold PageBuilder's local icons into the shared Icons module (#418) * refactor(admin): fold PageBuilder's local icons into the shared module PageBuilder.tsx carried its own `Icons` object duplicating most of the glyphs already exported by Icons.tsx, with hardcoded sizes and slightly divergent paths. Migrate all 32 call sites to the shared module and delete the local object. Five glyphs had no counterpart and are added to Icons.tsx as 1:1 ports of the local paths: IconX, IconPlus, IconHome, IconCopy, IconImage. The local ExternalLink and Check are dropped rather than ported — both had zero call sites. Two glyphs change shape slightly, which is the point of consolidating: the shared IconCamera includes the viewfinder bump the local copy omitted, and drag handles now use IconGripVertical. IconGripVertical uses the module's square 24x24 viewBox, so `.svg-drag` goes from 12x18 to 18x18 — the old non-square box would letterbox the glyph down to 12x12 and shrink the handle. * fix(admin): resolve icon-module integration after #416 Merging dev brought in #416, which added a second IconImage to Icons.tsx and two <Icons.Camera>/<Icons.Folder> section headers that reference the local Icons object this PR removes. Git merged both cleanly but the result did not type-check. - drop the duplicate IconImage (both copies were byte-identical) - point the two section headers at the imported IconCamera/IconFolder - refresh the SORT_LABELS comment: the icon set is imported now, not declared below --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> * fix(config): allow an empty gallery, guard against a double /api suffix (#421) An empty gallery is now a valid, rendered state instead of a throw: deriveGallery() no longer requires at least one album or subpage, so a deployment with no albums yet renders a bare homepage the owner can fill in via /admin. getConfig() also stops appending /api to an Immich URL that already ends in it, which previously produced .../api/api and broke every upstream request. Includes a restore of the per-album sort test cases, which the branch had lost by being cut before #408/#414. * feat(admin): favicon upload, served from the content volume (#422) Adds a bundled default favicon, an upload widget in admin Settings > General, and a route that serves the icon from the writable content/ volume with a fallback to the bundled default. Raster uploads (PNG/ICO/JPEG) are wrapped in an SVG container; the response carries its own CSP so an uploaded SVG cannot execute script on the origin. The GET route revalidates with an ETag instead of caching immutably, so a newly uploaded icon shows up immediately. Uploads are written via temp file + rename, and a Reset button restores the bundled default. * ci: flag unformatted files in a PR, without blocking it (#424) Prettier is configured as an error rule in eslint.config.mjs but has never run in CI, so part of the tree predates it. A final CI step now diffs against the PR base, runs prettier --list-different over the changed files, and emits a warning annotation per offender plus a job summary. Advisory by design: it never fails the job. Blocking would turn a PR red for merely touching a file that was already unformatted, and normalising the tree in one commit would wreck git blame and conflict with the PRs in flight. Requires fetch-depth: 0, since diffing against the base needs its history. * feat(install): first-run wizard gated by a one-time setup token (#419) Adds /install, a four-step first-run wizard: connect to Immich, optionally pick albums, name the site, finish. It verifies the credentials against the Immich server before writing anything, then writes gallery.yaml, settings.yaml and a content/install.json carrying the Immich credentials and a generated site secret. install.json exists because a running process cannot pick up new env vars — the wizard has to write configuration that takes effect without a restart. getInstallCredentials() merges it under the real environment, so env vars always win and rotation stays a matter of setting one. Both the page and the API routes are gated by a one-time setup token printed to the server log, so a deployment that is reachable before gallery.yaml exists cannot be configured by whoever finds it first. The token is stored in content/.setup-token (0600) rather than a module variable: Next.js bundles the page and each route handler separately, so a module-level token left the page and the API disagreeing inside one process and the wizard stuck on step 1. It is removed once the install completes. The admin password is stored as an scrypt hash using the scheme lib/auth.ts already applies to album passwords; a plaintext ADMIN_PASSWORD env var keeps working. * docs: document the setup wizard, fix the read-only content mount (#425) Quick Start now leads with the /install wizard, with the hand-written YAML route kept alongside it, and a First-Run Setup section covers the setup token, the files the wizard writes, and env-var precedence. Two corrections: both Docker examples mounted content/ as :ro, which silently breaks the wizard, the admin panel and the backup rotation alike — docs/admin-panel.md already said so and the README contradicted it. And nothing documented that content/install.json holds the Immich API key, so a backup of content/ is a backup of credentials. Also adds a Contributors section crediting the people whose work is in the project. * feat(admin): floating save bar pinned to the bottom of the viewport (#426) The save bar was the first, static element inside .admin-main. Since the document itself scrolls, it left the viewport as soon as you scrolled down — editing a subpage section or a settings block far below gave no visible dirty hint and no reachable save button. Replace it with a bottom-pinned floating bar shared by both editors. It only mounts while there is something to act on (unsaved changes, an in-flight save, or a result message), so it never covers content while idle. The success message clears after 5s, which hides the bar again. - new SaveBar component, replacing the duplicated markup in PageBuilder and SettingsEditor - adopt the previously unused .floating-save-bar CSS: slide-in keyframes (carrying translateX(-50%)), dirty border, wrap/gap, mobile variant and a prefers-reduced-motion opt-out; z-index 900 keeps it below modals - .admin-main gains bottom padding so the bar never covers page content - drop the now-unreachable idle hints: the ⌘S hint becomes a button title, the Live Sync note becomes a static line above the settings layout - header "Site" link now bypasses the cache (/?fresh=1), so the preview stays reachable when the bar is hidden Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(admin): themed listbox for the album sort control (#427) The per-album "Photo order" control was a native <select>. Because an <option> cannot contain markup, its choices could not use the admin panel's currentColor SVG set — the reason #415 had to fall back to plain text after dropping the emoji labels. Adds a Listbox component implementing the ARIA combobox/listbox pattern, so options can render a glyph beside their label: - DOM focus stays on the trigger button; the active option is announced through aria-activedescendant, keeping focus management to one element - Keyboard: arrows (clamped at the ends, like a native select), Home/End, Enter/Space to commit, Escape to cancel, Tab commits and moves on, and prefix type-ahead with a repeat-key cycle - Outside dismissal on pointerdown, so a press starting outside closes the popup before the click retargets The sort options now carry an icon each: calendar, arrow-down, arrow-up, an A→Z marker, and the drag glyph for manual — matching the badge the album card already shows. SORT_LABELS stays plain text because the badge feeds it to a title attribute. Closes #417 Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(git): ignore generated design handoff folders * fix(admin): stop the album sort dropdown clipping, and simplify the panel (#428) * fix(admin): render listbox popup in a portal so it escapes modal clipping The sort control's popup was position:absolute inside three clipping ancestors (.album-drawer overflow:hidden > .album-drawer-body overflow-y:auto > .modal-right-column overflow-y:auto), so it was cut off at the bottom of the Edit Album Details modal. z-index could not help: clipping happens before stacking. It also always hung below the trigger, with no flip. Portal the popup to document.body and position it from the trigger's viewport rect, flipping above when there is more room there and capping max-height to the space available so it scrolls internally rather than overflowing. It is dismissed on scroll and resize, since the anchor is only measured on open. The outside-pointerdown handler now also treats the popup as inside; without that the portalled list counts as outside, and a click on an option would close it before the selection commits. * refactor(admin): single-column album details panel The left column spent 1.2fr on a cover thumbnail and three stat rows, two of which (Status, Custom Hero) only restated the form fields opposite them, while the form itself was squeezed into 1.8fr behind a second nested scroller. Stack the drawer in one column instead: cover as a banner, then the form at full width, with the UUID moved into the footer. The body is now the only scroll container, which also removes one of the ancestors that was clipping the sort popup. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> * fix(admin): give the portalled listbox its theme back, lock the page behind modals (#429) Two defects in the album editor. The sort listbox popup painted transparent. Every --admin-* variable is scoped to .admin-layout, and since the popup moved into document.body it sits outside that subtree, so background/border/text all resolved to nothing. It now carries its own copy of the palette in both colour schemes, plus the font it no longer inherits. Scrolling inside a modal also moved the page behind it. No admin modal ever locked body scroll: the overlay covers the page but does not absorb wheel events, so a scroll starting on the backdrop — or continuing past the end of the modal's own scroller — reaches the document. overscroll-behavior cannot cover that case on its own, because it only applies to scroll containers and the backdrop is not one. useScrollLock freezes body while a modal is open and compensates for the width the scrollbar gives up, so nothing shifts underneath. Each lock restores the inline value it found, which makes nesting work without a counter — a picker opened from the drawer restores the drawer's hidden state instead of clearing it. Applied to both drawers and all four picker modals, which share the defect. overscroll-behavior: contain on the scrollers stops the chaining they can handle themselves. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com> * fix(security): allow unsafe-eval in CSP script-src during dev mode * feat(journal): add Journal Studio with split-screen editor, live preview and dedicated routes * fix(build): separate client parser from server journal-service and fix build type errors * fix(journal): Fotos rendern, Layout und Lightbox-Steuerung korrigieren Fünf unabhängige Fehler in der öffentlichen Journal- und Essay-Ansicht: * Foto-Blöcke wurden nie angezeigt. EssayView löst ein Foto über PhotoItem.id auf, und das sind verschlüsselte Tokens — die Blöcke aus dem Markdown tragen aber rohe Asset-UUIDs. Jede Zuordnung lief ins Leere, und nicht auflösbare Blöcke werden still verworfen. Die IDs werden jetzt serverseitig übersetzt; damit verschwinden nebenbei die rohen UUIDs aus dem Client-Payload, die dort laut Projektregel nie auftauchen dürfen. Nicht auflösbare Referenzen werden geloggt. * Überschriften standen weiter links als der Fließtext. Jeder Block hatte einzeln `max-width: 68ch`, und `ch` ist relativ zur Schrift des Elements — die Serif-Überschrift ergab eine breitere Spalte. Ersetzt durch eine gemeinsame, font-unabhängige `--essay-measure`. * Fullbleed-Fotos bluteten nur nach links aus: `.essay-figure` ist `width: 100%`, wodurch die Box überbestimmt ist und der negative rechte Margin verworfen wird. * Foto-Paare stellten beide Bilder gleich breit dar, wodurch ein Hochformat neben einem Querformat doppelt so hoch wurde. Jetzt eine Justified-Reihe: Breite proportional zum Seitenverhältnis, dadurch exakt gleiche Höhen ohne Beschnitt. * Die Lightbox hatte im Journal keine Tastatursteuerung und keine Scroll-Sperre — beides lag in PhotoGrid, also nur im Album-Raster. Verlagert in die Lightbox selbst, der doppelte Handler in PhotoGrid entfernt (sonst wäre pro Pfeildruck zwei Bilder weitergesprungen). Zusätzlich sind Proofing-Herzen und das EXIF-Panel im redaktionellen Modus abschaltbar und im Journal aus: Client-Proofing ist ein Übergabe-Workflow für Alben, keine Funktion einer Reportage. Auf der Übersicht wurde der Untertitel doppelt gerendert, weil extractExcerpt() auf ihn zurückfällt. * feat(admin): eigene URLs für alle Bereiche und überarbeiteter Journal Studio Das Panel war eine einzige Client-Komponente, die ihre Tabs über useState umschaltet: keine Route pro Bereich, kein Deep-Link, kein Zurück-Button, und nach jedem Reload landete man wieder auf "Pages". Auch der Journal-Editor hatte keine eigene URL. Jetzt sieben echte Routen (/admin, /admin/pages, /admin/journal, /admin/journal/<slug>, /admin/settings, /admin/settings/<section>, /admin/analytics). Die Shell mit Auth-Prüfung und Kopfzeile sitzt im Layout und umschließt children — so bleibt die Session-Prüfung über Routenwechsel montiert, statt bei jedem Tab-Wechsel neu zu laufen und den Spinner aufblitzen zu lassen. Unbekannte Settings-Sections fallen auf General zurück. Im selben Zug der Journal Studio, der die Routing-Änderung ohnehin berührt: * Alle Eingabefelder nutzten die Klasse `admin-input`, die in keinem CSS definiert war — sie fielen auf Browser-Defaults zurück. Jetzt gestylt, gescoped, damit der generische Name nicht ins übrige Panel leckt. * Der Split View ist per Divider verschiebbar (Maus, Tastatur, Doppelklick zum Zurücksetzen), Breite in localStorage. * Das Studio bricht aus der 1120px-Spalte aus, die Preview hat Platz. * Die Preview zeigte für jedes Foto fest 3:2 und log damit über das Layout der veröffentlichten Seite; die echten Verhältnisse werden jetzt an den Thumbnails gemessen. * Blöcke mit alten positionsbasierten Foto-Referenzen werden markiert — die lassen sich auf einer eigenständigen Journal-Seite nicht auflösen und verschwanden bisher stillschweigend. * Blocktyp-Chips als gemeinsame Komponente, monochrom und per Icon unterschieden statt in einer eigenen Blau/Lila/Orange-Palette, die sonst nirgends im Panel vorkommt. * Emojis raus, SVG-Icons rein. * fix(admin): Designsystem-Lücken im Panel schließen Eine systematische Suche nach Klassen, die im TSX benutzt, aber in keinem CSS definiert sind, hat vier Stellen mit demselben Muster gefunden: * `admin-btn-secondary` und `admin-btn-danger` existierten nicht. Sämtliche Löschen-Buttons sahen aus wie normale Buttons — keine Warnwirkung. Als `.admin-btn.admin-btn-danger` geschrieben, weil die Varianten mit den Größenklassen kombiniert werden, die weiter unten ihren eigenen Hintergrund setzen. * `page-progress-fill` fehlte: die Balken im Analytics-Panel waren leere Rinnen, der Wert unsichtbar. Ebenso `analytics-empty` und `admin-loading-container`. * `subpage-drawer-section`, `subpage-drawer-title-group` und `input-with-icon` im PageBuilder waren wirkungslos und teils mit Inline-Styles notdürftig kompensiert. * `grid-card-preview` fehlte, wodurch alle Layout-Vorschauen auf Höhe null kollabierten. Nur "Showcase" war sichtbar — und das aus Versehen, weil sein Tile `hero-tile` hieß und damit die `aspect-ratio` einer fremden PageBuilder-Klasse erbte. Umbenannt. Dazu die Theme-Vorschauen, die praktisch identisch aussahen: alle sieben zeigten dieselben drei quadratischen Kacheln, einziger Unterschied war die Hintergrundfarbe. Sie spiegeln jetzt die echten Preset-Daten aus lib/config/theme.ts — Schriftcharakter, Eckradius, Rasterdichte, Passepartout bzw. Schatten. Die Kopfzeile richtet sich an einer gemeinsamen Steuerhöhe aus. Der "Site"-Link war höher als die Buttons daneben: `.admin-btn` hatte keine explizite line-height, und <button> bekommt box-sizing: border-box vom Browser, <a> nicht. Die Statusanzeige setzte weder Schriftfamilie noch -größe und fiel auf den Browser-Default zurück — sie war nie Teil des Designsystems. Jetzt gleiche Höhe und Typografie, Pillenform als Zustandsanzeige, Trenner zur Aktionsgruppe. Das dauerhafte Pulsieren des grünen Punkts entfällt; Animation bleibt den Zuständen vorbehalten, die Aufmerksamkeit brauchen. Restliche Emojis durch SVG-Icons ersetzt. * feat(admin): add scroll-to-top toggle and SVG arrow The back-to-top button was always on and drew its arrow with the ↑ text character. Add a `scrollToTop` setting (General section in the admin panel, defaults to on so existing sites are unaffected) and replace the glyph with a stroked SVG that inherits currentColor across all presets. Scroll handling is now rAF-throttled, and prefers-reduced-motion turns off both the hover lift and the smooth scroll. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * security(journal): escape author HTML instead of filtering it CodeQL flags 26 high-severity alerts on the release PR; the bulk of them point at sanitizeHtml(), a denylist of three regexes whose output goes into dangerouslySetInnerHTML. I reproduced the bypasses before changing anything — all four pass the old filter: <img src=x onerror=alert(1)> unquoted handler, regex wants quotes <img src=x onerror='alert(1)'> single quotes, same reason <svg onload=alert(1)> not a <script> tag javasjavascript:cript:alert(1) one-pass replace, the rest recombines Plus an attribute breakout in the link renderer, which interpolated the URL into href="${url}" unescaped: [x](" onmouseover=alert(1) x=") -> <a href="" onmouseover=alert(1" ...> Replaced with escaping. Every `&<>"'` in author text becomes an entity before any markdown rule runs, so the only tags in the output are the ones renderInlineMarkdown builds itself and a URL cannot leave its attribute. Link schemes are now an allowlist (http, https, mailto, tel, relative, anchor); anything else renders as plain text. The serializer needed decodeHtmlEntities to match: without it a save would write `&lt;` into the Markdown file and the next parse would escape the `&` again, corrupting the text further on every round trip. A test covers parse -> serialize -> parse stability. Two existing tests asserted the old behaviour and were rewritten rather than deleted: one expected the script tag to be *removed* from the output, the other expected the substring "onerror" to be absent. Both now assert the property that matters — that no tag can form — because `onerror` surviving as inert text is fine. Exploitation required admin access either way: journal and essay text comes from the studio or from content/*.md. This removes the weakness, it does not close an open door. * fix(journal): contain file paths, fix frontmatter escaping, defuse two regexes Follow-up to the CodeQL findings on release PR #432. I went through all 23 alerts individually; this addresses the ones that are worth addressing and documents the ones that are not. Path containment (12 alerts, all false positives). Every path built from a slug goes through isValidSlug(), a strict `/^[a-zA-Z0-9_-]+$/` allowlist — verified against `../../etc/passwd`, `foo/../../bar`, `a/b`, `..` and friends, all rejected. CodeQL cannot see it because the check lives in another module. Added a containedPath() helper that resolves the path and refuses anything landing outside the content directory: a second lock on a door that was already locked, and a barrier the analysis can follow. Also removed the dead `slug.endsWith('.md')` branches — isValidSlug rejects dots, so they could never be taken. Frontmatter escaping (1 alert, a real bug). The serializer escaped `"` but not `\`, and the parser never unescaped anything. A title containing either character gained a backslash on every save/load cycle: Path C:\Users "quoted" -> Path C:\\Users \"quoted\" -> ... Escaping now covers the backslash first and the parser undoes both. A round trip test covers quotes, backslashes, colons and apostrophes. Two of three ReDoS regexes (2 alerts). The heading pattern had `\s+` next to `(.+)`, which overlap, so the engine tried every split of the whitespace run before failing; it is `[ \t]+` and `(\S.*)` now. The quote author pattern wrapped a lazy group around an optional group — the quadratic case — and is an index split on the first separator now. The third regex, the bold/italic pass, is deliberately left alone. Rewriting it with a negated class removes the backtracking but breaks nesting: `**bold *and italic* here**` renders as `*<em>bold </em>and italic<em> here</em>*`. The input is Markdown from an authenticated admin, never a visitor, so the worst case is an author slowing down their own page. The comment in the code says so. Not addressed: 5 js/insufficient-password-hash alerts. They ask for a slow KDF where the code uses SHA-256/HMAC — correct in general, but the admin password comes from an environment variable and is never stored, so a stronger KDF protects nothing that is not already in plaintext in the environment. 399 unit tests pass (18 new), build and tsc clean. * fix(journal): split the quote author by scanning, not by pattern Cleaning up after myself. #439 replaced the quote author regex `/^(.*?)(?:\s+--\s+(.+))?$/` — a lazy group around an optional one, the quadratic case — with `/\s+--\s+/`, and CodeQL promptly flagged the replacement for the same reason. One reported pattern traded for another. splitQuoteAuthor() scans for the first `--` that has whitespace on both sides. Linear, and it needs no reasoning about the regex engine at all. Behaviour is identical to the original regex, checked case by case against it: separator, no separator, several separators, tabs, wide gaps, `a--b` without spaces, leading and trailing separators, empty string. All nine are covered by tests, plus one asserting it stays fast on a 50k whitespace run. * security(admin): derive the session signing key with scrypt getSigningKey() ran the admin password through a single SHA-256 digest. It is key derivation rather than password storage, so it was never a stored-hash problem — but if the derived key ever leaked, one fast hash makes recovering the password by brute force cheap. CodeQL flags it as js/insufficient-password-hash and, for this particular alert, has a point. scrypt now. Two details that matter: The salt has to be stable. A random salt would produce a different key on every call and invalidate every session; it is derived from AUTH_SECRET, which is deployment-specific. Verified across separate processes: same inputs produce a verifying token, so a restart or redeploy does not log everyone out. The result is cached for the process lifetime. scrypt is deliberately slow and getSigningKey() runs on every admin request — deriving per call would add ~24ms to each one. The cache key is a digest of secret plus password, so a rotation misses the cache and derives again, and no extra plaintext copy of the password is kept around. Measured: first derivation 24ms, subsequent calls 0.12ms. Password change and secret change both invalidate an existing token, checked in separate processes. Note the one-time effect: existing admin sessions are invalidated by the change in derivation, so everyone logs in once more. * security(admin): key the signing-key cache on its inputs, not a digest #441 removed the SHA-256 digest of the admin password from the key derivation and introduced a new one three lines above it, as the cache key. Same rule, same file: CodeQL reported it immediately. The comment justifying it was wrong too. It claimed no second plaintext copy of the password was retained, while building the digest input allocates exactly that in order to hash it. The cache now holds the two input strings and compares them directly. They are the same objects the env and install caches already hold, so nothing extra is retained, and no fast hash of the password exists in memory for the life of the process. Re-verified after the change, in separate processes: a token from one process verifies in another with the same inputs, a changed password or secret rejects it, first derivation 24ms, cached calls 0.001ms. That leaves scrypt as the only place the password is hashed here. The two HMACs further down operate on the derived key and on token data, not on the password; the constant-time comparison in verifyAdminPassword is the previously dismissed one. --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
2026-08-14 16:55:07 +02:00
display: inline-block;
text-decoration: none;
feat: add visual admin panel with page builder and settings editor - Add /admin route with password-protected visual page builder - Page Builder: manage hero images, standalone albums, subpages, and sections - Album Picker: browse all shared Immich albums with search and filtering - Settings Editor: theme, grid, footer, legal, SEO configuration - YAML service with atomic writes and automatic backups (content/.backups/) - HMAC-signed admin sessions (24h expiry, HttpOnly cookies) - API endpoints: /api/admin/{auth,gallery,settings,albums,reload} - Enable with ADMIN_PASSWORD env var; disabled by default - invalidateConfigCache() export for hot-reload after saves
2026-05-29 17:04:37 +02:00
}
.admin-tab:hover {
fix: admin panel light/dark theme support, improved contrast, and backup confirmation a) Admin panel now respects the site's light/dark theme toggle via CSS custom properties that respond to [data-theme='light'] on <html>. All hardcoded dark colors replaced with semantic CSS variables. b) Improved contrast in dark mode: secondary text changed from #666/#555 to #a0a0a0, muted text from #555 to #707070. All text is now clearly readable against dark backgrounds. c) Backup system was already implemented in yaml-service.ts (creates timestamped backups in content/.backups/ before each save, keeps last 10 versions). Now the UI shows a confirmation message that a backup was created after each successful save.
2026-05-29 17:20:56 +02:00
color: var(--admin-text-secondary);
feat: add visual admin panel with page builder and settings editor - Add /admin route with password-protected visual page builder - Page Builder: manage hero images, standalone albums, subpages, and sections - Album Picker: browse all shared Immich albums with search and filtering - Settings Editor: theme, grid, footer, legal, SEO configuration - YAML service with atomic writes and automatic backups (content/.backups/) - HMAC-signed admin sessions (24h expiry, HttpOnly cookies) - API endpoints: /api/admin/{auth,gallery,settings,albums,reload} - Enable with ADMIN_PASSWORD env var; disabled by default - invalidateConfigCache() export for hot-reload after saves
2026-05-29 17:04:37 +02:00
}
.admin-tab.active {
fix: admin panel light/dark theme support, improved contrast, and backup confirmation a) Admin panel now respects the site's light/dark theme toggle via CSS custom properties that respond to [data-theme='light'] on <html>. All hardcoded dark colors replaced with semantic CSS variables. b) Improved contrast in dark mode: secondary text changed from #666/#555 to #a0a0a0, muted text from #555 to #707070. All text is now clearly readable against dark backgrounds. c) Backup system was already implemented in yaml-service.ts (creates timestamped backups in content/.backups/ before each save, keeps last 10 versions). Now the UI shows a confirmation message that a backup was created after each successful save.
2026-05-29 17:20:56 +02:00
color: var(--admin-text);
border-bottom-color: var(--admin-text);
feat: add visual admin panel with page builder and settings editor - Add /admin route with password-protected visual page builder - Page Builder: manage hero images, standalone albums, subpages, and sections - Album Picker: browse all shared Immich albums with search and filtering - Settings Editor: theme, grid, footer, legal, SEO configuration - YAML service with atomic writes and automatic backups (content/.backups/) - HMAC-signed admin sessions (24h expiry, HttpOnly cookies) - API endpoints: /api/admin/{auth,gallery,settings,albums,reload} - Enable with ADMIN_PASSWORD env var; disabled by default - invalidateConfigCache() export for hot-reload after saves
2026-05-29 17:04:37 +02:00
}
.admin-main {
flex: 1;
release: v0.11.0 — journal fixes, admin URLs, design system cleanup (#432) * fix(screenshots): sharp-Typen fuer 0.34 und 0.35 gleichzeitig (#410) sharp 0.35 ist von `export =` auf ESM umgestellt: der Modul-Namespace ist nicht mehr aufrufbar, die Factory sitzt unter .default. Der Type-Check brach damit in scripts/screenshots.ts weg, sobald der Next-Bump (#402) sharp von 0.34.5 auf 0.35.3 mitzieht -- sharp ist hier keine deklarierte Dependency, sondern kommt ueber Next mit. Die Form wird jetzt aus dem installierten Paket abgeleitet statt festgeschrieben, zur Laufzeit wie im Typ. Geprueft mit beiden Versionen: tsc laeuft mit 0.34.5 und mit 0.35.3 fehlerfrei durch. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(deps): bump the nextjs group across 1 directory with 2 updates (#402) Bumps the nextjs group with 2 updates in the / directory: [next](https://github.com/vercel/next.js) and [eslint-config-next](https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next). Updates `next` from 16.2.12 to 16.3.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/compare/v16.2.12...v16.3.0) Updates `eslint-config-next` from 16.2.12 to 16.3.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/commits/v16.3.0/packages/eslint-config-next) --- updated-dependencies: - dependency-name: eslint-config-next dependency-version: 16.3.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: nextjs - dependency-name: next dependency-version: 16.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nextjs ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps-dev): bump prettier from 3.8.3 to 3.9.6 (#405) Bumps [prettier](https://github.com/prettier/prettier) from 3.8.3 to 3.9.6. - [Release notes](https://github.com/prettier/prettier/releases) - [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md) - [Commits](https://github.com/prettier/prettier/compare/3.8.3...3.9.6) --- updated-dependencies: - dependency-name: prettier dependency-version: 3.9.6 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * docs(changelog): Unreleased-Sektion fuer die Bumps nach v0.10.0 (#413) Die Dependency-PRs sind nach dem Release auf dev gelandet, teils auch auf main. Ohne Eintrag waeren sie beim naechsten Release unsichtbar -- inklusive Next 16.3.0, das CVE-2025-13465 mitbringt. Ausserdem im 0.10.0-Abschnitt nachgetragen, dass der Trivy-Scan bis #409 nie gelaufen ist. Der Fix steckt im Tag v0.10.0, fehlte aber in der Aufzaehlung -- und "Images werden bei jedem Publish gescannt" stand im Changelog, waehrend der Job im Action-Setup abbrach. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(gallery): per-album sort order, independent of Immich (#408) (#414) Album order was dictated entirely by Immich: getAlbum() sorted by the album's own asc/desc flag, so a Folio album always mirrored the archive. A curated series has a narrative order that has nothing to do with capture time, and changing the Immich album's sort to fit the website changes it for the archive too. Adds an optional per-album `sort` in gallery.yaml, editable in /admin, defaulting to today's behaviour so every existing config is unchanged: immich (default) | newest | oldest | filename | manual `manual` is a pinned *prefix*: `assetOrder` lists only the photos placed by hand, everything else follows in the album's Immich order. A full permutation of a 2,000-photo album would be ~80 KB of UUIDs in a file that is rewritten and copied to content/.backups/ on every admin save. It also makes drift fall out for free — photos removed in Immich never match, new ones land in the tail rather than being hidden. Sorting is applied after the cache read, not before the cache write, so the LRU keeps one canonical Immich-ordered copy per album. That avoids putting the mode in the cache key, lets a config change take effect without depending on invalidation, and keeps the stale-serving path correct. cache.get() returns the stored object by reference, so withSort() returns a shallow clone with a new array — sorting in place would reorder the shared entry, and under request coalescing every concurrent caller would be sorting the same array. Also fixes a prerequisite bug: /api/admin/albums/[albumId]/assets read album.assets from GET /albums/:id, which Immich 3.x no longer populates (lib/immich.ts:507). The hero picker's "This Album" tab returned nothing and threw outright when the key was absent. It now goes through the client's paginated metadata search, with ?types=all to opt videos in for the reorder editor. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): drop decorative emoji from the sort select labels (#415) An <option> cannot contain markup, so the SVG set in Icons is not reachable there — but a decorative emoji is not a substitute for it. Plain text instead; the album card badge already uses a real icon. The remaining emoji in the admin panel (asset picker tabs, section headings, layout picker options) predate this branch and are left for a separate cleanup. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): replace emoji icons with the shared SVG icon set (#416) The admin panel mixed two icon conventions: inline SVGs from `Icons.tsx` in most components, and decorative emoji in the asset picker and a few PageBuilder labels. Emoji render inconsistently across platforms, ignore the accent colour, and cannot inherit the `.svg-icon` sizing rules. - Icons.tsx: add `IconStar` (filled — it marks a state, not an action) and `IconImage`. - AssetPicker: the three tab labels and the favourite tile badge now use IconFolder / IconStar / IconImage. - PageBuilder: the "Standalone Albums" and "Subpages" headings use the icon set instead of an emoji. - PageBuilder: the layout picker drops its emoji for plain text. An <option> cannot contain markup, so an SVG is impossible there and a decorative glyph is not a substitute. - admin.css: align icon and label in the picker tabs, and swap the favourite badge's text-shadow for drop-shadow, which is what applies to an inline SVG. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): fold PageBuilder's local icons into the shared Icons module (#418) * refactor(admin): fold PageBuilder's local icons into the shared module PageBuilder.tsx carried its own `Icons` object duplicating most of the glyphs already exported by Icons.tsx, with hardcoded sizes and slightly divergent paths. Migrate all 32 call sites to the shared module and delete the local object. Five glyphs had no counterpart and are added to Icons.tsx as 1:1 ports of the local paths: IconX, IconPlus, IconHome, IconCopy, IconImage. The local ExternalLink and Check are dropped rather than ported — both had zero call sites. Two glyphs change shape slightly, which is the point of consolidating: the shared IconCamera includes the viewfinder bump the local copy omitted, and drag handles now use IconGripVertical. IconGripVertical uses the module's square 24x24 viewBox, so `.svg-drag` goes from 12x18 to 18x18 — the old non-square box would letterbox the glyph down to 12x12 and shrink the handle. * fix(admin): resolve icon-module integration after #416 Merging dev brought in #416, which added a second IconImage to Icons.tsx and two <Icons.Camera>/<Icons.Folder> section headers that reference the local Icons object this PR removes. Git merged both cleanly but the result did not type-check. - drop the duplicate IconImage (both copies were byte-identical) - point the two section headers at the imported IconCamera/IconFolder - refresh the SORT_LABELS comment: the icon set is imported now, not declared below --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> * fix(config): allow an empty gallery, guard against a double /api suffix (#421) An empty gallery is now a valid, rendered state instead of a throw: deriveGallery() no longer requires at least one album or subpage, so a deployment with no albums yet renders a bare homepage the owner can fill in via /admin. getConfig() also stops appending /api to an Immich URL that already ends in it, which previously produced .../api/api and broke every upstream request. Includes a restore of the per-album sort test cases, which the branch had lost by being cut before #408/#414. * feat(admin): favicon upload, served from the content volume (#422) Adds a bundled default favicon, an upload widget in admin Settings > General, and a route that serves the icon from the writable content/ volume with a fallback to the bundled default. Raster uploads (PNG/ICO/JPEG) are wrapped in an SVG container; the response carries its own CSP so an uploaded SVG cannot execute script on the origin. The GET route revalidates with an ETag instead of caching immutably, so a newly uploaded icon shows up immediately. Uploads are written via temp file + rename, and a Reset button restores the bundled default. * ci: flag unformatted files in a PR, without blocking it (#424) Prettier is configured as an error rule in eslint.config.mjs but has never run in CI, so part of the tree predates it. A final CI step now diffs against the PR base, runs prettier --list-different over the changed files, and emits a warning annotation per offender plus a job summary. Advisory by design: it never fails the job. Blocking would turn a PR red for merely touching a file that was already unformatted, and normalising the tree in one commit would wreck git blame and conflict with the PRs in flight. Requires fetch-depth: 0, since diffing against the base needs its history. * feat(install): first-run wizard gated by a one-time setup token (#419) Adds /install, a four-step first-run wizard: connect to Immich, optionally pick albums, name the site, finish. It verifies the credentials against the Immich server before writing anything, then writes gallery.yaml, settings.yaml and a content/install.json carrying the Immich credentials and a generated site secret. install.json exists because a running process cannot pick up new env vars — the wizard has to write configuration that takes effect without a restart. getInstallCredentials() merges it under the real environment, so env vars always win and rotation stays a matter of setting one. Both the page and the API routes are gated by a one-time setup token printed to the server log, so a deployment that is reachable before gallery.yaml exists cannot be configured by whoever finds it first. The token is stored in content/.setup-token (0600) rather than a module variable: Next.js bundles the page and each route handler separately, so a module-level token left the page and the API disagreeing inside one process and the wizard stuck on step 1. It is removed once the install completes. The admin password is stored as an scrypt hash using the scheme lib/auth.ts already applies to album passwords; a plaintext ADMIN_PASSWORD env var keeps working. * docs: document the setup wizard, fix the read-only content mount (#425) Quick Start now leads with the /install wizard, with the hand-written YAML route kept alongside it, and a First-Run Setup section covers the setup token, the files the wizard writes, and env-var precedence. Two corrections: both Docker examples mounted content/ as :ro, which silently breaks the wizard, the admin panel and the backup rotation alike — docs/admin-panel.md already said so and the README contradicted it. And nothing documented that content/install.json holds the Immich API key, so a backup of content/ is a backup of credentials. Also adds a Contributors section crediting the people whose work is in the project. * feat(admin): floating save bar pinned to the bottom of the viewport (#426) The save bar was the first, static element inside .admin-main. Since the document itself scrolls, it left the viewport as soon as you scrolled down — editing a subpage section or a settings block far below gave no visible dirty hint and no reachable save button. Replace it with a bottom-pinned floating bar shared by both editors. It only mounts while there is something to act on (unsaved changes, an in-flight save, or a result message), so it never covers content while idle. The success message clears after 5s, which hides the bar again. - new SaveBar component, replacing the duplicated markup in PageBuilder and SettingsEditor - adopt the previously unused .floating-save-bar CSS: slide-in keyframes (carrying translateX(-50%)), dirty border, wrap/gap, mobile variant and a prefers-reduced-motion opt-out; z-index 900 keeps it below modals - .admin-main gains bottom padding so the bar never covers page content - drop the now-unreachable idle hints: the ⌘S hint becomes a button title, the Live Sync note becomes a static line above the settings layout - header "Site" link now bypasses the cache (/?fresh=1), so the preview stays reachable when the bar is hidden Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(admin): themed listbox for the album sort control (#427) The per-album "Photo order" control was a native <select>. Because an <option> cannot contain markup, its choices could not use the admin panel's currentColor SVG set — the reason #415 had to fall back to plain text after dropping the emoji labels. Adds a Listbox component implementing the ARIA combobox/listbox pattern, so options can render a glyph beside their label: - DOM focus stays on the trigger button; the active option is announced through aria-activedescendant, keeping focus management to one element - Keyboard: arrows (clamped at the ends, like a native select), Home/End, Enter/Space to commit, Escape to cancel, Tab commits and moves on, and prefix type-ahead with a repeat-key cycle - Outside dismissal on pointerdown, so a press starting outside closes the popup before the click retargets The sort options now carry an icon each: calendar, arrow-down, arrow-up, an A→Z marker, and the drag glyph for manual — matching the badge the album card already shows. SORT_LABELS stays plain text because the badge feeds it to a title attribute. Closes #417 Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(git): ignore generated design handoff folders * fix(admin): stop the album sort dropdown clipping, and simplify the panel (#428) * fix(admin): render listbox popup in a portal so it escapes modal clipping The sort control's popup was position:absolute inside three clipping ancestors (.album-drawer overflow:hidden > .album-drawer-body overflow-y:auto > .modal-right-column overflow-y:auto), so it was cut off at the bottom of the Edit Album Details modal. z-index could not help: clipping happens before stacking. It also always hung below the trigger, with no flip. Portal the popup to document.body and position it from the trigger's viewport rect, flipping above when there is more room there and capping max-height to the space available so it scrolls internally rather than overflowing. It is dismissed on scroll and resize, since the anchor is only measured on open. The outside-pointerdown handler now also treats the popup as inside; without that the portalled list counts as outside, and a click on an option would close it before the selection commits. * refactor(admin): single-column album details panel The left column spent 1.2fr on a cover thumbnail and three stat rows, two of which (Status, Custom Hero) only restated the form fields opposite them, while the form itself was squeezed into 1.8fr behind a second nested scroller. Stack the drawer in one column instead: cover as a banner, then the form at full width, with the UUID moved into the footer. The body is now the only scroll container, which also removes one of the ancestors that was clipping the sort popup. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> * fix(admin): give the portalled listbox its theme back, lock the page behind modals (#429) Two defects in the album editor. The sort listbox popup painted transparent. Every --admin-* variable is scoped to .admin-layout, and since the popup moved into document.body it sits outside that subtree, so background/border/text all resolved to nothing. It now carries its own copy of the palette in both colour schemes, plus the font it no longer inherits. Scrolling inside a modal also moved the page behind it. No admin modal ever locked body scroll: the overlay covers the page but does not absorb wheel events, so a scroll starting on the backdrop — or continuing past the end of the modal's own scroller — reaches the document. overscroll-behavior cannot cover that case on its own, because it only applies to scroll containers and the backdrop is not one. useScrollLock freezes body while a modal is open and compensates for the width the scrollbar gives up, so nothing shifts underneath. Each lock restores the inline value it found, which makes nesting work without a counter — a picker opened from the drawer restores the drawer's hidden state instead of clearing it. Applied to both drawers and all four picker modals, which share the defect. overscroll-behavior: contain on the scrollers stops the chaining they can handle themselves. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com> * fix(security): allow unsafe-eval in CSP script-src during dev mode * feat(journal): add Journal Studio with split-screen editor, live preview and dedicated routes * fix(build): separate client parser from server journal-service and fix build type errors * fix(journal): Fotos rendern, Layout und Lightbox-Steuerung korrigieren Fünf unabhängige Fehler in der öffentlichen Journal- und Essay-Ansicht: * Foto-Blöcke wurden nie angezeigt. EssayView löst ein Foto über PhotoItem.id auf, und das sind verschlüsselte Tokens — die Blöcke aus dem Markdown tragen aber rohe Asset-UUIDs. Jede Zuordnung lief ins Leere, und nicht auflösbare Blöcke werden still verworfen. Die IDs werden jetzt serverseitig übersetzt; damit verschwinden nebenbei die rohen UUIDs aus dem Client-Payload, die dort laut Projektregel nie auftauchen dürfen. Nicht auflösbare Referenzen werden geloggt. * Überschriften standen weiter links als der Fließtext. Jeder Block hatte einzeln `max-width: 68ch`, und `ch` ist relativ zur Schrift des Elements — die Serif-Überschrift ergab eine breitere Spalte. Ersetzt durch eine gemeinsame, font-unabhängige `--essay-measure`. * Fullbleed-Fotos bluteten nur nach links aus: `.essay-figure` ist `width: 100%`, wodurch die Box überbestimmt ist und der negative rechte Margin verworfen wird. * Foto-Paare stellten beide Bilder gleich breit dar, wodurch ein Hochformat neben einem Querformat doppelt so hoch wurde. Jetzt eine Justified-Reihe: Breite proportional zum Seitenverhältnis, dadurch exakt gleiche Höhen ohne Beschnitt. * Die Lightbox hatte im Journal keine Tastatursteuerung und keine Scroll-Sperre — beides lag in PhotoGrid, also nur im Album-Raster. Verlagert in die Lightbox selbst, der doppelte Handler in PhotoGrid entfernt (sonst wäre pro Pfeildruck zwei Bilder weitergesprungen). Zusätzlich sind Proofing-Herzen und das EXIF-Panel im redaktionellen Modus abschaltbar und im Journal aus: Client-Proofing ist ein Übergabe-Workflow für Alben, keine Funktion einer Reportage. Auf der Übersicht wurde der Untertitel doppelt gerendert, weil extractExcerpt() auf ihn zurückfällt. * feat(admin): eigene URLs für alle Bereiche und überarbeiteter Journal Studio Das Panel war eine einzige Client-Komponente, die ihre Tabs über useState umschaltet: keine Route pro Bereich, kein Deep-Link, kein Zurück-Button, und nach jedem Reload landete man wieder auf "Pages". Auch der Journal-Editor hatte keine eigene URL. Jetzt sieben echte Routen (/admin, /admin/pages, /admin/journal, /admin/journal/<slug>, /admin/settings, /admin/settings/<section>, /admin/analytics). Die Shell mit Auth-Prüfung und Kopfzeile sitzt im Layout und umschließt children — so bleibt die Session-Prüfung über Routenwechsel montiert, statt bei jedem Tab-Wechsel neu zu laufen und den Spinner aufblitzen zu lassen. Unbekannte Settings-Sections fallen auf General zurück. Im selben Zug der Journal Studio, der die Routing-Änderung ohnehin berührt: * Alle Eingabefelder nutzten die Klasse `admin-input`, die in keinem CSS definiert war — sie fielen auf Browser-Defaults zurück. Jetzt gestylt, gescoped, damit der generische Name nicht ins übrige Panel leckt. * Der Split View ist per Divider verschiebbar (Maus, Tastatur, Doppelklick zum Zurücksetzen), Breite in localStorage. * Das Studio bricht aus der 1120px-Spalte aus, die Preview hat Platz. * Die Preview zeigte für jedes Foto fest 3:2 und log damit über das Layout der veröffentlichten Seite; die echten Verhältnisse werden jetzt an den Thumbnails gemessen. * Blöcke mit alten positionsbasierten Foto-Referenzen werden markiert — die lassen sich auf einer eigenständigen Journal-Seite nicht auflösen und verschwanden bisher stillschweigend. * Blocktyp-Chips als gemeinsame Komponente, monochrom und per Icon unterschieden statt in einer eigenen Blau/Lila/Orange-Palette, die sonst nirgends im Panel vorkommt. * Emojis raus, SVG-Icons rein. * fix(admin): Designsystem-Lücken im Panel schließen Eine systematische Suche nach Klassen, die im TSX benutzt, aber in keinem CSS definiert sind, hat vier Stellen mit demselben Muster gefunden: * `admin-btn-secondary` und `admin-btn-danger` existierten nicht. Sämtliche Löschen-Buttons sahen aus wie normale Buttons — keine Warnwirkung. Als `.admin-btn.admin-btn-danger` geschrieben, weil die Varianten mit den Größenklassen kombiniert werden, die weiter unten ihren eigenen Hintergrund setzen. * `page-progress-fill` fehlte: die Balken im Analytics-Panel waren leere Rinnen, der Wert unsichtbar. Ebenso `analytics-empty` und `admin-loading-container`. * `subpage-drawer-section`, `subpage-drawer-title-group` und `input-with-icon` im PageBuilder waren wirkungslos und teils mit Inline-Styles notdürftig kompensiert. * `grid-card-preview` fehlte, wodurch alle Layout-Vorschauen auf Höhe null kollabierten. Nur "Showcase" war sichtbar — und das aus Versehen, weil sein Tile `hero-tile` hieß und damit die `aspect-ratio` einer fremden PageBuilder-Klasse erbte. Umbenannt. Dazu die Theme-Vorschauen, die praktisch identisch aussahen: alle sieben zeigten dieselben drei quadratischen Kacheln, einziger Unterschied war die Hintergrundfarbe. Sie spiegeln jetzt die echten Preset-Daten aus lib/config/theme.ts — Schriftcharakter, Eckradius, Rasterdichte, Passepartout bzw. Schatten. Die Kopfzeile richtet sich an einer gemeinsamen Steuerhöhe aus. Der "Site"-Link war höher als die Buttons daneben: `.admin-btn` hatte keine explizite line-height, und <button> bekommt box-sizing: border-box vom Browser, <a> nicht. Die Statusanzeige setzte weder Schriftfamilie noch -größe und fiel auf den Browser-Default zurück — sie war nie Teil des Designsystems. Jetzt gleiche Höhe und Typografie, Pillenform als Zustandsanzeige, Trenner zur Aktionsgruppe. Das dauerhafte Pulsieren des grünen Punkts entfällt; Animation bleibt den Zuständen vorbehalten, die Aufmerksamkeit brauchen. Restliche Emojis durch SVG-Icons ersetzt. * feat(admin): add scroll-to-top toggle and SVG arrow The back-to-top button was always on and drew its arrow with the ↑ text character. Add a `scrollToTop` setting (General section in the admin panel, defaults to on so existing sites are unaffected) and replace the glyph with a stroked SVG that inherits currentColor across all presets. Scroll handling is now rAF-throttled, and prefers-reduced-motion turns off both the hover lift and the smooth scroll. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * security(journal): escape author HTML instead of filtering it CodeQL flags 26 high-severity alerts on the release PR; the bulk of them point at sanitizeHtml(), a denylist of three regexes whose output goes into dangerouslySetInnerHTML. I reproduced the bypasses before changing anything — all four pass the old filter: <img src=x onerror=alert(1)> unquoted handler, regex wants quotes <img src=x onerror='alert(1)'> single quotes, same reason <svg onload=alert(1)> not a <script> tag javasjavascript:cript:alert(1) one-pass replace, the rest recombines Plus an attribute breakout in the link renderer, which interpolated the URL into href="${url}" unescaped: [x](" onmouseover=alert(1) x=") -> <a href="" onmouseover=alert(1" ...> Replaced with escaping. Every `&<>"'` in author text becomes an entity before any markdown rule runs, so the only tags in the output are the ones renderInlineMarkdown builds itself and a URL cannot leave its attribute. Link schemes are now an allowlist (http, https, mailto, tel, relative, anchor); anything else renders as plain text. The serializer needed decodeHtmlEntities to match: without it a save would write `&lt;` into the Markdown file and the next parse would escape the `&` again, corrupting the text further on every round trip. A test covers parse -> serialize -> parse stability. Two existing tests asserted the old behaviour and were rewritten rather than deleted: one expected the script tag to be *removed* from the output, the other expected the substring "onerror" to be absent. Both now assert the property that matters — that no tag can form — because `onerror` surviving as inert text is fine. Exploitation required admin access either way: journal and essay text comes from the studio or from content/*.md. This removes the weakness, it does not close an open door. * fix(journal): contain file paths, fix frontmatter escaping, defuse two regexes Follow-up to the CodeQL findings on release PR #432. I went through all 23 alerts individually; this addresses the ones that are worth addressing and documents the ones that are not. Path containment (12 alerts, all false positives). Every path built from a slug goes through isValidSlug(), a strict `/^[a-zA-Z0-9_-]+$/` allowlist — verified against `../../etc/passwd`, `foo/../../bar`, `a/b`, `..` and friends, all rejected. CodeQL cannot see it because the check lives in another module. Added a containedPath() helper that resolves the path and refuses anything landing outside the content directory: a second lock on a door that was already locked, and a barrier the analysis can follow. Also removed the dead `slug.endsWith('.md')` branches — isValidSlug rejects dots, so they could never be taken. Frontmatter escaping (1 alert, a real bug). The serializer escaped `"` but not `\`, and the parser never unescaped anything. A title containing either character gained a backslash on every save/load cycle: Path C:\Users "quoted" -> Path C:\\Users \"quoted\" -> ... Escaping now covers the backslash first and the parser undoes both. A round trip test covers quotes, backslashes, colons and apostrophes. Two of three ReDoS regexes (2 alerts). The heading pattern had `\s+` next to `(.+)`, which overlap, so the engine tried every split of the whitespace run before failing; it is `[ \t]+` and `(\S.*)` now. The quote author pattern wrapped a lazy group around an optional group — the quadratic case — and is an index split on the first separator now. The third regex, the bold/italic pass, is deliberately left alone. Rewriting it with a negated class removes the backtracking but breaks nesting: `**bold *and italic* here**` renders as `*<em>bold </em>and italic<em> here</em>*`. The input is Markdown from an authenticated admin, never a visitor, so the worst case is an author slowing down their own page. The comment in the code says so. Not addressed: 5 js/insufficient-password-hash alerts. They ask for a slow KDF where the code uses SHA-256/HMAC — correct in general, but the admin password comes from an environment variable and is never stored, so a stronger KDF protects nothing that is not already in plaintext in the environment. 399 unit tests pass (18 new), build and tsc clean. * fix(journal): split the quote author by scanning, not by pattern Cleaning up after myself. #439 replaced the quote author regex `/^(.*?)(?:\s+--\s+(.+))?$/` — a lazy group around an optional one, the quadratic case — with `/\s+--\s+/`, and CodeQL promptly flagged the replacement for the same reason. One reported pattern traded for another. splitQuoteAuthor() scans for the first `--` that has whitespace on both sides. Linear, and it needs no reasoning about the regex engine at all. Behaviour is identical to the original regex, checked case by case against it: separator, no separator, several separators, tabs, wide gaps, `a--b` without spaces, leading and trailing separators, empty string. All nine are covered by tests, plus one asserting it stays fast on a 50k whitespace run. * security(admin): derive the session signing key with scrypt getSigningKey() ran the admin password through a single SHA-256 digest. It is key derivation rather than password storage, so it was never a stored-hash problem — but if the derived key ever leaked, one fast hash makes recovering the password by brute force cheap. CodeQL flags it as js/insufficient-password-hash and, for this particular alert, has a point. scrypt now. Two details that matter: The salt has to be stable. A random salt would produce a different key on every call and invalidate every session; it is derived from AUTH_SECRET, which is deployment-specific. Verified across separate processes: same inputs produce a verifying token, so a restart or redeploy does not log everyone out. The result is cached for the process lifetime. scrypt is deliberately slow and getSigningKey() runs on every admin request — deriving per call would add ~24ms to each one. The cache key is a digest of secret plus password, so a rotation misses the cache and derives again, and no extra plaintext copy of the password is kept around. Measured: first derivation 24ms, subsequent calls 0.12ms. Password change and secret change both invalidate an existing token, checked in separate processes. Note the one-time effect: existing admin sessions are invalidated by the change in derivation, so everyone logs in once more. * security(admin): key the signing-key cache on its inputs, not a digest #441 removed the SHA-256 digest of the admin password from the key derivation and introduced a new one three lines above it, as the cache key. Same rule, same file: CodeQL reported it immediately. The comment justifying it was wrong too. It claimed no second plaintext copy of the password was retained, while building the digest input allocates exactly that in order to hash it. The cache now holds the two input strings and compares them directly. They are the same objects the env and install caches already hold, so nothing extra is retained, and no fast hash of the password exists in memory for the life of the process. Re-verified after the change, in separate processes: a token from one process verifies in another with the same inputs, a changed password or secret rejects it, first derivation 24ms, cached calls 0.001ms. That leaves scrypt as the only place the password is hashed here. The two HMACs further down operate on the derived key and on token data, not on the password; the constant-time comparison in verifyAdminPassword is the previously dismissed one. --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
2026-08-14 16:55:07 +02:00
/* Extra bottom padding so the floating save bar never covers page content. */
padding: 1.5rem 1.5rem 6rem;
feat: enlarge admin thumbnails for hero, album, and subpage grids - Hero grid: 140px → 220px min tile width - Album grid: 160px → 240px min tile width - Subpage grid: 140px → 200px min tile width - Picker thumbnails: 40px → 52px - Admin main max-width: 960px → 1120px for more space - Slightly larger overlay buttons and index badges
2026-05-29 17:37:34 +02:00
max-width: 1120px;
feat: add visual admin panel with page builder and settings editor - Add /admin route with password-protected visual page builder - Page Builder: manage hero images, standalone albums, subpages, and sections - Album Picker: browse all shared Immich albums with search and filtering - Settings Editor: theme, grid, footer, legal, SEO configuration - YAML service with atomic writes and automatic backups (content/.backups/) - HMAC-signed admin sessions (24h expiry, HttpOnly cookies) - API endpoints: /api/admin/{auth,gallery,settings,albums,reload} - Enable with ADMIN_PASSWORD env var; disabled by default - invalidateConfigCache() export for hot-reload after saves
2026-05-29 17:04:37 +02:00
margin: 0 auto;
width: 100%;
}
/* ── Save Bar ──────────────────────────────────────────────── */
.save-bar-left {
display: flex;
align-items: center;
gap: 0.75rem;
}
.unsaved-badge {
release: v0.11.0 — journal fixes, admin URLs, design system cleanup (#432) * fix(screenshots): sharp-Typen fuer 0.34 und 0.35 gleichzeitig (#410) sharp 0.35 ist von `export =` auf ESM umgestellt: der Modul-Namespace ist nicht mehr aufrufbar, die Factory sitzt unter .default. Der Type-Check brach damit in scripts/screenshots.ts weg, sobald der Next-Bump (#402) sharp von 0.34.5 auf 0.35.3 mitzieht -- sharp ist hier keine deklarierte Dependency, sondern kommt ueber Next mit. Die Form wird jetzt aus dem installierten Paket abgeleitet statt festgeschrieben, zur Laufzeit wie im Typ. Geprueft mit beiden Versionen: tsc laeuft mit 0.34.5 und mit 0.35.3 fehlerfrei durch. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(deps): bump the nextjs group across 1 directory with 2 updates (#402) Bumps the nextjs group with 2 updates in the / directory: [next](https://github.com/vercel/next.js) and [eslint-config-next](https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next). Updates `next` from 16.2.12 to 16.3.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/compare/v16.2.12...v16.3.0) Updates `eslint-config-next` from 16.2.12 to 16.3.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/commits/v16.3.0/packages/eslint-config-next) --- updated-dependencies: - dependency-name: eslint-config-next dependency-version: 16.3.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: nextjs - dependency-name: next dependency-version: 16.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nextjs ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps-dev): bump prettier from 3.8.3 to 3.9.6 (#405) Bumps [prettier](https://github.com/prettier/prettier) from 3.8.3 to 3.9.6. - [Release notes](https://github.com/prettier/prettier/releases) - [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md) - [Commits](https://github.com/prettier/prettier/compare/3.8.3...3.9.6) --- updated-dependencies: - dependency-name: prettier dependency-version: 3.9.6 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * docs(changelog): Unreleased-Sektion fuer die Bumps nach v0.10.0 (#413) Die Dependency-PRs sind nach dem Release auf dev gelandet, teils auch auf main. Ohne Eintrag waeren sie beim naechsten Release unsichtbar -- inklusive Next 16.3.0, das CVE-2025-13465 mitbringt. Ausserdem im 0.10.0-Abschnitt nachgetragen, dass der Trivy-Scan bis #409 nie gelaufen ist. Der Fix steckt im Tag v0.10.0, fehlte aber in der Aufzaehlung -- und "Images werden bei jedem Publish gescannt" stand im Changelog, waehrend der Job im Action-Setup abbrach. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(gallery): per-album sort order, independent of Immich (#408) (#414) Album order was dictated entirely by Immich: getAlbum() sorted by the album's own asc/desc flag, so a Folio album always mirrored the archive. A curated series has a narrative order that has nothing to do with capture time, and changing the Immich album's sort to fit the website changes it for the archive too. Adds an optional per-album `sort` in gallery.yaml, editable in /admin, defaulting to today's behaviour so every existing config is unchanged: immich (default) | newest | oldest | filename | manual `manual` is a pinned *prefix*: `assetOrder` lists only the photos placed by hand, everything else follows in the album's Immich order. A full permutation of a 2,000-photo album would be ~80 KB of UUIDs in a file that is rewritten and copied to content/.backups/ on every admin save. It also makes drift fall out for free — photos removed in Immich never match, new ones land in the tail rather than being hidden. Sorting is applied after the cache read, not before the cache write, so the LRU keeps one canonical Immich-ordered copy per album. That avoids putting the mode in the cache key, lets a config change take effect without depending on invalidation, and keeps the stale-serving path correct. cache.get() returns the stored object by reference, so withSort() returns a shallow clone with a new array — sorting in place would reorder the shared entry, and under request coalescing every concurrent caller would be sorting the same array. Also fixes a prerequisite bug: /api/admin/albums/[albumId]/assets read album.assets from GET /albums/:id, which Immich 3.x no longer populates (lib/immich.ts:507). The hero picker's "This Album" tab returned nothing and threw outright when the key was absent. It now goes through the client's paginated metadata search, with ?types=all to opt videos in for the reorder editor. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): drop decorative emoji from the sort select labels (#415) An <option> cannot contain markup, so the SVG set in Icons is not reachable there — but a decorative emoji is not a substitute for it. Plain text instead; the album card badge already uses a real icon. The remaining emoji in the admin panel (asset picker tabs, section headings, layout picker options) predate this branch and are left for a separate cleanup. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): replace emoji icons with the shared SVG icon set (#416) The admin panel mixed two icon conventions: inline SVGs from `Icons.tsx` in most components, and decorative emoji in the asset picker and a few PageBuilder labels. Emoji render inconsistently across platforms, ignore the accent colour, and cannot inherit the `.svg-icon` sizing rules. - Icons.tsx: add `IconStar` (filled — it marks a state, not an action) and `IconImage`. - AssetPicker: the three tab labels and the favourite tile badge now use IconFolder / IconStar / IconImage. - PageBuilder: the "Standalone Albums" and "Subpages" headings use the icon set instead of an emoji. - PageBuilder: the layout picker drops its emoji for plain text. An <option> cannot contain markup, so an SVG is impossible there and a decorative glyph is not a substitute. - admin.css: align icon and label in the picker tabs, and swap the favourite badge's text-shadow for drop-shadow, which is what applies to an inline SVG. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): fold PageBuilder's local icons into the shared Icons module (#418) * refactor(admin): fold PageBuilder's local icons into the shared module PageBuilder.tsx carried its own `Icons` object duplicating most of the glyphs already exported by Icons.tsx, with hardcoded sizes and slightly divergent paths. Migrate all 32 call sites to the shared module and delete the local object. Five glyphs had no counterpart and are added to Icons.tsx as 1:1 ports of the local paths: IconX, IconPlus, IconHome, IconCopy, IconImage. The local ExternalLink and Check are dropped rather than ported — both had zero call sites. Two glyphs change shape slightly, which is the point of consolidating: the shared IconCamera includes the viewfinder bump the local copy omitted, and drag handles now use IconGripVertical. IconGripVertical uses the module's square 24x24 viewBox, so `.svg-drag` goes from 12x18 to 18x18 — the old non-square box would letterbox the glyph down to 12x12 and shrink the handle. * fix(admin): resolve icon-module integration after #416 Merging dev brought in #416, which added a second IconImage to Icons.tsx and two <Icons.Camera>/<Icons.Folder> section headers that reference the local Icons object this PR removes. Git merged both cleanly but the result did not type-check. - drop the duplicate IconImage (both copies were byte-identical) - point the two section headers at the imported IconCamera/IconFolder - refresh the SORT_LABELS comment: the icon set is imported now, not declared below --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> * fix(config): allow an empty gallery, guard against a double /api suffix (#421) An empty gallery is now a valid, rendered state instead of a throw: deriveGallery() no longer requires at least one album or subpage, so a deployment with no albums yet renders a bare homepage the owner can fill in via /admin. getConfig() also stops appending /api to an Immich URL that already ends in it, which previously produced .../api/api and broke every upstream request. Includes a restore of the per-album sort test cases, which the branch had lost by being cut before #408/#414. * feat(admin): favicon upload, served from the content volume (#422) Adds a bundled default favicon, an upload widget in admin Settings > General, and a route that serves the icon from the writable content/ volume with a fallback to the bundled default. Raster uploads (PNG/ICO/JPEG) are wrapped in an SVG container; the response carries its own CSP so an uploaded SVG cannot execute script on the origin. The GET route revalidates with an ETag instead of caching immutably, so a newly uploaded icon shows up immediately. Uploads are written via temp file + rename, and a Reset button restores the bundled default. * ci: flag unformatted files in a PR, without blocking it (#424) Prettier is configured as an error rule in eslint.config.mjs but has never run in CI, so part of the tree predates it. A final CI step now diffs against the PR base, runs prettier --list-different over the changed files, and emits a warning annotation per offender plus a job summary. Advisory by design: it never fails the job. Blocking would turn a PR red for merely touching a file that was already unformatted, and normalising the tree in one commit would wreck git blame and conflict with the PRs in flight. Requires fetch-depth: 0, since diffing against the base needs its history. * feat(install): first-run wizard gated by a one-time setup token (#419) Adds /install, a four-step first-run wizard: connect to Immich, optionally pick albums, name the site, finish. It verifies the credentials against the Immich server before writing anything, then writes gallery.yaml, settings.yaml and a content/install.json carrying the Immich credentials and a generated site secret. install.json exists because a running process cannot pick up new env vars — the wizard has to write configuration that takes effect without a restart. getInstallCredentials() merges it under the real environment, so env vars always win and rotation stays a matter of setting one. Both the page and the API routes are gated by a one-time setup token printed to the server log, so a deployment that is reachable before gallery.yaml exists cannot be configured by whoever finds it first. The token is stored in content/.setup-token (0600) rather than a module variable: Next.js bundles the page and each route handler separately, so a module-level token left the page and the API disagreeing inside one process and the wizard stuck on step 1. It is removed once the install completes. The admin password is stored as an scrypt hash using the scheme lib/auth.ts already applies to album passwords; a plaintext ADMIN_PASSWORD env var keeps working. * docs: document the setup wizard, fix the read-only content mount (#425) Quick Start now leads with the /install wizard, with the hand-written YAML route kept alongside it, and a First-Run Setup section covers the setup token, the files the wizard writes, and env-var precedence. Two corrections: both Docker examples mounted content/ as :ro, which silently breaks the wizard, the admin panel and the backup rotation alike — docs/admin-panel.md already said so and the README contradicted it. And nothing documented that content/install.json holds the Immich API key, so a backup of content/ is a backup of credentials. Also adds a Contributors section crediting the people whose work is in the project. * feat(admin): floating save bar pinned to the bottom of the viewport (#426) The save bar was the first, static element inside .admin-main. Since the document itself scrolls, it left the viewport as soon as you scrolled down — editing a subpage section or a settings block far below gave no visible dirty hint and no reachable save button. Replace it with a bottom-pinned floating bar shared by both editors. It only mounts while there is something to act on (unsaved changes, an in-flight save, or a result message), so it never covers content while idle. The success message clears after 5s, which hides the bar again. - new SaveBar component, replacing the duplicated markup in PageBuilder and SettingsEditor - adopt the previously unused .floating-save-bar CSS: slide-in keyframes (carrying translateX(-50%)), dirty border, wrap/gap, mobile variant and a prefers-reduced-motion opt-out; z-index 900 keeps it below modals - .admin-main gains bottom padding so the bar never covers page content - drop the now-unreachable idle hints: the ⌘S hint becomes a button title, the Live Sync note becomes a static line above the settings layout - header "Site" link now bypasses the cache (/?fresh=1), so the preview stays reachable when the bar is hidden Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(admin): themed listbox for the album sort control (#427) The per-album "Photo order" control was a native <select>. Because an <option> cannot contain markup, its choices could not use the admin panel's currentColor SVG set — the reason #415 had to fall back to plain text after dropping the emoji labels. Adds a Listbox component implementing the ARIA combobox/listbox pattern, so options can render a glyph beside their label: - DOM focus stays on the trigger button; the active option is announced through aria-activedescendant, keeping focus management to one element - Keyboard: arrows (clamped at the ends, like a native select), Home/End, Enter/Space to commit, Escape to cancel, Tab commits and moves on, and prefix type-ahead with a repeat-key cycle - Outside dismissal on pointerdown, so a press starting outside closes the popup before the click retargets The sort options now carry an icon each: calendar, arrow-down, arrow-up, an A→Z marker, and the drag glyph for manual — matching the badge the album card already shows. SORT_LABELS stays plain text because the badge feeds it to a title attribute. Closes #417 Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(git): ignore generated design handoff folders * fix(admin): stop the album sort dropdown clipping, and simplify the panel (#428) * fix(admin): render listbox popup in a portal so it escapes modal clipping The sort control's popup was position:absolute inside three clipping ancestors (.album-drawer overflow:hidden > .album-drawer-body overflow-y:auto > .modal-right-column overflow-y:auto), so it was cut off at the bottom of the Edit Album Details modal. z-index could not help: clipping happens before stacking. It also always hung below the trigger, with no flip. Portal the popup to document.body and position it from the trigger's viewport rect, flipping above when there is more room there and capping max-height to the space available so it scrolls internally rather than overflowing. It is dismissed on scroll and resize, since the anchor is only measured on open. The outside-pointerdown handler now also treats the popup as inside; without that the portalled list counts as outside, and a click on an option would close it before the selection commits. * refactor(admin): single-column album details panel The left column spent 1.2fr on a cover thumbnail and three stat rows, two of which (Status, Custom Hero) only restated the form fields opposite them, while the form itself was squeezed into 1.8fr behind a second nested scroller. Stack the drawer in one column instead: cover as a banner, then the form at full width, with the UUID moved into the footer. The body is now the only scroll container, which also removes one of the ancestors that was clipping the sort popup. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> * fix(admin): give the portalled listbox its theme back, lock the page behind modals (#429) Two defects in the album editor. The sort listbox popup painted transparent. Every --admin-* variable is scoped to .admin-layout, and since the popup moved into document.body it sits outside that subtree, so background/border/text all resolved to nothing. It now carries its own copy of the palette in both colour schemes, plus the font it no longer inherits. Scrolling inside a modal also moved the page behind it. No admin modal ever locked body scroll: the overlay covers the page but does not absorb wheel events, so a scroll starting on the backdrop — or continuing past the end of the modal's own scroller — reaches the document. overscroll-behavior cannot cover that case on its own, because it only applies to scroll containers and the backdrop is not one. useScrollLock freezes body while a modal is open and compensates for the width the scrollbar gives up, so nothing shifts underneath. Each lock restores the inline value it found, which makes nesting work without a counter — a picker opened from the drawer restores the drawer's hidden state instead of clearing it. Applied to both drawers and all four picker modals, which share the defect. overscroll-behavior: contain on the scrollers stops the chaining they can handle themselves. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com> * fix(security): allow unsafe-eval in CSP script-src during dev mode * feat(journal): add Journal Studio with split-screen editor, live preview and dedicated routes * fix(build): separate client parser from server journal-service and fix build type errors * fix(journal): Fotos rendern, Layout und Lightbox-Steuerung korrigieren Fünf unabhängige Fehler in der öffentlichen Journal- und Essay-Ansicht: * Foto-Blöcke wurden nie angezeigt. EssayView löst ein Foto über PhotoItem.id auf, und das sind verschlüsselte Tokens — die Blöcke aus dem Markdown tragen aber rohe Asset-UUIDs. Jede Zuordnung lief ins Leere, und nicht auflösbare Blöcke werden still verworfen. Die IDs werden jetzt serverseitig übersetzt; damit verschwinden nebenbei die rohen UUIDs aus dem Client-Payload, die dort laut Projektregel nie auftauchen dürfen. Nicht auflösbare Referenzen werden geloggt. * Überschriften standen weiter links als der Fließtext. Jeder Block hatte einzeln `max-width: 68ch`, und `ch` ist relativ zur Schrift des Elements — die Serif-Überschrift ergab eine breitere Spalte. Ersetzt durch eine gemeinsame, font-unabhängige `--essay-measure`. * Fullbleed-Fotos bluteten nur nach links aus: `.essay-figure` ist `width: 100%`, wodurch die Box überbestimmt ist und der negative rechte Margin verworfen wird. * Foto-Paare stellten beide Bilder gleich breit dar, wodurch ein Hochformat neben einem Querformat doppelt so hoch wurde. Jetzt eine Justified-Reihe: Breite proportional zum Seitenverhältnis, dadurch exakt gleiche Höhen ohne Beschnitt. * Die Lightbox hatte im Journal keine Tastatursteuerung und keine Scroll-Sperre — beides lag in PhotoGrid, also nur im Album-Raster. Verlagert in die Lightbox selbst, der doppelte Handler in PhotoGrid entfernt (sonst wäre pro Pfeildruck zwei Bilder weitergesprungen). Zusätzlich sind Proofing-Herzen und das EXIF-Panel im redaktionellen Modus abschaltbar und im Journal aus: Client-Proofing ist ein Übergabe-Workflow für Alben, keine Funktion einer Reportage. Auf der Übersicht wurde der Untertitel doppelt gerendert, weil extractExcerpt() auf ihn zurückfällt. * feat(admin): eigene URLs für alle Bereiche und überarbeiteter Journal Studio Das Panel war eine einzige Client-Komponente, die ihre Tabs über useState umschaltet: keine Route pro Bereich, kein Deep-Link, kein Zurück-Button, und nach jedem Reload landete man wieder auf "Pages". Auch der Journal-Editor hatte keine eigene URL. Jetzt sieben echte Routen (/admin, /admin/pages, /admin/journal, /admin/journal/<slug>, /admin/settings, /admin/settings/<section>, /admin/analytics). Die Shell mit Auth-Prüfung und Kopfzeile sitzt im Layout und umschließt children — so bleibt die Session-Prüfung über Routenwechsel montiert, statt bei jedem Tab-Wechsel neu zu laufen und den Spinner aufblitzen zu lassen. Unbekannte Settings-Sections fallen auf General zurück. Im selben Zug der Journal Studio, der die Routing-Änderung ohnehin berührt: * Alle Eingabefelder nutzten die Klasse `admin-input`, die in keinem CSS definiert war — sie fielen auf Browser-Defaults zurück. Jetzt gestylt, gescoped, damit der generische Name nicht ins übrige Panel leckt. * Der Split View ist per Divider verschiebbar (Maus, Tastatur, Doppelklick zum Zurücksetzen), Breite in localStorage. * Das Studio bricht aus der 1120px-Spalte aus, die Preview hat Platz. * Die Preview zeigte für jedes Foto fest 3:2 und log damit über das Layout der veröffentlichten Seite; die echten Verhältnisse werden jetzt an den Thumbnails gemessen. * Blöcke mit alten positionsbasierten Foto-Referenzen werden markiert — die lassen sich auf einer eigenständigen Journal-Seite nicht auflösen und verschwanden bisher stillschweigend. * Blocktyp-Chips als gemeinsame Komponente, monochrom und per Icon unterschieden statt in einer eigenen Blau/Lila/Orange-Palette, die sonst nirgends im Panel vorkommt. * Emojis raus, SVG-Icons rein. * fix(admin): Designsystem-Lücken im Panel schließen Eine systematische Suche nach Klassen, die im TSX benutzt, aber in keinem CSS definiert sind, hat vier Stellen mit demselben Muster gefunden: * `admin-btn-secondary` und `admin-btn-danger` existierten nicht. Sämtliche Löschen-Buttons sahen aus wie normale Buttons — keine Warnwirkung. Als `.admin-btn.admin-btn-danger` geschrieben, weil die Varianten mit den Größenklassen kombiniert werden, die weiter unten ihren eigenen Hintergrund setzen. * `page-progress-fill` fehlte: die Balken im Analytics-Panel waren leere Rinnen, der Wert unsichtbar. Ebenso `analytics-empty` und `admin-loading-container`. * `subpage-drawer-section`, `subpage-drawer-title-group` und `input-with-icon` im PageBuilder waren wirkungslos und teils mit Inline-Styles notdürftig kompensiert. * `grid-card-preview` fehlte, wodurch alle Layout-Vorschauen auf Höhe null kollabierten. Nur "Showcase" war sichtbar — und das aus Versehen, weil sein Tile `hero-tile` hieß und damit die `aspect-ratio` einer fremden PageBuilder-Klasse erbte. Umbenannt. Dazu die Theme-Vorschauen, die praktisch identisch aussahen: alle sieben zeigten dieselben drei quadratischen Kacheln, einziger Unterschied war die Hintergrundfarbe. Sie spiegeln jetzt die echten Preset-Daten aus lib/config/theme.ts — Schriftcharakter, Eckradius, Rasterdichte, Passepartout bzw. Schatten. Die Kopfzeile richtet sich an einer gemeinsamen Steuerhöhe aus. Der "Site"-Link war höher als die Buttons daneben: `.admin-btn` hatte keine explizite line-height, und <button> bekommt box-sizing: border-box vom Browser, <a> nicht. Die Statusanzeige setzte weder Schriftfamilie noch -größe und fiel auf den Browser-Default zurück — sie war nie Teil des Designsystems. Jetzt gleiche Höhe und Typografie, Pillenform als Zustandsanzeige, Trenner zur Aktionsgruppe. Das dauerhafte Pulsieren des grünen Punkts entfällt; Animation bleibt den Zuständen vorbehalten, die Aufmerksamkeit brauchen. Restliche Emojis durch SVG-Icons ersetzt. * feat(admin): add scroll-to-top toggle and SVG arrow The back-to-top button was always on and drew its arrow with the ↑ text character. Add a `scrollToTop` setting (General section in the admin panel, defaults to on so existing sites are unaffected) and replace the glyph with a stroked SVG that inherits currentColor across all presets. Scroll handling is now rAF-throttled, and prefers-reduced-motion turns off both the hover lift and the smooth scroll. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * security(journal): escape author HTML instead of filtering it CodeQL flags 26 high-severity alerts on the release PR; the bulk of them point at sanitizeHtml(), a denylist of three regexes whose output goes into dangerouslySetInnerHTML. I reproduced the bypasses before changing anything — all four pass the old filter: <img src=x onerror=alert(1)> unquoted handler, regex wants quotes <img src=x onerror='alert(1)'> single quotes, same reason <svg onload=alert(1)> not a <script> tag javasjavascript:cript:alert(1) one-pass replace, the rest recombines Plus an attribute breakout in the link renderer, which interpolated the URL into href="${url}" unescaped: [x](" onmouseover=alert(1) x=") -> <a href="" onmouseover=alert(1" ...> Replaced with escaping. Every `&<>"'` in author text becomes an entity before any markdown rule runs, so the only tags in the output are the ones renderInlineMarkdown builds itself and a URL cannot leave its attribute. Link schemes are now an allowlist (http, https, mailto, tel, relative, anchor); anything else renders as plain text. The serializer needed decodeHtmlEntities to match: without it a save would write `&lt;` into the Markdown file and the next parse would escape the `&` again, corrupting the text further on every round trip. A test covers parse -> serialize -> parse stability. Two existing tests asserted the old behaviour and were rewritten rather than deleted: one expected the script tag to be *removed* from the output, the other expected the substring "onerror" to be absent. Both now assert the property that matters — that no tag can form — because `onerror` surviving as inert text is fine. Exploitation required admin access either way: journal and essay text comes from the studio or from content/*.md. This removes the weakness, it does not close an open door. * fix(journal): contain file paths, fix frontmatter escaping, defuse two regexes Follow-up to the CodeQL findings on release PR #432. I went through all 23 alerts individually; this addresses the ones that are worth addressing and documents the ones that are not. Path containment (12 alerts, all false positives). Every path built from a slug goes through isValidSlug(), a strict `/^[a-zA-Z0-9_-]+$/` allowlist — verified against `../../etc/passwd`, `foo/../../bar`, `a/b`, `..` and friends, all rejected. CodeQL cannot see it because the check lives in another module. Added a containedPath() helper that resolves the path and refuses anything landing outside the content directory: a second lock on a door that was already locked, and a barrier the analysis can follow. Also removed the dead `slug.endsWith('.md')` branches — isValidSlug rejects dots, so they could never be taken. Frontmatter escaping (1 alert, a real bug). The serializer escaped `"` but not `\`, and the parser never unescaped anything. A title containing either character gained a backslash on every save/load cycle: Path C:\Users "quoted" -> Path C:\\Users \"quoted\" -> ... Escaping now covers the backslash first and the parser undoes both. A round trip test covers quotes, backslashes, colons and apostrophes. Two of three ReDoS regexes (2 alerts). The heading pattern had `\s+` next to `(.+)`, which overlap, so the engine tried every split of the whitespace run before failing; it is `[ \t]+` and `(\S.*)` now. The quote author pattern wrapped a lazy group around an optional group — the quadratic case — and is an index split on the first separator now. The third regex, the bold/italic pass, is deliberately left alone. Rewriting it with a negated class removes the backtracking but breaks nesting: `**bold *and italic* here**` renders as `*<em>bold </em>and italic<em> here</em>*`. The input is Markdown from an authenticated admin, never a visitor, so the worst case is an author slowing down their own page. The comment in the code says so. Not addressed: 5 js/insufficient-password-hash alerts. They ask for a slow KDF where the code uses SHA-256/HMAC — correct in general, but the admin password comes from an environment variable and is never stored, so a stronger KDF protects nothing that is not already in plaintext in the environment. 399 unit tests pass (18 new), build and tsc clean. * fix(journal): split the quote author by scanning, not by pattern Cleaning up after myself. #439 replaced the quote author regex `/^(.*?)(?:\s+--\s+(.+))?$/` — a lazy group around an optional one, the quadratic case — with `/\s+--\s+/`, and CodeQL promptly flagged the replacement for the same reason. One reported pattern traded for another. splitQuoteAuthor() scans for the first `--` that has whitespace on both sides. Linear, and it needs no reasoning about the regex engine at all. Behaviour is identical to the original regex, checked case by case against it: separator, no separator, several separators, tabs, wide gaps, `a--b` without spaces, leading and trailing separators, empty string. All nine are covered by tests, plus one asserting it stays fast on a 50k whitespace run. * security(admin): derive the session signing key with scrypt getSigningKey() ran the admin password through a single SHA-256 digest. It is key derivation rather than password storage, so it was never a stored-hash problem — but if the derived key ever leaked, one fast hash makes recovering the password by brute force cheap. CodeQL flags it as js/insufficient-password-hash and, for this particular alert, has a point. scrypt now. Two details that matter: The salt has to be stable. A random salt would produce a different key on every call and invalidate every session; it is derived from AUTH_SECRET, which is deployment-specific. Verified across separate processes: same inputs produce a verifying token, so a restart or redeploy does not log everyone out. The result is cached for the process lifetime. scrypt is deliberately slow and getSigningKey() runs on every admin request — deriving per call would add ~24ms to each one. The cache key is a digest of secret plus password, so a rotation misses the cache and derives again, and no extra plaintext copy of the password is kept around. Measured: first derivation 24ms, subsequent calls 0.12ms. Password change and secret change both invalidate an existing token, checked in separate processes. Note the one-time effect: existing admin sessions are invalidated by the change in derivation, so everyone logs in once more. * security(admin): key the signing-key cache on its inputs, not a digest #441 removed the SHA-256 digest of the admin password from the key derivation and introduced a new one three lines above it, as the cache key. Same rule, same file: CodeQL reported it immediately. The comment justifying it was wrong too. It claimed no second plaintext copy of the password was retained, while building the digest input allocates exactly that in order to hash it. The cache now holds the two input strings and compares them directly. They are the same objects the env and install caches already hold, so nothing extra is retained, and no fast hash of the password exists in memory for the life of the process. Re-verified after the change, in separate processes: a token from one process verifies in another with the same inputs, a changed password or secret rejects it, first derivation 24ms, cached calls 0.001ms. That leaves scrypt as the only place the password is hashed here. The two HMACs further down operate on the derived key and on token data, not on the password; the constant-time comparison in verifyAdminPassword is the previously dismissed one. --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
2026-08-14 16:55:07 +02:00
display: inline-flex;
align-items: center;
feat: add visual admin panel with page builder and settings editor - Add /admin route with password-protected visual page builder - Page Builder: manage hero images, standalone albums, subpages, and sections - Album Picker: browse all shared Immich albums with search and filtering - Settings Editor: theme, grid, footer, legal, SEO configuration - YAML service with atomic writes and automatic backups (content/.backups/) - HMAC-signed admin sessions (24h expiry, HttpOnly cookies) - API endpoints: /api/admin/{auth,gallery,settings,albums,reload} - Enable with ADMIN_PASSWORD env var; disabled by default - invalidateConfigCache() export for hot-reload after saves
2026-05-29 17:04:37 +02:00
font-size: 0.75rem;
fix: admin panel light/dark theme support, improved contrast, and backup confirmation a) Admin panel now respects the site's light/dark theme toggle via CSS custom properties that respond to [data-theme='light'] on <html>. All hardcoded dark colors replaced with semantic CSS variables. b) Improved contrast in dark mode: secondary text changed from #666/#555 to #a0a0a0, muted text from #555 to #707070. All text is now clearly readable against dark backgrounds. c) Backup system was already implemented in yaml-service.ts (creates timestamped backups in content/.backups/ before each save, keeps last 10 versions). Now the UI shows a confirmation message that a backup was created after each successful save.
2026-05-29 17:20:56 +02:00
color: var(--admin-accent);
feat: add visual admin panel with page builder and settings editor - Add /admin route with password-protected visual page builder - Page Builder: manage hero images, standalone albums, subpages, and sections - Album Picker: browse all shared Immich albums with search and filtering - Settings Editor: theme, grid, footer, legal, SEO configuration - YAML service with atomic writes and automatic backups (content/.backups/) - HMAC-signed admin sessions (24h expiry, HttpOnly cookies) - API endpoints: /api/admin/{auth,gallery,settings,albums,reload} - Enable with ADMIN_PASSWORD env var; disabled by default - invalidateConfigCache() export for hot-reload after saves
2026-05-29 17:04:37 +02:00
font-weight: 500;
}
.save-message {
font-size: 0.75rem;
font-weight: 500;
}
.save-message.success {
fix: admin panel light/dark theme support, improved contrast, and backup confirmation a) Admin panel now respects the site's light/dark theme toggle via CSS custom properties that respond to [data-theme='light'] on <html>. All hardcoded dark colors replaced with semantic CSS variables. b) Improved contrast in dark mode: secondary text changed from #666/#555 to #a0a0a0, muted text from #555 to #707070. All text is now clearly readable against dark backgrounds. c) Backup system was already implemented in yaml-service.ts (creates timestamped backups in content/.backups/ before each save, keeps last 10 versions). Now the UI shows a confirmation message that a backup was created after each successful save.
2026-05-29 17:20:56 +02:00
color: var(--admin-success);
feat: add visual admin panel with page builder and settings editor - Add /admin route with password-protected visual page builder - Page Builder: manage hero images, standalone albums, subpages, and sections - Album Picker: browse all shared Immich albums with search and filtering - Settings Editor: theme, grid, footer, legal, SEO configuration - YAML service with atomic writes and automatic backups (content/.backups/) - HMAC-signed admin sessions (24h expiry, HttpOnly cookies) - API endpoints: /api/admin/{auth,gallery,settings,albums,reload} - Enable with ADMIN_PASSWORD env var; disabled by default - invalidateConfigCache() export for hot-reload after saves
2026-05-29 17:04:37 +02:00
}
.save-message.error {
fix: admin panel light/dark theme support, improved contrast, and backup confirmation a) Admin panel now respects the site's light/dark theme toggle via CSS custom properties that respond to [data-theme='light'] on <html>. All hardcoded dark colors replaced with semantic CSS variables. b) Improved contrast in dark mode: secondary text changed from #666/#555 to #a0a0a0, muted text from #555 to #707070. All text is now clearly readable against dark backgrounds. c) Backup system was already implemented in yaml-service.ts (creates timestamped backups in content/.backups/ before each save, keeps last 10 versions). Now the UI shows a confirmation message that a backup was created after each successful save.
2026-05-29 17:20:56 +02:00
color: var(--admin-error);
feat: add visual admin panel with page builder and settings editor - Add /admin route with password-protected visual page builder - Page Builder: manage hero images, standalone albums, subpages, and sections - Album Picker: browse all shared Immich albums with search and filtering - Settings Editor: theme, grid, footer, legal, SEO configuration - YAML service with atomic writes and automatic backups (content/.backups/) - HMAC-signed admin sessions (24h expiry, HttpOnly cookies) - API endpoints: /api/admin/{auth,gallery,settings,albums,reload} - Enable with ADMIN_PASSWORD env var; disabled by default - invalidateConfigCache() export for hot-reload after saves
2026-05-29 17:04:37 +02:00
}
/* ── Page Builder ──────────────────────────────────────────── */
.builder-section {
margin-bottom: 2rem;
}
.builder-section-header {
display: flex;
align-items: center;
justify-content: space-between;
margin-bottom: 0.75rem;
}
.builder-section-header h2 {
font-size: 1rem;
font-weight: 600;
margin: 0;
}
.empty-hint {
fix: admin panel light/dark theme support, improved contrast, and backup confirmation a) Admin panel now respects the site's light/dark theme toggle via CSS custom properties that respond to [data-theme='light'] on <html>. All hardcoded dark colors replaced with semantic CSS variables. b) Improved contrast in dark mode: secondary text changed from #666/#555 to #a0a0a0, muted text from #555 to #707070. All text is now clearly readable against dark backgrounds. c) Backup system was already implemented in yaml-service.ts (creates timestamped backups in content/.backups/ before each save, keeps last 10 versions). Now the UI shows a confirmation message that a backup was created after each successful save.
2026-05-29 17:20:56 +02:00
color: var(--admin-text-muted);
feat: add visual admin panel with page builder and settings editor - Add /admin route with password-protected visual page builder - Page Builder: manage hero images, standalone albums, subpages, and sections - Album Picker: browse all shared Immich albums with search and filtering - Settings Editor: theme, grid, footer, legal, SEO configuration - YAML service with atomic writes and automatic backups (content/.backups/) - HMAC-signed admin sessions (24h expiry, HttpOnly cookies) - API endpoints: /api/admin/{auth,gallery,settings,albums,reload} - Enable with ADMIN_PASSWORD env var; disabled by default - invalidateConfigCache() export for hot-reload after saves
2026-05-29 17:04:37 +02:00
font-size: 0.8rem;
font-style: italic;
padding: 0.75rem;
fix: admin panel light/dark theme support, improved contrast, and backup confirmation a) Admin panel now respects the site's light/dark theme toggle via CSS custom properties that respond to [data-theme='light'] on <html>. All hardcoded dark colors replaced with semantic CSS variables. b) Improved contrast in dark mode: secondary text changed from #666/#555 to #a0a0a0, muted text from #555 to #707070. All text is now clearly readable against dark backgrounds. c) Backup system was already implemented in yaml-service.ts (creates timestamped backups in content/.backups/ before each save, keeps last 10 versions). Now the UI shows a confirmation message that a backup was created after each successful save.
2026-05-29 17:20:56 +02:00
border: 1px dashed var(--admin-border);
feat: add visual admin panel with page builder and settings editor - Add /admin route with password-protected visual page builder - Page Builder: manage hero images, standalone albums, subpages, and sections - Album Picker: browse all shared Immich albums with search and filtering - Settings Editor: theme, grid, footer, legal, SEO configuration - YAML service with atomic writes and automatic backups (content/.backups/) - HMAC-signed admin sessions (24h expiry, HttpOnly cookies) - API endpoints: /api/admin/{auth,gallery,settings,albums,reload} - Enable with ADMIN_PASSWORD env var; disabled by default - invalidateConfigCache() export for hot-reload after saves
2026-05-29 17:04:37 +02:00
border-radius: 6px;
text-align: center;
}
feat: redesign hero section as visual image grid with large previews - Hero images shown as landscape tiles (16:10 aspect ratio) in a grid - Full cover images instead of tiny thumbnails with UUID text - Remove button appears on hover (red X, top-right corner) - Slide number badge shown bottom-left for ordering reference - Much more visual and recognizable at a glance
2026-05-29 17:26:54 +02:00
/* Hero Grid */
.hero-grid {
display: grid;
feat: enlarge admin thumbnails for hero, album, and subpage grids - Hero grid: 140px → 220px min tile width - Album grid: 160px → 240px min tile width - Subpage grid: 140px → 200px min tile width - Picker thumbnails: 40px → 52px - Admin main max-width: 960px → 1120px for more space - Slightly larger overlay buttons and index badges
2026-05-29 17:37:34 +02:00
grid-template-columns: repeat(auto-fill, minmax(220px, 1fr));
gap: 0.75rem;
feat: add visual admin panel with page builder and settings editor - Add /admin route with password-protected visual page builder - Page Builder: manage hero images, standalone albums, subpages, and sections - Album Picker: browse all shared Immich albums with search and filtering - Settings Editor: theme, grid, footer, legal, SEO configuration - YAML service with atomic writes and automatic backups (content/.backups/) - HMAC-signed admin sessions (24h expiry, HttpOnly cookies) - API endpoints: /api/admin/{auth,gallery,settings,albums,reload} - Enable with ADMIN_PASSWORD env var; disabled by default - invalidateConfigCache() export for hot-reload after saves
2026-05-29 17:04:37 +02:00
}
feat: redesign hero section as visual image grid with large previews - Hero images shown as landscape tiles (16:10 aspect ratio) in a grid - Full cover images instead of tiny thumbnails with UUID text - Remove button appears on hover (red X, top-right corner) - Slide number badge shown bottom-left for ordering reference - Much more visual and recognizable at a glance
2026-05-29 17:26:54 +02:00
.hero-tile {
position: relative;
aspect-ratio: 16 / 10;
feat: enlarge admin thumbnails for hero, album, and subpage grids - Hero grid: 140px → 220px min tile width - Album grid: 160px → 240px min tile width - Subpage grid: 140px → 200px min tile width - Picker thumbnails: 40px → 52px - Admin main max-width: 960px → 1120px for more space - Slightly larger overlay buttons and index badges
2026-05-29 17:37:34 +02:00
border-radius: 10px;
feat: redesign hero section as visual image grid with large previews - Hero images shown as landscape tiles (16:10 aspect ratio) in a grid - Full cover images instead of tiny thumbnails with UUID text - Remove button appears on hover (red X, top-right corner) - Slide number badge shown bottom-left for ordering reference - Much more visual and recognizable at a glance
2026-05-29 17:26:54 +02:00
overflow: hidden;
background: var(--admin-bg-elevated);
fix: admin panel light/dark theme support, improved contrast, and backup confirmation a) Admin panel now respects the site's light/dark theme toggle via CSS custom properties that respond to [data-theme='light'] on <html>. All hardcoded dark colors replaced with semantic CSS variables. b) Improved contrast in dark mode: secondary text changed from #666/#555 to #a0a0a0, muted text from #555 to #707070. All text is now clearly readable against dark backgrounds. c) Backup system was already implemented in yaml-service.ts (creates timestamped backups in content/.backups/ before each save, keeps last 10 versions). Now the UI shows a confirmation message that a backup was created after each successful save.
2026-05-29 17:20:56 +02:00
border: 1px solid var(--admin-border);
feat: redesign hero section as visual image grid with large previews - Hero images shown as landscape tiles (16:10 aspect ratio) in a grid - Full cover images instead of tiny thumbnails with UUID text - Remove button appears on hover (red X, top-right corner) - Slide number badge shown bottom-left for ordering reference - Much more visual and recognizable at a glance
2026-05-29 17:26:54 +02:00
transition: border-color 0.15s;
}
.hero-tile:hover {
border-color: var(--admin-border-hover);
feat: add visual admin panel with page builder and settings editor - Add /admin route with password-protected visual page builder - Page Builder: manage hero images, standalone albums, subpages, and sections - Album Picker: browse all shared Immich albums with search and filtering - Settings Editor: theme, grid, footer, legal, SEO configuration - YAML service with atomic writes and automatic backups (content/.backups/) - HMAC-signed admin sessions (24h expiry, HttpOnly cookies) - API endpoints: /api/admin/{auth,gallery,settings,albums,reload} - Enable with ADMIN_PASSWORD env var; disabled by default - invalidateConfigCache() export for hot-reload after saves
2026-05-29 17:04:37 +02:00
}
feat: redesign hero section as visual image grid with large previews - Hero images shown as landscape tiles (16:10 aspect ratio) in a grid - Full cover images instead of tiny thumbnails with UUID text - Remove button appears on hover (red X, top-right corner) - Slide number badge shown bottom-left for ordering reference - Much more visual and recognizable at a glance
2026-05-29 17:26:54 +02:00
.hero-tile img {
width: 100%;
height: 100%;
feat: add thumbnail previews to admin panel for albums and hero images - Add /api/admin/thumbnail/[id] proxy endpoint for serving Immich thumbnails - Show album cover thumbnails in AlbumCard components (subpages + standalone) - Show actual image thumbnails in AlbumPicker modal instead of emoji placeholders - Show small thumbnail previews for hero image entries - Add corresponding CSS styles for all thumbnail elements
2026-05-29 17:14:58 +02:00
object-fit: cover;
}
feat: redesign hero section as visual image grid with large previews - Hero images shown as landscape tiles (16:10 aspect ratio) in a grid - Full cover images instead of tiny thumbnails with UUID text - Remove button appears on hover (red X, top-right corner) - Slide number badge shown bottom-left for ordering reference - Much more visual and recognizable at a glance
2026-05-29 17:26:54 +02:00
.hero-tile-remove {
position: absolute;
feat: enlarge admin thumbnails for hero, album, and subpage grids - Hero grid: 140px → 220px min tile width - Album grid: 160px → 240px min tile width - Subpage grid: 140px → 200px min tile width - Picker thumbnails: 40px → 52px - Admin main max-width: 960px → 1120px for more space - Slightly larger overlay buttons and index badges
2026-05-29 17:37:34 +02:00
top: 6px;
right: 6px;
width: 26px;
height: 26px;
feat: redesign hero section as visual image grid with large previews - Hero images shown as landscape tiles (16:10 aspect ratio) in a grid - Full cover images instead of tiny thumbnails with UUID text - Remove button appears on hover (red X, top-right corner) - Slide number badge shown bottom-left for ordering reference - Much more visual and recognizable at a glance
2026-05-29 17:26:54 +02:00
border-radius: 50%;
background: rgba(0, 0, 0, 0.6);
backdrop-filter: blur(4px);
border: none;
color: #fff;
feat: enlarge admin thumbnails for hero, album, and subpage grids - Hero grid: 140px → 220px min tile width - Album grid: 160px → 240px min tile width - Subpage grid: 140px → 200px min tile width - Picker thumbnails: 40px → 52px - Admin main max-width: 960px → 1120px for more space - Slightly larger overlay buttons and index badges
2026-05-29 17:37:34 +02:00
font-size: 0.9rem;
feat: redesign hero section as visual image grid with large previews - Hero images shown as landscape tiles (16:10 aspect ratio) in a grid - Full cover images instead of tiny thumbnails with UUID text - Remove button appears on hover (red X, top-right corner) - Slide number badge shown bottom-left for ordering reference - Much more visual and recognizable at a glance
2026-05-29 17:26:54 +02:00
cursor: pointer;
display: flex;
align-items: center;
justify-content: center;
opacity: 0;
transition: opacity 0.15s;
}
.hero-tile:hover .hero-tile-remove {
opacity: 1;
}
.hero-tile-remove:hover {
background: rgba(220, 40, 40, 0.8);
}
.hero-tile-index {
position: absolute;
feat: enlarge admin thumbnails for hero, album, and subpage grids - Hero grid: 140px → 220px min tile width - Album grid: 160px → 240px min tile width - Subpage grid: 140px → 200px min tile width - Picker thumbnails: 40px → 52px - Admin main max-width: 960px → 1120px for more space - Slightly larger overlay buttons and index badges
2026-05-29 17:37:34 +02:00
bottom: 6px;
left: 6px;
width: 22px;
height: 22px;
border-radius: 5px;
feat: redesign hero section as visual image grid with large previews - Hero images shown as landscape tiles (16:10 aspect ratio) in a grid - Full cover images instead of tiny thumbnails with UUID text - Remove button appears on hover (red X, top-right corner) - Slide number badge shown bottom-left for ordering reference - Much more visual and recognizable at a glance
2026-05-29 17:26:54 +02:00
background: rgba(0, 0, 0, 0.5);
color: #fff;
feat: enlarge admin thumbnails for hero, album, and subpage grids - Hero grid: 140px → 220px min tile width - Album grid: 160px → 240px min tile width - Subpage grid: 140px → 200px min tile width - Picker thumbnails: 40px → 52px - Admin main max-width: 960px → 1120px for more space - Slightly larger overlay buttons and index badges
2026-05-29 17:37:34 +02:00
font-size: 0.7rem;
feat: redesign hero section as visual image grid with large previews - Hero images shown as landscape tiles (16:10 aspect ratio) in a grid - Full cover images instead of tiny thumbnails with UUID text - Remove button appears on hover (red X, top-right corner) - Slide number badge shown bottom-left for ordering reference - Much more visual and recognizable at a glance
2026-05-29 17:26:54 +02:00
font-weight: 600;
display: flex;
align-items: center;
justify-content: center;
feat: add visual admin panel with page builder and settings editor - Add /admin route with password-protected visual page builder - Page Builder: manage hero images, standalone albums, subpages, and sections - Album Picker: browse all shared Immich albums with search and filtering - Settings Editor: theme, grid, footer, legal, SEO configuration - YAML service with atomic writes and automatic backups (content/.backups/) - HMAC-signed admin sessions (24h expiry, HttpOnly cookies) - API endpoints: /api/admin/{auth,gallery,settings,albums,reload} - Enable with ADMIN_PASSWORD env var; disabled by default - invalidateConfigCache() export for hot-reload after saves
2026-05-29 17:04:37 +02:00
}
feat: redesign admin album cards as grid tiles with large cover images Replace the list-style album cards with a visual grid layout: - Albums shown as tiles with square cover images (aspect-ratio: 1) - Grid auto-fills with min 160px columns - Edit/remove buttons appear as overlay on hover - Album name and photo count shown below the cover - Much more compact — multiple albums visible without scrolling
2026-05-29 17:24:53 +02:00
/* Album Grid */
feat: add visual admin panel with page builder and settings editor - Add /admin route with password-protected visual page builder - Page Builder: manage hero images, standalone albums, subpages, and sections - Album Picker: browse all shared Immich albums with search and filtering - Settings Editor: theme, grid, footer, legal, SEO configuration - YAML service with atomic writes and automatic backups (content/.backups/) - HMAC-signed admin sessions (24h expiry, HttpOnly cookies) - API endpoints: /api/admin/{auth,gallery,settings,albums,reload} - Enable with ADMIN_PASSWORD env var; disabled by default - invalidateConfigCache() export for hot-reload after saves
2026-05-29 17:04:37 +02:00
.album-list {
feat: redesign admin album cards as grid tiles with large cover images Replace the list-style album cards with a visual grid layout: - Albums shown as tiles with square cover images (aspect-ratio: 1) - Grid auto-fills with min 160px columns - Edit/remove buttons appear as overlay on hover - Album name and photo count shown below the cover - Much more compact — multiple albums visible without scrolling
2026-05-29 17:24:53 +02:00
display: grid;
feat: enlarge admin thumbnails for hero, album, and subpage grids - Hero grid: 140px → 220px min tile width - Album grid: 160px → 240px min tile width - Subpage grid: 140px → 200px min tile width - Picker thumbnails: 40px → 52px - Admin main max-width: 960px → 1120px for more space - Slightly larger overlay buttons and index badges
2026-05-29 17:37:34 +02:00
grid-template-columns: repeat(auto-fill, minmax(240px, 1fr));
gap: 1rem;
feat: add visual admin panel with page builder and settings editor - Add /admin route with password-protected visual page builder - Page Builder: manage hero images, standalone albums, subpages, and sections - Album Picker: browse all shared Immich albums with search and filtering - Settings Editor: theme, grid, footer, legal, SEO configuration - YAML service with atomic writes and automatic backups (content/.backups/) - HMAC-signed admin sessions (24h expiry, HttpOnly cookies) - API endpoints: /api/admin/{auth,gallery,settings,albums,reload} - Enable with ADMIN_PASSWORD env var; disabled by default - invalidateConfigCache() export for hot-reload after saves
2026-05-29 17:04:37 +02:00
}
feat: redesign admin album cards as grid tiles with large cover images Replace the list-style album cards with a visual grid layout: - Albums shown as tiles with square cover images (aspect-ratio: 1) - Grid auto-fills with min 160px columns - Edit/remove buttons appear as overlay on hover - Album name and photo count shown below the cover - Much more compact — multiple albums visible without scrolling
2026-05-29 17:24:53 +02:00
.album-tile {
fix: admin panel light/dark theme support, improved contrast, and backup confirmation a) Admin panel now respects the site's light/dark theme toggle via CSS custom properties that respond to [data-theme='light'] on <html>. All hardcoded dark colors replaced with semantic CSS variables. b) Improved contrast in dark mode: secondary text changed from #666/#555 to #a0a0a0, muted text from #555 to #707070. All text is now clearly readable against dark backgrounds. c) Backup system was already implemented in yaml-service.ts (creates timestamped backups in content/.backups/ before each save, keeps last 10 versions). Now the UI shows a confirmation message that a backup was created after each successful save.
2026-05-29 17:20:56 +02:00
background: var(--admin-bg-raised);
border: 1px solid var(--admin-border);
feat: redesign admin album cards as grid tiles with large cover images Replace the list-style album cards with a visual grid layout: - Albums shown as tiles with square cover images (aspect-ratio: 1) - Grid auto-fills with min 160px columns - Edit/remove buttons appear as overlay on hover - Album name and photo count shown below the cover - Much more compact — multiple albums visible without scrolling
2026-05-29 17:24:53 +02:00
border-radius: 10px;
feat: add visual admin panel with page builder and settings editor - Add /admin route with password-protected visual page builder - Page Builder: manage hero images, standalone albums, subpages, and sections - Album Picker: browse all shared Immich albums with search and filtering - Settings Editor: theme, grid, footer, legal, SEO configuration - YAML service with atomic writes and automatic backups (content/.backups/) - HMAC-signed admin sessions (24h expiry, HttpOnly cookies) - API endpoints: /api/admin/{auth,gallery,settings,albums,reload} - Enable with ADMIN_PASSWORD env var; disabled by default - invalidateConfigCache() export for hot-reload after saves
2026-05-29 17:04:37 +02:00
overflow: hidden;
chore(release): v0.10.0 (#400) Photo Essay mode, client proofing, studio-modern preset, admin panel overhaul, watermark, cookieless analytics, subpage toggle, SEO title templates. Analytics API now admin-only, Trivy scan on publish. Album order mirrors the Immich timeline; map theme, admin status panel, lightbox counter and Docker health check fixed. See CHANGELOG.md for the full list and the health-check upgrade note.
2026-08-10 09:56:20 +02:00
transition:
border-color 0.15s,
box-shadow 0.15s;
feat: add visual admin panel with page builder and settings editor - Add /admin route with password-protected visual page builder - Page Builder: manage hero images, standalone albums, subpages, and sections - Album Picker: browse all shared Immich albums with search and filtering - Settings Editor: theme, grid, footer, legal, SEO configuration - YAML service with atomic writes and automatic backups (content/.backups/) - HMAC-signed admin sessions (24h expiry, HttpOnly cookies) - API endpoints: /api/admin/{auth,gallery,settings,albums,reload} - Enable with ADMIN_PASSWORD env var; disabled by default - invalidateConfigCache() export for hot-reload after saves
2026-05-29 17:04:37 +02:00
}
feat: redesign admin album cards as grid tiles with large cover images Replace the list-style album cards with a visual grid layout: - Albums shown as tiles with square cover images (aspect-ratio: 1) - Grid auto-fills with min 160px columns - Edit/remove buttons appear as overlay on hover - Album name and photo count shown below the cover - Much more compact — multiple albums visible without scrolling
2026-05-29 17:24:53 +02:00
.album-tile:hover {
fix: admin panel light/dark theme support, improved contrast, and backup confirmation a) Admin panel now respects the site's light/dark theme toggle via CSS custom properties that respond to [data-theme='light'] on <html>. All hardcoded dark colors replaced with semantic CSS variables. b) Improved contrast in dark mode: secondary text changed from #666/#555 to #a0a0a0, muted text from #555 to #707070. All text is now clearly readable against dark backgrounds. c) Backup system was already implemented in yaml-service.ts (creates timestamped backups in content/.backups/ before each save, keeps last 10 versions). Now the UI shows a confirmation message that a backup was created after each successful save.
2026-05-29 17:20:56 +02:00
border-color: var(--admin-border-hover);
feat: redesign admin album cards as grid tiles with large cover images Replace the list-style album cards with a visual grid layout: - Albums shown as tiles with square cover images (aspect-ratio: 1) - Grid auto-fills with min 160px columns - Edit/remove buttons appear as overlay on hover - Album name and photo count shown below the cover - Much more compact — multiple albums visible without scrolling
2026-05-29 17:24:53 +02:00
box-shadow: 0 2px 8px rgba(0, 0, 0, 0.15);
feat: add visual admin panel with page builder and settings editor - Add /admin route with password-protected visual page builder - Page Builder: manage hero images, standalone albums, subpages, and sections - Album Picker: browse all shared Immich albums with search and filtering - Settings Editor: theme, grid, footer, legal, SEO configuration - YAML service with atomic writes and automatic backups (content/.backups/) - HMAC-signed admin sessions (24h expiry, HttpOnly cookies) - API endpoints: /api/admin/{auth,gallery,settings,albums,reload} - Enable with ADMIN_PASSWORD env var; disabled by default - invalidateConfigCache() export for hot-reload after saves
2026-05-29 17:04:37 +02:00
}
feat: redesign admin album cards as grid tiles with large cover images Replace the list-style album cards with a visual grid layout: - Albums shown as tiles with square cover images (aspect-ratio: 1) - Grid auto-fills with min 160px columns - Edit/remove buttons appear as overlay on hover - Album name and photo count shown below the cover - Much more compact — multiple albums visible without scrolling
2026-05-29 17:24:53 +02:00
.album-tile-cover {
position: relative;
aspect-ratio: 1;
fix: admin panel light/dark theme support, improved contrast, and backup confirmation a) Admin panel now respects the site's light/dark theme toggle via CSS custom properties that respond to [data-theme='light'] on <html>. All hardcoded dark colors replaced with semantic CSS variables. b) Improved contrast in dark mode: secondary text changed from #666/#555 to #a0a0a0, muted text from #555 to #707070. All text is now clearly readable against dark backgrounds. c) Backup system was already implemented in yaml-service.ts (creates timestamped backups in content/.backups/ before each save, keeps last 10 versions). Now the UI shows a confirmation message that a backup was created after each successful save.
2026-05-29 17:20:56 +02:00
background: var(--admin-bg-elevated);
feat: redesign admin album cards as grid tiles with large cover images Replace the list-style album cards with a visual grid layout: - Albums shown as tiles with square cover images (aspect-ratio: 1) - Grid auto-fills with min 160px columns - Edit/remove buttons appear as overlay on hover - Album name and photo count shown below the cover - Much more compact — multiple albums visible without scrolling
2026-05-29 17:24:53 +02:00
overflow: hidden;
feat: add thumbnail previews to admin panel for albums and hero images - Add /api/admin/thumbnail/[id] proxy endpoint for serving Immich thumbnails - Show album cover thumbnails in AlbumCard components (subpages + standalone) - Show actual image thumbnails in AlbumPicker modal instead of emoji placeholders - Show small thumbnail previews for hero image entries - Add corresponding CSS styles for all thumbnail elements
2026-05-29 17:14:58 +02:00
}
feat: redesign admin album cards as grid tiles with large cover images Replace the list-style album cards with a visual grid layout: - Albums shown as tiles with square cover images (aspect-ratio: 1) - Grid auto-fills with min 160px columns - Edit/remove buttons appear as overlay on hover - Album name and photo count shown below the cover - Much more compact — multiple albums visible without scrolling
2026-05-29 17:24:53 +02:00
.album-tile-cover img {
feat: add thumbnail previews to admin panel for albums and hero images - Add /api/admin/thumbnail/[id] proxy endpoint for serving Immich thumbnails - Show album cover thumbnails in AlbumCard components (subpages + standalone) - Show actual image thumbnails in AlbumPicker modal instead of emoji placeholders - Show small thumbnail previews for hero image entries - Add corresponding CSS styles for all thumbnail elements
2026-05-29 17:14:58 +02:00
width: 100%;
height: 100%;
object-fit: cover;
feat: add visual admin panel with page builder and settings editor - Add /admin route with password-protected visual page builder - Page Builder: manage hero images, standalone albums, subpages, and sections - Album Picker: browse all shared Immich albums with search and filtering - Settings Editor: theme, grid, footer, legal, SEO configuration - YAML service with atomic writes and automatic backups (content/.backups/) - HMAC-signed admin sessions (24h expiry, HttpOnly cookies) - API endpoints: /api/admin/{auth,gallery,settings,albums,reload} - Enable with ADMIN_PASSWORD env var; disabled by default - invalidateConfigCache() export for hot-reload after saves
2026-05-29 17:04:37 +02:00
}
feat: redesign admin album cards as grid tiles with large cover images Replace the list-style album cards with a visual grid layout: - Albums shown as tiles with square cover images (aspect-ratio: 1) - Grid auto-fills with min 160px columns - Edit/remove buttons appear as overlay on hover - Album name and photo count shown below the cover - Much more compact — multiple albums visible without scrolling
2026-05-29 17:24:53 +02:00
.album-tile-placeholder {
width: 100%;
height: 100%;
feat: add visual admin panel with page builder and settings editor - Add /admin route with password-protected visual page builder - Page Builder: manage hero images, standalone albums, subpages, and sections - Album Picker: browse all shared Immich albums with search and filtering - Settings Editor: theme, grid, footer, legal, SEO configuration - YAML service with atomic writes and automatic backups (content/.backups/) - HMAC-signed admin sessions (24h expiry, HttpOnly cookies) - API endpoints: /api/admin/{auth,gallery,settings,albums,reload} - Enable with ADMIN_PASSWORD env var; disabled by default - invalidateConfigCache() export for hot-reload after saves
2026-05-29 17:04:37 +02:00
display: flex;
feat: redesign admin album cards as grid tiles with large cover images Replace the list-style album cards with a visual grid layout: - Albums shown as tiles with square cover images (aspect-ratio: 1) - Grid auto-fills with min 160px columns - Edit/remove buttons appear as overlay on hover - Album name and photo count shown below the cover - Much more compact — multiple albums visible without scrolling
2026-05-29 17:24:53 +02:00
align-items: center;
justify-content: center;
font-size: 2rem;
}
.album-tile-overlay {
position: absolute;
inset: 0;
background: rgba(0, 0, 0, 0.5);
display: flex;
align-items: center;
justify-content: center;
feat: add visual admin panel with page builder and settings editor - Add /admin route with password-protected visual page builder - Page Builder: manage hero images, standalone albums, subpages, and sections - Album Picker: browse all shared Immich albums with search and filtering - Settings Editor: theme, grid, footer, legal, SEO configuration - YAML service with atomic writes and automatic backups (content/.backups/) - HMAC-signed admin sessions (24h expiry, HttpOnly cookies) - API endpoints: /api/admin/{auth,gallery,settings,albums,reload} - Enable with ADMIN_PASSWORD env var; disabled by default - invalidateConfigCache() export for hot-reload after saves
2026-05-29 17:04:37 +02:00
gap: 0.5rem;
feat: redesign admin album cards as grid tiles with large cover images Replace the list-style album cards with a visual grid layout: - Albums shown as tiles with square cover images (aspect-ratio: 1) - Grid auto-fills with min 160px columns - Edit/remove buttons appear as overlay on hover - Album name and photo count shown below the cover - Much more compact — multiple albums visible without scrolling
2026-05-29 17:24:53 +02:00
opacity: 0;
transition: opacity 0.15s;
feat: add visual admin panel with page builder and settings editor - Add /admin route with password-protected visual page builder - Page Builder: manage hero images, standalone albums, subpages, and sections - Album Picker: browse all shared Immich albums with search and filtering - Settings Editor: theme, grid, footer, legal, SEO configuration - YAML service with atomic writes and automatic backups (content/.backups/) - HMAC-signed admin sessions (24h expiry, HttpOnly cookies) - API endpoints: /api/admin/{auth,gallery,settings,albums,reload} - Enable with ADMIN_PASSWORD env var; disabled by default - invalidateConfigCache() export for hot-reload after saves
2026-05-29 17:04:37 +02:00
}
feat: redesign admin album cards as grid tiles with large cover images Replace the list-style album cards with a visual grid layout: - Albums shown as tiles with square cover images (aspect-ratio: 1) - Grid auto-fills with min 160px columns - Edit/remove buttons appear as overlay on hover - Album name and photo count shown below the cover - Much more compact — multiple albums visible without scrolling
2026-05-29 17:24:53 +02:00
.album-tile:hover .album-tile-overlay {
opacity: 1;
}
.album-tile-btn {
background: rgba(255, 255, 255, 0.15);
backdrop-filter: blur(4px);
border: 1px solid rgba(255, 255, 255, 0.25);
color: #fff;
feat: enlarge admin thumbnails for hero, album, and subpage grids - Hero grid: 140px → 220px min tile width - Album grid: 160px → 240px min tile width - Subpage grid: 140px → 200px min tile width - Picker thumbnails: 40px → 52px - Admin main max-width: 960px → 1120px for more space - Slightly larger overlay buttons and index badges
2026-05-29 17:37:34 +02:00
width: 36px;
height: 36px;
feat: redesign admin album cards as grid tiles with large cover images Replace the list-style album cards with a visual grid layout: - Albums shown as tiles with square cover images (aspect-ratio: 1) - Grid auto-fills with min 160px columns - Edit/remove buttons appear as overlay on hover - Album name and photo count shown below the cover - Much more compact — multiple albums visible without scrolling
2026-05-29 17:24:53 +02:00
border-radius: 50%;
display: flex;
align-items: center;
justify-content: center;
cursor: pointer;
feat: enlarge admin thumbnails for hero, album, and subpage grids - Hero grid: 140px → 220px min tile width - Album grid: 160px → 240px min tile width - Subpage grid: 140px → 200px min tile width - Picker thumbnails: 40px → 52px - Admin main max-width: 960px → 1120px for more space - Slightly larger overlay buttons and index badges
2026-05-29 17:37:34 +02:00
font-size: 0.95rem;
feat: redesign admin album cards as grid tiles with large cover images Replace the list-style album cards with a visual grid layout: - Albums shown as tiles with square cover images (aspect-ratio: 1) - Grid auto-fills with min 160px columns - Edit/remove buttons appear as overlay on hover - Album name and photo count shown below the cover - Much more compact — multiple albums visible without scrolling
2026-05-29 17:24:53 +02:00
transition: background 0.1s;
}
.album-tile-btn:hover {
background: rgba(255, 255, 255, 0.3);
}
.album-tile-info {
feat: enlarge admin thumbnails for hero, album, and subpage grids - Hero grid: 140px → 220px min tile width - Album grid: 160px → 240px min tile width - Subpage grid: 140px → 200px min tile width - Picker thumbnails: 40px → 52px - Admin main max-width: 960px → 1120px for more space - Slightly larger overlay buttons and index badges
2026-05-29 17:37:34 +02:00
padding: 0.6rem 0.75rem;
feat: redesign admin album cards as grid tiles with large cover images Replace the list-style album cards with a visual grid layout: - Albums shown as tiles with square cover images (aspect-ratio: 1) - Grid auto-fills with min 160px columns - Edit/remove buttons appear as overlay on hover - Album name and photo count shown below the cover - Much more compact — multiple albums visible without scrolling
2026-05-29 17:24:53 +02:00
display: flex;
flex-direction: column;
feat: enlarge admin thumbnails for hero, album, and subpage grids - Hero grid: 140px → 220px min tile width - Album grid: 160px → 240px min tile width - Subpage grid: 140px → 200px min tile width - Picker thumbnails: 40px → 52px - Admin main max-width: 960px → 1120px for more space - Slightly larger overlay buttons and index badges
2026-05-29 17:37:34 +02:00
gap: 0.15rem;
feat: redesign admin album cards as grid tiles with large cover images Replace the list-style album cards with a visual grid layout: - Albums shown as tiles with square cover images (aspect-ratio: 1) - Grid auto-fills with min 160px columns - Edit/remove buttons appear as overlay on hover - Album name and photo count shown below the cover - Much more compact — multiple albums visible without scrolling
2026-05-29 17:24:53 +02:00
}
.album-tile-name {
feat: enlarge admin thumbnails for hero, album, and subpage grids - Hero grid: 140px → 220px min tile width - Album grid: 160px → 240px min tile width - Subpage grid: 140px → 200px min tile width - Picker thumbnails: 40px → 52px - Admin main max-width: 960px → 1120px for more space - Slightly larger overlay buttons and index badges
2026-05-29 17:37:34 +02:00
font-size: 0.875rem;
feat: add visual admin panel with page builder and settings editor - Add /admin route with password-protected visual page builder - Page Builder: manage hero images, standalone albums, subpages, and sections - Album Picker: browse all shared Immich albums with search and filtering - Settings Editor: theme, grid, footer, legal, SEO configuration - YAML service with atomic writes and automatic backups (content/.backups/) - HMAC-signed admin sessions (24h expiry, HttpOnly cookies) - API endpoints: /api/admin/{auth,gallery,settings,albums,reload} - Enable with ADMIN_PASSWORD env var; disabled by default - invalidateConfigCache() export for hot-reload after saves
2026-05-29 17:04:37 +02:00
font-weight: 500;
white-space: nowrap;
overflow: hidden;
text-overflow: ellipsis;
}
feat: redesign admin album cards as grid tiles with large cover images Replace the list-style album cards with a visual grid layout: - Albums shown as tiles with square cover images (aspect-ratio: 1) - Grid auto-fills with min 160px columns - Edit/remove buttons appear as overlay on hover - Album name and photo count shown below the cover - Much more compact — multiple albums visible without scrolling
2026-05-29 17:24:53 +02:00
.album-tile-count {
feat: enlarge admin thumbnails for hero, album, and subpage grids - Hero grid: 140px → 220px min tile width - Album grid: 160px → 240px min tile width - Subpage grid: 140px → 200px min tile width - Picker thumbnails: 40px → 52px - Admin main max-width: 960px → 1120px for more space - Slightly larger overlay buttons and index badges
2026-05-29 17:37:34 +02:00
font-size: 0.75rem;
fix: admin panel light/dark theme support, improved contrast, and backup confirmation a) Admin panel now respects the site's light/dark theme toggle via CSS custom properties that respond to [data-theme='light'] on <html>. All hardcoded dark colors replaced with semantic CSS variables. b) Improved contrast in dark mode: secondary text changed from #666/#555 to #a0a0a0, muted text from #555 to #707070. All text is now clearly readable against dark backgrounds. c) Backup system was already implemented in yaml-service.ts (creates timestamped backups in content/.backups/ before each save, keeps last 10 versions). Now the UI shows a confirmation message that a backup was created after each successful save.
2026-05-29 17:20:56 +02:00
color: var(--admin-text-muted);
feat: add visual admin panel with page builder and settings editor - Add /admin route with password-protected visual page builder - Page Builder: manage hero images, standalone albums, subpages, and sections - Album Picker: browse all shared Immich albums with search and filtering - Settings Editor: theme, grid, footer, legal, SEO configuration - YAML service with atomic writes and automatic backups (content/.backups/) - HMAC-signed admin sessions (24h expiry, HttpOnly cookies) - API endpoints: /api/admin/{auth,gallery,settings,albums,reload} - Enable with ADMIN_PASSWORD env var; disabled by default - invalidateConfigCache() export for hot-reload after saves
2026-05-29 17:04:37 +02:00
}
feat: redesign admin album cards as grid tiles with large cover images Replace the list-style album cards with a visual grid layout: - Albums shown as tiles with square cover images (aspect-ratio: 1) - Grid auto-fills with min 160px columns - Edit/remove buttons appear as overlay on hover - Album name and photo count shown below the cover - Much more compact — multiple albums visible without scrolling
2026-05-29 17:24:53 +02:00
.album-tile-details {
feat: add visual admin panel with page builder and settings editor - Add /admin route with password-protected visual page builder - Page Builder: manage hero images, standalone albums, subpages, and sections - Album Picker: browse all shared Immich albums with search and filtering - Settings Editor: theme, grid, footer, legal, SEO configuration - YAML service with atomic writes and automatic backups (content/.backups/) - HMAC-signed admin sessions (24h expiry, HttpOnly cookies) - API endpoints: /api/admin/{auth,gallery,settings,albums,reload} - Enable with ADMIN_PASSWORD env var; disabled by default - invalidateConfigCache() export for hot-reload after saves
2026-05-29 17:04:37 +02:00
padding: 0.75rem;
fix: admin panel light/dark theme support, improved contrast, and backup confirmation a) Admin panel now respects the site's light/dark theme toggle via CSS custom properties that respond to [data-theme='light'] on <html>. All hardcoded dark colors replaced with semantic CSS variables. b) Improved contrast in dark mode: secondary text changed from #666/#555 to #a0a0a0, muted text from #555 to #707070. All text is now clearly readable against dark backgrounds. c) Backup system was already implemented in yaml-service.ts (creates timestamped backups in content/.backups/ before each save, keeps last 10 versions). Now the UI shows a confirmation message that a backup was created after each successful save.
2026-05-29 17:20:56 +02:00
border-top: 1px solid var(--admin-border);
background: var(--admin-bg);
feat: add visual admin panel with page builder and settings editor - Add /admin route with password-protected visual page builder - Page Builder: manage hero images, standalone albums, subpages, and sections - Album Picker: browse all shared Immich albums with search and filtering - Settings Editor: theme, grid, footer, legal, SEO configuration - YAML service with atomic writes and automatic backups (content/.backups/) - HMAC-signed admin sessions (24h expiry, HttpOnly cookies) - API endpoints: /api/admin/{auth,gallery,settings,albums,reload} - Enable with ADMIN_PASSWORD env var; disabled by default - invalidateConfigCache() export for hot-reload after saves
2026-05-29 17:04:37 +02:00
}
feat: per-album hero image – picker from album assets, fullbleed banner on detail page
2026-05-30 15:33:43 +02:00
/* Album Hero Field */
.album-hero-field {
display: flex;
align-items: center;
gap: 0.75rem;
flex-wrap: wrap;
}
.album-hero-preview {
position: relative;
width: 80px;
height: 54px;
border-radius: 6px;
overflow: hidden;
flex-shrink: 0;
border: 1px solid var(--admin-border);
}
.album-hero-preview img {
width: 100%;
height: 100%;
object-fit: cover;
display: block;
}
.album-hero-remove {
position: absolute;
top: 2px;
right: 2px;
width: 18px;
height: 18px;
border-radius: 50%;
background: rgba(0, 0, 0, 0.65);
color: #fff;
border: none;
cursor: pointer;
font-size: 0.75rem;
line-height: 1;
display: flex;
align-items: center;
justify-content: center;
padding: 0;
}
.album-hero-empty {
font-size: 0.8rem;
color: var(--admin-text-muted);
font-style: italic;
}
feat: redesign admin album cards as grid tiles with large cover images Replace the list-style album cards with a visual grid layout: - Albums shown as tiles with square cover images (aspect-ratio: 1) - Grid auto-fills with min 160px columns - Edit/remove buttons appear as overlay on hover - Album name and photo count shown below the cover - Much more compact — multiple albums visible without scrolling
2026-05-29 17:24:53 +02:00
.album-tile-uuid {
feat: add visual admin panel with page builder and settings editor - Add /admin route with password-protected visual page builder - Page Builder: manage hero images, standalone albums, subpages, and sections - Album Picker: browse all shared Immich albums with search and filtering - Settings Editor: theme, grid, footer, legal, SEO configuration - YAML service with atomic writes and automatic backups (content/.backups/) - HMAC-signed admin sessions (24h expiry, HttpOnly cookies) - API endpoints: /api/admin/{auth,gallery,settings,albums,reload} - Enable with ADMIN_PASSWORD env var; disabled by default - invalidateConfigCache() export for hot-reload after saves
2026-05-29 17:04:37 +02:00
margin-top: 0.5rem;
}
feat: redesign admin album cards as grid tiles with large cover images Replace the list-style album cards with a visual grid layout: - Albums shown as tiles with square cover images (aspect-ratio: 1) - Grid auto-fills with min 160px columns - Edit/remove buttons appear as overlay on hover - Album name and photo count shown below the cover - Much more compact — multiple albums visible without scrolling
2026-05-29 17:24:53 +02:00
.album-tile-uuid code {
feat: add visual admin panel with page builder and settings editor - Add /admin route with password-protected visual page builder - Page Builder: manage hero images, standalone albums, subpages, and sections - Album Picker: browse all shared Immich albums with search and filtering - Settings Editor: theme, grid, footer, legal, SEO configuration - YAML service with atomic writes and automatic backups (content/.backups/) - HMAC-signed admin sessions (24h expiry, HttpOnly cookies) - API endpoints: /api/admin/{auth,gallery,settings,albums,reload} - Enable with ADMIN_PASSWORD env var; disabled by default - invalidateConfigCache() export for hot-reload after saves
2026-05-29 17:04:37 +02:00
font-size: 0.7rem;
fix: admin panel light/dark theme support, improved contrast, and backup confirmation a) Admin panel now respects the site's light/dark theme toggle via CSS custom properties that respond to [data-theme='light'] on <html>. All hardcoded dark colors replaced with semantic CSS variables. b) Improved contrast in dark mode: secondary text changed from #666/#555 to #a0a0a0, muted text from #555 to #707070. All text is now clearly readable against dark backgrounds. c) Backup system was already implemented in yaml-service.ts (creates timestamped backups in content/.backups/ before each save, keeps last 10 versions). Now the UI shows a confirmation message that a backup was created after each successful save.
2026-05-29 17:20:56 +02:00
color: var(--admin-text-muted);
feat: add visual admin panel with page builder and settings editor - Add /admin route with password-protected visual page builder - Page Builder: manage hero images, standalone albums, subpages, and sections - Album Picker: browse all shared Immich albums with search and filtering - Settings Editor: theme, grid, footer, legal, SEO configuration - YAML service with atomic writes and automatic backups (content/.backups/) - HMAC-signed admin sessions (24h expiry, HttpOnly cookies) - API endpoints: /api/admin/{auth,gallery,settings,albums,reload} - Enable with ADMIN_PASSWORD env var; disabled by default - invalidateConfigCache() export for hot-reload after saves
2026-05-29 17:04:37 +02:00
word-break: break-all;
}
feat: redesign subpages as collapsible tile grid for better overview - Subpages shown as compact visual tiles in a grid (like folders) - Each tile shows the first album's cover image + name + album count - Click a tile to expand/edit that subpage's details below - Active tile highlighted with accent border - Only one subpage expanded at a time — no more endless scrolling - Move arrows changed to ← → (horizontal) matching the grid layout - Smooth slide-down animation when expanding a subpage
2026-05-29 17:29:26 +02:00
/* Subpage Overview Grid */
.subpage-grid {
display: grid;
feat: enlarge admin thumbnails for hero, album, and subpage grids - Hero grid: 140px → 220px min tile width - Album grid: 160px → 240px min tile width - Subpage grid: 140px → 200px min tile width - Picker thumbnails: 40px → 52px - Admin main max-width: 960px → 1120px for more space - Slightly larger overlay buttons and index badges
2026-05-29 17:37:34 +02:00
grid-template-columns: repeat(auto-fill, minmax(200px, 1fr));
gap: 0.75rem;
feat: redesign subpages as collapsible tile grid for better overview - Subpages shown as compact visual tiles in a grid (like folders) - Each tile shows the first album's cover image + name + album count - Click a tile to expand/edit that subpage's details below - Active tile highlighted with accent border - Only one subpage expanded at a time — no more endless scrolling - Move arrows changed to ← → (horizontal) matching the grid layout - Smooth slide-down animation when expanding a subpage
2026-05-29 17:29:26 +02:00
margin-bottom: 1rem;
}
.subpage-tile {
security: add Trivy container scan to Docker publish workflow (#399) * feat(admin): add backup manager UI with 1-click restore * feat(admin): collapse older backup entries by default * fix(theme): isolate admin layout, instant DOM theme updates, and add Light/Dark mode toggle * feat(admin): replace text controls for Photo Frame and Hero Style with visual preview cards * fix(admin): define missing CSS rules for button system (.btn, .preset-btn) * feat(admin): redesign theme settings with segmented mode toggle, accent color swatches, and custom iOS-style toggle cards * feat(admin): upgrade all settings tabs with visual grid previews, Google SEO snippet preview, and toggle cards * feat(admin): overhaul Pages Builder UX with slide-over drawer, card hover badges, real-time search, and floating save bar * fix(admin): remove leftover dangling syntax snippet in PageBuilder.tsx * fix(admin): add position: relative to subpage-tile so hover overlay is contained inside the tile * style(admin): replace all emojis with clean Leica-style vector SVG icons * fix(types): extend IconProps with SVGProps to allow style prop on Leica SVG icons * feat(admin): add subpage live-preview, privacy analytics, and asset protection settings * fix(typecheck): fix AlbumEntry property access in subpage drawer preview mode * fix(types): fix ImmichAlbumInfo property names thumbnailAssetId and albumName in PageBuilder.tsx * fix(types): add protection and watermark optional properties to AppConfig interface * feat(settings): add toggle for disabling analytics tracking (defaults to enabled) * feat(ux): show status banner when analytics tracking is disabled + add live sync indicator * feat(watermark): render customizable watermark overlay on Lightbox images + rename section to Portfolio Features & Modules * fix(types): import type LightboxWatermark in PhotoGrid.tsx * fix(types): destructure watermark prop in PhotoGrid function signature * feat(seo): add configurable subpage title template and metadata descriptions * feat(seo): add generateMetadata to about page for title template support * feat(proofing): add client proofing, favorites selection, compact URL bitmasking, and export modal * feat(essay): add Photo Essay storytelling mode with RSC markdown parser and fullbleed/pair layouts * feat(subpages): add page enabled toggle to deactivate subpages without deleting them * feat(admin): add visual essay block builder for photo essay storytelling pages * security: add Trivy container scan to Docker publish workflow Scans the built image for CRITICAL/HIGH CVEs on every release and uploads results to the GitHub Security tab. Non-blocking for now (exit-code 0) so releases aren't gated on findings. Also documents the scan and existing Dependabot coverage in the README. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-08-07 11:08:04 +02:00
position: relative;
feat: redesign subpages as collapsible tile grid for better overview - Subpages shown as compact visual tiles in a grid (like folders) - Each tile shows the first album's cover image + name + album count - Click a tile to expand/edit that subpage's details below - Active tile highlighted with accent border - Only one subpage expanded at a time — no more endless scrolling - Move arrows changed to ← → (horizontal) matching the grid layout - Smooth slide-down animation when expanding a subpage
2026-05-29 17:29:26 +02:00
background: var(--admin-bg-raised);
border: 1px solid var(--admin-border);
border-radius: 10px;
overflow: hidden;
cursor: pointer;
chore(release): v0.10.0 (#400) Photo Essay mode, client proofing, studio-modern preset, admin panel overhaul, watermark, cookieless analytics, subpage toggle, SEO title templates. Analytics API now admin-only, Trivy scan on publish. Album order mirrors the Immich timeline; map theme, admin status panel, lightbox counter and Docker health check fixed. See CHANGELOG.md for the full list and the health-check upgrade note.
2026-08-10 09:56:20 +02:00
transition:
border-color 0.15s,
box-shadow 0.15s,
transform 0.1s;
feat: redesign subpages as collapsible tile grid for better overview - Subpages shown as compact visual tiles in a grid (like folders) - Each tile shows the first album's cover image + name + album count - Click a tile to expand/edit that subpage's details below - Active tile highlighted with accent border - Only one subpage expanded at a time — no more endless scrolling - Move arrows changed to ← → (horizontal) matching the grid layout - Smooth slide-down animation when expanding a subpage
2026-05-29 17:29:26 +02:00
}
.subpage-tile:hover {
border-color: var(--admin-border-hover);
box-shadow: 0 2px 8px rgba(0, 0, 0, 0.12);
}
.subpage-tile.active {
border-color: var(--admin-accent);
box-shadow: 0 0 0 1px var(--admin-accent);
}
.subpage-tile-cover {
security: add Trivy container scan to Docker publish workflow (#399) * feat(admin): add backup manager UI with 1-click restore * feat(admin): collapse older backup entries by default * fix(theme): isolate admin layout, instant DOM theme updates, and add Light/Dark mode toggle * feat(admin): replace text controls for Photo Frame and Hero Style with visual preview cards * fix(admin): define missing CSS rules for button system (.btn, .preset-btn) * feat(admin): redesign theme settings with segmented mode toggle, accent color swatches, and custom iOS-style toggle cards * feat(admin): upgrade all settings tabs with visual grid previews, Google SEO snippet preview, and toggle cards * feat(admin): overhaul Pages Builder UX with slide-over drawer, card hover badges, real-time search, and floating save bar * fix(admin): remove leftover dangling syntax snippet in PageBuilder.tsx * fix(admin): add position: relative to subpage-tile so hover overlay is contained inside the tile * style(admin): replace all emojis with clean Leica-style vector SVG icons * fix(types): extend IconProps with SVGProps to allow style prop on Leica SVG icons * feat(admin): add subpage live-preview, privacy analytics, and asset protection settings * fix(typecheck): fix AlbumEntry property access in subpage drawer preview mode * fix(types): fix ImmichAlbumInfo property names thumbnailAssetId and albumName in PageBuilder.tsx * fix(types): add protection and watermark optional properties to AppConfig interface * feat(settings): add toggle for disabling analytics tracking (defaults to enabled) * feat(ux): show status banner when analytics tracking is disabled + add live sync indicator * feat(watermark): render customizable watermark overlay on Lightbox images + rename section to Portfolio Features & Modules * fix(types): import type LightboxWatermark in PhotoGrid.tsx * fix(types): destructure watermark prop in PhotoGrid function signature * feat(seo): add configurable subpage title template and metadata descriptions * feat(seo): add generateMetadata to about page for title template support * feat(proofing): add client proofing, favorites selection, compact URL bitmasking, and export modal * feat(essay): add Photo Essay storytelling mode with RSC markdown parser and fullbleed/pair layouts * feat(subpages): add page enabled toggle to deactivate subpages without deleting them * feat(admin): add visual essay block builder for photo essay storytelling pages * security: add Trivy container scan to Docker publish workflow Scans the built image for CRITICAL/HIGH CVEs on every release and uploads results to the GitHub Security tab. Non-blocking for now (exit-code 0) so releases aren't gated on findings. Also documents the scan and existing Dependabot coverage in the README. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-08-07 11:08:04 +02:00
position: relative;
feat: redesign subpages as collapsible tile grid for better overview - Subpages shown as compact visual tiles in a grid (like folders) - Each tile shows the first album's cover image + name + album count - Click a tile to expand/edit that subpage's details below - Active tile highlighted with accent border - Only one subpage expanded at a time — no more endless scrolling - Move arrows changed to ← → (horizontal) matching the grid layout - Smooth slide-down animation when expanding a subpage
2026-05-29 17:29:26 +02:00
aspect-ratio: 16 / 10;
background: var(--admin-bg-elevated);
overflow: hidden;
}
.subpage-tile-cover img {
width: 100%;
height: 100%;
object-fit: cover;
}
.subpage-tile-placeholder {
width: 100%;
height: 100%;
display: flex;
align-items: center;
justify-content: center;
font-size: 1.5rem;
}
.subpage-tile-info {
padding: 0.4rem 0.6rem;
display: flex;
flex-direction: column;
gap: 0.05rem;
}
.subpage-tile-name {
font-size: 0.78rem;
font-weight: 600;
white-space: nowrap;
overflow: hidden;
text-overflow: ellipsis;
}
.subpage-tile-meta {
font-size: 0.65rem;
color: var(--admin-text-muted);
}
/* Subpage Expanded Detail */
.subpage-detail {
fix: admin panel light/dark theme support, improved contrast, and backup confirmation a) Admin panel now respects the site's light/dark theme toggle via CSS custom properties that respond to [data-theme='light'] on <html>. All hardcoded dark colors replaced with semantic CSS variables. b) Improved contrast in dark mode: secondary text changed from #666/#555 to #a0a0a0, muted text from #555 to #707070. All text is now clearly readable against dark backgrounds. c) Backup system was already implemented in yaml-service.ts (creates timestamped backups in content/.backups/ before each save, keeps last 10 versions). Now the UI shows a confirmation message that a backup was created after each successful save.
2026-05-29 17:20:56 +02:00
background: var(--admin-bg);
border: 1px solid var(--admin-border);
feat: add visual admin panel with page builder and settings editor - Add /admin route with password-protected visual page builder - Page Builder: manage hero images, standalone albums, subpages, and sections - Album Picker: browse all shared Immich albums with search and filtering - Settings Editor: theme, grid, footer, legal, SEO configuration - YAML service with atomic writes and automatic backups (content/.backups/) - HMAC-signed admin sessions (24h expiry, HttpOnly cookies) - API endpoints: /api/admin/{auth,gallery,settings,albums,reload} - Enable with ADMIN_PASSWORD env var; disabled by default - invalidateConfigCache() export for hot-reload after saves
2026-05-29 17:04:37 +02:00
border-radius: 10px;
overflow: hidden;
feat: redesign subpages as collapsible tile grid for better overview - Subpages shown as compact visual tiles in a grid (like folders) - Each tile shows the first album's cover image + name + album count - Click a tile to expand/edit that subpage's details below - Active tile highlighted with accent border - Only one subpage expanded at a time — no more endless scrolling - Move arrows changed to ← → (horizontal) matching the grid layout - Smooth slide-down animation when expanding a subpage
2026-05-29 17:29:26 +02:00
animation: slideDown 0.15s ease-out;
}
@keyframes slideDown {
chore(release): v0.10.0 (#400) Photo Essay mode, client proofing, studio-modern preset, admin panel overhaul, watermark, cookieless analytics, subpage toggle, SEO title templates. Analytics API now admin-only, Trivy scan on publish. Album order mirrors the Immich timeline; map theme, admin status panel, lightbox counter and Docker health check fixed. See CHANGELOG.md for the full list and the health-check upgrade note.
2026-08-10 09:56:20 +02:00
from {
opacity: 0;
transform: translateY(-4px);
}
to {
opacity: 1;
transform: translateY(0);
}
feat: add visual admin panel with page builder and settings editor - Add /admin route with password-protected visual page builder - Page Builder: manage hero images, standalone albums, subpages, and sections - Album Picker: browse all shared Immich albums with search and filtering - Settings Editor: theme, grid, footer, legal, SEO configuration - YAML service with atomic writes and automatic backups (content/.backups/) - HMAC-signed admin sessions (24h expiry, HttpOnly cookies) - API endpoints: /api/admin/{auth,gallery,settings,albums,reload} - Enable with ADMIN_PASSWORD env var; disabled by default - invalidateConfigCache() export for hot-reload after saves
2026-05-29 17:04:37 +02:00
}
feat: redesign subpages as collapsible tile grid for better overview - Subpages shown as compact visual tiles in a grid (like folders) - Each tile shows the first album's cover image + name + album count - Click a tile to expand/edit that subpage's details below - Active tile highlighted with accent border - Only one subpage expanded at a time — no more endless scrolling - Move arrows changed to ← → (horizontal) matching the grid layout - Smooth slide-down animation when expanding a subpage
2026-05-29 17:29:26 +02:00
.subpage-detail-header {
feat: add visual admin panel with page builder and settings editor - Add /admin route with password-protected visual page builder - Page Builder: manage hero images, standalone albums, subpages, and sections - Album Picker: browse all shared Immich albums with search and filtering - Settings Editor: theme, grid, footer, legal, SEO configuration - YAML service with atomic writes and automatic backups (content/.backups/) - HMAC-signed admin sessions (24h expiry, HttpOnly cookies) - API endpoints: /api/admin/{auth,gallery,settings,albums,reload} - Enable with ADMIN_PASSWORD env var; disabled by default - invalidateConfigCache() export for hot-reload after saves
2026-05-29 17:04:37 +02:00
display: flex;
align-items: center;
justify-content: space-between;
padding: 0.75rem 1rem;
fix: admin panel light/dark theme support, improved contrast, and backup confirmation a) Admin panel now respects the site's light/dark theme toggle via CSS custom properties that respond to [data-theme='light'] on <html>. All hardcoded dark colors replaced with semantic CSS variables. b) Improved contrast in dark mode: secondary text changed from #666/#555 to #a0a0a0, muted text from #555 to #707070. All text is now clearly readable against dark backgrounds. c) Backup system was already implemented in yaml-service.ts (creates timestamped backups in content/.backups/ before each save, keeps last 10 versions). Now the UI shows a confirmation message that a backup was created after each successful save.
2026-05-29 17:20:56 +02:00
background: var(--admin-bg-raised);
border-bottom: 1px solid var(--admin-border);
feat: add visual admin panel with page builder and settings editor - Add /admin route with password-protected visual page builder - Page Builder: manage hero images, standalone albums, subpages, and sections - Album Picker: browse all shared Immich albums with search and filtering - Settings Editor: theme, grid, footer, legal, SEO configuration - YAML service with atomic writes and automatic backups (content/.backups/) - HMAC-signed admin sessions (24h expiry, HttpOnly cookies) - API endpoints: /api/admin/{auth,gallery,settings,albums,reload} - Enable with ADMIN_PASSWORD env var; disabled by default - invalidateConfigCache() export for hot-reload after saves
2026-05-29 17:04:37 +02:00
}
feat: redesign subpages as collapsible tile grid for better overview - Subpages shown as compact visual tiles in a grid (like folders) - Each tile shows the first album's cover image + name + album count - Click a tile to expand/edit that subpage's details below - Active tile highlighted with accent border - Only one subpage expanded at a time — no more endless scrolling - Move arrows changed to ← → (horizontal) matching the grid layout - Smooth slide-down animation when expanding a subpage
2026-05-29 17:29:26 +02:00
.subpage-detail-header-left {
feat: add visual admin panel with page builder and settings editor - Add /admin route with password-protected visual page builder - Page Builder: manage hero images, standalone albums, subpages, and sections - Album Picker: browse all shared Immich albums with search and filtering - Settings Editor: theme, grid, footer, legal, SEO configuration - YAML service with atomic writes and automatic backups (content/.backups/) - HMAC-signed admin sessions (24h expiry, HttpOnly cookies) - API endpoints: /api/admin/{auth,gallery,settings,albums,reload} - Enable with ADMIN_PASSWORD env var; disabled by default - invalidateConfigCache() export for hot-reload after saves
2026-05-29 17:04:37 +02:00
display: flex;
align-items: center;
gap: 0.5rem;
flex: 1;
min-width: 0;
}
feat: redesign subpages as collapsible tile grid for better overview - Subpages shown as compact visual tiles in a grid (like folders) - Each tile shows the first album's cover image + name + album count - Click a tile to expand/edit that subpage's details below - Active tile highlighted with accent border - Only one subpage expanded at a time — no more endless scrolling - Move arrows changed to ← → (horizontal) matching the grid layout - Smooth slide-down animation when expanding a subpage
2026-05-29 17:29:26 +02:00
.subpage-detail-header-right {
display: flex;
align-items: center;
gap: 0.25rem;
}
feat: add visual admin panel with page builder and settings editor - Add /admin route with password-protected visual page builder - Page Builder: manage hero images, standalone albums, subpages, and sections - Album Picker: browse all shared Immich albums with search and filtering - Settings Editor: theme, grid, footer, legal, SEO configuration - YAML service with atomic writes and automatic backups (content/.backups/) - HMAC-signed admin sessions (24h expiry, HttpOnly cookies) - API endpoints: /api/admin/{auth,gallery,settings,albums,reload} - Enable with ADMIN_PASSWORD env var; disabled by default - invalidateConfigCache() export for hot-reload after saves
2026-05-29 17:04:37 +02:00
.subpage-move-btns {
display: flex;
gap: 0;
}
.subpage-move-btns .admin-btn-icon {
font-size: 0.75rem;
padding: 0.1rem 0.3rem;
}
.subpage-name-input {
flex: 1;
background: transparent;
border: 1px solid transparent;
fix: admin panel light/dark theme support, improved contrast, and backup confirmation a) Admin panel now respects the site's light/dark theme toggle via CSS custom properties that respond to [data-theme='light'] on <html>. All hardcoded dark colors replaced with semantic CSS variables. b) Improved contrast in dark mode: secondary text changed from #666/#555 to #a0a0a0, muted text from #555 to #707070. All text is now clearly readable against dark backgrounds. c) Backup system was already implemented in yaml-service.ts (creates timestamped backups in content/.backups/ before each save, keeps last 10 versions). Now the UI shows a confirmation message that a backup was created after each successful save.
2026-05-29 17:20:56 +02:00
color: var(--admin-text);
feat: add visual admin panel with page builder and settings editor - Add /admin route with password-protected visual page builder - Page Builder: manage hero images, standalone albums, subpages, and sections - Album Picker: browse all shared Immich albums with search and filtering - Settings Editor: theme, grid, footer, legal, SEO configuration - YAML service with atomic writes and automatic backups (content/.backups/) - HMAC-signed admin sessions (24h expiry, HttpOnly cookies) - API endpoints: /api/admin/{auth,gallery,settings,albums,reload} - Enable with ADMIN_PASSWORD env var; disabled by default - invalidateConfigCache() export for hot-reload after saves
2026-05-29 17:04:37 +02:00
font-size: 0.95rem;
font-weight: 600;
padding: 0.3rem 0.5rem;
border-radius: 4px;
transition: border-color 0.15s;
}
.subpage-name-input:hover {
fix: admin panel light/dark theme support, improved contrast, and backup confirmation a) Admin panel now respects the site's light/dark theme toggle via CSS custom properties that respond to [data-theme='light'] on <html>. All hardcoded dark colors replaced with semantic CSS variables. b) Improved contrast in dark mode: secondary text changed from #666/#555 to #a0a0a0, muted text from #555 to #707070. All text is now clearly readable against dark backgrounds. c) Backup system was already implemented in yaml-service.ts (creates timestamped backups in content/.backups/ before each save, keeps last 10 versions). Now the UI shows a confirmation message that a backup was created after each successful save.
2026-05-29 17:20:56 +02:00
border-color: var(--admin-border);
feat: add visual admin panel with page builder and settings editor - Add /admin route with password-protected visual page builder - Page Builder: manage hero images, standalone albums, subpages, and sections - Album Picker: browse all shared Immich albums with search and filtering - Settings Editor: theme, grid, footer, legal, SEO configuration - YAML service with atomic writes and automatic backups (content/.backups/) - HMAC-signed admin sessions (24h expiry, HttpOnly cookies) - API endpoints: /api/admin/{auth,gallery,settings,albums,reload} - Enable with ADMIN_PASSWORD env var; disabled by default - invalidateConfigCache() export for hot-reload after saves
2026-05-29 17:04:37 +02:00
}
.subpage-name-input:focus {
outline: none;
fix: admin panel light/dark theme support, improved contrast, and backup confirmation a) Admin panel now respects the site's light/dark theme toggle via CSS custom properties that respond to [data-theme='light'] on <html>. All hardcoded dark colors replaced with semantic CSS variables. b) Improved contrast in dark mode: secondary text changed from #666/#555 to #a0a0a0, muted text from #555 to #707070. All text is now clearly readable against dark backgrounds. c) Backup system was already implemented in yaml-service.ts (creates timestamped backups in content/.backups/ before each save, keeps last 10 versions). Now the UI shows a confirmation message that a backup was created after each successful save.
2026-05-29 17:20:56 +02:00
border-color: var(--admin-border-focus);
background: var(--admin-bg-input);
feat: add visual admin panel with page builder and settings editor - Add /admin route with password-protected visual page builder - Page Builder: manage hero images, standalone albums, subpages, and sections - Album Picker: browse all shared Immich albums with search and filtering - Settings Editor: theme, grid, footer, legal, SEO configuration - YAML service with atomic writes and automatic backups (content/.backups/) - HMAC-signed admin sessions (24h expiry, HttpOnly cookies) - API endpoints: /api/admin/{auth,gallery,settings,albums,reload} - Enable with ADMIN_PASSWORD env var; disabled by default - invalidateConfigCache() export for hot-reload after saves
2026-05-29 17:04:37 +02:00
}
.subpage-meta {
padding: 0.75rem 1rem;
fix: admin panel light/dark theme support, improved contrast, and backup confirmation a) Admin panel now respects the site's light/dark theme toggle via CSS custom properties that respond to [data-theme='light'] on <html>. All hardcoded dark colors replaced with semantic CSS variables. b) Improved contrast in dark mode: secondary text changed from #666/#555 to #a0a0a0, muted text from #555 to #707070. All text is now clearly readable against dark backgrounds. c) Backup system was already implemented in yaml-service.ts (creates timestamped backups in content/.backups/ before each save, keeps last 10 versions). Now the UI shows a confirmation message that a backup was created after each successful save.
2026-05-29 17:20:56 +02:00
border-bottom: 1px solid var(--admin-border);
feat: add visual admin panel with page builder and settings editor - Add /admin route with password-protected visual page builder - Page Builder: manage hero images, standalone albums, subpages, and sections - Album Picker: browse all shared Immich albums with search and filtering - Settings Editor: theme, grid, footer, legal, SEO configuration - YAML service with atomic writes and automatic backups (content/.backups/) - HMAC-signed admin sessions (24h expiry, HttpOnly cookies) - API endpoints: /api/admin/{auth,gallery,settings,albums,reload} - Enable with ADMIN_PASSWORD env var; disabled by default - invalidateConfigCache() export for hot-reload after saves
2026-05-29 17:04:37 +02:00
}
.subpage-albums {
padding: 0.75rem 1rem;
}
.subpage-albums-header {
display: flex;
align-items: center;
justify-content: space-between;
margin-bottom: 0.5rem;
font-size: 0.75rem;
fix: admin panel light/dark theme support, improved contrast, and backup confirmation a) Admin panel now respects the site's light/dark theme toggle via CSS custom properties that respond to [data-theme='light'] on <html>. All hardcoded dark colors replaced with semantic CSS variables. b) Improved contrast in dark mode: secondary text changed from #666/#555 to #a0a0a0, muted text from #555 to #707070. All text is now clearly readable against dark backgrounds. c) Backup system was already implemented in yaml-service.ts (creates timestamped backups in content/.backups/ before each save, keeps last 10 versions). Now the UI shows a confirmation message that a backup was created after each successful save.
2026-05-29 17:20:56 +02:00
color: var(--admin-text-muted);
feat: add visual admin panel with page builder and settings editor - Add /admin route with password-protected visual page builder - Page Builder: manage hero images, standalone albums, subpages, and sections - Album Picker: browse all shared Immich albums with search and filtering - Settings Editor: theme, grid, footer, legal, SEO configuration - YAML service with atomic writes and automatic backups (content/.backups/) - HMAC-signed admin sessions (24h expiry, HttpOnly cookies) - API endpoints: /api/admin/{auth,gallery,settings,albums,reload} - Enable with ADMIN_PASSWORD env var; disabled by default - invalidateConfigCache() export for hot-reload after saves
2026-05-29 17:04:37 +02:00
text-transform: uppercase;
letter-spacing: 0.05em;
}
.subpage-sections {
padding: 0 1rem 0.5rem;
}
.subpage-actions {
display: flex;
gap: 0.5rem;
padding: 0.75rem 1rem;
fix: admin panel light/dark theme support, improved contrast, and backup confirmation a) Admin panel now respects the site's light/dark theme toggle via CSS custom properties that respond to [data-theme='light'] on <html>. All hardcoded dark colors replaced with semantic CSS variables. b) Improved contrast in dark mode: secondary text changed from #666/#555 to #a0a0a0, muted text from #555 to #707070. All text is now clearly readable against dark backgrounds. c) Backup system was already implemented in yaml-service.ts (creates timestamped backups in content/.backups/ before each save, keeps last 10 versions). Now the UI shows a confirmation message that a backup was created after each successful save.
2026-05-29 17:20:56 +02:00
border-top: 1px solid var(--admin-border);
feat: add visual admin panel with page builder and settings editor - Add /admin route with password-protected visual page builder - Page Builder: manage hero images, standalone albums, subpages, and sections - Album Picker: browse all shared Immich albums with search and filtering - Settings Editor: theme, grid, footer, legal, SEO configuration - YAML service with atomic writes and automatic backups (content/.backups/) - HMAC-signed admin sessions (24h expiry, HttpOnly cookies) - API endpoints: /api/admin/{auth,gallery,settings,albums,reload} - Enable with ADMIN_PASSWORD env var; disabled by default - invalidateConfigCache() export for hot-reload after saves
2026-05-29 17:04:37 +02:00
}
/* Section Card */
.section-card {
fix: admin panel light/dark theme support, improved contrast, and backup confirmation a) Admin panel now respects the site's light/dark theme toggle via CSS custom properties that respond to [data-theme='light'] on <html>. All hardcoded dark colors replaced with semantic CSS variables. b) Improved contrast in dark mode: secondary text changed from #666/#555 to #a0a0a0, muted text from #555 to #707070. All text is now clearly readable against dark backgrounds. c) Backup system was already implemented in yaml-service.ts (creates timestamped backups in content/.backups/ before each save, keeps last 10 versions). Now the UI shows a confirmation message that a backup was created after each successful save.
2026-05-29 17:20:56 +02:00
background: var(--admin-bg-input);
border: 1px solid var(--admin-border);
feat: add visual admin panel with page builder and settings editor - Add /admin route with password-protected visual page builder - Page Builder: manage hero images, standalone albums, subpages, and sections - Album Picker: browse all shared Immich albums with search and filtering - Settings Editor: theme, grid, footer, legal, SEO configuration - YAML service with atomic writes and automatic backups (content/.backups/) - HMAC-signed admin sessions (24h expiry, HttpOnly cookies) - API endpoints: /api/admin/{auth,gallery,settings,albums,reload} - Enable with ADMIN_PASSWORD env var; disabled by default - invalidateConfigCache() export for hot-reload after saves
2026-05-29 17:04:37 +02:00
border-radius: 8px;
padding: 0.75rem;
margin-bottom: 0.5rem;
}
.section-header {
display: flex;
align-items: center;
justify-content: space-between;
margin-bottom: 0.5rem;
}
.section-title-input {
flex: 1;
background: transparent;
border: 1px solid transparent;
fix: admin panel light/dark theme support, improved contrast, and backup confirmation a) Admin panel now respects the site's light/dark theme toggle via CSS custom properties that respond to [data-theme='light'] on <html>. All hardcoded dark colors replaced with semantic CSS variables. b) Improved contrast in dark mode: secondary text changed from #666/#555 to #a0a0a0, muted text from #555 to #707070. All text is now clearly readable against dark backgrounds. c) Backup system was already implemented in yaml-service.ts (creates timestamped backups in content/.backups/ before each save, keeps last 10 versions). Now the UI shows a confirmation message that a backup was created after each successful save.
2026-05-29 17:20:56 +02:00
color: var(--admin-text);
feat: add visual admin panel with page builder and settings editor - Add /admin route with password-protected visual page builder - Page Builder: manage hero images, standalone albums, subpages, and sections - Album Picker: browse all shared Immich albums with search and filtering - Settings Editor: theme, grid, footer, legal, SEO configuration - YAML service with atomic writes and automatic backups (content/.backups/) - HMAC-signed admin sessions (24h expiry, HttpOnly cookies) - API endpoints: /api/admin/{auth,gallery,settings,albums,reload} - Enable with ADMIN_PASSWORD env var; disabled by default - invalidateConfigCache() export for hot-reload after saves
2026-05-29 17:04:37 +02:00
font-size: 0.85rem;
font-weight: 500;
padding: 0.2rem 0.4rem;
border-radius: 4px;
}
.section-title-input:focus {
outline: none;
fix: admin panel light/dark theme support, improved contrast, and backup confirmation a) Admin panel now respects the site's light/dark theme toggle via CSS custom properties that respond to [data-theme='light'] on <html>. All hardcoded dark colors replaced with semantic CSS variables. b) Improved contrast in dark mode: secondary text changed from #666/#555 to #a0a0a0, muted text from #555 to #707070. All text is now clearly readable against dark backgrounds. c) Backup system was already implemented in yaml-service.ts (creates timestamped backups in content/.backups/ before each save, keeps last 10 versions). Now the UI shows a confirmation message that a backup was created after each successful save.
2026-05-29 17:20:56 +02:00
border-color: var(--admin-border-hover);
background: var(--admin-bg);
feat: add visual admin panel with page builder and settings editor - Add /admin route with password-protected visual page builder - Page Builder: manage hero images, standalone albums, subpages, and sections - Album Picker: browse all shared Immich albums with search and filtering - Settings Editor: theme, grid, footer, legal, SEO configuration - YAML service with atomic writes and automatic backups (content/.backups/) - HMAC-signed admin sessions (24h expiry, HttpOnly cookies) - API endpoints: /api/admin/{auth,gallery,settings,albums,reload} - Enable with ADMIN_PASSWORD env var; disabled by default - invalidateConfigCache() export for hot-reload after saves
2026-05-29 17:04:37 +02:00
}
.section-desc-input {
font-size: 0.8rem !important;
padding: 0.4rem 0.5rem !important;
}
/* ── Album Picker ──────────────────────────────────────────── */
.picker-overlay {
position: fixed;
inset: 0;
z-index: 1000;
fix: admin panel light/dark theme support, improved contrast, and backup confirmation a) Admin panel now respects the site's light/dark theme toggle via CSS custom properties that respond to [data-theme='light'] on <html>. All hardcoded dark colors replaced with semantic CSS variables. b) Improved contrast in dark mode: secondary text changed from #666/#555 to #a0a0a0, muted text from #555 to #707070. All text is now clearly readable against dark backgrounds. c) Backup system was already implemented in yaml-service.ts (creates timestamped backups in content/.backups/ before each save, keeps last 10 versions). Now the UI shows a confirmation message that a backup was created after each successful save.
2026-05-29 17:20:56 +02:00
background: var(--admin-overlay);
feat: add visual admin panel with page builder and settings editor - Add /admin route with password-protected visual page builder - Page Builder: manage hero images, standalone albums, subpages, and sections - Album Picker: browse all shared Immich albums with search and filtering - Settings Editor: theme, grid, footer, legal, SEO configuration - YAML service with atomic writes and automatic backups (content/.backups/) - HMAC-signed admin sessions (24h expiry, HttpOnly cookies) - API endpoints: /api/admin/{auth,gallery,settings,albums,reload} - Enable with ADMIN_PASSWORD env var; disabled by default - invalidateConfigCache() export for hot-reload after saves
2026-05-29 17:04:37 +02:00
display: flex;
align-items: center;
justify-content: center;
padding: 2rem;
backdrop-filter: blur(4px);
}
.picker-modal {
width: 100%;
max-width: 560px;
max-height: 80vh;
fix: admin panel light/dark theme support, improved contrast, and backup confirmation a) Admin panel now respects the site's light/dark theme toggle via CSS custom properties that respond to [data-theme='light'] on <html>. All hardcoded dark colors replaced with semantic CSS variables. b) Improved contrast in dark mode: secondary text changed from #666/#555 to #a0a0a0, muted text from #555 to #707070. All text is now clearly readable against dark backgrounds. c) Backup system was already implemented in yaml-service.ts (creates timestamped backups in content/.backups/ before each save, keeps last 10 versions). Now the UI shows a confirmation message that a backup was created after each successful save.
2026-05-29 17:20:56 +02:00
background: var(--admin-bg-raised);
border: 1px solid var(--admin-border);
feat: add visual admin panel with page builder and settings editor - Add /admin route with password-protected visual page builder - Page Builder: manage hero images, standalone albums, subpages, and sections - Album Picker: browse all shared Immich albums with search and filtering - Settings Editor: theme, grid, footer, legal, SEO configuration - YAML service with atomic writes and automatic backups (content/.backups/) - HMAC-signed admin sessions (24h expiry, HttpOnly cookies) - API endpoints: /api/admin/{auth,gallery,settings,albums,reload} - Enable with ADMIN_PASSWORD env var; disabled by default - invalidateConfigCache() export for hot-reload after saves
2026-05-29 17:04:37 +02:00
border-radius: 12px;
display: flex;
flex-direction: column;
overflow: hidden;
}
.picker-header {
display: flex;
align-items: center;
justify-content: space-between;
padding: 1rem 1.25rem;
fix: admin panel light/dark theme support, improved contrast, and backup confirmation a) Admin panel now respects the site's light/dark theme toggle via CSS custom properties that respond to [data-theme='light'] on <html>. All hardcoded dark colors replaced with semantic CSS variables. b) Improved contrast in dark mode: secondary text changed from #666/#555 to #a0a0a0, muted text from #555 to #707070. All text is now clearly readable against dark backgrounds. c) Backup system was already implemented in yaml-service.ts (creates timestamped backups in content/.backups/ before each save, keeps last 10 versions). Now the UI shows a confirmation message that a backup was created after each successful save.
2026-05-29 17:20:56 +02:00
border-bottom: 1px solid var(--admin-border);
feat: add visual admin panel with page builder and settings editor - Add /admin route with password-protected visual page builder - Page Builder: manage hero images, standalone albums, subpages, and sections - Album Picker: browse all shared Immich albums with search and filtering - Settings Editor: theme, grid, footer, legal, SEO configuration - YAML service with atomic writes and automatic backups (content/.backups/) - HMAC-signed admin sessions (24h expiry, HttpOnly cookies) - API endpoints: /api/admin/{auth,gallery,settings,albums,reload} - Enable with ADMIN_PASSWORD env var; disabled by default - invalidateConfigCache() export for hot-reload after saves
2026-05-29 17:04:37 +02:00
}
.picker-header h3 {
font-size: 1rem;
font-weight: 600;
margin: 0;
}
.picker-search {
padding: 0.75rem 1.25rem;
fix: admin panel light/dark theme support, improved contrast, and backup confirmation a) Admin panel now respects the site's light/dark theme toggle via CSS custom properties that respond to [data-theme='light'] on <html>. All hardcoded dark colors replaced with semantic CSS variables. b) Improved contrast in dark mode: secondary text changed from #666/#555 to #a0a0a0, muted text from #555 to #707070. All text is now clearly readable against dark backgrounds. c) Backup system was already implemented in yaml-service.ts (creates timestamped backups in content/.backups/ before each save, keeps last 10 versions). Now the UI shows a confirmation message that a backup was created after each successful save.
2026-05-29 17:20:56 +02:00
border-bottom: 1px solid var(--admin-border);
feat: add visual admin panel with page builder and settings editor - Add /admin route with password-protected visual page builder - Page Builder: manage hero images, standalone albums, subpages, and sections - Album Picker: browse all shared Immich albums with search and filtering - Settings Editor: theme, grid, footer, legal, SEO configuration - YAML service with atomic writes and automatic backups (content/.backups/) - HMAC-signed admin sessions (24h expiry, HttpOnly cookies) - API endpoints: /api/admin/{auth,gallery,settings,albums,reload} - Enable with ADMIN_PASSWORD env var; disabled by default - invalidateConfigCache() export for hot-reload after saves
2026-05-29 17:04:37 +02:00
}
.picker-search input {
width: 100%;
padding: 0.6rem 0.75rem;
fix: admin panel light/dark theme support, improved contrast, and backup confirmation a) Admin panel now respects the site's light/dark theme toggle via CSS custom properties that respond to [data-theme='light'] on <html>. All hardcoded dark colors replaced with semantic CSS variables. b) Improved contrast in dark mode: secondary text changed from #666/#555 to #a0a0a0, muted text from #555 to #707070. All text is now clearly readable against dark backgrounds. c) Backup system was already implemented in yaml-service.ts (creates timestamped backups in content/.backups/ before each save, keeps last 10 versions). Now the UI shows a confirmation message that a backup was created after each successful save.
2026-05-29 17:20:56 +02:00
background: var(--admin-bg-input);
border: 1px solid var(--admin-border);
feat: add visual admin panel with page builder and settings editor - Add /admin route with password-protected visual page builder - Page Builder: manage hero images, standalone albums, subpages, and sections - Album Picker: browse all shared Immich albums with search and filtering - Settings Editor: theme, grid, footer, legal, SEO configuration - YAML service with atomic writes and automatic backups (content/.backups/) - HMAC-signed admin sessions (24h expiry, HttpOnly cookies) - API endpoints: /api/admin/{auth,gallery,settings,albums,reload} - Enable with ADMIN_PASSWORD env var; disabled by default - invalidateConfigCache() export for hot-reload after saves
2026-05-29 17:04:37 +02:00
border-radius: 6px;
fix: admin panel light/dark theme support, improved contrast, and backup confirmation a) Admin panel now respects the site's light/dark theme toggle via CSS custom properties that respond to [data-theme='light'] on <html>. All hardcoded dark colors replaced with semantic CSS variables. b) Improved contrast in dark mode: secondary text changed from #666/#555 to #a0a0a0, muted text from #555 to #707070. All text is now clearly readable against dark backgrounds. c) Backup system was already implemented in yaml-service.ts (creates timestamped backups in content/.backups/ before each save, keeps last 10 versions). Now the UI shows a confirmation message that a backup was created after each successful save.
2026-05-29 17:20:56 +02:00
color: var(--admin-text);
feat: add visual admin panel with page builder and settings editor - Add /admin route with password-protected visual page builder - Page Builder: manage hero images, standalone albums, subpages, and sections - Album Picker: browse all shared Immich albums with search and filtering - Settings Editor: theme, grid, footer, legal, SEO configuration - YAML service with atomic writes and automatic backups (content/.backups/) - HMAC-signed admin sessions (24h expiry, HttpOnly cookies) - API endpoints: /api/admin/{auth,gallery,settings,albums,reload} - Enable with ADMIN_PASSWORD env var; disabled by default - invalidateConfigCache() export for hot-reload after saves
2026-05-29 17:04:37 +02:00
font-size: 0.85rem;
}
.picker-search input:focus {
outline: none;
fix: admin panel light/dark theme support, improved contrast, and backup confirmation a) Admin panel now respects the site's light/dark theme toggle via CSS custom properties that respond to [data-theme='light'] on <html>. All hardcoded dark colors replaced with semantic CSS variables. b) Improved contrast in dark mode: secondary text changed from #666/#555 to #a0a0a0, muted text from #555 to #707070. All text is now clearly readable against dark backgrounds. c) Backup system was already implemented in yaml-service.ts (creates timestamped backups in content/.backups/ before each save, keeps last 10 versions). Now the UI shows a confirmation message that a backup was created after each successful save.
2026-05-29 17:20:56 +02:00
border-color: var(--admin-border-focus);
feat: add visual admin panel with page builder and settings editor - Add /admin route with password-protected visual page builder - Page Builder: manage hero images, standalone albums, subpages, and sections - Album Picker: browse all shared Immich albums with search and filtering - Settings Editor: theme, grid, footer, legal, SEO configuration - YAML service with atomic writes and automatic backups (content/.backups/) - HMAC-signed admin sessions (24h expiry, HttpOnly cookies) - API endpoints: /api/admin/{auth,gallery,settings,albums,reload} - Enable with ADMIN_PASSWORD env var; disabled by default - invalidateConfigCache() export for hot-reload after saves
2026-05-29 17:04:37 +02:00
}
.picker-list {
flex: 1;
overflow-y: auto;
release: v0.11.0 — journal fixes, admin URLs, design system cleanup (#432) * fix(screenshots): sharp-Typen fuer 0.34 und 0.35 gleichzeitig (#410) sharp 0.35 ist von `export =` auf ESM umgestellt: der Modul-Namespace ist nicht mehr aufrufbar, die Factory sitzt unter .default. Der Type-Check brach damit in scripts/screenshots.ts weg, sobald der Next-Bump (#402) sharp von 0.34.5 auf 0.35.3 mitzieht -- sharp ist hier keine deklarierte Dependency, sondern kommt ueber Next mit. Die Form wird jetzt aus dem installierten Paket abgeleitet statt festgeschrieben, zur Laufzeit wie im Typ. Geprueft mit beiden Versionen: tsc laeuft mit 0.34.5 und mit 0.35.3 fehlerfrei durch. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(deps): bump the nextjs group across 1 directory with 2 updates (#402) Bumps the nextjs group with 2 updates in the / directory: [next](https://github.com/vercel/next.js) and [eslint-config-next](https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next). Updates `next` from 16.2.12 to 16.3.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/compare/v16.2.12...v16.3.0) Updates `eslint-config-next` from 16.2.12 to 16.3.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/commits/v16.3.0/packages/eslint-config-next) --- updated-dependencies: - dependency-name: eslint-config-next dependency-version: 16.3.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: nextjs - dependency-name: next dependency-version: 16.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nextjs ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps-dev): bump prettier from 3.8.3 to 3.9.6 (#405) Bumps [prettier](https://github.com/prettier/prettier) from 3.8.3 to 3.9.6. - [Release notes](https://github.com/prettier/prettier/releases) - [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md) - [Commits](https://github.com/prettier/prettier/compare/3.8.3...3.9.6) --- updated-dependencies: - dependency-name: prettier dependency-version: 3.9.6 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * docs(changelog): Unreleased-Sektion fuer die Bumps nach v0.10.0 (#413) Die Dependency-PRs sind nach dem Release auf dev gelandet, teils auch auf main. Ohne Eintrag waeren sie beim naechsten Release unsichtbar -- inklusive Next 16.3.0, das CVE-2025-13465 mitbringt. Ausserdem im 0.10.0-Abschnitt nachgetragen, dass der Trivy-Scan bis #409 nie gelaufen ist. Der Fix steckt im Tag v0.10.0, fehlte aber in der Aufzaehlung -- und "Images werden bei jedem Publish gescannt" stand im Changelog, waehrend der Job im Action-Setup abbrach. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(gallery): per-album sort order, independent of Immich (#408) (#414) Album order was dictated entirely by Immich: getAlbum() sorted by the album's own asc/desc flag, so a Folio album always mirrored the archive. A curated series has a narrative order that has nothing to do with capture time, and changing the Immich album's sort to fit the website changes it for the archive too. Adds an optional per-album `sort` in gallery.yaml, editable in /admin, defaulting to today's behaviour so every existing config is unchanged: immich (default) | newest | oldest | filename | manual `manual` is a pinned *prefix*: `assetOrder` lists only the photos placed by hand, everything else follows in the album's Immich order. A full permutation of a 2,000-photo album would be ~80 KB of UUIDs in a file that is rewritten and copied to content/.backups/ on every admin save. It also makes drift fall out for free — photos removed in Immich never match, new ones land in the tail rather than being hidden. Sorting is applied after the cache read, not before the cache write, so the LRU keeps one canonical Immich-ordered copy per album. That avoids putting the mode in the cache key, lets a config change take effect without depending on invalidation, and keeps the stale-serving path correct. cache.get() returns the stored object by reference, so withSort() returns a shallow clone with a new array — sorting in place would reorder the shared entry, and under request coalescing every concurrent caller would be sorting the same array. Also fixes a prerequisite bug: /api/admin/albums/[albumId]/assets read album.assets from GET /albums/:id, which Immich 3.x no longer populates (lib/immich.ts:507). The hero picker's "This Album" tab returned nothing and threw outright when the key was absent. It now goes through the client's paginated metadata search, with ?types=all to opt videos in for the reorder editor. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): drop decorative emoji from the sort select labels (#415) An <option> cannot contain markup, so the SVG set in Icons is not reachable there — but a decorative emoji is not a substitute for it. Plain text instead; the album card badge already uses a real icon. The remaining emoji in the admin panel (asset picker tabs, section headings, layout picker options) predate this branch and are left for a separate cleanup. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): replace emoji icons with the shared SVG icon set (#416) The admin panel mixed two icon conventions: inline SVGs from `Icons.tsx` in most components, and decorative emoji in the asset picker and a few PageBuilder labels. Emoji render inconsistently across platforms, ignore the accent colour, and cannot inherit the `.svg-icon` sizing rules. - Icons.tsx: add `IconStar` (filled — it marks a state, not an action) and `IconImage`. - AssetPicker: the three tab labels and the favourite tile badge now use IconFolder / IconStar / IconImage. - PageBuilder: the "Standalone Albums" and "Subpages" headings use the icon set instead of an emoji. - PageBuilder: the layout picker drops its emoji for plain text. An <option> cannot contain markup, so an SVG is impossible there and a decorative glyph is not a substitute. - admin.css: align icon and label in the picker tabs, and swap the favourite badge's text-shadow for drop-shadow, which is what applies to an inline SVG. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): fold PageBuilder's local icons into the shared Icons module (#418) * refactor(admin): fold PageBuilder's local icons into the shared module PageBuilder.tsx carried its own `Icons` object duplicating most of the glyphs already exported by Icons.tsx, with hardcoded sizes and slightly divergent paths. Migrate all 32 call sites to the shared module and delete the local object. Five glyphs had no counterpart and are added to Icons.tsx as 1:1 ports of the local paths: IconX, IconPlus, IconHome, IconCopy, IconImage. The local ExternalLink and Check are dropped rather than ported — both had zero call sites. Two glyphs change shape slightly, which is the point of consolidating: the shared IconCamera includes the viewfinder bump the local copy omitted, and drag handles now use IconGripVertical. IconGripVertical uses the module's square 24x24 viewBox, so `.svg-drag` goes from 12x18 to 18x18 — the old non-square box would letterbox the glyph down to 12x12 and shrink the handle. * fix(admin): resolve icon-module integration after #416 Merging dev brought in #416, which added a second IconImage to Icons.tsx and two <Icons.Camera>/<Icons.Folder> section headers that reference the local Icons object this PR removes. Git merged both cleanly but the result did not type-check. - drop the duplicate IconImage (both copies were byte-identical) - point the two section headers at the imported IconCamera/IconFolder - refresh the SORT_LABELS comment: the icon set is imported now, not declared below --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> * fix(config): allow an empty gallery, guard against a double /api suffix (#421) An empty gallery is now a valid, rendered state instead of a throw: deriveGallery() no longer requires at least one album or subpage, so a deployment with no albums yet renders a bare homepage the owner can fill in via /admin. getConfig() also stops appending /api to an Immich URL that already ends in it, which previously produced .../api/api and broke every upstream request. Includes a restore of the per-album sort test cases, which the branch had lost by being cut before #408/#414. * feat(admin): favicon upload, served from the content volume (#422) Adds a bundled default favicon, an upload widget in admin Settings > General, and a route that serves the icon from the writable content/ volume with a fallback to the bundled default. Raster uploads (PNG/ICO/JPEG) are wrapped in an SVG container; the response carries its own CSP so an uploaded SVG cannot execute script on the origin. The GET route revalidates with an ETag instead of caching immutably, so a newly uploaded icon shows up immediately. Uploads are written via temp file + rename, and a Reset button restores the bundled default. * ci: flag unformatted files in a PR, without blocking it (#424) Prettier is configured as an error rule in eslint.config.mjs but has never run in CI, so part of the tree predates it. A final CI step now diffs against the PR base, runs prettier --list-different over the changed files, and emits a warning annotation per offender plus a job summary. Advisory by design: it never fails the job. Blocking would turn a PR red for merely touching a file that was already unformatted, and normalising the tree in one commit would wreck git blame and conflict with the PRs in flight. Requires fetch-depth: 0, since diffing against the base needs its history. * feat(install): first-run wizard gated by a one-time setup token (#419) Adds /install, a four-step first-run wizard: connect to Immich, optionally pick albums, name the site, finish. It verifies the credentials against the Immich server before writing anything, then writes gallery.yaml, settings.yaml and a content/install.json carrying the Immich credentials and a generated site secret. install.json exists because a running process cannot pick up new env vars — the wizard has to write configuration that takes effect without a restart. getInstallCredentials() merges it under the real environment, so env vars always win and rotation stays a matter of setting one. Both the page and the API routes are gated by a one-time setup token printed to the server log, so a deployment that is reachable before gallery.yaml exists cannot be configured by whoever finds it first. The token is stored in content/.setup-token (0600) rather than a module variable: Next.js bundles the page and each route handler separately, so a module-level token left the page and the API disagreeing inside one process and the wizard stuck on step 1. It is removed once the install completes. The admin password is stored as an scrypt hash using the scheme lib/auth.ts already applies to album passwords; a plaintext ADMIN_PASSWORD env var keeps working. * docs: document the setup wizard, fix the read-only content mount (#425) Quick Start now leads with the /install wizard, with the hand-written YAML route kept alongside it, and a First-Run Setup section covers the setup token, the files the wizard writes, and env-var precedence. Two corrections: both Docker examples mounted content/ as :ro, which silently breaks the wizard, the admin panel and the backup rotation alike — docs/admin-panel.md already said so and the README contradicted it. And nothing documented that content/install.json holds the Immich API key, so a backup of content/ is a backup of credentials. Also adds a Contributors section crediting the people whose work is in the project. * feat(admin): floating save bar pinned to the bottom of the viewport (#426) The save bar was the first, static element inside .admin-main. Since the document itself scrolls, it left the viewport as soon as you scrolled down — editing a subpage section or a settings block far below gave no visible dirty hint and no reachable save button. Replace it with a bottom-pinned floating bar shared by both editors. It only mounts while there is something to act on (unsaved changes, an in-flight save, or a result message), so it never covers content while idle. The success message clears after 5s, which hides the bar again. - new SaveBar component, replacing the duplicated markup in PageBuilder and SettingsEditor - adopt the previously unused .floating-save-bar CSS: slide-in keyframes (carrying translateX(-50%)), dirty border, wrap/gap, mobile variant and a prefers-reduced-motion opt-out; z-index 900 keeps it below modals - .admin-main gains bottom padding so the bar never covers page content - drop the now-unreachable idle hints: the ⌘S hint becomes a button title, the Live Sync note becomes a static line above the settings layout - header "Site" link now bypasses the cache (/?fresh=1), so the preview stays reachable when the bar is hidden Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(admin): themed listbox for the album sort control (#427) The per-album "Photo order" control was a native <select>. Because an <option> cannot contain markup, its choices could not use the admin panel's currentColor SVG set — the reason #415 had to fall back to plain text after dropping the emoji labels. Adds a Listbox component implementing the ARIA combobox/listbox pattern, so options can render a glyph beside their label: - DOM focus stays on the trigger button; the active option is announced through aria-activedescendant, keeping focus management to one element - Keyboard: arrows (clamped at the ends, like a native select), Home/End, Enter/Space to commit, Escape to cancel, Tab commits and moves on, and prefix type-ahead with a repeat-key cycle - Outside dismissal on pointerdown, so a press starting outside closes the popup before the click retargets The sort options now carry an icon each: calendar, arrow-down, arrow-up, an A→Z marker, and the drag glyph for manual — matching the badge the album card already shows. SORT_LABELS stays plain text because the badge feeds it to a title attribute. Closes #417 Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(git): ignore generated design handoff folders * fix(admin): stop the album sort dropdown clipping, and simplify the panel (#428) * fix(admin): render listbox popup in a portal so it escapes modal clipping The sort control's popup was position:absolute inside three clipping ancestors (.album-drawer overflow:hidden > .album-drawer-body overflow-y:auto > .modal-right-column overflow-y:auto), so it was cut off at the bottom of the Edit Album Details modal. z-index could not help: clipping happens before stacking. It also always hung below the trigger, with no flip. Portal the popup to document.body and position it from the trigger's viewport rect, flipping above when there is more room there and capping max-height to the space available so it scrolls internally rather than overflowing. It is dismissed on scroll and resize, since the anchor is only measured on open. The outside-pointerdown handler now also treats the popup as inside; without that the portalled list counts as outside, and a click on an option would close it before the selection commits. * refactor(admin): single-column album details panel The left column spent 1.2fr on a cover thumbnail and three stat rows, two of which (Status, Custom Hero) only restated the form fields opposite them, while the form itself was squeezed into 1.8fr behind a second nested scroller. Stack the drawer in one column instead: cover as a banner, then the form at full width, with the UUID moved into the footer. The body is now the only scroll container, which also removes one of the ancestors that was clipping the sort popup. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> * fix(admin): give the portalled listbox its theme back, lock the page behind modals (#429) Two defects in the album editor. The sort listbox popup painted transparent. Every --admin-* variable is scoped to .admin-layout, and since the popup moved into document.body it sits outside that subtree, so background/border/text all resolved to nothing. It now carries its own copy of the palette in both colour schemes, plus the font it no longer inherits. Scrolling inside a modal also moved the page behind it. No admin modal ever locked body scroll: the overlay covers the page but does not absorb wheel events, so a scroll starting on the backdrop — or continuing past the end of the modal's own scroller — reaches the document. overscroll-behavior cannot cover that case on its own, because it only applies to scroll containers and the backdrop is not one. useScrollLock freezes body while a modal is open and compensates for the width the scrollbar gives up, so nothing shifts underneath. Each lock restores the inline value it found, which makes nesting work without a counter — a picker opened from the drawer restores the drawer's hidden state instead of clearing it. Applied to both drawers and all four picker modals, which share the defect. overscroll-behavior: contain on the scrollers stops the chaining they can handle themselves. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com> * fix(security): allow unsafe-eval in CSP script-src during dev mode * feat(journal): add Journal Studio with split-screen editor, live preview and dedicated routes * fix(build): separate client parser from server journal-service and fix build type errors * fix(journal): Fotos rendern, Layout und Lightbox-Steuerung korrigieren Fünf unabhängige Fehler in der öffentlichen Journal- und Essay-Ansicht: * Foto-Blöcke wurden nie angezeigt. EssayView löst ein Foto über PhotoItem.id auf, und das sind verschlüsselte Tokens — die Blöcke aus dem Markdown tragen aber rohe Asset-UUIDs. Jede Zuordnung lief ins Leere, und nicht auflösbare Blöcke werden still verworfen. Die IDs werden jetzt serverseitig übersetzt; damit verschwinden nebenbei die rohen UUIDs aus dem Client-Payload, die dort laut Projektregel nie auftauchen dürfen. Nicht auflösbare Referenzen werden geloggt. * Überschriften standen weiter links als der Fließtext. Jeder Block hatte einzeln `max-width: 68ch`, und `ch` ist relativ zur Schrift des Elements — die Serif-Überschrift ergab eine breitere Spalte. Ersetzt durch eine gemeinsame, font-unabhängige `--essay-measure`. * Fullbleed-Fotos bluteten nur nach links aus: `.essay-figure` ist `width: 100%`, wodurch die Box überbestimmt ist und der negative rechte Margin verworfen wird. * Foto-Paare stellten beide Bilder gleich breit dar, wodurch ein Hochformat neben einem Querformat doppelt so hoch wurde. Jetzt eine Justified-Reihe: Breite proportional zum Seitenverhältnis, dadurch exakt gleiche Höhen ohne Beschnitt. * Die Lightbox hatte im Journal keine Tastatursteuerung und keine Scroll-Sperre — beides lag in PhotoGrid, also nur im Album-Raster. Verlagert in die Lightbox selbst, der doppelte Handler in PhotoGrid entfernt (sonst wäre pro Pfeildruck zwei Bilder weitergesprungen). Zusätzlich sind Proofing-Herzen und das EXIF-Panel im redaktionellen Modus abschaltbar und im Journal aus: Client-Proofing ist ein Übergabe-Workflow für Alben, keine Funktion einer Reportage. Auf der Übersicht wurde der Untertitel doppelt gerendert, weil extractExcerpt() auf ihn zurückfällt. * feat(admin): eigene URLs für alle Bereiche und überarbeiteter Journal Studio Das Panel war eine einzige Client-Komponente, die ihre Tabs über useState umschaltet: keine Route pro Bereich, kein Deep-Link, kein Zurück-Button, und nach jedem Reload landete man wieder auf "Pages". Auch der Journal-Editor hatte keine eigene URL. Jetzt sieben echte Routen (/admin, /admin/pages, /admin/journal, /admin/journal/<slug>, /admin/settings, /admin/settings/<section>, /admin/analytics). Die Shell mit Auth-Prüfung und Kopfzeile sitzt im Layout und umschließt children — so bleibt die Session-Prüfung über Routenwechsel montiert, statt bei jedem Tab-Wechsel neu zu laufen und den Spinner aufblitzen zu lassen. Unbekannte Settings-Sections fallen auf General zurück. Im selben Zug der Journal Studio, der die Routing-Änderung ohnehin berührt: * Alle Eingabefelder nutzten die Klasse `admin-input`, die in keinem CSS definiert war — sie fielen auf Browser-Defaults zurück. Jetzt gestylt, gescoped, damit der generische Name nicht ins übrige Panel leckt. * Der Split View ist per Divider verschiebbar (Maus, Tastatur, Doppelklick zum Zurücksetzen), Breite in localStorage. * Das Studio bricht aus der 1120px-Spalte aus, die Preview hat Platz. * Die Preview zeigte für jedes Foto fest 3:2 und log damit über das Layout der veröffentlichten Seite; die echten Verhältnisse werden jetzt an den Thumbnails gemessen. * Blöcke mit alten positionsbasierten Foto-Referenzen werden markiert — die lassen sich auf einer eigenständigen Journal-Seite nicht auflösen und verschwanden bisher stillschweigend. * Blocktyp-Chips als gemeinsame Komponente, monochrom und per Icon unterschieden statt in einer eigenen Blau/Lila/Orange-Palette, die sonst nirgends im Panel vorkommt. * Emojis raus, SVG-Icons rein. * fix(admin): Designsystem-Lücken im Panel schließen Eine systematische Suche nach Klassen, die im TSX benutzt, aber in keinem CSS definiert sind, hat vier Stellen mit demselben Muster gefunden: * `admin-btn-secondary` und `admin-btn-danger` existierten nicht. Sämtliche Löschen-Buttons sahen aus wie normale Buttons — keine Warnwirkung. Als `.admin-btn.admin-btn-danger` geschrieben, weil die Varianten mit den Größenklassen kombiniert werden, die weiter unten ihren eigenen Hintergrund setzen. * `page-progress-fill` fehlte: die Balken im Analytics-Panel waren leere Rinnen, der Wert unsichtbar. Ebenso `analytics-empty` und `admin-loading-container`. * `subpage-drawer-section`, `subpage-drawer-title-group` und `input-with-icon` im PageBuilder waren wirkungslos und teils mit Inline-Styles notdürftig kompensiert. * `grid-card-preview` fehlte, wodurch alle Layout-Vorschauen auf Höhe null kollabierten. Nur "Showcase" war sichtbar — und das aus Versehen, weil sein Tile `hero-tile` hieß und damit die `aspect-ratio` einer fremden PageBuilder-Klasse erbte. Umbenannt. Dazu die Theme-Vorschauen, die praktisch identisch aussahen: alle sieben zeigten dieselben drei quadratischen Kacheln, einziger Unterschied war die Hintergrundfarbe. Sie spiegeln jetzt die echten Preset-Daten aus lib/config/theme.ts — Schriftcharakter, Eckradius, Rasterdichte, Passepartout bzw. Schatten. Die Kopfzeile richtet sich an einer gemeinsamen Steuerhöhe aus. Der "Site"-Link war höher als die Buttons daneben: `.admin-btn` hatte keine explizite line-height, und <button> bekommt box-sizing: border-box vom Browser, <a> nicht. Die Statusanzeige setzte weder Schriftfamilie noch -größe und fiel auf den Browser-Default zurück — sie war nie Teil des Designsystems. Jetzt gleiche Höhe und Typografie, Pillenform als Zustandsanzeige, Trenner zur Aktionsgruppe. Das dauerhafte Pulsieren des grünen Punkts entfällt; Animation bleibt den Zuständen vorbehalten, die Aufmerksamkeit brauchen. Restliche Emojis durch SVG-Icons ersetzt. * feat(admin): add scroll-to-top toggle and SVG arrow The back-to-top button was always on and drew its arrow with the ↑ text character. Add a `scrollToTop` setting (General section in the admin panel, defaults to on so existing sites are unaffected) and replace the glyph with a stroked SVG that inherits currentColor across all presets. Scroll handling is now rAF-throttled, and prefers-reduced-motion turns off both the hover lift and the smooth scroll. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * security(journal): escape author HTML instead of filtering it CodeQL flags 26 high-severity alerts on the release PR; the bulk of them point at sanitizeHtml(), a denylist of three regexes whose output goes into dangerouslySetInnerHTML. I reproduced the bypasses before changing anything — all four pass the old filter: <img src=x onerror=alert(1)> unquoted handler, regex wants quotes <img src=x onerror='alert(1)'> single quotes, same reason <svg onload=alert(1)> not a <script> tag javasjavascript:cript:alert(1) one-pass replace, the rest recombines Plus an attribute breakout in the link renderer, which interpolated the URL into href="${url}" unescaped: [x](" onmouseover=alert(1) x=") -> <a href="" onmouseover=alert(1" ...> Replaced with escaping. Every `&<>"'` in author text becomes an entity before any markdown rule runs, so the only tags in the output are the ones renderInlineMarkdown builds itself and a URL cannot leave its attribute. Link schemes are now an allowlist (http, https, mailto, tel, relative, anchor); anything else renders as plain text. The serializer needed decodeHtmlEntities to match: without it a save would write `&lt;` into the Markdown file and the next parse would escape the `&` again, corrupting the text further on every round trip. A test covers parse -> serialize -> parse stability. Two existing tests asserted the old behaviour and were rewritten rather than deleted: one expected the script tag to be *removed* from the output, the other expected the substring "onerror" to be absent. Both now assert the property that matters — that no tag can form — because `onerror` surviving as inert text is fine. Exploitation required admin access either way: journal and essay text comes from the studio or from content/*.md. This removes the weakness, it does not close an open door. * fix(journal): contain file paths, fix frontmatter escaping, defuse two regexes Follow-up to the CodeQL findings on release PR #432. I went through all 23 alerts individually; this addresses the ones that are worth addressing and documents the ones that are not. Path containment (12 alerts, all false positives). Every path built from a slug goes through isValidSlug(), a strict `/^[a-zA-Z0-9_-]+$/` allowlist — verified against `../../etc/passwd`, `foo/../../bar`, `a/b`, `..` and friends, all rejected. CodeQL cannot see it because the check lives in another module. Added a containedPath() helper that resolves the path and refuses anything landing outside the content directory: a second lock on a door that was already locked, and a barrier the analysis can follow. Also removed the dead `slug.endsWith('.md')` branches — isValidSlug rejects dots, so they could never be taken. Frontmatter escaping (1 alert, a real bug). The serializer escaped `"` but not `\`, and the parser never unescaped anything. A title containing either character gained a backslash on every save/load cycle: Path C:\Users "quoted" -> Path C:\\Users \"quoted\" -> ... Escaping now covers the backslash first and the parser undoes both. A round trip test covers quotes, backslashes, colons and apostrophes. Two of three ReDoS regexes (2 alerts). The heading pattern had `\s+` next to `(.+)`, which overlap, so the engine tried every split of the whitespace run before failing; it is `[ \t]+` and `(\S.*)` now. The quote author pattern wrapped a lazy group around an optional group — the quadratic case — and is an index split on the first separator now. The third regex, the bold/italic pass, is deliberately left alone. Rewriting it with a negated class removes the backtracking but breaks nesting: `**bold *and italic* here**` renders as `*<em>bold </em>and italic<em> here</em>*`. The input is Markdown from an authenticated admin, never a visitor, so the worst case is an author slowing down their own page. The comment in the code says so. Not addressed: 5 js/insufficient-password-hash alerts. They ask for a slow KDF where the code uses SHA-256/HMAC — correct in general, but the admin password comes from an environment variable and is never stored, so a stronger KDF protects nothing that is not already in plaintext in the environment. 399 unit tests pass (18 new), build and tsc clean. * fix(journal): split the quote author by scanning, not by pattern Cleaning up after myself. #439 replaced the quote author regex `/^(.*?)(?:\s+--\s+(.+))?$/` — a lazy group around an optional one, the quadratic case — with `/\s+--\s+/`, and CodeQL promptly flagged the replacement for the same reason. One reported pattern traded for another. splitQuoteAuthor() scans for the first `--` that has whitespace on both sides. Linear, and it needs no reasoning about the regex engine at all. Behaviour is identical to the original regex, checked case by case against it: separator, no separator, several separators, tabs, wide gaps, `a--b` without spaces, leading and trailing separators, empty string. All nine are covered by tests, plus one asserting it stays fast on a 50k whitespace run. * security(admin): derive the session signing key with scrypt getSigningKey() ran the admin password through a single SHA-256 digest. It is key derivation rather than password storage, so it was never a stored-hash problem — but if the derived key ever leaked, one fast hash makes recovering the password by brute force cheap. CodeQL flags it as js/insufficient-password-hash and, for this particular alert, has a point. scrypt now. Two details that matter: The salt has to be stable. A random salt would produce a different key on every call and invalidate every session; it is derived from AUTH_SECRET, which is deployment-specific. Verified across separate processes: same inputs produce a verifying token, so a restart or redeploy does not log everyone out. The result is cached for the process lifetime. scrypt is deliberately slow and getSigningKey() runs on every admin request — deriving per call would add ~24ms to each one. The cache key is a digest of secret plus password, so a rotation misses the cache and derives again, and no extra plaintext copy of the password is kept around. Measured: first derivation 24ms, subsequent calls 0.12ms. Password change and secret change both invalidate an existing token, checked in separate processes. Note the one-time effect: existing admin sessions are invalidated by the change in derivation, so everyone logs in once more. * security(admin): key the signing-key cache on its inputs, not a digest #441 removed the SHA-256 digest of the admin password from the key derivation and introduced a new one three lines above it, as the cache key. Same rule, same file: CodeQL reported it immediately. The comment justifying it was wrong too. It claimed no second plaintext copy of the password was retained, while building the digest input allocates exactly that in order to hash it. The cache now holds the two input strings and compares them directly. They are the same objects the env and install caches already hold, so nothing extra is retained, and no fast hash of the password exists in memory for the life of the process. Re-verified after the change, in separate processes: a token from one process verifies in another with the same inputs, a changed password or secret rejects it, first derivation 24ms, cached calls 0.001ms. That leaves scrypt as the only place the password is hashed here. The two HMACs further down operate on the derived key and on token data, not on the password; the constant-time comparison in verifyAdminPassword is the previously dismissed one. --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
2026-08-14 16:55:07 +02:00
overscroll-behavior: contain;
feat: add visual admin panel with page builder and settings editor - Add /admin route with password-protected visual page builder - Page Builder: manage hero images, standalone albums, subpages, and sections - Album Picker: browse all shared Immich albums with search and filtering - Settings Editor: theme, grid, footer, legal, SEO configuration - YAML service with atomic writes and automatic backups (content/.backups/) - HMAC-signed admin sessions (24h expiry, HttpOnly cookies) - API endpoints: /api/admin/{auth,gallery,settings,albums,reload} - Enable with ADMIN_PASSWORD env var; disabled by default - invalidateConfigCache() export for hot-reload after saves
2026-05-29 17:04:37 +02:00
padding: 0.5rem;
}
.picker-item {
display: flex;
align-items: center;
gap: 0.75rem;
padding: 0.6rem 0.75rem;
border-radius: 8px;
cursor: pointer;
transition: background 0.1s;
}
.picker-item:hover:not(.used) {
fix: admin panel light/dark theme support, improved contrast, and backup confirmation a) Admin panel now respects the site's light/dark theme toggle via CSS custom properties that respond to [data-theme='light'] on <html>. All hardcoded dark colors replaced with semantic CSS variables. b) Improved contrast in dark mode: secondary text changed from #666/#555 to #a0a0a0, muted text from #555 to #707070. All text is now clearly readable against dark backgrounds. c) Backup system was already implemented in yaml-service.ts (creates timestamped backups in content/.backups/ before each save, keeps last 10 versions). Now the UI shows a confirmation message that a backup was created after each successful save.
2026-05-29 17:20:56 +02:00
background: var(--admin-bg-elevated);
feat: add visual admin panel with page builder and settings editor - Add /admin route with password-protected visual page builder - Page Builder: manage hero images, standalone albums, subpages, and sections - Album Picker: browse all shared Immich albums with search and filtering - Settings Editor: theme, grid, footer, legal, SEO configuration - YAML service with atomic writes and automatic backups (content/.backups/) - HMAC-signed admin sessions (24h expiry, HttpOnly cookies) - API endpoints: /api/admin/{auth,gallery,settings,albums,reload} - Enable with ADMIN_PASSWORD env var; disabled by default - invalidateConfigCache() export for hot-reload after saves
2026-05-29 17:04:37 +02:00
}
.picker-item.used {
opacity: 0.5;
cursor: not-allowed;
}
.picker-item-thumb {
flex-shrink: 0;
}
.picker-thumb-placeholder {
feat: enlarge admin thumbnails for hero, album, and subpage grids - Hero grid: 140px → 220px min tile width - Album grid: 160px → 240px min tile width - Subpage grid: 140px → 200px min tile width - Picker thumbnails: 40px → 52px - Admin main max-width: 960px → 1120px for more space - Slightly larger overlay buttons and index badges
2026-05-29 17:37:34 +02:00
width: 52px;
height: 52px;
feat: add visual admin panel with page builder and settings editor - Add /admin route with password-protected visual page builder - Page Builder: manage hero images, standalone albums, subpages, and sections - Album Picker: browse all shared Immich albums with search and filtering - Settings Editor: theme, grid, footer, legal, SEO configuration - YAML service with atomic writes and automatic backups (content/.backups/) - HMAC-signed admin sessions (24h expiry, HttpOnly cookies) - API endpoints: /api/admin/{auth,gallery,settings,albums,reload} - Enable with ADMIN_PASSWORD env var; disabled by default - invalidateConfigCache() export for hot-reload after saves
2026-05-29 17:04:37 +02:00
display: flex;
align-items: center;
justify-content: center;
fix: admin panel light/dark theme support, improved contrast, and backup confirmation a) Admin panel now respects the site's light/dark theme toggle via CSS custom properties that respond to [data-theme='light'] on <html>. All hardcoded dark colors replaced with semantic CSS variables. b) Improved contrast in dark mode: secondary text changed from #666/#555 to #a0a0a0, muted text from #555 to #707070. All text is now clearly readable against dark backgrounds. c) Backup system was already implemented in yaml-service.ts (creates timestamped backups in content/.backups/ before each save, keeps last 10 versions). Now the UI shows a confirmation message that a backup was created after each successful save.
2026-05-29 17:20:56 +02:00
background: var(--admin-bg-elevated);
feat: enlarge admin thumbnails for hero, album, and subpage grids - Hero grid: 140px → 220px min tile width - Album grid: 160px → 240px min tile width - Subpage grid: 140px → 200px min tile width - Picker thumbnails: 40px → 52px - Admin main max-width: 960px → 1120px for more space - Slightly larger overlay buttons and index badges
2026-05-29 17:37:34 +02:00
border-radius: 8px;
font-size: 1.2rem;
feat: add visual admin panel with page builder and settings editor - Add /admin route with password-protected visual page builder - Page Builder: manage hero images, standalone albums, subpages, and sections - Album Picker: browse all shared Immich albums with search and filtering - Settings Editor: theme, grid, footer, legal, SEO configuration - YAML service with atomic writes and automatic backups (content/.backups/) - HMAC-signed admin sessions (24h expiry, HttpOnly cookies) - API endpoints: /api/admin/{auth,gallery,settings,albums,reload} - Enable with ADMIN_PASSWORD env var; disabled by default - invalidateConfigCache() export for hot-reload after saves
2026-05-29 17:04:37 +02:00
}
feat: add thumbnail previews to admin panel for albums and hero images - Add /api/admin/thumbnail/[id] proxy endpoint for serving Immich thumbnails - Show album cover thumbnails in AlbumCard components (subpages + standalone) - Show actual image thumbnails in AlbumPicker modal instead of emoji placeholders - Show small thumbnail previews for hero image entries - Add corresponding CSS styles for all thumbnail elements
2026-05-29 17:14:58 +02:00
.picker-thumb-img {
feat: enlarge admin thumbnails for hero, album, and subpage grids - Hero grid: 140px → 220px min tile width - Album grid: 160px → 240px min tile width - Subpage grid: 140px → 200px min tile width - Picker thumbnails: 40px → 52px - Admin main max-width: 960px → 1120px for more space - Slightly larger overlay buttons and index badges
2026-05-29 17:37:34 +02:00
width: 52px;
height: 52px;
feat: add thumbnail previews to admin panel for albums and hero images - Add /api/admin/thumbnail/[id] proxy endpoint for serving Immich thumbnails - Show album cover thumbnails in AlbumCard components (subpages + standalone) - Show actual image thumbnails in AlbumPicker modal instead of emoji placeholders - Show small thumbnail previews for hero image entries - Add corresponding CSS styles for all thumbnail elements
2026-05-29 17:14:58 +02:00
object-fit: cover;
feat: enlarge admin thumbnails for hero, album, and subpage grids - Hero grid: 140px → 220px min tile width - Album grid: 160px → 240px min tile width - Subpage grid: 140px → 200px min tile width - Picker thumbnails: 40px → 52px - Admin main max-width: 960px → 1120px for more space - Slightly larger overlay buttons and index badges
2026-05-29 17:37:34 +02:00
border-radius: 8px;
fix: admin panel light/dark theme support, improved contrast, and backup confirmation a) Admin panel now respects the site's light/dark theme toggle via CSS custom properties that respond to [data-theme='light'] on <html>. All hardcoded dark colors replaced with semantic CSS variables. b) Improved contrast in dark mode: secondary text changed from #666/#555 to #a0a0a0, muted text from #555 to #707070. All text is now clearly readable against dark backgrounds. c) Backup system was already implemented in yaml-service.ts (creates timestamped backups in content/.backups/ before each save, keeps last 10 versions). Now the UI shows a confirmation message that a backup was created after each successful save.
2026-05-29 17:20:56 +02:00
background: var(--admin-bg-elevated);
feat: add thumbnail previews to admin panel for albums and hero images - Add /api/admin/thumbnail/[id] proxy endpoint for serving Immich thumbnails - Show album cover thumbnails in AlbumCard components (subpages + standalone) - Show actual image thumbnails in AlbumPicker modal instead of emoji placeholders - Show small thumbnail previews for hero image entries - Add corresponding CSS styles for all thumbnail elements
2026-05-29 17:14:58 +02:00
}
feat: add visual admin panel with page builder and settings editor - Add /admin route with password-protected visual page builder - Page Builder: manage hero images, standalone albums, subpages, and sections - Album Picker: browse all shared Immich albums with search and filtering - Settings Editor: theme, grid, footer, legal, SEO configuration - YAML service with atomic writes and automatic backups (content/.backups/) - HMAC-signed admin sessions (24h expiry, HttpOnly cookies) - API endpoints: /api/admin/{auth,gallery,settings,albums,reload} - Enable with ADMIN_PASSWORD env var; disabled by default - invalidateConfigCache() export for hot-reload after saves
2026-05-29 17:04:37 +02:00
.picker-item-info {
flex: 1;
min-width: 0;
display: flex;
flex-direction: column;
gap: 0.15rem;
}
.picker-item-name {
font-size: 0.85rem;
font-weight: 500;
white-space: nowrap;
overflow: hidden;
text-overflow: ellipsis;
}
.picker-item-meta {
font-size: 0.7rem;
fix: admin panel light/dark theme support, improved contrast, and backup confirmation a) Admin panel now respects the site's light/dark theme toggle via CSS custom properties that respond to [data-theme='light'] on <html>. All hardcoded dark colors replaced with semantic CSS variables. b) Improved contrast in dark mode: secondary text changed from #666/#555 to #a0a0a0, muted text from #555 to #707070. All text is now clearly readable against dark backgrounds. c) Backup system was already implemented in yaml-service.ts (creates timestamped backups in content/.backups/ before each save, keeps last 10 versions). Now the UI shows a confirmation message that a backup was created after each successful save.
2026-05-29 17:20:56 +02:00
color: var(--admin-text-muted);
feat: add visual admin panel with page builder and settings editor - Add /admin route with password-protected visual page builder - Page Builder: manage hero images, standalone albums, subpages, and sections - Album Picker: browse all shared Immich albums with search and filtering - Settings Editor: theme, grid, footer, legal, SEO configuration - YAML service with atomic writes and automatic backups (content/.backups/) - HMAC-signed admin sessions (24h expiry, HttpOnly cookies) - API endpoints: /api/admin/{auth,gallery,settings,albums,reload} - Enable with ADMIN_PASSWORD env var; disabled by default - invalidateConfigCache() export for hot-reload after saves
2026-05-29 17:04:37 +02:00
}
.picker-item-action {
flex-shrink: 0;
}
.picker-used-badge {
font-size: 0.7rem;
fix: admin panel light/dark theme support, improved contrast, and backup confirmation a) Admin panel now respects the site's light/dark theme toggle via CSS custom properties that respond to [data-theme='light'] on <html>. All hardcoded dark colors replaced with semantic CSS variables. b) Improved contrast in dark mode: secondary text changed from #666/#555 to #a0a0a0, muted text from #555 to #707070. All text is now clearly readable against dark backgrounds. c) Backup system was already implemented in yaml-service.ts (creates timestamped backups in content/.backups/ before each save, keeps last 10 versions). Now the UI shows a confirmation message that a backup was created after each successful save.
2026-05-29 17:20:56 +02:00
color: var(--admin-text-muted);
feat: add visual admin panel with page builder and settings editor - Add /admin route with password-protected visual page builder - Page Builder: manage hero images, standalone albums, subpages, and sections - Album Picker: browse all shared Immich albums with search and filtering - Settings Editor: theme, grid, footer, legal, SEO configuration - YAML service with atomic writes and automatic backups (content/.backups/) - HMAC-signed admin sessions (24h expiry, HttpOnly cookies) - API endpoints: /api/admin/{auth,gallery,settings,albums,reload} - Enable with ADMIN_PASSWORD env var; disabled by default - invalidateConfigCache() export for hot-reload after saves
2026-05-29 17:04:37 +02:00
padding: 0.2rem 0.5rem;
fix: admin panel light/dark theme support, improved contrast, and backup confirmation a) Admin panel now respects the site's light/dark theme toggle via CSS custom properties that respond to [data-theme='light'] on <html>. All hardcoded dark colors replaced with semantic CSS variables. b) Improved contrast in dark mode: secondary text changed from #666/#555 to #a0a0a0, muted text from #555 to #707070. All text is now clearly readable against dark backgrounds. c) Backup system was already implemented in yaml-service.ts (creates timestamped backups in content/.backups/ before each save, keeps last 10 versions). Now the UI shows a confirmation message that a backup was created after each successful save.
2026-05-29 17:20:56 +02:00
border: 1px solid var(--admin-border);
feat: add visual admin panel with page builder and settings editor - Add /admin route with password-protected visual page builder - Page Builder: manage hero images, standalone albums, subpages, and sections - Album Picker: browse all shared Immich albums with search and filtering - Settings Editor: theme, grid, footer, legal, SEO configuration - YAML service with atomic writes and automatic backups (content/.backups/) - HMAC-signed admin sessions (24h expiry, HttpOnly cookies) - API endpoints: /api/admin/{auth,gallery,settings,albums,reload} - Enable with ADMIN_PASSWORD env var; disabled by default - invalidateConfigCache() export for hot-reload after saves
2026-05-29 17:04:37 +02:00
border-radius: 4px;
}
.picker-select-badge {
font-size: 0.7rem;
fix: admin panel light/dark theme support, improved contrast, and backup confirmation a) Admin panel now respects the site's light/dark theme toggle via CSS custom properties that respond to [data-theme='light'] on <html>. All hardcoded dark colors replaced with semantic CSS variables. b) Improved contrast in dark mode: secondary text changed from #666/#555 to #a0a0a0, muted text from #555 to #707070. All text is now clearly readable against dark backgrounds. c) Backup system was already implemented in yaml-service.ts (creates timestamped backups in content/.backups/ before each save, keeps last 10 versions). Now the UI shows a confirmation message that a backup was created after each successful save.
2026-05-29 17:20:56 +02:00
color: var(--admin-success);
feat: add visual admin panel with page builder and settings editor - Add /admin route with password-protected visual page builder - Page Builder: manage hero images, standalone albums, subpages, and sections - Album Picker: browse all shared Immich albums with search and filtering - Settings Editor: theme, grid, footer, legal, SEO configuration - YAML service with atomic writes and automatic backups (content/.backups/) - HMAC-signed admin sessions (24h expiry, HttpOnly cookies) - API endpoints: /api/admin/{auth,gallery,settings,albums,reload} - Enable with ADMIN_PASSWORD env var; disabled by default - invalidateConfigCache() export for hot-reload after saves
2026-05-29 17:04:37 +02:00
padding: 0.2rem 0.5rem;
fix: admin panel light/dark theme support, improved contrast, and backup confirmation a) Admin panel now respects the site's light/dark theme toggle via CSS custom properties that respond to [data-theme='light'] on <html>. All hardcoded dark colors replaced with semantic CSS variables. b) Improved contrast in dark mode: secondary text changed from #666/#555 to #a0a0a0, muted text from #555 to #707070. All text is now clearly readable against dark backgrounds. c) Backup system was already implemented in yaml-service.ts (creates timestamped backups in content/.backups/ before each save, keeps last 10 versions). Now the UI shows a confirmation message that a backup was created after each successful save.
2026-05-29 17:20:56 +02:00
border: 1px solid var(--admin-success);
feat: add visual admin panel with page builder and settings editor - Add /admin route with password-protected visual page builder - Page Builder: manage hero images, standalone albums, subpages, and sections - Album Picker: browse all shared Immich albums with search and filtering - Settings Editor: theme, grid, footer, legal, SEO configuration - YAML service with atomic writes and automatic backups (content/.backups/) - HMAC-signed admin sessions (24h expiry, HttpOnly cookies) - API endpoints: /api/admin/{auth,gallery,settings,albums,reload} - Enable with ADMIN_PASSWORD env var; disabled by default - invalidateConfigCache() export for hot-reload after saves
2026-05-29 17:04:37 +02:00
border-radius: 4px;
opacity: 0;
transition: opacity 0.1s;
}
.picker-item:hover .picker-select-badge {
opacity: 1;
}
/* ── Settings Editor ──────────────────────────────────────── */
release: v0.11.0 — journal fixes, admin URLs, design system cleanup (#432) * fix(screenshots): sharp-Typen fuer 0.34 und 0.35 gleichzeitig (#410) sharp 0.35 ist von `export =` auf ESM umgestellt: der Modul-Namespace ist nicht mehr aufrufbar, die Factory sitzt unter .default. Der Type-Check brach damit in scripts/screenshots.ts weg, sobald der Next-Bump (#402) sharp von 0.34.5 auf 0.35.3 mitzieht -- sharp ist hier keine deklarierte Dependency, sondern kommt ueber Next mit. Die Form wird jetzt aus dem installierten Paket abgeleitet statt festgeschrieben, zur Laufzeit wie im Typ. Geprueft mit beiden Versionen: tsc laeuft mit 0.34.5 und mit 0.35.3 fehlerfrei durch. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(deps): bump the nextjs group across 1 directory with 2 updates (#402) Bumps the nextjs group with 2 updates in the / directory: [next](https://github.com/vercel/next.js) and [eslint-config-next](https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next). Updates `next` from 16.2.12 to 16.3.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/compare/v16.2.12...v16.3.0) Updates `eslint-config-next` from 16.2.12 to 16.3.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/commits/v16.3.0/packages/eslint-config-next) --- updated-dependencies: - dependency-name: eslint-config-next dependency-version: 16.3.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: nextjs - dependency-name: next dependency-version: 16.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nextjs ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps-dev): bump prettier from 3.8.3 to 3.9.6 (#405) Bumps [prettier](https://github.com/prettier/prettier) from 3.8.3 to 3.9.6. - [Release notes](https://github.com/prettier/prettier/releases) - [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md) - [Commits](https://github.com/prettier/prettier/compare/3.8.3...3.9.6) --- updated-dependencies: - dependency-name: prettier dependency-version: 3.9.6 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * docs(changelog): Unreleased-Sektion fuer die Bumps nach v0.10.0 (#413) Die Dependency-PRs sind nach dem Release auf dev gelandet, teils auch auf main. Ohne Eintrag waeren sie beim naechsten Release unsichtbar -- inklusive Next 16.3.0, das CVE-2025-13465 mitbringt. Ausserdem im 0.10.0-Abschnitt nachgetragen, dass der Trivy-Scan bis #409 nie gelaufen ist. Der Fix steckt im Tag v0.10.0, fehlte aber in der Aufzaehlung -- und "Images werden bei jedem Publish gescannt" stand im Changelog, waehrend der Job im Action-Setup abbrach. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(gallery): per-album sort order, independent of Immich (#408) (#414) Album order was dictated entirely by Immich: getAlbum() sorted by the album's own asc/desc flag, so a Folio album always mirrored the archive. A curated series has a narrative order that has nothing to do with capture time, and changing the Immich album's sort to fit the website changes it for the archive too. Adds an optional per-album `sort` in gallery.yaml, editable in /admin, defaulting to today's behaviour so every existing config is unchanged: immich (default) | newest | oldest | filename | manual `manual` is a pinned *prefix*: `assetOrder` lists only the photos placed by hand, everything else follows in the album's Immich order. A full permutation of a 2,000-photo album would be ~80 KB of UUIDs in a file that is rewritten and copied to content/.backups/ on every admin save. It also makes drift fall out for free — photos removed in Immich never match, new ones land in the tail rather than being hidden. Sorting is applied after the cache read, not before the cache write, so the LRU keeps one canonical Immich-ordered copy per album. That avoids putting the mode in the cache key, lets a config change take effect without depending on invalidation, and keeps the stale-serving path correct. cache.get() returns the stored object by reference, so withSort() returns a shallow clone with a new array — sorting in place would reorder the shared entry, and under request coalescing every concurrent caller would be sorting the same array. Also fixes a prerequisite bug: /api/admin/albums/[albumId]/assets read album.assets from GET /albums/:id, which Immich 3.x no longer populates (lib/immich.ts:507). The hero picker's "This Album" tab returned nothing and threw outright when the key was absent. It now goes through the client's paginated metadata search, with ?types=all to opt videos in for the reorder editor. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): drop decorative emoji from the sort select labels (#415) An <option> cannot contain markup, so the SVG set in Icons is not reachable there — but a decorative emoji is not a substitute for it. Plain text instead; the album card badge already uses a real icon. The remaining emoji in the admin panel (asset picker tabs, section headings, layout picker options) predate this branch and are left for a separate cleanup. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): replace emoji icons with the shared SVG icon set (#416) The admin panel mixed two icon conventions: inline SVGs from `Icons.tsx` in most components, and decorative emoji in the asset picker and a few PageBuilder labels. Emoji render inconsistently across platforms, ignore the accent colour, and cannot inherit the `.svg-icon` sizing rules. - Icons.tsx: add `IconStar` (filled — it marks a state, not an action) and `IconImage`. - AssetPicker: the three tab labels and the favourite tile badge now use IconFolder / IconStar / IconImage. - PageBuilder: the "Standalone Albums" and "Subpages" headings use the icon set instead of an emoji. - PageBuilder: the layout picker drops its emoji for plain text. An <option> cannot contain markup, so an SVG is impossible there and a decorative glyph is not a substitute. - admin.css: align icon and label in the picker tabs, and swap the favourite badge's text-shadow for drop-shadow, which is what applies to an inline SVG. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): fold PageBuilder's local icons into the shared Icons module (#418) * refactor(admin): fold PageBuilder's local icons into the shared module PageBuilder.tsx carried its own `Icons` object duplicating most of the glyphs already exported by Icons.tsx, with hardcoded sizes and slightly divergent paths. Migrate all 32 call sites to the shared module and delete the local object. Five glyphs had no counterpart and are added to Icons.tsx as 1:1 ports of the local paths: IconX, IconPlus, IconHome, IconCopy, IconImage. The local ExternalLink and Check are dropped rather than ported — both had zero call sites. Two glyphs change shape slightly, which is the point of consolidating: the shared IconCamera includes the viewfinder bump the local copy omitted, and drag handles now use IconGripVertical. IconGripVertical uses the module's square 24x24 viewBox, so `.svg-drag` goes from 12x18 to 18x18 — the old non-square box would letterbox the glyph down to 12x12 and shrink the handle. * fix(admin): resolve icon-module integration after #416 Merging dev brought in #416, which added a second IconImage to Icons.tsx and two <Icons.Camera>/<Icons.Folder> section headers that reference the local Icons object this PR removes. Git merged both cleanly but the result did not type-check. - drop the duplicate IconImage (both copies were byte-identical) - point the two section headers at the imported IconCamera/IconFolder - refresh the SORT_LABELS comment: the icon set is imported now, not declared below --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> * fix(config): allow an empty gallery, guard against a double /api suffix (#421) An empty gallery is now a valid, rendered state instead of a throw: deriveGallery() no longer requires at least one album or subpage, so a deployment with no albums yet renders a bare homepage the owner can fill in via /admin. getConfig() also stops appending /api to an Immich URL that already ends in it, which previously produced .../api/api and broke every upstream request. Includes a restore of the per-album sort test cases, which the branch had lost by being cut before #408/#414. * feat(admin): favicon upload, served from the content volume (#422) Adds a bundled default favicon, an upload widget in admin Settings > General, and a route that serves the icon from the writable content/ volume with a fallback to the bundled default. Raster uploads (PNG/ICO/JPEG) are wrapped in an SVG container; the response carries its own CSP so an uploaded SVG cannot execute script on the origin. The GET route revalidates with an ETag instead of caching immutably, so a newly uploaded icon shows up immediately. Uploads are written via temp file + rename, and a Reset button restores the bundled default. * ci: flag unformatted files in a PR, without blocking it (#424) Prettier is configured as an error rule in eslint.config.mjs but has never run in CI, so part of the tree predates it. A final CI step now diffs against the PR base, runs prettier --list-different over the changed files, and emits a warning annotation per offender plus a job summary. Advisory by design: it never fails the job. Blocking would turn a PR red for merely touching a file that was already unformatted, and normalising the tree in one commit would wreck git blame and conflict with the PRs in flight. Requires fetch-depth: 0, since diffing against the base needs its history. * feat(install): first-run wizard gated by a one-time setup token (#419) Adds /install, a four-step first-run wizard: connect to Immich, optionally pick albums, name the site, finish. It verifies the credentials against the Immich server before writing anything, then writes gallery.yaml, settings.yaml and a content/install.json carrying the Immich credentials and a generated site secret. install.json exists because a running process cannot pick up new env vars — the wizard has to write configuration that takes effect without a restart. getInstallCredentials() merges it under the real environment, so env vars always win and rotation stays a matter of setting one. Both the page and the API routes are gated by a one-time setup token printed to the server log, so a deployment that is reachable before gallery.yaml exists cannot be configured by whoever finds it first. The token is stored in content/.setup-token (0600) rather than a module variable: Next.js bundles the page and each route handler separately, so a module-level token left the page and the API disagreeing inside one process and the wizard stuck on step 1. It is removed once the install completes. The admin password is stored as an scrypt hash using the scheme lib/auth.ts already applies to album passwords; a plaintext ADMIN_PASSWORD env var keeps working. * docs: document the setup wizard, fix the read-only content mount (#425) Quick Start now leads with the /install wizard, with the hand-written YAML route kept alongside it, and a First-Run Setup section covers the setup token, the files the wizard writes, and env-var precedence. Two corrections: both Docker examples mounted content/ as :ro, which silently breaks the wizard, the admin panel and the backup rotation alike — docs/admin-panel.md already said so and the README contradicted it. And nothing documented that content/install.json holds the Immich API key, so a backup of content/ is a backup of credentials. Also adds a Contributors section crediting the people whose work is in the project. * feat(admin): floating save bar pinned to the bottom of the viewport (#426) The save bar was the first, static element inside .admin-main. Since the document itself scrolls, it left the viewport as soon as you scrolled down — editing a subpage section or a settings block far below gave no visible dirty hint and no reachable save button. Replace it with a bottom-pinned floating bar shared by both editors. It only mounts while there is something to act on (unsaved changes, an in-flight save, or a result message), so it never covers content while idle. The success message clears after 5s, which hides the bar again. - new SaveBar component, replacing the duplicated markup in PageBuilder and SettingsEditor - adopt the previously unused .floating-save-bar CSS: slide-in keyframes (carrying translateX(-50%)), dirty border, wrap/gap, mobile variant and a prefers-reduced-motion opt-out; z-index 900 keeps it below modals - .admin-main gains bottom padding so the bar never covers page content - drop the now-unreachable idle hints: the ⌘S hint becomes a button title, the Live Sync note becomes a static line above the settings layout - header "Site" link now bypasses the cache (/?fresh=1), so the preview stays reachable when the bar is hidden Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(admin): themed listbox for the album sort control (#427) The per-album "Photo order" control was a native <select>. Because an <option> cannot contain markup, its choices could not use the admin panel's currentColor SVG set — the reason #415 had to fall back to plain text after dropping the emoji labels. Adds a Listbox component implementing the ARIA combobox/listbox pattern, so options can render a glyph beside their label: - DOM focus stays on the trigger button; the active option is announced through aria-activedescendant, keeping focus management to one element - Keyboard: arrows (clamped at the ends, like a native select), Home/End, Enter/Space to commit, Escape to cancel, Tab commits and moves on, and prefix type-ahead with a repeat-key cycle - Outside dismissal on pointerdown, so a press starting outside closes the popup before the click retargets The sort options now carry an icon each: calendar, arrow-down, arrow-up, an A→Z marker, and the drag glyph for manual — matching the badge the album card already shows. SORT_LABELS stays plain text because the badge feeds it to a title attribute. Closes #417 Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(git): ignore generated design handoff folders * fix(admin): stop the album sort dropdown clipping, and simplify the panel (#428) * fix(admin): render listbox popup in a portal so it escapes modal clipping The sort control's popup was position:absolute inside three clipping ancestors (.album-drawer overflow:hidden > .album-drawer-body overflow-y:auto > .modal-right-column overflow-y:auto), so it was cut off at the bottom of the Edit Album Details modal. z-index could not help: clipping happens before stacking. It also always hung below the trigger, with no flip. Portal the popup to document.body and position it from the trigger's viewport rect, flipping above when there is more room there and capping max-height to the space available so it scrolls internally rather than overflowing. It is dismissed on scroll and resize, since the anchor is only measured on open. The outside-pointerdown handler now also treats the popup as inside; without that the portalled list counts as outside, and a click on an option would close it before the selection commits. * refactor(admin): single-column album details panel The left column spent 1.2fr on a cover thumbnail and three stat rows, two of which (Status, Custom Hero) only restated the form fields opposite them, while the form itself was squeezed into 1.8fr behind a second nested scroller. Stack the drawer in one column instead: cover as a banner, then the form at full width, with the UUID moved into the footer. The body is now the only scroll container, which also removes one of the ancestors that was clipping the sort popup. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> * fix(admin): give the portalled listbox its theme back, lock the page behind modals (#429) Two defects in the album editor. The sort listbox popup painted transparent. Every --admin-* variable is scoped to .admin-layout, and since the popup moved into document.body it sits outside that subtree, so background/border/text all resolved to nothing. It now carries its own copy of the palette in both colour schemes, plus the font it no longer inherits. Scrolling inside a modal also moved the page behind it. No admin modal ever locked body scroll: the overlay covers the page but does not absorb wheel events, so a scroll starting on the backdrop — or continuing past the end of the modal's own scroller — reaches the document. overscroll-behavior cannot cover that case on its own, because it only applies to scroll containers and the backdrop is not one. useScrollLock freezes body while a modal is open and compensates for the width the scrollbar gives up, so nothing shifts underneath. Each lock restores the inline value it found, which makes nesting work without a counter — a picker opened from the drawer restores the drawer's hidden state instead of clearing it. Applied to both drawers and all four picker modals, which share the defect. overscroll-behavior: contain on the scrollers stops the chaining they can handle themselves. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com> * fix(security): allow unsafe-eval in CSP script-src during dev mode * feat(journal): add Journal Studio with split-screen editor, live preview and dedicated routes * fix(build): separate client parser from server journal-service and fix build type errors * fix(journal): Fotos rendern, Layout und Lightbox-Steuerung korrigieren Fünf unabhängige Fehler in der öffentlichen Journal- und Essay-Ansicht: * Foto-Blöcke wurden nie angezeigt. EssayView löst ein Foto über PhotoItem.id auf, und das sind verschlüsselte Tokens — die Blöcke aus dem Markdown tragen aber rohe Asset-UUIDs. Jede Zuordnung lief ins Leere, und nicht auflösbare Blöcke werden still verworfen. Die IDs werden jetzt serverseitig übersetzt; damit verschwinden nebenbei die rohen UUIDs aus dem Client-Payload, die dort laut Projektregel nie auftauchen dürfen. Nicht auflösbare Referenzen werden geloggt. * Überschriften standen weiter links als der Fließtext. Jeder Block hatte einzeln `max-width: 68ch`, und `ch` ist relativ zur Schrift des Elements — die Serif-Überschrift ergab eine breitere Spalte. Ersetzt durch eine gemeinsame, font-unabhängige `--essay-measure`. * Fullbleed-Fotos bluteten nur nach links aus: `.essay-figure` ist `width: 100%`, wodurch die Box überbestimmt ist und der negative rechte Margin verworfen wird. * Foto-Paare stellten beide Bilder gleich breit dar, wodurch ein Hochformat neben einem Querformat doppelt so hoch wurde. Jetzt eine Justified-Reihe: Breite proportional zum Seitenverhältnis, dadurch exakt gleiche Höhen ohne Beschnitt. * Die Lightbox hatte im Journal keine Tastatursteuerung und keine Scroll-Sperre — beides lag in PhotoGrid, also nur im Album-Raster. Verlagert in die Lightbox selbst, der doppelte Handler in PhotoGrid entfernt (sonst wäre pro Pfeildruck zwei Bilder weitergesprungen). Zusätzlich sind Proofing-Herzen und das EXIF-Panel im redaktionellen Modus abschaltbar und im Journal aus: Client-Proofing ist ein Übergabe-Workflow für Alben, keine Funktion einer Reportage. Auf der Übersicht wurde der Untertitel doppelt gerendert, weil extractExcerpt() auf ihn zurückfällt. * feat(admin): eigene URLs für alle Bereiche und überarbeiteter Journal Studio Das Panel war eine einzige Client-Komponente, die ihre Tabs über useState umschaltet: keine Route pro Bereich, kein Deep-Link, kein Zurück-Button, und nach jedem Reload landete man wieder auf "Pages". Auch der Journal-Editor hatte keine eigene URL. Jetzt sieben echte Routen (/admin, /admin/pages, /admin/journal, /admin/journal/<slug>, /admin/settings, /admin/settings/<section>, /admin/analytics). Die Shell mit Auth-Prüfung und Kopfzeile sitzt im Layout und umschließt children — so bleibt die Session-Prüfung über Routenwechsel montiert, statt bei jedem Tab-Wechsel neu zu laufen und den Spinner aufblitzen zu lassen. Unbekannte Settings-Sections fallen auf General zurück. Im selben Zug der Journal Studio, der die Routing-Änderung ohnehin berührt: * Alle Eingabefelder nutzten die Klasse `admin-input`, die in keinem CSS definiert war — sie fielen auf Browser-Defaults zurück. Jetzt gestylt, gescoped, damit der generische Name nicht ins übrige Panel leckt. * Der Split View ist per Divider verschiebbar (Maus, Tastatur, Doppelklick zum Zurücksetzen), Breite in localStorage. * Das Studio bricht aus der 1120px-Spalte aus, die Preview hat Platz. * Die Preview zeigte für jedes Foto fest 3:2 und log damit über das Layout der veröffentlichten Seite; die echten Verhältnisse werden jetzt an den Thumbnails gemessen. * Blöcke mit alten positionsbasierten Foto-Referenzen werden markiert — die lassen sich auf einer eigenständigen Journal-Seite nicht auflösen und verschwanden bisher stillschweigend. * Blocktyp-Chips als gemeinsame Komponente, monochrom und per Icon unterschieden statt in einer eigenen Blau/Lila/Orange-Palette, die sonst nirgends im Panel vorkommt. * Emojis raus, SVG-Icons rein. * fix(admin): Designsystem-Lücken im Panel schließen Eine systematische Suche nach Klassen, die im TSX benutzt, aber in keinem CSS definiert sind, hat vier Stellen mit demselben Muster gefunden: * `admin-btn-secondary` und `admin-btn-danger` existierten nicht. Sämtliche Löschen-Buttons sahen aus wie normale Buttons — keine Warnwirkung. Als `.admin-btn.admin-btn-danger` geschrieben, weil die Varianten mit den Größenklassen kombiniert werden, die weiter unten ihren eigenen Hintergrund setzen. * `page-progress-fill` fehlte: die Balken im Analytics-Panel waren leere Rinnen, der Wert unsichtbar. Ebenso `analytics-empty` und `admin-loading-container`. * `subpage-drawer-section`, `subpage-drawer-title-group` und `input-with-icon` im PageBuilder waren wirkungslos und teils mit Inline-Styles notdürftig kompensiert. * `grid-card-preview` fehlte, wodurch alle Layout-Vorschauen auf Höhe null kollabierten. Nur "Showcase" war sichtbar — und das aus Versehen, weil sein Tile `hero-tile` hieß und damit die `aspect-ratio` einer fremden PageBuilder-Klasse erbte. Umbenannt. Dazu die Theme-Vorschauen, die praktisch identisch aussahen: alle sieben zeigten dieselben drei quadratischen Kacheln, einziger Unterschied war die Hintergrundfarbe. Sie spiegeln jetzt die echten Preset-Daten aus lib/config/theme.ts — Schriftcharakter, Eckradius, Rasterdichte, Passepartout bzw. Schatten. Die Kopfzeile richtet sich an einer gemeinsamen Steuerhöhe aus. Der "Site"-Link war höher als die Buttons daneben: `.admin-btn` hatte keine explizite line-height, und <button> bekommt box-sizing: border-box vom Browser, <a> nicht. Die Statusanzeige setzte weder Schriftfamilie noch -größe und fiel auf den Browser-Default zurück — sie war nie Teil des Designsystems. Jetzt gleiche Höhe und Typografie, Pillenform als Zustandsanzeige, Trenner zur Aktionsgruppe. Das dauerhafte Pulsieren des grünen Punkts entfällt; Animation bleibt den Zuständen vorbehalten, die Aufmerksamkeit brauchen. Restliche Emojis durch SVG-Icons ersetzt. * feat(admin): add scroll-to-top toggle and SVG arrow The back-to-top button was always on and drew its arrow with the ↑ text character. Add a `scrollToTop` setting (General section in the admin panel, defaults to on so existing sites are unaffected) and replace the glyph with a stroked SVG that inherits currentColor across all presets. Scroll handling is now rAF-throttled, and prefers-reduced-motion turns off both the hover lift and the smooth scroll. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * security(journal): escape author HTML instead of filtering it CodeQL flags 26 high-severity alerts on the release PR; the bulk of them point at sanitizeHtml(), a denylist of three regexes whose output goes into dangerouslySetInnerHTML. I reproduced the bypasses before changing anything — all four pass the old filter: <img src=x onerror=alert(1)> unquoted handler, regex wants quotes <img src=x onerror='alert(1)'> single quotes, same reason <svg onload=alert(1)> not a <script> tag javasjavascript:cript:alert(1) one-pass replace, the rest recombines Plus an attribute breakout in the link renderer, which interpolated the URL into href="${url}" unescaped: [x](" onmouseover=alert(1) x=") -> <a href="" onmouseover=alert(1" ...> Replaced with escaping. Every `&<>"'` in author text becomes an entity before any markdown rule runs, so the only tags in the output are the ones renderInlineMarkdown builds itself and a URL cannot leave its attribute. Link schemes are now an allowlist (http, https, mailto, tel, relative, anchor); anything else renders as plain text. The serializer needed decodeHtmlEntities to match: without it a save would write `&lt;` into the Markdown file and the next parse would escape the `&` again, corrupting the text further on every round trip. A test covers parse -> serialize -> parse stability. Two existing tests asserted the old behaviour and were rewritten rather than deleted: one expected the script tag to be *removed* from the output, the other expected the substring "onerror" to be absent. Both now assert the property that matters — that no tag can form — because `onerror` surviving as inert text is fine. Exploitation required admin access either way: journal and essay text comes from the studio or from content/*.md. This removes the weakness, it does not close an open door. * fix(journal): contain file paths, fix frontmatter escaping, defuse two regexes Follow-up to the CodeQL findings on release PR #432. I went through all 23 alerts individually; this addresses the ones that are worth addressing and documents the ones that are not. Path containment (12 alerts, all false positives). Every path built from a slug goes through isValidSlug(), a strict `/^[a-zA-Z0-9_-]+$/` allowlist — verified against `../../etc/passwd`, `foo/../../bar`, `a/b`, `..` and friends, all rejected. CodeQL cannot see it because the check lives in another module. Added a containedPath() helper that resolves the path and refuses anything landing outside the content directory: a second lock on a door that was already locked, and a barrier the analysis can follow. Also removed the dead `slug.endsWith('.md')` branches — isValidSlug rejects dots, so they could never be taken. Frontmatter escaping (1 alert, a real bug). The serializer escaped `"` but not `\`, and the parser never unescaped anything. A title containing either character gained a backslash on every save/load cycle: Path C:\Users "quoted" -> Path C:\\Users \"quoted\" -> ... Escaping now covers the backslash first and the parser undoes both. A round trip test covers quotes, backslashes, colons and apostrophes. Two of three ReDoS regexes (2 alerts). The heading pattern had `\s+` next to `(.+)`, which overlap, so the engine tried every split of the whitespace run before failing; it is `[ \t]+` and `(\S.*)` now. The quote author pattern wrapped a lazy group around an optional group — the quadratic case — and is an index split on the first separator now. The third regex, the bold/italic pass, is deliberately left alone. Rewriting it with a negated class removes the backtracking but breaks nesting: `**bold *and italic* here**` renders as `*<em>bold </em>and italic<em> here</em>*`. The input is Markdown from an authenticated admin, never a visitor, so the worst case is an author slowing down their own page. The comment in the code says so. Not addressed: 5 js/insufficient-password-hash alerts. They ask for a slow KDF where the code uses SHA-256/HMAC — correct in general, but the admin password comes from an environment variable and is never stored, so a stronger KDF protects nothing that is not already in plaintext in the environment. 399 unit tests pass (18 new), build and tsc clean. * fix(journal): split the quote author by scanning, not by pattern Cleaning up after myself. #439 replaced the quote author regex `/^(.*?)(?:\s+--\s+(.+))?$/` — a lazy group around an optional one, the quadratic case — with `/\s+--\s+/`, and CodeQL promptly flagged the replacement for the same reason. One reported pattern traded for another. splitQuoteAuthor() scans for the first `--` that has whitespace on both sides. Linear, and it needs no reasoning about the regex engine at all. Behaviour is identical to the original regex, checked case by case against it: separator, no separator, several separators, tabs, wide gaps, `a--b` without spaces, leading and trailing separators, empty string. All nine are covered by tests, plus one asserting it stays fast on a 50k whitespace run. * security(admin): derive the session signing key with scrypt getSigningKey() ran the admin password through a single SHA-256 digest. It is key derivation rather than password storage, so it was never a stored-hash problem — but if the derived key ever leaked, one fast hash makes recovering the password by brute force cheap. CodeQL flags it as js/insufficient-password-hash and, for this particular alert, has a point. scrypt now. Two details that matter: The salt has to be stable. A random salt would produce a different key on every call and invalidate every session; it is derived from AUTH_SECRET, which is deployment-specific. Verified across separate processes: same inputs produce a verifying token, so a restart or redeploy does not log everyone out. The result is cached for the process lifetime. scrypt is deliberately slow and getSigningKey() runs on every admin request — deriving per call would add ~24ms to each one. The cache key is a digest of secret plus password, so a rotation misses the cache and derives again, and no extra plaintext copy of the password is kept around. Measured: first derivation 24ms, subsequent calls 0.12ms. Password change and secret change both invalidate an existing token, checked in separate processes. Note the one-time effect: existing admin sessions are invalidated by the change in derivation, so everyone logs in once more. * security(admin): key the signing-key cache on its inputs, not a digest #441 removed the SHA-256 digest of the admin password from the key derivation and introduced a new one three lines above it, as the cache key. Same rule, same file: CodeQL reported it immediately. The comment justifying it was wrong too. It claimed no second plaintext copy of the password was retained, while building the digest input allocates exactly that in order to hash it. The cache now holds the two input strings and compares them directly. They are the same objects the env and install caches already hold, so nothing extra is retained, and no fast hash of the password exists in memory for the life of the process. Re-verified after the change, in separate processes: a token from one process verifies in another with the same inputs, a changed password or secret rejects it, first derivation 24ms, cached calls 0.001ms. That leaves scrypt as the only place the password is hashed here. The two HMACs further down operate on the derived key and on token data, not on the password; the constant-time comparison in verifyAdminPassword is the previously dismissed one. --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
2026-08-14 16:55:07 +02:00
.settings-live-sync-note {
margin: 0 0 1.25rem;
font-size: 0.75rem;
color: var(--admin-text-muted);
display: flex;
align-items: center;
gap: 6px;
}
feat: add visual admin panel with page builder and settings editor - Add /admin route with password-protected visual page builder - Page Builder: manage hero images, standalone albums, subpages, and sections - Album Picker: browse all shared Immich albums with search and filtering - Settings Editor: theme, grid, footer, legal, SEO configuration - YAML service with atomic writes and automatic backups (content/.backups/) - HMAC-signed admin sessions (24h expiry, HttpOnly cookies) - API endpoints: /api/admin/{auth,gallery,settings,albums,reload} - Enable with ADMIN_PASSWORD env var; disabled by default - invalidateConfigCache() export for hot-reload after saves
2026-05-29 17:04:37 +02:00
.settings-layout {
display: grid;
grid-template-columns: 160px 1fr;
gap: 2rem;
}
.settings-nav {
display: flex;
flex-direction: column;
gap: 0.25rem;
}
release: v0.11.0 — journal fixes, admin URLs, design system cleanup (#432) * fix(screenshots): sharp-Typen fuer 0.34 und 0.35 gleichzeitig (#410) sharp 0.35 ist von `export =` auf ESM umgestellt: der Modul-Namespace ist nicht mehr aufrufbar, die Factory sitzt unter .default. Der Type-Check brach damit in scripts/screenshots.ts weg, sobald der Next-Bump (#402) sharp von 0.34.5 auf 0.35.3 mitzieht -- sharp ist hier keine deklarierte Dependency, sondern kommt ueber Next mit. Die Form wird jetzt aus dem installierten Paket abgeleitet statt festgeschrieben, zur Laufzeit wie im Typ. Geprueft mit beiden Versionen: tsc laeuft mit 0.34.5 und mit 0.35.3 fehlerfrei durch. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(deps): bump the nextjs group across 1 directory with 2 updates (#402) Bumps the nextjs group with 2 updates in the / directory: [next](https://github.com/vercel/next.js) and [eslint-config-next](https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next). Updates `next` from 16.2.12 to 16.3.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/compare/v16.2.12...v16.3.0) Updates `eslint-config-next` from 16.2.12 to 16.3.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/commits/v16.3.0/packages/eslint-config-next) --- updated-dependencies: - dependency-name: eslint-config-next dependency-version: 16.3.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: nextjs - dependency-name: next dependency-version: 16.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nextjs ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps-dev): bump prettier from 3.8.3 to 3.9.6 (#405) Bumps [prettier](https://github.com/prettier/prettier) from 3.8.3 to 3.9.6. - [Release notes](https://github.com/prettier/prettier/releases) - [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md) - [Commits](https://github.com/prettier/prettier/compare/3.8.3...3.9.6) --- updated-dependencies: - dependency-name: prettier dependency-version: 3.9.6 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * docs(changelog): Unreleased-Sektion fuer die Bumps nach v0.10.0 (#413) Die Dependency-PRs sind nach dem Release auf dev gelandet, teils auch auf main. Ohne Eintrag waeren sie beim naechsten Release unsichtbar -- inklusive Next 16.3.0, das CVE-2025-13465 mitbringt. Ausserdem im 0.10.0-Abschnitt nachgetragen, dass der Trivy-Scan bis #409 nie gelaufen ist. Der Fix steckt im Tag v0.10.0, fehlte aber in der Aufzaehlung -- und "Images werden bei jedem Publish gescannt" stand im Changelog, waehrend der Job im Action-Setup abbrach. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(gallery): per-album sort order, independent of Immich (#408) (#414) Album order was dictated entirely by Immich: getAlbum() sorted by the album's own asc/desc flag, so a Folio album always mirrored the archive. A curated series has a narrative order that has nothing to do with capture time, and changing the Immich album's sort to fit the website changes it for the archive too. Adds an optional per-album `sort` in gallery.yaml, editable in /admin, defaulting to today's behaviour so every existing config is unchanged: immich (default) | newest | oldest | filename | manual `manual` is a pinned *prefix*: `assetOrder` lists only the photos placed by hand, everything else follows in the album's Immich order. A full permutation of a 2,000-photo album would be ~80 KB of UUIDs in a file that is rewritten and copied to content/.backups/ on every admin save. It also makes drift fall out for free — photos removed in Immich never match, new ones land in the tail rather than being hidden. Sorting is applied after the cache read, not before the cache write, so the LRU keeps one canonical Immich-ordered copy per album. That avoids putting the mode in the cache key, lets a config change take effect without depending on invalidation, and keeps the stale-serving path correct. cache.get() returns the stored object by reference, so withSort() returns a shallow clone with a new array — sorting in place would reorder the shared entry, and under request coalescing every concurrent caller would be sorting the same array. Also fixes a prerequisite bug: /api/admin/albums/[albumId]/assets read album.assets from GET /albums/:id, which Immich 3.x no longer populates (lib/immich.ts:507). The hero picker's "This Album" tab returned nothing and threw outright when the key was absent. It now goes through the client's paginated metadata search, with ?types=all to opt videos in for the reorder editor. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): drop decorative emoji from the sort select labels (#415) An <option> cannot contain markup, so the SVG set in Icons is not reachable there — but a decorative emoji is not a substitute for it. Plain text instead; the album card badge already uses a real icon. The remaining emoji in the admin panel (asset picker tabs, section headings, layout picker options) predate this branch and are left for a separate cleanup. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): replace emoji icons with the shared SVG icon set (#416) The admin panel mixed two icon conventions: inline SVGs from `Icons.tsx` in most components, and decorative emoji in the asset picker and a few PageBuilder labels. Emoji render inconsistently across platforms, ignore the accent colour, and cannot inherit the `.svg-icon` sizing rules. - Icons.tsx: add `IconStar` (filled — it marks a state, not an action) and `IconImage`. - AssetPicker: the three tab labels and the favourite tile badge now use IconFolder / IconStar / IconImage. - PageBuilder: the "Standalone Albums" and "Subpages" headings use the icon set instead of an emoji. - PageBuilder: the layout picker drops its emoji for plain text. An <option> cannot contain markup, so an SVG is impossible there and a decorative glyph is not a substitute. - admin.css: align icon and label in the picker tabs, and swap the favourite badge's text-shadow for drop-shadow, which is what applies to an inline SVG. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): fold PageBuilder's local icons into the shared Icons module (#418) * refactor(admin): fold PageBuilder's local icons into the shared module PageBuilder.tsx carried its own `Icons` object duplicating most of the glyphs already exported by Icons.tsx, with hardcoded sizes and slightly divergent paths. Migrate all 32 call sites to the shared module and delete the local object. Five glyphs had no counterpart and are added to Icons.tsx as 1:1 ports of the local paths: IconX, IconPlus, IconHome, IconCopy, IconImage. The local ExternalLink and Check are dropped rather than ported — both had zero call sites. Two glyphs change shape slightly, which is the point of consolidating: the shared IconCamera includes the viewfinder bump the local copy omitted, and drag handles now use IconGripVertical. IconGripVertical uses the module's square 24x24 viewBox, so `.svg-drag` goes from 12x18 to 18x18 — the old non-square box would letterbox the glyph down to 12x12 and shrink the handle. * fix(admin): resolve icon-module integration after #416 Merging dev brought in #416, which added a second IconImage to Icons.tsx and two <Icons.Camera>/<Icons.Folder> section headers that reference the local Icons object this PR removes. Git merged both cleanly but the result did not type-check. - drop the duplicate IconImage (both copies were byte-identical) - point the two section headers at the imported IconCamera/IconFolder - refresh the SORT_LABELS comment: the icon set is imported now, not declared below --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> * fix(config): allow an empty gallery, guard against a double /api suffix (#421) An empty gallery is now a valid, rendered state instead of a throw: deriveGallery() no longer requires at least one album or subpage, so a deployment with no albums yet renders a bare homepage the owner can fill in via /admin. getConfig() also stops appending /api to an Immich URL that already ends in it, which previously produced .../api/api and broke every upstream request. Includes a restore of the per-album sort test cases, which the branch had lost by being cut before #408/#414. * feat(admin): favicon upload, served from the content volume (#422) Adds a bundled default favicon, an upload widget in admin Settings > General, and a route that serves the icon from the writable content/ volume with a fallback to the bundled default. Raster uploads (PNG/ICO/JPEG) are wrapped in an SVG container; the response carries its own CSP so an uploaded SVG cannot execute script on the origin. The GET route revalidates with an ETag instead of caching immutably, so a newly uploaded icon shows up immediately. Uploads are written via temp file + rename, and a Reset button restores the bundled default. * ci: flag unformatted files in a PR, without blocking it (#424) Prettier is configured as an error rule in eslint.config.mjs but has never run in CI, so part of the tree predates it. A final CI step now diffs against the PR base, runs prettier --list-different over the changed files, and emits a warning annotation per offender plus a job summary. Advisory by design: it never fails the job. Blocking would turn a PR red for merely touching a file that was already unformatted, and normalising the tree in one commit would wreck git blame and conflict with the PRs in flight. Requires fetch-depth: 0, since diffing against the base needs its history. * feat(install): first-run wizard gated by a one-time setup token (#419) Adds /install, a four-step first-run wizard: connect to Immich, optionally pick albums, name the site, finish. It verifies the credentials against the Immich server before writing anything, then writes gallery.yaml, settings.yaml and a content/install.json carrying the Immich credentials and a generated site secret. install.json exists because a running process cannot pick up new env vars — the wizard has to write configuration that takes effect without a restart. getInstallCredentials() merges it under the real environment, so env vars always win and rotation stays a matter of setting one. Both the page and the API routes are gated by a one-time setup token printed to the server log, so a deployment that is reachable before gallery.yaml exists cannot be configured by whoever finds it first. The token is stored in content/.setup-token (0600) rather than a module variable: Next.js bundles the page and each route handler separately, so a module-level token left the page and the API disagreeing inside one process and the wizard stuck on step 1. It is removed once the install completes. The admin password is stored as an scrypt hash using the scheme lib/auth.ts already applies to album passwords; a plaintext ADMIN_PASSWORD env var keeps working. * docs: document the setup wizard, fix the read-only content mount (#425) Quick Start now leads with the /install wizard, with the hand-written YAML route kept alongside it, and a First-Run Setup section covers the setup token, the files the wizard writes, and env-var precedence. Two corrections: both Docker examples mounted content/ as :ro, which silently breaks the wizard, the admin panel and the backup rotation alike — docs/admin-panel.md already said so and the README contradicted it. And nothing documented that content/install.json holds the Immich API key, so a backup of content/ is a backup of credentials. Also adds a Contributors section crediting the people whose work is in the project. * feat(admin): floating save bar pinned to the bottom of the viewport (#426) The save bar was the first, static element inside .admin-main. Since the document itself scrolls, it left the viewport as soon as you scrolled down — editing a subpage section or a settings block far below gave no visible dirty hint and no reachable save button. Replace it with a bottom-pinned floating bar shared by both editors. It only mounts while there is something to act on (unsaved changes, an in-flight save, or a result message), so it never covers content while idle. The success message clears after 5s, which hides the bar again. - new SaveBar component, replacing the duplicated markup in PageBuilder and SettingsEditor - adopt the previously unused .floating-save-bar CSS: slide-in keyframes (carrying translateX(-50%)), dirty border, wrap/gap, mobile variant and a prefers-reduced-motion opt-out; z-index 900 keeps it below modals - .admin-main gains bottom padding so the bar never covers page content - drop the now-unreachable idle hints: the ⌘S hint becomes a button title, the Live Sync note becomes a static line above the settings layout - header "Site" link now bypasses the cache (/?fresh=1), so the preview stays reachable when the bar is hidden Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(admin): themed listbox for the album sort control (#427) The per-album "Photo order" control was a native <select>. Because an <option> cannot contain markup, its choices could not use the admin panel's currentColor SVG set — the reason #415 had to fall back to plain text after dropping the emoji labels. Adds a Listbox component implementing the ARIA combobox/listbox pattern, so options can render a glyph beside their label: - DOM focus stays on the trigger button; the active option is announced through aria-activedescendant, keeping focus management to one element - Keyboard: arrows (clamped at the ends, like a native select), Home/End, Enter/Space to commit, Escape to cancel, Tab commits and moves on, and prefix type-ahead with a repeat-key cycle - Outside dismissal on pointerdown, so a press starting outside closes the popup before the click retargets The sort options now carry an icon each: calendar, arrow-down, arrow-up, an A→Z marker, and the drag glyph for manual — matching the badge the album card already shows. SORT_LABELS stays plain text because the badge feeds it to a title attribute. Closes #417 Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(git): ignore generated design handoff folders * fix(admin): stop the album sort dropdown clipping, and simplify the panel (#428) * fix(admin): render listbox popup in a portal so it escapes modal clipping The sort control's popup was position:absolute inside three clipping ancestors (.album-drawer overflow:hidden > .album-drawer-body overflow-y:auto > .modal-right-column overflow-y:auto), so it was cut off at the bottom of the Edit Album Details modal. z-index could not help: clipping happens before stacking. It also always hung below the trigger, with no flip. Portal the popup to document.body and position it from the trigger's viewport rect, flipping above when there is more room there and capping max-height to the space available so it scrolls internally rather than overflowing. It is dismissed on scroll and resize, since the anchor is only measured on open. The outside-pointerdown handler now also treats the popup as inside; without that the portalled list counts as outside, and a click on an option would close it before the selection commits. * refactor(admin): single-column album details panel The left column spent 1.2fr on a cover thumbnail and three stat rows, two of which (Status, Custom Hero) only restated the form fields opposite them, while the form itself was squeezed into 1.8fr behind a second nested scroller. Stack the drawer in one column instead: cover as a banner, then the form at full width, with the UUID moved into the footer. The body is now the only scroll container, which also removes one of the ancestors that was clipping the sort popup. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> * fix(admin): give the portalled listbox its theme back, lock the page behind modals (#429) Two defects in the album editor. The sort listbox popup painted transparent. Every --admin-* variable is scoped to .admin-layout, and since the popup moved into document.body it sits outside that subtree, so background/border/text all resolved to nothing. It now carries its own copy of the palette in both colour schemes, plus the font it no longer inherits. Scrolling inside a modal also moved the page behind it. No admin modal ever locked body scroll: the overlay covers the page but does not absorb wheel events, so a scroll starting on the backdrop — or continuing past the end of the modal's own scroller — reaches the document. overscroll-behavior cannot cover that case on its own, because it only applies to scroll containers and the backdrop is not one. useScrollLock freezes body while a modal is open and compensates for the width the scrollbar gives up, so nothing shifts underneath. Each lock restores the inline value it found, which makes nesting work without a counter — a picker opened from the drawer restores the drawer's hidden state instead of clearing it. Applied to both drawers and all four picker modals, which share the defect. overscroll-behavior: contain on the scrollers stops the chaining they can handle themselves. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com> * fix(security): allow unsafe-eval in CSP script-src during dev mode * feat(journal): add Journal Studio with split-screen editor, live preview and dedicated routes * fix(build): separate client parser from server journal-service and fix build type errors * fix(journal): Fotos rendern, Layout und Lightbox-Steuerung korrigieren Fünf unabhängige Fehler in der öffentlichen Journal- und Essay-Ansicht: * Foto-Blöcke wurden nie angezeigt. EssayView löst ein Foto über PhotoItem.id auf, und das sind verschlüsselte Tokens — die Blöcke aus dem Markdown tragen aber rohe Asset-UUIDs. Jede Zuordnung lief ins Leere, und nicht auflösbare Blöcke werden still verworfen. Die IDs werden jetzt serverseitig übersetzt; damit verschwinden nebenbei die rohen UUIDs aus dem Client-Payload, die dort laut Projektregel nie auftauchen dürfen. Nicht auflösbare Referenzen werden geloggt. * Überschriften standen weiter links als der Fließtext. Jeder Block hatte einzeln `max-width: 68ch`, und `ch` ist relativ zur Schrift des Elements — die Serif-Überschrift ergab eine breitere Spalte. Ersetzt durch eine gemeinsame, font-unabhängige `--essay-measure`. * Fullbleed-Fotos bluteten nur nach links aus: `.essay-figure` ist `width: 100%`, wodurch die Box überbestimmt ist und der negative rechte Margin verworfen wird. * Foto-Paare stellten beide Bilder gleich breit dar, wodurch ein Hochformat neben einem Querformat doppelt so hoch wurde. Jetzt eine Justified-Reihe: Breite proportional zum Seitenverhältnis, dadurch exakt gleiche Höhen ohne Beschnitt. * Die Lightbox hatte im Journal keine Tastatursteuerung und keine Scroll-Sperre — beides lag in PhotoGrid, also nur im Album-Raster. Verlagert in die Lightbox selbst, der doppelte Handler in PhotoGrid entfernt (sonst wäre pro Pfeildruck zwei Bilder weitergesprungen). Zusätzlich sind Proofing-Herzen und das EXIF-Panel im redaktionellen Modus abschaltbar und im Journal aus: Client-Proofing ist ein Übergabe-Workflow für Alben, keine Funktion einer Reportage. Auf der Übersicht wurde der Untertitel doppelt gerendert, weil extractExcerpt() auf ihn zurückfällt. * feat(admin): eigene URLs für alle Bereiche und überarbeiteter Journal Studio Das Panel war eine einzige Client-Komponente, die ihre Tabs über useState umschaltet: keine Route pro Bereich, kein Deep-Link, kein Zurück-Button, und nach jedem Reload landete man wieder auf "Pages". Auch der Journal-Editor hatte keine eigene URL. Jetzt sieben echte Routen (/admin, /admin/pages, /admin/journal, /admin/journal/<slug>, /admin/settings, /admin/settings/<section>, /admin/analytics). Die Shell mit Auth-Prüfung und Kopfzeile sitzt im Layout und umschließt children — so bleibt die Session-Prüfung über Routenwechsel montiert, statt bei jedem Tab-Wechsel neu zu laufen und den Spinner aufblitzen zu lassen. Unbekannte Settings-Sections fallen auf General zurück. Im selben Zug der Journal Studio, der die Routing-Änderung ohnehin berührt: * Alle Eingabefelder nutzten die Klasse `admin-input`, die in keinem CSS definiert war — sie fielen auf Browser-Defaults zurück. Jetzt gestylt, gescoped, damit der generische Name nicht ins übrige Panel leckt. * Der Split View ist per Divider verschiebbar (Maus, Tastatur, Doppelklick zum Zurücksetzen), Breite in localStorage. * Das Studio bricht aus der 1120px-Spalte aus, die Preview hat Platz. * Die Preview zeigte für jedes Foto fest 3:2 und log damit über das Layout der veröffentlichten Seite; die echten Verhältnisse werden jetzt an den Thumbnails gemessen. * Blöcke mit alten positionsbasierten Foto-Referenzen werden markiert — die lassen sich auf einer eigenständigen Journal-Seite nicht auflösen und verschwanden bisher stillschweigend. * Blocktyp-Chips als gemeinsame Komponente, monochrom und per Icon unterschieden statt in einer eigenen Blau/Lila/Orange-Palette, die sonst nirgends im Panel vorkommt. * Emojis raus, SVG-Icons rein. * fix(admin): Designsystem-Lücken im Panel schließen Eine systematische Suche nach Klassen, die im TSX benutzt, aber in keinem CSS definiert sind, hat vier Stellen mit demselben Muster gefunden: * `admin-btn-secondary` und `admin-btn-danger` existierten nicht. Sämtliche Löschen-Buttons sahen aus wie normale Buttons — keine Warnwirkung. Als `.admin-btn.admin-btn-danger` geschrieben, weil die Varianten mit den Größenklassen kombiniert werden, die weiter unten ihren eigenen Hintergrund setzen. * `page-progress-fill` fehlte: die Balken im Analytics-Panel waren leere Rinnen, der Wert unsichtbar. Ebenso `analytics-empty` und `admin-loading-container`. * `subpage-drawer-section`, `subpage-drawer-title-group` und `input-with-icon` im PageBuilder waren wirkungslos und teils mit Inline-Styles notdürftig kompensiert. * `grid-card-preview` fehlte, wodurch alle Layout-Vorschauen auf Höhe null kollabierten. Nur "Showcase" war sichtbar — und das aus Versehen, weil sein Tile `hero-tile` hieß und damit die `aspect-ratio` einer fremden PageBuilder-Klasse erbte. Umbenannt. Dazu die Theme-Vorschauen, die praktisch identisch aussahen: alle sieben zeigten dieselben drei quadratischen Kacheln, einziger Unterschied war die Hintergrundfarbe. Sie spiegeln jetzt die echten Preset-Daten aus lib/config/theme.ts — Schriftcharakter, Eckradius, Rasterdichte, Passepartout bzw. Schatten. Die Kopfzeile richtet sich an einer gemeinsamen Steuerhöhe aus. Der "Site"-Link war höher als die Buttons daneben: `.admin-btn` hatte keine explizite line-height, und <button> bekommt box-sizing: border-box vom Browser, <a> nicht. Die Statusanzeige setzte weder Schriftfamilie noch -größe und fiel auf den Browser-Default zurück — sie war nie Teil des Designsystems. Jetzt gleiche Höhe und Typografie, Pillenform als Zustandsanzeige, Trenner zur Aktionsgruppe. Das dauerhafte Pulsieren des grünen Punkts entfällt; Animation bleibt den Zuständen vorbehalten, die Aufmerksamkeit brauchen. Restliche Emojis durch SVG-Icons ersetzt. * feat(admin): add scroll-to-top toggle and SVG arrow The back-to-top button was always on and drew its arrow with the ↑ text character. Add a `scrollToTop` setting (General section in the admin panel, defaults to on so existing sites are unaffected) and replace the glyph with a stroked SVG that inherits currentColor across all presets. Scroll handling is now rAF-throttled, and prefers-reduced-motion turns off both the hover lift and the smooth scroll. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * security(journal): escape author HTML instead of filtering it CodeQL flags 26 high-severity alerts on the release PR; the bulk of them point at sanitizeHtml(), a denylist of three regexes whose output goes into dangerouslySetInnerHTML. I reproduced the bypasses before changing anything — all four pass the old filter: <img src=x onerror=alert(1)> unquoted handler, regex wants quotes <img src=x onerror='alert(1)'> single quotes, same reason <svg onload=alert(1)> not a <script> tag javasjavascript:cript:alert(1) one-pass replace, the rest recombines Plus an attribute breakout in the link renderer, which interpolated the URL into href="${url}" unescaped: [x](" onmouseover=alert(1) x=") -> <a href="" onmouseover=alert(1" ...> Replaced with escaping. Every `&<>"'` in author text becomes an entity before any markdown rule runs, so the only tags in the output are the ones renderInlineMarkdown builds itself and a URL cannot leave its attribute. Link schemes are now an allowlist (http, https, mailto, tel, relative, anchor); anything else renders as plain text. The serializer needed decodeHtmlEntities to match: without it a save would write `&lt;` into the Markdown file and the next parse would escape the `&` again, corrupting the text further on every round trip. A test covers parse -> serialize -> parse stability. Two existing tests asserted the old behaviour and were rewritten rather than deleted: one expected the script tag to be *removed* from the output, the other expected the substring "onerror" to be absent. Both now assert the property that matters — that no tag can form — because `onerror` surviving as inert text is fine. Exploitation required admin access either way: journal and essay text comes from the studio or from content/*.md. This removes the weakness, it does not close an open door. * fix(journal): contain file paths, fix frontmatter escaping, defuse two regexes Follow-up to the CodeQL findings on release PR #432. I went through all 23 alerts individually; this addresses the ones that are worth addressing and documents the ones that are not. Path containment (12 alerts, all false positives). Every path built from a slug goes through isValidSlug(), a strict `/^[a-zA-Z0-9_-]+$/` allowlist — verified against `../../etc/passwd`, `foo/../../bar`, `a/b`, `..` and friends, all rejected. CodeQL cannot see it because the check lives in another module. Added a containedPath() helper that resolves the path and refuses anything landing outside the content directory: a second lock on a door that was already locked, and a barrier the analysis can follow. Also removed the dead `slug.endsWith('.md')` branches — isValidSlug rejects dots, so they could never be taken. Frontmatter escaping (1 alert, a real bug). The serializer escaped `"` but not `\`, and the parser never unescaped anything. A title containing either character gained a backslash on every save/load cycle: Path C:\Users "quoted" -> Path C:\\Users \"quoted\" -> ... Escaping now covers the backslash first and the parser undoes both. A round trip test covers quotes, backslashes, colons and apostrophes. Two of three ReDoS regexes (2 alerts). The heading pattern had `\s+` next to `(.+)`, which overlap, so the engine tried every split of the whitespace run before failing; it is `[ \t]+` and `(\S.*)` now. The quote author pattern wrapped a lazy group around an optional group — the quadratic case — and is an index split on the first separator now. The third regex, the bold/italic pass, is deliberately left alone. Rewriting it with a negated class removes the backtracking but breaks nesting: `**bold *and italic* here**` renders as `*<em>bold </em>and italic<em> here</em>*`. The input is Markdown from an authenticated admin, never a visitor, so the worst case is an author slowing down their own page. The comment in the code says so. Not addressed: 5 js/insufficient-password-hash alerts. They ask for a slow KDF where the code uses SHA-256/HMAC — correct in general, but the admin password comes from an environment variable and is never stored, so a stronger KDF protects nothing that is not already in plaintext in the environment. 399 unit tests pass (18 new), build and tsc clean. * fix(journal): split the quote author by scanning, not by pattern Cleaning up after myself. #439 replaced the quote author regex `/^(.*?)(?:\s+--\s+(.+))?$/` — a lazy group around an optional one, the quadratic case — with `/\s+--\s+/`, and CodeQL promptly flagged the replacement for the same reason. One reported pattern traded for another. splitQuoteAuthor() scans for the first `--` that has whitespace on both sides. Linear, and it needs no reasoning about the regex engine at all. Behaviour is identical to the original regex, checked case by case against it: separator, no separator, several separators, tabs, wide gaps, `a--b` without spaces, leading and trailing separators, empty string. All nine are covered by tests, plus one asserting it stays fast on a 50k whitespace run. * security(admin): derive the session signing key with scrypt getSigningKey() ran the admin password through a single SHA-256 digest. It is key derivation rather than password storage, so it was never a stored-hash problem — but if the derived key ever leaked, one fast hash makes recovering the password by brute force cheap. CodeQL flags it as js/insufficient-password-hash and, for this particular alert, has a point. scrypt now. Two details that matter: The salt has to be stable. A random salt would produce a different key on every call and invalidate every session; it is derived from AUTH_SECRET, which is deployment-specific. Verified across separate processes: same inputs produce a verifying token, so a restart or redeploy does not log everyone out. The result is cached for the process lifetime. scrypt is deliberately slow and getSigningKey() runs on every admin request — deriving per call would add ~24ms to each one. The cache key is a digest of secret plus password, so a rotation misses the cache and derives again, and no extra plaintext copy of the password is kept around. Measured: first derivation 24ms, subsequent calls 0.12ms. Password change and secret change both invalidate an existing token, checked in separate processes. Note the one-time effect: existing admin sessions are invalidated by the change in derivation, so everyone logs in once more. * security(admin): key the signing-key cache on its inputs, not a digest #441 removed the SHA-256 digest of the admin password from the key derivation and introduced a new one three lines above it, as the cache key. Same rule, same file: CodeQL reported it immediately. The comment justifying it was wrong too. It claimed no second plaintext copy of the password was retained, while building the digest input allocates exactly that in order to hash it. The cache now holds the two input strings and compares them directly. They are the same objects the env and install caches already hold, so nothing extra is retained, and no fast hash of the password exists in memory for the life of the process. Re-verified after the change, in separate processes: a token from one process verifies in another with the same inputs, a changed password or secret rejects it, first derivation 24ms, cached calls 0.001ms. That leaves scrypt as the only place the password is hashed here. The two HMACs further down operate on the derived key and on token data, not on the password; the constant-time comparison in verifyAdminPassword is the previously dismissed one. --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
2026-08-14 16:55:07 +02:00
/* Rendered as an <a> — each settings section is its own route. */
feat: add visual admin panel with page builder and settings editor - Add /admin route with password-protected visual page builder - Page Builder: manage hero images, standalone albums, subpages, and sections - Album Picker: browse all shared Immich albums with search and filtering - Settings Editor: theme, grid, footer, legal, SEO configuration - YAML service with atomic writes and automatic backups (content/.backups/) - HMAC-signed admin sessions (24h expiry, HttpOnly cookies) - API endpoints: /api/admin/{auth,gallery,settings,albums,reload} - Enable with ADMIN_PASSWORD env var; disabled by default - invalidateConfigCache() export for hot-reload after saves
2026-05-29 17:04:37 +02:00
.settings-nav-item {
background: none;
border: none;
fix: admin panel light/dark theme support, improved contrast, and backup confirmation a) Admin panel now respects the site's light/dark theme toggle via CSS custom properties that respond to [data-theme='light'] on <html>. All hardcoded dark colors replaced with semantic CSS variables. b) Improved contrast in dark mode: secondary text changed from #666/#555 to #a0a0a0, muted text from #555 to #707070. All text is now clearly readable against dark backgrounds. c) Backup system was already implemented in yaml-service.ts (creates timestamped backups in content/.backups/ before each save, keeps last 10 versions). Now the UI shows a confirmation message that a backup was created after each successful save.
2026-05-29 17:20:56 +02:00
color: var(--admin-text-muted);
feat: add visual admin panel with page builder and settings editor - Add /admin route with password-protected visual page builder - Page Builder: manage hero images, standalone albums, subpages, and sections - Album Picker: browse all shared Immich albums with search and filtering - Settings Editor: theme, grid, footer, legal, SEO configuration - YAML service with atomic writes and automatic backups (content/.backups/) - HMAC-signed admin sessions (24h expiry, HttpOnly cookies) - API endpoints: /api/admin/{auth,gallery,settings,albums,reload} - Enable with ADMIN_PASSWORD env var; disabled by default - invalidateConfigCache() export for hot-reload after saves
2026-05-29 17:04:37 +02:00
text-align: left;
padding: 0.5rem 0.75rem;
font-size: 0.85rem;
border-radius: 6px;
cursor: pointer;
transition: all 0.1s;
release: v0.11.0 — journal fixes, admin URLs, design system cleanup (#432) * fix(screenshots): sharp-Typen fuer 0.34 und 0.35 gleichzeitig (#410) sharp 0.35 ist von `export =` auf ESM umgestellt: der Modul-Namespace ist nicht mehr aufrufbar, die Factory sitzt unter .default. Der Type-Check brach damit in scripts/screenshots.ts weg, sobald der Next-Bump (#402) sharp von 0.34.5 auf 0.35.3 mitzieht -- sharp ist hier keine deklarierte Dependency, sondern kommt ueber Next mit. Die Form wird jetzt aus dem installierten Paket abgeleitet statt festgeschrieben, zur Laufzeit wie im Typ. Geprueft mit beiden Versionen: tsc laeuft mit 0.34.5 und mit 0.35.3 fehlerfrei durch. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(deps): bump the nextjs group across 1 directory with 2 updates (#402) Bumps the nextjs group with 2 updates in the / directory: [next](https://github.com/vercel/next.js) and [eslint-config-next](https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next). Updates `next` from 16.2.12 to 16.3.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/compare/v16.2.12...v16.3.0) Updates `eslint-config-next` from 16.2.12 to 16.3.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/commits/v16.3.0/packages/eslint-config-next) --- updated-dependencies: - dependency-name: eslint-config-next dependency-version: 16.3.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: nextjs - dependency-name: next dependency-version: 16.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nextjs ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps-dev): bump prettier from 3.8.3 to 3.9.6 (#405) Bumps [prettier](https://github.com/prettier/prettier) from 3.8.3 to 3.9.6. - [Release notes](https://github.com/prettier/prettier/releases) - [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md) - [Commits](https://github.com/prettier/prettier/compare/3.8.3...3.9.6) --- updated-dependencies: - dependency-name: prettier dependency-version: 3.9.6 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * docs(changelog): Unreleased-Sektion fuer die Bumps nach v0.10.0 (#413) Die Dependency-PRs sind nach dem Release auf dev gelandet, teils auch auf main. Ohne Eintrag waeren sie beim naechsten Release unsichtbar -- inklusive Next 16.3.0, das CVE-2025-13465 mitbringt. Ausserdem im 0.10.0-Abschnitt nachgetragen, dass der Trivy-Scan bis #409 nie gelaufen ist. Der Fix steckt im Tag v0.10.0, fehlte aber in der Aufzaehlung -- und "Images werden bei jedem Publish gescannt" stand im Changelog, waehrend der Job im Action-Setup abbrach. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(gallery): per-album sort order, independent of Immich (#408) (#414) Album order was dictated entirely by Immich: getAlbum() sorted by the album's own asc/desc flag, so a Folio album always mirrored the archive. A curated series has a narrative order that has nothing to do with capture time, and changing the Immich album's sort to fit the website changes it for the archive too. Adds an optional per-album `sort` in gallery.yaml, editable in /admin, defaulting to today's behaviour so every existing config is unchanged: immich (default) | newest | oldest | filename | manual `manual` is a pinned *prefix*: `assetOrder` lists only the photos placed by hand, everything else follows in the album's Immich order. A full permutation of a 2,000-photo album would be ~80 KB of UUIDs in a file that is rewritten and copied to content/.backups/ on every admin save. It also makes drift fall out for free — photos removed in Immich never match, new ones land in the tail rather than being hidden. Sorting is applied after the cache read, not before the cache write, so the LRU keeps one canonical Immich-ordered copy per album. That avoids putting the mode in the cache key, lets a config change take effect without depending on invalidation, and keeps the stale-serving path correct. cache.get() returns the stored object by reference, so withSort() returns a shallow clone with a new array — sorting in place would reorder the shared entry, and under request coalescing every concurrent caller would be sorting the same array. Also fixes a prerequisite bug: /api/admin/albums/[albumId]/assets read album.assets from GET /albums/:id, which Immich 3.x no longer populates (lib/immich.ts:507). The hero picker's "This Album" tab returned nothing and threw outright when the key was absent. It now goes through the client's paginated metadata search, with ?types=all to opt videos in for the reorder editor. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): drop decorative emoji from the sort select labels (#415) An <option> cannot contain markup, so the SVG set in Icons is not reachable there — but a decorative emoji is not a substitute for it. Plain text instead; the album card badge already uses a real icon. The remaining emoji in the admin panel (asset picker tabs, section headings, layout picker options) predate this branch and are left for a separate cleanup. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): replace emoji icons with the shared SVG icon set (#416) The admin panel mixed two icon conventions: inline SVGs from `Icons.tsx` in most components, and decorative emoji in the asset picker and a few PageBuilder labels. Emoji render inconsistently across platforms, ignore the accent colour, and cannot inherit the `.svg-icon` sizing rules. - Icons.tsx: add `IconStar` (filled — it marks a state, not an action) and `IconImage`. - AssetPicker: the three tab labels and the favourite tile badge now use IconFolder / IconStar / IconImage. - PageBuilder: the "Standalone Albums" and "Subpages" headings use the icon set instead of an emoji. - PageBuilder: the layout picker drops its emoji for plain text. An <option> cannot contain markup, so an SVG is impossible there and a decorative glyph is not a substitute. - admin.css: align icon and label in the picker tabs, and swap the favourite badge's text-shadow for drop-shadow, which is what applies to an inline SVG. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): fold PageBuilder's local icons into the shared Icons module (#418) * refactor(admin): fold PageBuilder's local icons into the shared module PageBuilder.tsx carried its own `Icons` object duplicating most of the glyphs already exported by Icons.tsx, with hardcoded sizes and slightly divergent paths. Migrate all 32 call sites to the shared module and delete the local object. Five glyphs had no counterpart and are added to Icons.tsx as 1:1 ports of the local paths: IconX, IconPlus, IconHome, IconCopy, IconImage. The local ExternalLink and Check are dropped rather than ported — both had zero call sites. Two glyphs change shape slightly, which is the point of consolidating: the shared IconCamera includes the viewfinder bump the local copy omitted, and drag handles now use IconGripVertical. IconGripVertical uses the module's square 24x24 viewBox, so `.svg-drag` goes from 12x18 to 18x18 — the old non-square box would letterbox the glyph down to 12x12 and shrink the handle. * fix(admin): resolve icon-module integration after #416 Merging dev brought in #416, which added a second IconImage to Icons.tsx and two <Icons.Camera>/<Icons.Folder> section headers that reference the local Icons object this PR removes. Git merged both cleanly but the result did not type-check. - drop the duplicate IconImage (both copies were byte-identical) - point the two section headers at the imported IconCamera/IconFolder - refresh the SORT_LABELS comment: the icon set is imported now, not declared below --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> * fix(config): allow an empty gallery, guard against a double /api suffix (#421) An empty gallery is now a valid, rendered state instead of a throw: deriveGallery() no longer requires at least one album or subpage, so a deployment with no albums yet renders a bare homepage the owner can fill in via /admin. getConfig() also stops appending /api to an Immich URL that already ends in it, which previously produced .../api/api and broke every upstream request. Includes a restore of the per-album sort test cases, which the branch had lost by being cut before #408/#414. * feat(admin): favicon upload, served from the content volume (#422) Adds a bundled default favicon, an upload widget in admin Settings > General, and a route that serves the icon from the writable content/ volume with a fallback to the bundled default. Raster uploads (PNG/ICO/JPEG) are wrapped in an SVG container; the response carries its own CSP so an uploaded SVG cannot execute script on the origin. The GET route revalidates with an ETag instead of caching immutably, so a newly uploaded icon shows up immediately. Uploads are written via temp file + rename, and a Reset button restores the bundled default. * ci: flag unformatted files in a PR, without blocking it (#424) Prettier is configured as an error rule in eslint.config.mjs but has never run in CI, so part of the tree predates it. A final CI step now diffs against the PR base, runs prettier --list-different over the changed files, and emits a warning annotation per offender plus a job summary. Advisory by design: it never fails the job. Blocking would turn a PR red for merely touching a file that was already unformatted, and normalising the tree in one commit would wreck git blame and conflict with the PRs in flight. Requires fetch-depth: 0, since diffing against the base needs its history. * feat(install): first-run wizard gated by a one-time setup token (#419) Adds /install, a four-step first-run wizard: connect to Immich, optionally pick albums, name the site, finish. It verifies the credentials against the Immich server before writing anything, then writes gallery.yaml, settings.yaml and a content/install.json carrying the Immich credentials and a generated site secret. install.json exists because a running process cannot pick up new env vars — the wizard has to write configuration that takes effect without a restart. getInstallCredentials() merges it under the real environment, so env vars always win and rotation stays a matter of setting one. Both the page and the API routes are gated by a one-time setup token printed to the server log, so a deployment that is reachable before gallery.yaml exists cannot be configured by whoever finds it first. The token is stored in content/.setup-token (0600) rather than a module variable: Next.js bundles the page and each route handler separately, so a module-level token left the page and the API disagreeing inside one process and the wizard stuck on step 1. It is removed once the install completes. The admin password is stored as an scrypt hash using the scheme lib/auth.ts already applies to album passwords; a plaintext ADMIN_PASSWORD env var keeps working. * docs: document the setup wizard, fix the read-only content mount (#425) Quick Start now leads with the /install wizard, with the hand-written YAML route kept alongside it, and a First-Run Setup section covers the setup token, the files the wizard writes, and env-var precedence. Two corrections: both Docker examples mounted content/ as :ro, which silently breaks the wizard, the admin panel and the backup rotation alike — docs/admin-panel.md already said so and the README contradicted it. And nothing documented that content/install.json holds the Immich API key, so a backup of content/ is a backup of credentials. Also adds a Contributors section crediting the people whose work is in the project. * feat(admin): floating save bar pinned to the bottom of the viewport (#426) The save bar was the first, static element inside .admin-main. Since the document itself scrolls, it left the viewport as soon as you scrolled down — editing a subpage section or a settings block far below gave no visible dirty hint and no reachable save button. Replace it with a bottom-pinned floating bar shared by both editors. It only mounts while there is something to act on (unsaved changes, an in-flight save, or a result message), so it never covers content while idle. The success message clears after 5s, which hides the bar again. - new SaveBar component, replacing the duplicated markup in PageBuilder and SettingsEditor - adopt the previously unused .floating-save-bar CSS: slide-in keyframes (carrying translateX(-50%)), dirty border, wrap/gap, mobile variant and a prefers-reduced-motion opt-out; z-index 900 keeps it below modals - .admin-main gains bottom padding so the bar never covers page content - drop the now-unreachable idle hints: the ⌘S hint becomes a button title, the Live Sync note becomes a static line above the settings layout - header "Site" link now bypasses the cache (/?fresh=1), so the preview stays reachable when the bar is hidden Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(admin): themed listbox for the album sort control (#427) The per-album "Photo order" control was a native <select>. Because an <option> cannot contain markup, its choices could not use the admin panel's currentColor SVG set — the reason #415 had to fall back to plain text after dropping the emoji labels. Adds a Listbox component implementing the ARIA combobox/listbox pattern, so options can render a glyph beside their label: - DOM focus stays on the trigger button; the active option is announced through aria-activedescendant, keeping focus management to one element - Keyboard: arrows (clamped at the ends, like a native select), Home/End, Enter/Space to commit, Escape to cancel, Tab commits and moves on, and prefix type-ahead with a repeat-key cycle - Outside dismissal on pointerdown, so a press starting outside closes the popup before the click retargets The sort options now carry an icon each: calendar, arrow-down, arrow-up, an A→Z marker, and the drag glyph for manual — matching the badge the album card already shows. SORT_LABELS stays plain text because the badge feeds it to a title attribute. Closes #417 Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(git): ignore generated design handoff folders * fix(admin): stop the album sort dropdown clipping, and simplify the panel (#428) * fix(admin): render listbox popup in a portal so it escapes modal clipping The sort control's popup was position:absolute inside three clipping ancestors (.album-drawer overflow:hidden > .album-drawer-body overflow-y:auto > .modal-right-column overflow-y:auto), so it was cut off at the bottom of the Edit Album Details modal. z-index could not help: clipping happens before stacking. It also always hung below the trigger, with no flip. Portal the popup to document.body and position it from the trigger's viewport rect, flipping above when there is more room there and capping max-height to the space available so it scrolls internally rather than overflowing. It is dismissed on scroll and resize, since the anchor is only measured on open. The outside-pointerdown handler now also treats the popup as inside; without that the portalled list counts as outside, and a click on an option would close it before the selection commits. * refactor(admin): single-column album details panel The left column spent 1.2fr on a cover thumbnail and three stat rows, two of which (Status, Custom Hero) only restated the form fields opposite them, while the form itself was squeezed into 1.8fr behind a second nested scroller. Stack the drawer in one column instead: cover as a banner, then the form at full width, with the UUID moved into the footer. The body is now the only scroll container, which also removes one of the ancestors that was clipping the sort popup. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> * fix(admin): give the portalled listbox its theme back, lock the page behind modals (#429) Two defects in the album editor. The sort listbox popup painted transparent. Every --admin-* variable is scoped to .admin-layout, and since the popup moved into document.body it sits outside that subtree, so background/border/text all resolved to nothing. It now carries its own copy of the palette in both colour schemes, plus the font it no longer inherits. Scrolling inside a modal also moved the page behind it. No admin modal ever locked body scroll: the overlay covers the page but does not absorb wheel events, so a scroll starting on the backdrop — or continuing past the end of the modal's own scroller — reaches the document. overscroll-behavior cannot cover that case on its own, because it only applies to scroll containers and the backdrop is not one. useScrollLock freezes body while a modal is open and compensates for the width the scrollbar gives up, so nothing shifts underneath. Each lock restores the inline value it found, which makes nesting work without a counter — a picker opened from the drawer restores the drawer's hidden state instead of clearing it. Applied to both drawers and all four picker modals, which share the defect. overscroll-behavior: contain on the scrollers stops the chaining they can handle themselves. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com> * fix(security): allow unsafe-eval in CSP script-src during dev mode * feat(journal): add Journal Studio with split-screen editor, live preview and dedicated routes * fix(build): separate client parser from server journal-service and fix build type errors * fix(journal): Fotos rendern, Layout und Lightbox-Steuerung korrigieren Fünf unabhängige Fehler in der öffentlichen Journal- und Essay-Ansicht: * Foto-Blöcke wurden nie angezeigt. EssayView löst ein Foto über PhotoItem.id auf, und das sind verschlüsselte Tokens — die Blöcke aus dem Markdown tragen aber rohe Asset-UUIDs. Jede Zuordnung lief ins Leere, und nicht auflösbare Blöcke werden still verworfen. Die IDs werden jetzt serverseitig übersetzt; damit verschwinden nebenbei die rohen UUIDs aus dem Client-Payload, die dort laut Projektregel nie auftauchen dürfen. Nicht auflösbare Referenzen werden geloggt. * Überschriften standen weiter links als der Fließtext. Jeder Block hatte einzeln `max-width: 68ch`, und `ch` ist relativ zur Schrift des Elements — die Serif-Überschrift ergab eine breitere Spalte. Ersetzt durch eine gemeinsame, font-unabhängige `--essay-measure`. * Fullbleed-Fotos bluteten nur nach links aus: `.essay-figure` ist `width: 100%`, wodurch die Box überbestimmt ist und der negative rechte Margin verworfen wird. * Foto-Paare stellten beide Bilder gleich breit dar, wodurch ein Hochformat neben einem Querformat doppelt so hoch wurde. Jetzt eine Justified-Reihe: Breite proportional zum Seitenverhältnis, dadurch exakt gleiche Höhen ohne Beschnitt. * Die Lightbox hatte im Journal keine Tastatursteuerung und keine Scroll-Sperre — beides lag in PhotoGrid, also nur im Album-Raster. Verlagert in die Lightbox selbst, der doppelte Handler in PhotoGrid entfernt (sonst wäre pro Pfeildruck zwei Bilder weitergesprungen). Zusätzlich sind Proofing-Herzen und das EXIF-Panel im redaktionellen Modus abschaltbar und im Journal aus: Client-Proofing ist ein Übergabe-Workflow für Alben, keine Funktion einer Reportage. Auf der Übersicht wurde der Untertitel doppelt gerendert, weil extractExcerpt() auf ihn zurückfällt. * feat(admin): eigene URLs für alle Bereiche und überarbeiteter Journal Studio Das Panel war eine einzige Client-Komponente, die ihre Tabs über useState umschaltet: keine Route pro Bereich, kein Deep-Link, kein Zurück-Button, und nach jedem Reload landete man wieder auf "Pages". Auch der Journal-Editor hatte keine eigene URL. Jetzt sieben echte Routen (/admin, /admin/pages, /admin/journal, /admin/journal/<slug>, /admin/settings, /admin/settings/<section>, /admin/analytics). Die Shell mit Auth-Prüfung und Kopfzeile sitzt im Layout und umschließt children — so bleibt die Session-Prüfung über Routenwechsel montiert, statt bei jedem Tab-Wechsel neu zu laufen und den Spinner aufblitzen zu lassen. Unbekannte Settings-Sections fallen auf General zurück. Im selben Zug der Journal Studio, der die Routing-Änderung ohnehin berührt: * Alle Eingabefelder nutzten die Klasse `admin-input`, die in keinem CSS definiert war — sie fielen auf Browser-Defaults zurück. Jetzt gestylt, gescoped, damit der generische Name nicht ins übrige Panel leckt. * Der Split View ist per Divider verschiebbar (Maus, Tastatur, Doppelklick zum Zurücksetzen), Breite in localStorage. * Das Studio bricht aus der 1120px-Spalte aus, die Preview hat Platz. * Die Preview zeigte für jedes Foto fest 3:2 und log damit über das Layout der veröffentlichten Seite; die echten Verhältnisse werden jetzt an den Thumbnails gemessen. * Blöcke mit alten positionsbasierten Foto-Referenzen werden markiert — die lassen sich auf einer eigenständigen Journal-Seite nicht auflösen und verschwanden bisher stillschweigend. * Blocktyp-Chips als gemeinsame Komponente, monochrom und per Icon unterschieden statt in einer eigenen Blau/Lila/Orange-Palette, die sonst nirgends im Panel vorkommt. * Emojis raus, SVG-Icons rein. * fix(admin): Designsystem-Lücken im Panel schließen Eine systematische Suche nach Klassen, die im TSX benutzt, aber in keinem CSS definiert sind, hat vier Stellen mit demselben Muster gefunden: * `admin-btn-secondary` und `admin-btn-danger` existierten nicht. Sämtliche Löschen-Buttons sahen aus wie normale Buttons — keine Warnwirkung. Als `.admin-btn.admin-btn-danger` geschrieben, weil die Varianten mit den Größenklassen kombiniert werden, die weiter unten ihren eigenen Hintergrund setzen. * `page-progress-fill` fehlte: die Balken im Analytics-Panel waren leere Rinnen, der Wert unsichtbar. Ebenso `analytics-empty` und `admin-loading-container`. * `subpage-drawer-section`, `subpage-drawer-title-group` und `input-with-icon` im PageBuilder waren wirkungslos und teils mit Inline-Styles notdürftig kompensiert. * `grid-card-preview` fehlte, wodurch alle Layout-Vorschauen auf Höhe null kollabierten. Nur "Showcase" war sichtbar — und das aus Versehen, weil sein Tile `hero-tile` hieß und damit die `aspect-ratio` einer fremden PageBuilder-Klasse erbte. Umbenannt. Dazu die Theme-Vorschauen, die praktisch identisch aussahen: alle sieben zeigten dieselben drei quadratischen Kacheln, einziger Unterschied war die Hintergrundfarbe. Sie spiegeln jetzt die echten Preset-Daten aus lib/config/theme.ts — Schriftcharakter, Eckradius, Rasterdichte, Passepartout bzw. Schatten. Die Kopfzeile richtet sich an einer gemeinsamen Steuerhöhe aus. Der "Site"-Link war höher als die Buttons daneben: `.admin-btn` hatte keine explizite line-height, und <button> bekommt box-sizing: border-box vom Browser, <a> nicht. Die Statusanzeige setzte weder Schriftfamilie noch -größe und fiel auf den Browser-Default zurück — sie war nie Teil des Designsystems. Jetzt gleiche Höhe und Typografie, Pillenform als Zustandsanzeige, Trenner zur Aktionsgruppe. Das dauerhafte Pulsieren des grünen Punkts entfällt; Animation bleibt den Zuständen vorbehalten, die Aufmerksamkeit brauchen. Restliche Emojis durch SVG-Icons ersetzt. * feat(admin): add scroll-to-top toggle and SVG arrow The back-to-top button was always on and drew its arrow with the ↑ text character. Add a `scrollToTop` setting (General section in the admin panel, defaults to on so existing sites are unaffected) and replace the glyph with a stroked SVG that inherits currentColor across all presets. Scroll handling is now rAF-throttled, and prefers-reduced-motion turns off both the hover lift and the smooth scroll. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * security(journal): escape author HTML instead of filtering it CodeQL flags 26 high-severity alerts on the release PR; the bulk of them point at sanitizeHtml(), a denylist of three regexes whose output goes into dangerouslySetInnerHTML. I reproduced the bypasses before changing anything — all four pass the old filter: <img src=x onerror=alert(1)> unquoted handler, regex wants quotes <img src=x onerror='alert(1)'> single quotes, same reason <svg onload=alert(1)> not a <script> tag javasjavascript:cript:alert(1) one-pass replace, the rest recombines Plus an attribute breakout in the link renderer, which interpolated the URL into href="${url}" unescaped: [x](" onmouseover=alert(1) x=") -> <a href="" onmouseover=alert(1" ...> Replaced with escaping. Every `&<>"'` in author text becomes an entity before any markdown rule runs, so the only tags in the output are the ones renderInlineMarkdown builds itself and a URL cannot leave its attribute. Link schemes are now an allowlist (http, https, mailto, tel, relative, anchor); anything else renders as plain text. The serializer needed decodeHtmlEntities to match: without it a save would write `&lt;` into the Markdown file and the next parse would escape the `&` again, corrupting the text further on every round trip. A test covers parse -> serialize -> parse stability. Two existing tests asserted the old behaviour and were rewritten rather than deleted: one expected the script tag to be *removed* from the output, the other expected the substring "onerror" to be absent. Both now assert the property that matters — that no tag can form — because `onerror` surviving as inert text is fine. Exploitation required admin access either way: journal and essay text comes from the studio or from content/*.md. This removes the weakness, it does not close an open door. * fix(journal): contain file paths, fix frontmatter escaping, defuse two regexes Follow-up to the CodeQL findings on release PR #432. I went through all 23 alerts individually; this addresses the ones that are worth addressing and documents the ones that are not. Path containment (12 alerts, all false positives). Every path built from a slug goes through isValidSlug(), a strict `/^[a-zA-Z0-9_-]+$/` allowlist — verified against `../../etc/passwd`, `foo/../../bar`, `a/b`, `..` and friends, all rejected. CodeQL cannot see it because the check lives in another module. Added a containedPath() helper that resolves the path and refuses anything landing outside the content directory: a second lock on a door that was already locked, and a barrier the analysis can follow. Also removed the dead `slug.endsWith('.md')` branches — isValidSlug rejects dots, so they could never be taken. Frontmatter escaping (1 alert, a real bug). The serializer escaped `"` but not `\`, and the parser never unescaped anything. A title containing either character gained a backslash on every save/load cycle: Path C:\Users "quoted" -> Path C:\\Users \"quoted\" -> ... Escaping now covers the backslash first and the parser undoes both. A round trip test covers quotes, backslashes, colons and apostrophes. Two of three ReDoS regexes (2 alerts). The heading pattern had `\s+` next to `(.+)`, which overlap, so the engine tried every split of the whitespace run before failing; it is `[ \t]+` and `(\S.*)` now. The quote author pattern wrapped a lazy group around an optional group — the quadratic case — and is an index split on the first separator now. The third regex, the bold/italic pass, is deliberately left alone. Rewriting it with a negated class removes the backtracking but breaks nesting: `**bold *and italic* here**` renders as `*<em>bold </em>and italic<em> here</em>*`. The input is Markdown from an authenticated admin, never a visitor, so the worst case is an author slowing down their own page. The comment in the code says so. Not addressed: 5 js/insufficient-password-hash alerts. They ask for a slow KDF where the code uses SHA-256/HMAC — correct in general, but the admin password comes from an environment variable and is never stored, so a stronger KDF protects nothing that is not already in plaintext in the environment. 399 unit tests pass (18 new), build and tsc clean. * fix(journal): split the quote author by scanning, not by pattern Cleaning up after myself. #439 replaced the quote author regex `/^(.*?)(?:\s+--\s+(.+))?$/` — a lazy group around an optional one, the quadratic case — with `/\s+--\s+/`, and CodeQL promptly flagged the replacement for the same reason. One reported pattern traded for another. splitQuoteAuthor() scans for the first `--` that has whitespace on both sides. Linear, and it needs no reasoning about the regex engine at all. Behaviour is identical to the original regex, checked case by case against it: separator, no separator, several separators, tabs, wide gaps, `a--b` without spaces, leading and trailing separators, empty string. All nine are covered by tests, plus one asserting it stays fast on a 50k whitespace run. * security(admin): derive the session signing key with scrypt getSigningKey() ran the admin password through a single SHA-256 digest. It is key derivation rather than password storage, so it was never a stored-hash problem — but if the derived key ever leaked, one fast hash makes recovering the password by brute force cheap. CodeQL flags it as js/insufficient-password-hash and, for this particular alert, has a point. scrypt now. Two details that matter: The salt has to be stable. A random salt would produce a different key on every call and invalidate every session; it is derived from AUTH_SECRET, which is deployment-specific. Verified across separate processes: same inputs produce a verifying token, so a restart or redeploy does not log everyone out. The result is cached for the process lifetime. scrypt is deliberately slow and getSigningKey() runs on every admin request — deriving per call would add ~24ms to each one. The cache key is a digest of secret plus password, so a rotation misses the cache and derives again, and no extra plaintext copy of the password is kept around. Measured: first derivation 24ms, subsequent calls 0.12ms. Password change and secret change both invalidate an existing token, checked in separate processes. Note the one-time effect: existing admin sessions are invalidated by the change in derivation, so everyone logs in once more. * security(admin): key the signing-key cache on its inputs, not a digest #441 removed the SHA-256 digest of the admin password from the key derivation and introduced a new one three lines above it, as the cache key. Same rule, same file: CodeQL reported it immediately. The comment justifying it was wrong too. It claimed no second plaintext copy of the password was retained, while building the digest input allocates exactly that in order to hash it. The cache now holds the two input strings and compares them directly. They are the same objects the env and install caches already hold, so nothing extra is retained, and no fast hash of the password exists in memory for the life of the process. Re-verified after the change, in separate processes: a token from one process verifies in another with the same inputs, a changed password or secret rejects it, first derivation 24ms, cached calls 0.001ms. That leaves scrypt as the only place the password is hashed here. The two HMACs further down operate on the derived key and on token data, not on the password; the constant-time comparison in verifyAdminPassword is the previously dismissed one. --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
2026-08-14 16:55:07 +02:00
display: block;
text-decoration: none;
feat: add visual admin panel with page builder and settings editor - Add /admin route with password-protected visual page builder - Page Builder: manage hero images, standalone albums, subpages, and sections - Album Picker: browse all shared Immich albums with search and filtering - Settings Editor: theme, grid, footer, legal, SEO configuration - YAML service with atomic writes and automatic backups (content/.backups/) - HMAC-signed admin sessions (24h expiry, HttpOnly cookies) - API endpoints: /api/admin/{auth,gallery,settings,albums,reload} - Enable with ADMIN_PASSWORD env var; disabled by default - invalidateConfigCache() export for hot-reload after saves
2026-05-29 17:04:37 +02:00
}
.settings-nav-item:hover {
fix: admin panel light/dark theme support, improved contrast, and backup confirmation a) Admin panel now respects the site's light/dark theme toggle via CSS custom properties that respond to [data-theme='light'] on <html>. All hardcoded dark colors replaced with semantic CSS variables. b) Improved contrast in dark mode: secondary text changed from #666/#555 to #a0a0a0, muted text from #555 to #707070. All text is now clearly readable against dark backgrounds. c) Backup system was already implemented in yaml-service.ts (creates timestamped backups in content/.backups/ before each save, keeps last 10 versions). Now the UI shows a confirmation message that a backup was created after each successful save.
2026-05-29 17:20:56 +02:00
color: var(--admin-text);
background: var(--admin-bg-raised);
feat: add visual admin panel with page builder and settings editor - Add /admin route with password-protected visual page builder - Page Builder: manage hero images, standalone albums, subpages, and sections - Album Picker: browse all shared Immich albums with search and filtering - Settings Editor: theme, grid, footer, legal, SEO configuration - YAML service with atomic writes and automatic backups (content/.backups/) - HMAC-signed admin sessions (24h expiry, HttpOnly cookies) - API endpoints: /api/admin/{auth,gallery,settings,albums,reload} - Enable with ADMIN_PASSWORD env var; disabled by default - invalidateConfigCache() export for hot-reload after saves
2026-05-29 17:04:37 +02:00
}
.settings-nav-item.active {
fix: admin panel light/dark theme support, improved contrast, and backup confirmation a) Admin panel now respects the site's light/dark theme toggle via CSS custom properties that respond to [data-theme='light'] on <html>. All hardcoded dark colors replaced with semantic CSS variables. b) Improved contrast in dark mode: secondary text changed from #666/#555 to #a0a0a0, muted text from #555 to #707070. All text is now clearly readable against dark backgrounds. c) Backup system was already implemented in yaml-service.ts (creates timestamped backups in content/.backups/ before each save, keeps last 10 versions). Now the UI shows a confirmation message that a backup was created after each successful save.
2026-05-29 17:20:56 +02:00
color: var(--admin-text);
background: var(--admin-bg-elevated);
feat: add visual admin panel with page builder and settings editor - Add /admin route with password-protected visual page builder - Page Builder: manage hero images, standalone albums, subpages, and sections - Album Picker: browse all shared Immich albums with search and filtering - Settings Editor: theme, grid, footer, legal, SEO configuration - YAML service with atomic writes and automatic backups (content/.backups/) - HMAC-signed admin sessions (24h expiry, HttpOnly cookies) - API endpoints: /api/admin/{auth,gallery,settings,albums,reload} - Enable with ADMIN_PASSWORD env var; disabled by default - invalidateConfigCache() export for hot-reload after saves
2026-05-29 17:04:37 +02:00
}
.settings-content {
min-width: 0;
}
.settings-panel h3 {
font-size: 1.1rem;
font-weight: 600;
margin: 0 0 1rem;
}
feat(admin): visual theme cards, album search, and status dashboard (#241) * feat(admin): implement visual theme cards, album search, and system status diagnostics * fix(admin): resolve type-checking build errors in SettingsEditor and status route --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-05-31 21:17:52 +02:00
/* Preset Card Grid */
.preset-card-grid {
display: grid;
grid-template-columns: repeat(auto-fill, minmax(180px, 1fr));
gap: 1rem;
width: 100%;
}
.preset-card {
feat: add visual admin panel with page builder and settings editor - Add /admin route with password-protected visual page builder - Page Builder: manage hero images, standalone albums, subpages, and sections - Album Picker: browse all shared Immich albums with search and filtering - Settings Editor: theme, grid, footer, legal, SEO configuration - YAML service with atomic writes and automatic backups (content/.backups/) - HMAC-signed admin sessions (24h expiry, HttpOnly cookies) - API endpoints: /api/admin/{auth,gallery,settings,albums,reload} - Enable with ADMIN_PASSWORD env var; disabled by default - invalidateConfigCache() export for hot-reload after saves
2026-05-29 17:04:37 +02:00
display: flex;
feat(admin): visual theme cards, album search, and status dashboard (#241) * feat(admin): implement visual theme cards, album search, and system status diagnostics * fix(admin): resolve type-checking build errors in SettingsEditor and status route --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-05-31 21:17:52 +02:00
flex-direction: column;
background: var(--admin-bg-raised);
border: 1px solid var(--admin-border);
border-radius: 10px;
overflow: hidden;
cursor: pointer;
padding: 0;
text-align: left;
chore(release): v0.10.0 (#400) Photo Essay mode, client proofing, studio-modern preset, admin panel overhaul, watermark, cookieless analytics, subpage toggle, SEO title templates. Analytics API now admin-only, Trivy scan on publish. Album order mirrors the Immich timeline; map theme, admin status panel, lightbox counter and Docker health check fixed. See CHANGELOG.md for the full list and the health-check upgrade note.
2026-08-10 09:56:20 +02:00
transition:
transform 0.2s cubic-bezier(0.16, 1, 0.3, 1),
border-color 0.2s,
box-shadow 0.2s;
box-shadow: 0 1px 3px rgba(0, 0, 0, 0.05);
feat(admin): visual theme cards, album search, and status dashboard (#241) * feat(admin): implement visual theme cards, album search, and system status diagnostics * fix(admin): resolve type-checking build errors in SettingsEditor and status route --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-05-31 21:17:52 +02:00
}
.preset-card:hover {
transform: translateY(-2px);
border-color: var(--admin-border-hover);
box-shadow: 0 4px 12px rgba(0, 0, 0, 0.08);
}
.preset-card.active {
border-color: var(--admin-accent);
box-shadow: 0 0 0 2px var(--admin-accent);
}
release: v0.11.0 — journal fixes, admin URLs, design system cleanup (#432) * fix(screenshots): sharp-Typen fuer 0.34 und 0.35 gleichzeitig (#410) sharp 0.35 ist von `export =` auf ESM umgestellt: der Modul-Namespace ist nicht mehr aufrufbar, die Factory sitzt unter .default. Der Type-Check brach damit in scripts/screenshots.ts weg, sobald der Next-Bump (#402) sharp von 0.34.5 auf 0.35.3 mitzieht -- sharp ist hier keine deklarierte Dependency, sondern kommt ueber Next mit. Die Form wird jetzt aus dem installierten Paket abgeleitet statt festgeschrieben, zur Laufzeit wie im Typ. Geprueft mit beiden Versionen: tsc laeuft mit 0.34.5 und mit 0.35.3 fehlerfrei durch. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(deps): bump the nextjs group across 1 directory with 2 updates (#402) Bumps the nextjs group with 2 updates in the / directory: [next](https://github.com/vercel/next.js) and [eslint-config-next](https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next). Updates `next` from 16.2.12 to 16.3.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/compare/v16.2.12...v16.3.0) Updates `eslint-config-next` from 16.2.12 to 16.3.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/commits/v16.3.0/packages/eslint-config-next) --- updated-dependencies: - dependency-name: eslint-config-next dependency-version: 16.3.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: nextjs - dependency-name: next dependency-version: 16.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nextjs ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps-dev): bump prettier from 3.8.3 to 3.9.6 (#405) Bumps [prettier](https://github.com/prettier/prettier) from 3.8.3 to 3.9.6. - [Release notes](https://github.com/prettier/prettier/releases) - [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md) - [Commits](https://github.com/prettier/prettier/compare/3.8.3...3.9.6) --- updated-dependencies: - dependency-name: prettier dependency-version: 3.9.6 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * docs(changelog): Unreleased-Sektion fuer die Bumps nach v0.10.0 (#413) Die Dependency-PRs sind nach dem Release auf dev gelandet, teils auch auf main. Ohne Eintrag waeren sie beim naechsten Release unsichtbar -- inklusive Next 16.3.0, das CVE-2025-13465 mitbringt. Ausserdem im 0.10.0-Abschnitt nachgetragen, dass der Trivy-Scan bis #409 nie gelaufen ist. Der Fix steckt im Tag v0.10.0, fehlte aber in der Aufzaehlung -- und "Images werden bei jedem Publish gescannt" stand im Changelog, waehrend der Job im Action-Setup abbrach. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(gallery): per-album sort order, independent of Immich (#408) (#414) Album order was dictated entirely by Immich: getAlbum() sorted by the album's own asc/desc flag, so a Folio album always mirrored the archive. A curated series has a narrative order that has nothing to do with capture time, and changing the Immich album's sort to fit the website changes it for the archive too. Adds an optional per-album `sort` in gallery.yaml, editable in /admin, defaulting to today's behaviour so every existing config is unchanged: immich (default) | newest | oldest | filename | manual `manual` is a pinned *prefix*: `assetOrder` lists only the photos placed by hand, everything else follows in the album's Immich order. A full permutation of a 2,000-photo album would be ~80 KB of UUIDs in a file that is rewritten and copied to content/.backups/ on every admin save. It also makes drift fall out for free — photos removed in Immich never match, new ones land in the tail rather than being hidden. Sorting is applied after the cache read, not before the cache write, so the LRU keeps one canonical Immich-ordered copy per album. That avoids putting the mode in the cache key, lets a config change take effect without depending on invalidation, and keeps the stale-serving path correct. cache.get() returns the stored object by reference, so withSort() returns a shallow clone with a new array — sorting in place would reorder the shared entry, and under request coalescing every concurrent caller would be sorting the same array. Also fixes a prerequisite bug: /api/admin/albums/[albumId]/assets read album.assets from GET /albums/:id, which Immich 3.x no longer populates (lib/immich.ts:507). The hero picker's "This Album" tab returned nothing and threw outright when the key was absent. It now goes through the client's paginated metadata search, with ?types=all to opt videos in for the reorder editor. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): drop decorative emoji from the sort select labels (#415) An <option> cannot contain markup, so the SVG set in Icons is not reachable there — but a decorative emoji is not a substitute for it. Plain text instead; the album card badge already uses a real icon. The remaining emoji in the admin panel (asset picker tabs, section headings, layout picker options) predate this branch and are left for a separate cleanup. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): replace emoji icons with the shared SVG icon set (#416) The admin panel mixed two icon conventions: inline SVGs from `Icons.tsx` in most components, and decorative emoji in the asset picker and a few PageBuilder labels. Emoji render inconsistently across platforms, ignore the accent colour, and cannot inherit the `.svg-icon` sizing rules. - Icons.tsx: add `IconStar` (filled — it marks a state, not an action) and `IconImage`. - AssetPicker: the three tab labels and the favourite tile badge now use IconFolder / IconStar / IconImage. - PageBuilder: the "Standalone Albums" and "Subpages" headings use the icon set instead of an emoji. - PageBuilder: the layout picker drops its emoji for plain text. An <option> cannot contain markup, so an SVG is impossible there and a decorative glyph is not a substitute. - admin.css: align icon and label in the picker tabs, and swap the favourite badge's text-shadow for drop-shadow, which is what applies to an inline SVG. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): fold PageBuilder's local icons into the shared Icons module (#418) * refactor(admin): fold PageBuilder's local icons into the shared module PageBuilder.tsx carried its own `Icons` object duplicating most of the glyphs already exported by Icons.tsx, with hardcoded sizes and slightly divergent paths. Migrate all 32 call sites to the shared module and delete the local object. Five glyphs had no counterpart and are added to Icons.tsx as 1:1 ports of the local paths: IconX, IconPlus, IconHome, IconCopy, IconImage. The local ExternalLink and Check are dropped rather than ported — both had zero call sites. Two glyphs change shape slightly, which is the point of consolidating: the shared IconCamera includes the viewfinder bump the local copy omitted, and drag handles now use IconGripVertical. IconGripVertical uses the module's square 24x24 viewBox, so `.svg-drag` goes from 12x18 to 18x18 — the old non-square box would letterbox the glyph down to 12x12 and shrink the handle. * fix(admin): resolve icon-module integration after #416 Merging dev brought in #416, which added a second IconImage to Icons.tsx and two <Icons.Camera>/<Icons.Folder> section headers that reference the local Icons object this PR removes. Git merged both cleanly but the result did not type-check. - drop the duplicate IconImage (both copies were byte-identical) - point the two section headers at the imported IconCamera/IconFolder - refresh the SORT_LABELS comment: the icon set is imported now, not declared below --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> * fix(config): allow an empty gallery, guard against a double /api suffix (#421) An empty gallery is now a valid, rendered state instead of a throw: deriveGallery() no longer requires at least one album or subpage, so a deployment with no albums yet renders a bare homepage the owner can fill in via /admin. getConfig() also stops appending /api to an Immich URL that already ends in it, which previously produced .../api/api and broke every upstream request. Includes a restore of the per-album sort test cases, which the branch had lost by being cut before #408/#414. * feat(admin): favicon upload, served from the content volume (#422) Adds a bundled default favicon, an upload widget in admin Settings > General, and a route that serves the icon from the writable content/ volume with a fallback to the bundled default. Raster uploads (PNG/ICO/JPEG) are wrapped in an SVG container; the response carries its own CSP so an uploaded SVG cannot execute script on the origin. The GET route revalidates with an ETag instead of caching immutably, so a newly uploaded icon shows up immediately. Uploads are written via temp file + rename, and a Reset button restores the bundled default. * ci: flag unformatted files in a PR, without blocking it (#424) Prettier is configured as an error rule in eslint.config.mjs but has never run in CI, so part of the tree predates it. A final CI step now diffs against the PR base, runs prettier --list-different over the changed files, and emits a warning annotation per offender plus a job summary. Advisory by design: it never fails the job. Blocking would turn a PR red for merely touching a file that was already unformatted, and normalising the tree in one commit would wreck git blame and conflict with the PRs in flight. Requires fetch-depth: 0, since diffing against the base needs its history. * feat(install): first-run wizard gated by a one-time setup token (#419) Adds /install, a four-step first-run wizard: connect to Immich, optionally pick albums, name the site, finish. It verifies the credentials against the Immich server before writing anything, then writes gallery.yaml, settings.yaml and a content/install.json carrying the Immich credentials and a generated site secret. install.json exists because a running process cannot pick up new env vars — the wizard has to write configuration that takes effect without a restart. getInstallCredentials() merges it under the real environment, so env vars always win and rotation stays a matter of setting one. Both the page and the API routes are gated by a one-time setup token printed to the server log, so a deployment that is reachable before gallery.yaml exists cannot be configured by whoever finds it first. The token is stored in content/.setup-token (0600) rather than a module variable: Next.js bundles the page and each route handler separately, so a module-level token left the page and the API disagreeing inside one process and the wizard stuck on step 1. It is removed once the install completes. The admin password is stored as an scrypt hash using the scheme lib/auth.ts already applies to album passwords; a plaintext ADMIN_PASSWORD env var keeps working. * docs: document the setup wizard, fix the read-only content mount (#425) Quick Start now leads with the /install wizard, with the hand-written YAML route kept alongside it, and a First-Run Setup section covers the setup token, the files the wizard writes, and env-var precedence. Two corrections: both Docker examples mounted content/ as :ro, which silently breaks the wizard, the admin panel and the backup rotation alike — docs/admin-panel.md already said so and the README contradicted it. And nothing documented that content/install.json holds the Immich API key, so a backup of content/ is a backup of credentials. Also adds a Contributors section crediting the people whose work is in the project. * feat(admin): floating save bar pinned to the bottom of the viewport (#426) The save bar was the first, static element inside .admin-main. Since the document itself scrolls, it left the viewport as soon as you scrolled down — editing a subpage section or a settings block far below gave no visible dirty hint and no reachable save button. Replace it with a bottom-pinned floating bar shared by both editors. It only mounts while there is something to act on (unsaved changes, an in-flight save, or a result message), so it never covers content while idle. The success message clears after 5s, which hides the bar again. - new SaveBar component, replacing the duplicated markup in PageBuilder and SettingsEditor - adopt the previously unused .floating-save-bar CSS: slide-in keyframes (carrying translateX(-50%)), dirty border, wrap/gap, mobile variant and a prefers-reduced-motion opt-out; z-index 900 keeps it below modals - .admin-main gains bottom padding so the bar never covers page content - drop the now-unreachable idle hints: the ⌘S hint becomes a button title, the Live Sync note becomes a static line above the settings layout - header "Site" link now bypasses the cache (/?fresh=1), so the preview stays reachable when the bar is hidden Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(admin): themed listbox for the album sort control (#427) The per-album "Photo order" control was a native <select>. Because an <option> cannot contain markup, its choices could not use the admin panel's currentColor SVG set — the reason #415 had to fall back to plain text after dropping the emoji labels. Adds a Listbox component implementing the ARIA combobox/listbox pattern, so options can render a glyph beside their label: - DOM focus stays on the trigger button; the active option is announced through aria-activedescendant, keeping focus management to one element - Keyboard: arrows (clamped at the ends, like a native select), Home/End, Enter/Space to commit, Escape to cancel, Tab commits and moves on, and prefix type-ahead with a repeat-key cycle - Outside dismissal on pointerdown, so a press starting outside closes the popup before the click retargets The sort options now carry an icon each: calendar, arrow-down, arrow-up, an A→Z marker, and the drag glyph for manual — matching the badge the album card already shows. SORT_LABELS stays plain text because the badge feeds it to a title attribute. Closes #417 Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(git): ignore generated design handoff folders * fix(admin): stop the album sort dropdown clipping, and simplify the panel (#428) * fix(admin): render listbox popup in a portal so it escapes modal clipping The sort control's popup was position:absolute inside three clipping ancestors (.album-drawer overflow:hidden > .album-drawer-body overflow-y:auto > .modal-right-column overflow-y:auto), so it was cut off at the bottom of the Edit Album Details modal. z-index could not help: clipping happens before stacking. It also always hung below the trigger, with no flip. Portal the popup to document.body and position it from the trigger's viewport rect, flipping above when there is more room there and capping max-height to the space available so it scrolls internally rather than overflowing. It is dismissed on scroll and resize, since the anchor is only measured on open. The outside-pointerdown handler now also treats the popup as inside; without that the portalled list counts as outside, and a click on an option would close it before the selection commits. * refactor(admin): single-column album details panel The left column spent 1.2fr on a cover thumbnail and three stat rows, two of which (Status, Custom Hero) only restated the form fields opposite them, while the form itself was squeezed into 1.8fr behind a second nested scroller. Stack the drawer in one column instead: cover as a banner, then the form at full width, with the UUID moved into the footer. The body is now the only scroll container, which also removes one of the ancestors that was clipping the sort popup. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> * fix(admin): give the portalled listbox its theme back, lock the page behind modals (#429) Two defects in the album editor. The sort listbox popup painted transparent. Every --admin-* variable is scoped to .admin-layout, and since the popup moved into document.body it sits outside that subtree, so background/border/text all resolved to nothing. It now carries its own copy of the palette in both colour schemes, plus the font it no longer inherits. Scrolling inside a modal also moved the page behind it. No admin modal ever locked body scroll: the overlay covers the page but does not absorb wheel events, so a scroll starting on the backdrop — or continuing past the end of the modal's own scroller — reaches the document. overscroll-behavior cannot cover that case on its own, because it only applies to scroll containers and the backdrop is not one. useScrollLock freezes body while a modal is open and compensates for the width the scrollbar gives up, so nothing shifts underneath. Each lock restores the inline value it found, which makes nesting work without a counter — a picker opened from the drawer restores the drawer's hidden state instead of clearing it. Applied to both drawers and all four picker modals, which share the defect. overscroll-behavior: contain on the scrollers stops the chaining they can handle themselves. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com> * fix(security): allow unsafe-eval in CSP script-src during dev mode * feat(journal): add Journal Studio with split-screen editor, live preview and dedicated routes * fix(build): separate client parser from server journal-service and fix build type errors * fix(journal): Fotos rendern, Layout und Lightbox-Steuerung korrigieren Fünf unabhängige Fehler in der öffentlichen Journal- und Essay-Ansicht: * Foto-Blöcke wurden nie angezeigt. EssayView löst ein Foto über PhotoItem.id auf, und das sind verschlüsselte Tokens — die Blöcke aus dem Markdown tragen aber rohe Asset-UUIDs. Jede Zuordnung lief ins Leere, und nicht auflösbare Blöcke werden still verworfen. Die IDs werden jetzt serverseitig übersetzt; damit verschwinden nebenbei die rohen UUIDs aus dem Client-Payload, die dort laut Projektregel nie auftauchen dürfen. Nicht auflösbare Referenzen werden geloggt. * Überschriften standen weiter links als der Fließtext. Jeder Block hatte einzeln `max-width: 68ch`, und `ch` ist relativ zur Schrift des Elements — die Serif-Überschrift ergab eine breitere Spalte. Ersetzt durch eine gemeinsame, font-unabhängige `--essay-measure`. * Fullbleed-Fotos bluteten nur nach links aus: `.essay-figure` ist `width: 100%`, wodurch die Box überbestimmt ist und der negative rechte Margin verworfen wird. * Foto-Paare stellten beide Bilder gleich breit dar, wodurch ein Hochformat neben einem Querformat doppelt so hoch wurde. Jetzt eine Justified-Reihe: Breite proportional zum Seitenverhältnis, dadurch exakt gleiche Höhen ohne Beschnitt. * Die Lightbox hatte im Journal keine Tastatursteuerung und keine Scroll-Sperre — beides lag in PhotoGrid, also nur im Album-Raster. Verlagert in die Lightbox selbst, der doppelte Handler in PhotoGrid entfernt (sonst wäre pro Pfeildruck zwei Bilder weitergesprungen). Zusätzlich sind Proofing-Herzen und das EXIF-Panel im redaktionellen Modus abschaltbar und im Journal aus: Client-Proofing ist ein Übergabe-Workflow für Alben, keine Funktion einer Reportage. Auf der Übersicht wurde der Untertitel doppelt gerendert, weil extractExcerpt() auf ihn zurückfällt. * feat(admin): eigene URLs für alle Bereiche und überarbeiteter Journal Studio Das Panel war eine einzige Client-Komponente, die ihre Tabs über useState umschaltet: keine Route pro Bereich, kein Deep-Link, kein Zurück-Button, und nach jedem Reload landete man wieder auf "Pages". Auch der Journal-Editor hatte keine eigene URL. Jetzt sieben echte Routen (/admin, /admin/pages, /admin/journal, /admin/journal/<slug>, /admin/settings, /admin/settings/<section>, /admin/analytics). Die Shell mit Auth-Prüfung und Kopfzeile sitzt im Layout und umschließt children — so bleibt die Session-Prüfung über Routenwechsel montiert, statt bei jedem Tab-Wechsel neu zu laufen und den Spinner aufblitzen zu lassen. Unbekannte Settings-Sections fallen auf General zurück. Im selben Zug der Journal Studio, der die Routing-Änderung ohnehin berührt: * Alle Eingabefelder nutzten die Klasse `admin-input`, die in keinem CSS definiert war — sie fielen auf Browser-Defaults zurück. Jetzt gestylt, gescoped, damit der generische Name nicht ins übrige Panel leckt. * Der Split View ist per Divider verschiebbar (Maus, Tastatur, Doppelklick zum Zurücksetzen), Breite in localStorage. * Das Studio bricht aus der 1120px-Spalte aus, die Preview hat Platz. * Die Preview zeigte für jedes Foto fest 3:2 und log damit über das Layout der veröffentlichten Seite; die echten Verhältnisse werden jetzt an den Thumbnails gemessen. * Blöcke mit alten positionsbasierten Foto-Referenzen werden markiert — die lassen sich auf einer eigenständigen Journal-Seite nicht auflösen und verschwanden bisher stillschweigend. * Blocktyp-Chips als gemeinsame Komponente, monochrom und per Icon unterschieden statt in einer eigenen Blau/Lila/Orange-Palette, die sonst nirgends im Panel vorkommt. * Emojis raus, SVG-Icons rein. * fix(admin): Designsystem-Lücken im Panel schließen Eine systematische Suche nach Klassen, die im TSX benutzt, aber in keinem CSS definiert sind, hat vier Stellen mit demselben Muster gefunden: * `admin-btn-secondary` und `admin-btn-danger` existierten nicht. Sämtliche Löschen-Buttons sahen aus wie normale Buttons — keine Warnwirkung. Als `.admin-btn.admin-btn-danger` geschrieben, weil die Varianten mit den Größenklassen kombiniert werden, die weiter unten ihren eigenen Hintergrund setzen. * `page-progress-fill` fehlte: die Balken im Analytics-Panel waren leere Rinnen, der Wert unsichtbar. Ebenso `analytics-empty` und `admin-loading-container`. * `subpage-drawer-section`, `subpage-drawer-title-group` und `input-with-icon` im PageBuilder waren wirkungslos und teils mit Inline-Styles notdürftig kompensiert. * `grid-card-preview` fehlte, wodurch alle Layout-Vorschauen auf Höhe null kollabierten. Nur "Showcase" war sichtbar — und das aus Versehen, weil sein Tile `hero-tile` hieß und damit die `aspect-ratio` einer fremden PageBuilder-Klasse erbte. Umbenannt. Dazu die Theme-Vorschauen, die praktisch identisch aussahen: alle sieben zeigten dieselben drei quadratischen Kacheln, einziger Unterschied war die Hintergrundfarbe. Sie spiegeln jetzt die echten Preset-Daten aus lib/config/theme.ts — Schriftcharakter, Eckradius, Rasterdichte, Passepartout bzw. Schatten. Die Kopfzeile richtet sich an einer gemeinsamen Steuerhöhe aus. Der "Site"-Link war höher als die Buttons daneben: `.admin-btn` hatte keine explizite line-height, und <button> bekommt box-sizing: border-box vom Browser, <a> nicht. Die Statusanzeige setzte weder Schriftfamilie noch -größe und fiel auf den Browser-Default zurück — sie war nie Teil des Designsystems. Jetzt gleiche Höhe und Typografie, Pillenform als Zustandsanzeige, Trenner zur Aktionsgruppe. Das dauerhafte Pulsieren des grünen Punkts entfällt; Animation bleibt den Zuständen vorbehalten, die Aufmerksamkeit brauchen. Restliche Emojis durch SVG-Icons ersetzt. * feat(admin): add scroll-to-top toggle and SVG arrow The back-to-top button was always on and drew its arrow with the ↑ text character. Add a `scrollToTop` setting (General section in the admin panel, defaults to on so existing sites are unaffected) and replace the glyph with a stroked SVG that inherits currentColor across all presets. Scroll handling is now rAF-throttled, and prefers-reduced-motion turns off both the hover lift and the smooth scroll. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * security(journal): escape author HTML instead of filtering it CodeQL flags 26 high-severity alerts on the release PR; the bulk of them point at sanitizeHtml(), a denylist of three regexes whose output goes into dangerouslySetInnerHTML. I reproduced the bypasses before changing anything — all four pass the old filter: <img src=x onerror=alert(1)> unquoted handler, regex wants quotes <img src=x onerror='alert(1)'> single quotes, same reason <svg onload=alert(1)> not a <script> tag javasjavascript:cript:alert(1) one-pass replace, the rest recombines Plus an attribute breakout in the link renderer, which interpolated the URL into href="${url}" unescaped: [x](" onmouseover=alert(1) x=") -> <a href="" onmouseover=alert(1" ...> Replaced with escaping. Every `&<>"'` in author text becomes an entity before any markdown rule runs, so the only tags in the output are the ones renderInlineMarkdown builds itself and a URL cannot leave its attribute. Link schemes are now an allowlist (http, https, mailto, tel, relative, anchor); anything else renders as plain text. The serializer needed decodeHtmlEntities to match: without it a save would write `&lt;` into the Markdown file and the next parse would escape the `&` again, corrupting the text further on every round trip. A test covers parse -> serialize -> parse stability. Two existing tests asserted the old behaviour and were rewritten rather than deleted: one expected the script tag to be *removed* from the output, the other expected the substring "onerror" to be absent. Both now assert the property that matters — that no tag can form — because `onerror` surviving as inert text is fine. Exploitation required admin access either way: journal and essay text comes from the studio or from content/*.md. This removes the weakness, it does not close an open door. * fix(journal): contain file paths, fix frontmatter escaping, defuse two regexes Follow-up to the CodeQL findings on release PR #432. I went through all 23 alerts individually; this addresses the ones that are worth addressing and documents the ones that are not. Path containment (12 alerts, all false positives). Every path built from a slug goes through isValidSlug(), a strict `/^[a-zA-Z0-9_-]+$/` allowlist — verified against `../../etc/passwd`, `foo/../../bar`, `a/b`, `..` and friends, all rejected. CodeQL cannot see it because the check lives in another module. Added a containedPath() helper that resolves the path and refuses anything landing outside the content directory: a second lock on a door that was already locked, and a barrier the analysis can follow. Also removed the dead `slug.endsWith('.md')` branches — isValidSlug rejects dots, so they could never be taken. Frontmatter escaping (1 alert, a real bug). The serializer escaped `"` but not `\`, and the parser never unescaped anything. A title containing either character gained a backslash on every save/load cycle: Path C:\Users "quoted" -> Path C:\\Users \"quoted\" -> ... Escaping now covers the backslash first and the parser undoes both. A round trip test covers quotes, backslashes, colons and apostrophes. Two of three ReDoS regexes (2 alerts). The heading pattern had `\s+` next to `(.+)`, which overlap, so the engine tried every split of the whitespace run before failing; it is `[ \t]+` and `(\S.*)` now. The quote author pattern wrapped a lazy group around an optional group — the quadratic case — and is an index split on the first separator now. The third regex, the bold/italic pass, is deliberately left alone. Rewriting it with a negated class removes the backtracking but breaks nesting: `**bold *and italic* here**` renders as `*<em>bold </em>and italic<em> here</em>*`. The input is Markdown from an authenticated admin, never a visitor, so the worst case is an author slowing down their own page. The comment in the code says so. Not addressed: 5 js/insufficient-password-hash alerts. They ask for a slow KDF where the code uses SHA-256/HMAC — correct in general, but the admin password comes from an environment variable and is never stored, so a stronger KDF protects nothing that is not already in plaintext in the environment. 399 unit tests pass (18 new), build and tsc clean. * fix(journal): split the quote author by scanning, not by pattern Cleaning up after myself. #439 replaced the quote author regex `/^(.*?)(?:\s+--\s+(.+))?$/` — a lazy group around an optional one, the quadratic case — with `/\s+--\s+/`, and CodeQL promptly flagged the replacement for the same reason. One reported pattern traded for another. splitQuoteAuthor() scans for the first `--` that has whitespace on both sides. Linear, and it needs no reasoning about the regex engine at all. Behaviour is identical to the original regex, checked case by case against it: separator, no separator, several separators, tabs, wide gaps, `a--b` without spaces, leading and trailing separators, empty string. All nine are covered by tests, plus one asserting it stays fast on a 50k whitespace run. * security(admin): derive the session signing key with scrypt getSigningKey() ran the admin password through a single SHA-256 digest. It is key derivation rather than password storage, so it was never a stored-hash problem — but if the derived key ever leaked, one fast hash makes recovering the password by brute force cheap. CodeQL flags it as js/insufficient-password-hash and, for this particular alert, has a point. scrypt now. Two details that matter: The salt has to be stable. A random salt would produce a different key on every call and invalidate every session; it is derived from AUTH_SECRET, which is deployment-specific. Verified across separate processes: same inputs produce a verifying token, so a restart or redeploy does not log everyone out. The result is cached for the process lifetime. scrypt is deliberately slow and getSigningKey() runs on every admin request — deriving per call would add ~24ms to each one. The cache key is a digest of secret plus password, so a rotation misses the cache and derives again, and no extra plaintext copy of the password is kept around. Measured: first derivation 24ms, subsequent calls 0.12ms. Password change and secret change both invalidate an existing token, checked in separate processes. Note the one-time effect: existing admin sessions are invalidated by the change in derivation, so everyone logs in once more. * security(admin): key the signing-key cache on its inputs, not a digest #441 removed the SHA-256 digest of the admin password from the key derivation and introduced a new one three lines above it, as the cache key. Same rule, same file: CodeQL reported it immediately. The comment justifying it was wrong too. It claimed no second plaintext copy of the password was retained, while building the digest input allocates exactly that in order to hash it. The cache now holds the two input strings and compares them directly. They are the same objects the env and install caches already hold, so nothing extra is retained, and no fast hash of the password exists in memory for the life of the process. Re-verified after the change, in separate processes: a token from one process verifies in another with the same inputs, a changed password or secret rejects it, first derivation 24ms, cached calls 0.001ms. That leaves scrypt as the only place the password is hashed here. The two HMACs further down operate on the derived key and on token data, not on the password; the constant-time comparison in verifyAdminPassword is the previously dismissed one. --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
2026-08-14 16:55:07 +02:00
/* ── Preset Mini Preview Mockup ──────────────────────────────────
* Driven entirely by the --preset-* custom properties the card sets inline,
* so each mockup reflects that preset's real background, tile colour, corner
* radius, grid density and photo frame instead of looking identical.
*/
feat(admin): visual theme cards, album search, and status dashboard (#241) * feat(admin): implement visual theme cards, album search, and system status diagnostics * fix(admin): resolve type-checking build errors in SettingsEditor and status route --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-05-31 21:17:52 +02:00
.preset-card-preview {
width: 100%;
aspect-ratio: 16 / 10;
release: v0.11.0 — journal fixes, admin URLs, design system cleanup (#432) * fix(screenshots): sharp-Typen fuer 0.34 und 0.35 gleichzeitig (#410) sharp 0.35 ist von `export =` auf ESM umgestellt: der Modul-Namespace ist nicht mehr aufrufbar, die Factory sitzt unter .default. Der Type-Check brach damit in scripts/screenshots.ts weg, sobald der Next-Bump (#402) sharp von 0.34.5 auf 0.35.3 mitzieht -- sharp ist hier keine deklarierte Dependency, sondern kommt ueber Next mit. Die Form wird jetzt aus dem installierten Paket abgeleitet statt festgeschrieben, zur Laufzeit wie im Typ. Geprueft mit beiden Versionen: tsc laeuft mit 0.34.5 und mit 0.35.3 fehlerfrei durch. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(deps): bump the nextjs group across 1 directory with 2 updates (#402) Bumps the nextjs group with 2 updates in the / directory: [next](https://github.com/vercel/next.js) and [eslint-config-next](https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next). Updates `next` from 16.2.12 to 16.3.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/compare/v16.2.12...v16.3.0) Updates `eslint-config-next` from 16.2.12 to 16.3.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/commits/v16.3.0/packages/eslint-config-next) --- updated-dependencies: - dependency-name: eslint-config-next dependency-version: 16.3.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: nextjs - dependency-name: next dependency-version: 16.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nextjs ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps-dev): bump prettier from 3.8.3 to 3.9.6 (#405) Bumps [prettier](https://github.com/prettier/prettier) from 3.8.3 to 3.9.6. - [Release notes](https://github.com/prettier/prettier/releases) - [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md) - [Commits](https://github.com/prettier/prettier/compare/3.8.3...3.9.6) --- updated-dependencies: - dependency-name: prettier dependency-version: 3.9.6 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * docs(changelog): Unreleased-Sektion fuer die Bumps nach v0.10.0 (#413) Die Dependency-PRs sind nach dem Release auf dev gelandet, teils auch auf main. Ohne Eintrag waeren sie beim naechsten Release unsichtbar -- inklusive Next 16.3.0, das CVE-2025-13465 mitbringt. Ausserdem im 0.10.0-Abschnitt nachgetragen, dass der Trivy-Scan bis #409 nie gelaufen ist. Der Fix steckt im Tag v0.10.0, fehlte aber in der Aufzaehlung -- und "Images werden bei jedem Publish gescannt" stand im Changelog, waehrend der Job im Action-Setup abbrach. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(gallery): per-album sort order, independent of Immich (#408) (#414) Album order was dictated entirely by Immich: getAlbum() sorted by the album's own asc/desc flag, so a Folio album always mirrored the archive. A curated series has a narrative order that has nothing to do with capture time, and changing the Immich album's sort to fit the website changes it for the archive too. Adds an optional per-album `sort` in gallery.yaml, editable in /admin, defaulting to today's behaviour so every existing config is unchanged: immich (default) | newest | oldest | filename | manual `manual` is a pinned *prefix*: `assetOrder` lists only the photos placed by hand, everything else follows in the album's Immich order. A full permutation of a 2,000-photo album would be ~80 KB of UUIDs in a file that is rewritten and copied to content/.backups/ on every admin save. It also makes drift fall out for free — photos removed in Immich never match, new ones land in the tail rather than being hidden. Sorting is applied after the cache read, not before the cache write, so the LRU keeps one canonical Immich-ordered copy per album. That avoids putting the mode in the cache key, lets a config change take effect without depending on invalidation, and keeps the stale-serving path correct. cache.get() returns the stored object by reference, so withSort() returns a shallow clone with a new array — sorting in place would reorder the shared entry, and under request coalescing every concurrent caller would be sorting the same array. Also fixes a prerequisite bug: /api/admin/albums/[albumId]/assets read album.assets from GET /albums/:id, which Immich 3.x no longer populates (lib/immich.ts:507). The hero picker's "This Album" tab returned nothing and threw outright when the key was absent. It now goes through the client's paginated metadata search, with ?types=all to opt videos in for the reorder editor. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): drop decorative emoji from the sort select labels (#415) An <option> cannot contain markup, so the SVG set in Icons is not reachable there — but a decorative emoji is not a substitute for it. Plain text instead; the album card badge already uses a real icon. The remaining emoji in the admin panel (asset picker tabs, section headings, layout picker options) predate this branch and are left for a separate cleanup. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): replace emoji icons with the shared SVG icon set (#416) The admin panel mixed two icon conventions: inline SVGs from `Icons.tsx` in most components, and decorative emoji in the asset picker and a few PageBuilder labels. Emoji render inconsistently across platforms, ignore the accent colour, and cannot inherit the `.svg-icon` sizing rules. - Icons.tsx: add `IconStar` (filled — it marks a state, not an action) and `IconImage`. - AssetPicker: the three tab labels and the favourite tile badge now use IconFolder / IconStar / IconImage. - PageBuilder: the "Standalone Albums" and "Subpages" headings use the icon set instead of an emoji. - PageBuilder: the layout picker drops its emoji for plain text. An <option> cannot contain markup, so an SVG is impossible there and a decorative glyph is not a substitute. - admin.css: align icon and label in the picker tabs, and swap the favourite badge's text-shadow for drop-shadow, which is what applies to an inline SVG. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): fold PageBuilder's local icons into the shared Icons module (#418) * refactor(admin): fold PageBuilder's local icons into the shared module PageBuilder.tsx carried its own `Icons` object duplicating most of the glyphs already exported by Icons.tsx, with hardcoded sizes and slightly divergent paths. Migrate all 32 call sites to the shared module and delete the local object. Five glyphs had no counterpart and are added to Icons.tsx as 1:1 ports of the local paths: IconX, IconPlus, IconHome, IconCopy, IconImage. The local ExternalLink and Check are dropped rather than ported — both had zero call sites. Two glyphs change shape slightly, which is the point of consolidating: the shared IconCamera includes the viewfinder bump the local copy omitted, and drag handles now use IconGripVertical. IconGripVertical uses the module's square 24x24 viewBox, so `.svg-drag` goes from 12x18 to 18x18 — the old non-square box would letterbox the glyph down to 12x12 and shrink the handle. * fix(admin): resolve icon-module integration after #416 Merging dev brought in #416, which added a second IconImage to Icons.tsx and two <Icons.Camera>/<Icons.Folder> section headers that reference the local Icons object this PR removes. Git merged both cleanly but the result did not type-check. - drop the duplicate IconImage (both copies were byte-identical) - point the two section headers at the imported IconCamera/IconFolder - refresh the SORT_LABELS comment: the icon set is imported now, not declared below --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> * fix(config): allow an empty gallery, guard against a double /api suffix (#421) An empty gallery is now a valid, rendered state instead of a throw: deriveGallery() no longer requires at least one album or subpage, so a deployment with no albums yet renders a bare homepage the owner can fill in via /admin. getConfig() also stops appending /api to an Immich URL that already ends in it, which previously produced .../api/api and broke every upstream request. Includes a restore of the per-album sort test cases, which the branch had lost by being cut before #408/#414. * feat(admin): favicon upload, served from the content volume (#422) Adds a bundled default favicon, an upload widget in admin Settings > General, and a route that serves the icon from the writable content/ volume with a fallback to the bundled default. Raster uploads (PNG/ICO/JPEG) are wrapped in an SVG container; the response carries its own CSP so an uploaded SVG cannot execute script on the origin. The GET route revalidates with an ETag instead of caching immutably, so a newly uploaded icon shows up immediately. Uploads are written via temp file + rename, and a Reset button restores the bundled default. * ci: flag unformatted files in a PR, without blocking it (#424) Prettier is configured as an error rule in eslint.config.mjs but has never run in CI, so part of the tree predates it. A final CI step now diffs against the PR base, runs prettier --list-different over the changed files, and emits a warning annotation per offender plus a job summary. Advisory by design: it never fails the job. Blocking would turn a PR red for merely touching a file that was already unformatted, and normalising the tree in one commit would wreck git blame and conflict with the PRs in flight. Requires fetch-depth: 0, since diffing against the base needs its history. * feat(install): first-run wizard gated by a one-time setup token (#419) Adds /install, a four-step first-run wizard: connect to Immich, optionally pick albums, name the site, finish. It verifies the credentials against the Immich server before writing anything, then writes gallery.yaml, settings.yaml and a content/install.json carrying the Immich credentials and a generated site secret. install.json exists because a running process cannot pick up new env vars — the wizard has to write configuration that takes effect without a restart. getInstallCredentials() merges it under the real environment, so env vars always win and rotation stays a matter of setting one. Both the page and the API routes are gated by a one-time setup token printed to the server log, so a deployment that is reachable before gallery.yaml exists cannot be configured by whoever finds it first. The token is stored in content/.setup-token (0600) rather than a module variable: Next.js bundles the page and each route handler separately, so a module-level token left the page and the API disagreeing inside one process and the wizard stuck on step 1. It is removed once the install completes. The admin password is stored as an scrypt hash using the scheme lib/auth.ts already applies to album passwords; a plaintext ADMIN_PASSWORD env var keeps working. * docs: document the setup wizard, fix the read-only content mount (#425) Quick Start now leads with the /install wizard, with the hand-written YAML route kept alongside it, and a First-Run Setup section covers the setup token, the files the wizard writes, and env-var precedence. Two corrections: both Docker examples mounted content/ as :ro, which silently breaks the wizard, the admin panel and the backup rotation alike — docs/admin-panel.md already said so and the README contradicted it. And nothing documented that content/install.json holds the Immich API key, so a backup of content/ is a backup of credentials. Also adds a Contributors section crediting the people whose work is in the project. * feat(admin): floating save bar pinned to the bottom of the viewport (#426) The save bar was the first, static element inside .admin-main. Since the document itself scrolls, it left the viewport as soon as you scrolled down — editing a subpage section or a settings block far below gave no visible dirty hint and no reachable save button. Replace it with a bottom-pinned floating bar shared by both editors. It only mounts while there is something to act on (unsaved changes, an in-flight save, or a result message), so it never covers content while idle. The success message clears after 5s, which hides the bar again. - new SaveBar component, replacing the duplicated markup in PageBuilder and SettingsEditor - adopt the previously unused .floating-save-bar CSS: slide-in keyframes (carrying translateX(-50%)), dirty border, wrap/gap, mobile variant and a prefers-reduced-motion opt-out; z-index 900 keeps it below modals - .admin-main gains bottom padding so the bar never covers page content - drop the now-unreachable idle hints: the ⌘S hint becomes a button title, the Live Sync note becomes a static line above the settings layout - header "Site" link now bypasses the cache (/?fresh=1), so the preview stays reachable when the bar is hidden Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(admin): themed listbox for the album sort control (#427) The per-album "Photo order" control was a native <select>. Because an <option> cannot contain markup, its choices could not use the admin panel's currentColor SVG set — the reason #415 had to fall back to plain text after dropping the emoji labels. Adds a Listbox component implementing the ARIA combobox/listbox pattern, so options can render a glyph beside their label: - DOM focus stays on the trigger button; the active option is announced through aria-activedescendant, keeping focus management to one element - Keyboard: arrows (clamped at the ends, like a native select), Home/End, Enter/Space to commit, Escape to cancel, Tab commits and moves on, and prefix type-ahead with a repeat-key cycle - Outside dismissal on pointerdown, so a press starting outside closes the popup before the click retargets The sort options now carry an icon each: calendar, arrow-down, arrow-up, an A→Z marker, and the drag glyph for manual — matching the badge the album card already shows. SORT_LABELS stays plain text because the badge feeds it to a title attribute. Closes #417 Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(git): ignore generated design handoff folders * fix(admin): stop the album sort dropdown clipping, and simplify the panel (#428) * fix(admin): render listbox popup in a portal so it escapes modal clipping The sort control's popup was position:absolute inside three clipping ancestors (.album-drawer overflow:hidden > .album-drawer-body overflow-y:auto > .modal-right-column overflow-y:auto), so it was cut off at the bottom of the Edit Album Details modal. z-index could not help: clipping happens before stacking. It also always hung below the trigger, with no flip. Portal the popup to document.body and position it from the trigger's viewport rect, flipping above when there is more room there and capping max-height to the space available so it scrolls internally rather than overflowing. It is dismissed on scroll and resize, since the anchor is only measured on open. The outside-pointerdown handler now also treats the popup as inside; without that the portalled list counts as outside, and a click on an option would close it before the selection commits. * refactor(admin): single-column album details panel The left column spent 1.2fr on a cover thumbnail and three stat rows, two of which (Status, Custom Hero) only restated the form fields opposite them, while the form itself was squeezed into 1.8fr behind a second nested scroller. Stack the drawer in one column instead: cover as a banner, then the form at full width, with the UUID moved into the footer. The body is now the only scroll container, which also removes one of the ancestors that was clipping the sort popup. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> * fix(admin): give the portalled listbox its theme back, lock the page behind modals (#429) Two defects in the album editor. The sort listbox popup painted transparent. Every --admin-* variable is scoped to .admin-layout, and since the popup moved into document.body it sits outside that subtree, so background/border/text all resolved to nothing. It now carries its own copy of the palette in both colour schemes, plus the font it no longer inherits. Scrolling inside a modal also moved the page behind it. No admin modal ever locked body scroll: the overlay covers the page but does not absorb wheel events, so a scroll starting on the backdrop — or continuing past the end of the modal's own scroller — reaches the document. overscroll-behavior cannot cover that case on its own, because it only applies to scroll containers and the backdrop is not one. useScrollLock freezes body while a modal is open and compensates for the width the scrollbar gives up, so nothing shifts underneath. Each lock restores the inline value it found, which makes nesting work without a counter — a picker opened from the drawer restores the drawer's hidden state instead of clearing it. Applied to both drawers and all four picker modals, which share the defect. overscroll-behavior: contain on the scrollers stops the chaining they can handle themselves. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com> * fix(security): allow unsafe-eval in CSP script-src during dev mode * feat(journal): add Journal Studio with split-screen editor, live preview and dedicated routes * fix(build): separate client parser from server journal-service and fix build type errors * fix(journal): Fotos rendern, Layout und Lightbox-Steuerung korrigieren Fünf unabhängige Fehler in der öffentlichen Journal- und Essay-Ansicht: * Foto-Blöcke wurden nie angezeigt. EssayView löst ein Foto über PhotoItem.id auf, und das sind verschlüsselte Tokens — die Blöcke aus dem Markdown tragen aber rohe Asset-UUIDs. Jede Zuordnung lief ins Leere, und nicht auflösbare Blöcke werden still verworfen. Die IDs werden jetzt serverseitig übersetzt; damit verschwinden nebenbei die rohen UUIDs aus dem Client-Payload, die dort laut Projektregel nie auftauchen dürfen. Nicht auflösbare Referenzen werden geloggt. * Überschriften standen weiter links als der Fließtext. Jeder Block hatte einzeln `max-width: 68ch`, und `ch` ist relativ zur Schrift des Elements — die Serif-Überschrift ergab eine breitere Spalte. Ersetzt durch eine gemeinsame, font-unabhängige `--essay-measure`. * Fullbleed-Fotos bluteten nur nach links aus: `.essay-figure` ist `width: 100%`, wodurch die Box überbestimmt ist und der negative rechte Margin verworfen wird. * Foto-Paare stellten beide Bilder gleich breit dar, wodurch ein Hochformat neben einem Querformat doppelt so hoch wurde. Jetzt eine Justified-Reihe: Breite proportional zum Seitenverhältnis, dadurch exakt gleiche Höhen ohne Beschnitt. * Die Lightbox hatte im Journal keine Tastatursteuerung und keine Scroll-Sperre — beides lag in PhotoGrid, also nur im Album-Raster. Verlagert in die Lightbox selbst, der doppelte Handler in PhotoGrid entfernt (sonst wäre pro Pfeildruck zwei Bilder weitergesprungen). Zusätzlich sind Proofing-Herzen und das EXIF-Panel im redaktionellen Modus abschaltbar und im Journal aus: Client-Proofing ist ein Übergabe-Workflow für Alben, keine Funktion einer Reportage. Auf der Übersicht wurde der Untertitel doppelt gerendert, weil extractExcerpt() auf ihn zurückfällt. * feat(admin): eigene URLs für alle Bereiche und überarbeiteter Journal Studio Das Panel war eine einzige Client-Komponente, die ihre Tabs über useState umschaltet: keine Route pro Bereich, kein Deep-Link, kein Zurück-Button, und nach jedem Reload landete man wieder auf "Pages". Auch der Journal-Editor hatte keine eigene URL. Jetzt sieben echte Routen (/admin, /admin/pages, /admin/journal, /admin/journal/<slug>, /admin/settings, /admin/settings/<section>, /admin/analytics). Die Shell mit Auth-Prüfung und Kopfzeile sitzt im Layout und umschließt children — so bleibt die Session-Prüfung über Routenwechsel montiert, statt bei jedem Tab-Wechsel neu zu laufen und den Spinner aufblitzen zu lassen. Unbekannte Settings-Sections fallen auf General zurück. Im selben Zug der Journal Studio, der die Routing-Änderung ohnehin berührt: * Alle Eingabefelder nutzten die Klasse `admin-input`, die in keinem CSS definiert war — sie fielen auf Browser-Defaults zurück. Jetzt gestylt, gescoped, damit der generische Name nicht ins übrige Panel leckt. * Der Split View ist per Divider verschiebbar (Maus, Tastatur, Doppelklick zum Zurücksetzen), Breite in localStorage. * Das Studio bricht aus der 1120px-Spalte aus, die Preview hat Platz. * Die Preview zeigte für jedes Foto fest 3:2 und log damit über das Layout der veröffentlichten Seite; die echten Verhältnisse werden jetzt an den Thumbnails gemessen. * Blöcke mit alten positionsbasierten Foto-Referenzen werden markiert — die lassen sich auf einer eigenständigen Journal-Seite nicht auflösen und verschwanden bisher stillschweigend. * Blocktyp-Chips als gemeinsame Komponente, monochrom und per Icon unterschieden statt in einer eigenen Blau/Lila/Orange-Palette, die sonst nirgends im Panel vorkommt. * Emojis raus, SVG-Icons rein. * fix(admin): Designsystem-Lücken im Panel schließen Eine systematische Suche nach Klassen, die im TSX benutzt, aber in keinem CSS definiert sind, hat vier Stellen mit demselben Muster gefunden: * `admin-btn-secondary` und `admin-btn-danger` existierten nicht. Sämtliche Löschen-Buttons sahen aus wie normale Buttons — keine Warnwirkung. Als `.admin-btn.admin-btn-danger` geschrieben, weil die Varianten mit den Größenklassen kombiniert werden, die weiter unten ihren eigenen Hintergrund setzen. * `page-progress-fill` fehlte: die Balken im Analytics-Panel waren leere Rinnen, der Wert unsichtbar. Ebenso `analytics-empty` und `admin-loading-container`. * `subpage-drawer-section`, `subpage-drawer-title-group` und `input-with-icon` im PageBuilder waren wirkungslos und teils mit Inline-Styles notdürftig kompensiert. * `grid-card-preview` fehlte, wodurch alle Layout-Vorschauen auf Höhe null kollabierten. Nur "Showcase" war sichtbar — und das aus Versehen, weil sein Tile `hero-tile` hieß und damit die `aspect-ratio` einer fremden PageBuilder-Klasse erbte. Umbenannt. Dazu die Theme-Vorschauen, die praktisch identisch aussahen: alle sieben zeigten dieselben drei quadratischen Kacheln, einziger Unterschied war die Hintergrundfarbe. Sie spiegeln jetzt die echten Preset-Daten aus lib/config/theme.ts — Schriftcharakter, Eckradius, Rasterdichte, Passepartout bzw. Schatten. Die Kopfzeile richtet sich an einer gemeinsamen Steuerhöhe aus. Der "Site"-Link war höher als die Buttons daneben: `.admin-btn` hatte keine explizite line-height, und <button> bekommt box-sizing: border-box vom Browser, <a> nicht. Die Statusanzeige setzte weder Schriftfamilie noch -größe und fiel auf den Browser-Default zurück — sie war nie Teil des Designsystems. Jetzt gleiche Höhe und Typografie, Pillenform als Zustandsanzeige, Trenner zur Aktionsgruppe. Das dauerhafte Pulsieren des grünen Punkts entfällt; Animation bleibt den Zuständen vorbehalten, die Aufmerksamkeit brauchen. Restliche Emojis durch SVG-Icons ersetzt. * feat(admin): add scroll-to-top toggle and SVG arrow The back-to-top button was always on and drew its arrow with the ↑ text character. Add a `scrollToTop` setting (General section in the admin panel, defaults to on so existing sites are unaffected) and replace the glyph with a stroked SVG that inherits currentColor across all presets. Scroll handling is now rAF-throttled, and prefers-reduced-motion turns off both the hover lift and the smooth scroll. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * security(journal): escape author HTML instead of filtering it CodeQL flags 26 high-severity alerts on the release PR; the bulk of them point at sanitizeHtml(), a denylist of three regexes whose output goes into dangerouslySetInnerHTML. I reproduced the bypasses before changing anything — all four pass the old filter: <img src=x onerror=alert(1)> unquoted handler, regex wants quotes <img src=x onerror='alert(1)'> single quotes, same reason <svg onload=alert(1)> not a <script> tag javasjavascript:cript:alert(1) one-pass replace, the rest recombines Plus an attribute breakout in the link renderer, which interpolated the URL into href="${url}" unescaped: [x](" onmouseover=alert(1) x=") -> <a href="" onmouseover=alert(1" ...> Replaced with escaping. Every `&<>"'` in author text becomes an entity before any markdown rule runs, so the only tags in the output are the ones renderInlineMarkdown builds itself and a URL cannot leave its attribute. Link schemes are now an allowlist (http, https, mailto, tel, relative, anchor); anything else renders as plain text. The serializer needed decodeHtmlEntities to match: without it a save would write `&lt;` into the Markdown file and the next parse would escape the `&` again, corrupting the text further on every round trip. A test covers parse -> serialize -> parse stability. Two existing tests asserted the old behaviour and were rewritten rather than deleted: one expected the script tag to be *removed* from the output, the other expected the substring "onerror" to be absent. Both now assert the property that matters — that no tag can form — because `onerror` surviving as inert text is fine. Exploitation required admin access either way: journal and essay text comes from the studio or from content/*.md. This removes the weakness, it does not close an open door. * fix(journal): contain file paths, fix frontmatter escaping, defuse two regexes Follow-up to the CodeQL findings on release PR #432. I went through all 23 alerts individually; this addresses the ones that are worth addressing and documents the ones that are not. Path containment (12 alerts, all false positives). Every path built from a slug goes through isValidSlug(), a strict `/^[a-zA-Z0-9_-]+$/` allowlist — verified against `../../etc/passwd`, `foo/../../bar`, `a/b`, `..` and friends, all rejected. CodeQL cannot see it because the check lives in another module. Added a containedPath() helper that resolves the path and refuses anything landing outside the content directory: a second lock on a door that was already locked, and a barrier the analysis can follow. Also removed the dead `slug.endsWith('.md')` branches — isValidSlug rejects dots, so they could never be taken. Frontmatter escaping (1 alert, a real bug). The serializer escaped `"` but not `\`, and the parser never unescaped anything. A title containing either character gained a backslash on every save/load cycle: Path C:\Users "quoted" -> Path C:\\Users \"quoted\" -> ... Escaping now covers the backslash first and the parser undoes both. A round trip test covers quotes, backslashes, colons and apostrophes. Two of three ReDoS regexes (2 alerts). The heading pattern had `\s+` next to `(.+)`, which overlap, so the engine tried every split of the whitespace run before failing; it is `[ \t]+` and `(\S.*)` now. The quote author pattern wrapped a lazy group around an optional group — the quadratic case — and is an index split on the first separator now. The third regex, the bold/italic pass, is deliberately left alone. Rewriting it with a negated class removes the backtracking but breaks nesting: `**bold *and italic* here**` renders as `*<em>bold </em>and italic<em> here</em>*`. The input is Markdown from an authenticated admin, never a visitor, so the worst case is an author slowing down their own page. The comment in the code says so. Not addressed: 5 js/insufficient-password-hash alerts. They ask for a slow KDF where the code uses SHA-256/HMAC — correct in general, but the admin password comes from an environment variable and is never stored, so a stronger KDF protects nothing that is not already in plaintext in the environment. 399 unit tests pass (18 new), build and tsc clean. * fix(journal): split the quote author by scanning, not by pattern Cleaning up after myself. #439 replaced the quote author regex `/^(.*?)(?:\s+--\s+(.+))?$/` — a lazy group around an optional one, the quadratic case — with `/\s+--\s+/`, and CodeQL promptly flagged the replacement for the same reason. One reported pattern traded for another. splitQuoteAuthor() scans for the first `--` that has whitespace on both sides. Linear, and it needs no reasoning about the regex engine at all. Behaviour is identical to the original regex, checked case by case against it: separator, no separator, several separators, tabs, wide gaps, `a--b` without spaces, leading and trailing separators, empty string. All nine are covered by tests, plus one asserting it stays fast on a 50k whitespace run. * security(admin): derive the session signing key with scrypt getSigningKey() ran the admin password through a single SHA-256 digest. It is key derivation rather than password storage, so it was never a stored-hash problem — but if the derived key ever leaked, one fast hash makes recovering the password by brute force cheap. CodeQL flags it as js/insufficient-password-hash and, for this particular alert, has a point. scrypt now. Two details that matter: The salt has to be stable. A random salt would produce a different key on every call and invalidate every session; it is derived from AUTH_SECRET, which is deployment-specific. Verified across separate processes: same inputs produce a verifying token, so a restart or redeploy does not log everyone out. The result is cached for the process lifetime. scrypt is deliberately slow and getSigningKey() runs on every admin request — deriving per call would add ~24ms to each one. The cache key is a digest of secret plus password, so a rotation misses the cache and derives again, and no extra plaintext copy of the password is kept around. Measured: first derivation 24ms, subsequent calls 0.12ms. Password change and secret change both invalidate an existing token, checked in separate processes. Note the one-time effect: existing admin sessions are invalidated by the change in derivation, so everyone logs in once more. * security(admin): key the signing-key cache on its inputs, not a digest #441 removed the SHA-256 digest of the admin password from the key derivation and introduced a new one three lines above it, as the cache key. Same rule, same file: CodeQL reported it immediately. The comment justifying it was wrong too. It claimed no second plaintext copy of the password was retained, while building the digest input allocates exactly that in order to hash it. The cache now holds the two input strings and compares them directly. They are the same objects the env and install caches already hold, so nothing extra is retained, and no fast hash of the password exists in memory for the life of the process. Re-verified after the change, in separate processes: a token from one process verifies in another with the same inputs, a changed password or secret rejects it, first derivation 24ms, cached calls 0.001ms. That leaves scrypt as the only place the password is hashed here. The two HMACs further down operate on the derived key and on token data, not on the password; the constant-time comparison in verifyAdminPassword is the previously dismissed one. --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
2026-08-14 16:55:07 +02:00
padding: 0.55rem;
feat(admin): visual theme cards, album search, and status dashboard (#241) * feat(admin): implement visual theme cards, album search, and system status diagnostics * fix(admin): resolve type-checking build errors in SettingsEditor and status route --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-05-31 21:17:52 +02:00
display: flex;
flex-direction: column;
release: v0.11.0 — journal fixes, admin URLs, design system cleanup (#432) * fix(screenshots): sharp-Typen fuer 0.34 und 0.35 gleichzeitig (#410) sharp 0.35 ist von `export =` auf ESM umgestellt: der Modul-Namespace ist nicht mehr aufrufbar, die Factory sitzt unter .default. Der Type-Check brach damit in scripts/screenshots.ts weg, sobald der Next-Bump (#402) sharp von 0.34.5 auf 0.35.3 mitzieht -- sharp ist hier keine deklarierte Dependency, sondern kommt ueber Next mit. Die Form wird jetzt aus dem installierten Paket abgeleitet statt festgeschrieben, zur Laufzeit wie im Typ. Geprueft mit beiden Versionen: tsc laeuft mit 0.34.5 und mit 0.35.3 fehlerfrei durch. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(deps): bump the nextjs group across 1 directory with 2 updates (#402) Bumps the nextjs group with 2 updates in the / directory: [next](https://github.com/vercel/next.js) and [eslint-config-next](https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next). Updates `next` from 16.2.12 to 16.3.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/compare/v16.2.12...v16.3.0) Updates `eslint-config-next` from 16.2.12 to 16.3.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/commits/v16.3.0/packages/eslint-config-next) --- updated-dependencies: - dependency-name: eslint-config-next dependency-version: 16.3.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: nextjs - dependency-name: next dependency-version: 16.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nextjs ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps-dev): bump prettier from 3.8.3 to 3.9.6 (#405) Bumps [prettier](https://github.com/prettier/prettier) from 3.8.3 to 3.9.6. - [Release notes](https://github.com/prettier/prettier/releases) - [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md) - [Commits](https://github.com/prettier/prettier/compare/3.8.3...3.9.6) --- updated-dependencies: - dependency-name: prettier dependency-version: 3.9.6 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * docs(changelog): Unreleased-Sektion fuer die Bumps nach v0.10.0 (#413) Die Dependency-PRs sind nach dem Release auf dev gelandet, teils auch auf main. Ohne Eintrag waeren sie beim naechsten Release unsichtbar -- inklusive Next 16.3.0, das CVE-2025-13465 mitbringt. Ausserdem im 0.10.0-Abschnitt nachgetragen, dass der Trivy-Scan bis #409 nie gelaufen ist. Der Fix steckt im Tag v0.10.0, fehlte aber in der Aufzaehlung -- und "Images werden bei jedem Publish gescannt" stand im Changelog, waehrend der Job im Action-Setup abbrach. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(gallery): per-album sort order, independent of Immich (#408) (#414) Album order was dictated entirely by Immich: getAlbum() sorted by the album's own asc/desc flag, so a Folio album always mirrored the archive. A curated series has a narrative order that has nothing to do with capture time, and changing the Immich album's sort to fit the website changes it for the archive too. Adds an optional per-album `sort` in gallery.yaml, editable in /admin, defaulting to today's behaviour so every existing config is unchanged: immich (default) | newest | oldest | filename | manual `manual` is a pinned *prefix*: `assetOrder` lists only the photos placed by hand, everything else follows in the album's Immich order. A full permutation of a 2,000-photo album would be ~80 KB of UUIDs in a file that is rewritten and copied to content/.backups/ on every admin save. It also makes drift fall out for free — photos removed in Immich never match, new ones land in the tail rather than being hidden. Sorting is applied after the cache read, not before the cache write, so the LRU keeps one canonical Immich-ordered copy per album. That avoids putting the mode in the cache key, lets a config change take effect without depending on invalidation, and keeps the stale-serving path correct. cache.get() returns the stored object by reference, so withSort() returns a shallow clone with a new array — sorting in place would reorder the shared entry, and under request coalescing every concurrent caller would be sorting the same array. Also fixes a prerequisite bug: /api/admin/albums/[albumId]/assets read album.assets from GET /albums/:id, which Immich 3.x no longer populates (lib/immich.ts:507). The hero picker's "This Album" tab returned nothing and threw outright when the key was absent. It now goes through the client's paginated metadata search, with ?types=all to opt videos in for the reorder editor. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): drop decorative emoji from the sort select labels (#415) An <option> cannot contain markup, so the SVG set in Icons is not reachable there — but a decorative emoji is not a substitute for it. Plain text instead; the album card badge already uses a real icon. The remaining emoji in the admin panel (asset picker tabs, section headings, layout picker options) predate this branch and are left for a separate cleanup. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): replace emoji icons with the shared SVG icon set (#416) The admin panel mixed two icon conventions: inline SVGs from `Icons.tsx` in most components, and decorative emoji in the asset picker and a few PageBuilder labels. Emoji render inconsistently across platforms, ignore the accent colour, and cannot inherit the `.svg-icon` sizing rules. - Icons.tsx: add `IconStar` (filled — it marks a state, not an action) and `IconImage`. - AssetPicker: the three tab labels and the favourite tile badge now use IconFolder / IconStar / IconImage. - PageBuilder: the "Standalone Albums" and "Subpages" headings use the icon set instead of an emoji. - PageBuilder: the layout picker drops its emoji for plain text. An <option> cannot contain markup, so an SVG is impossible there and a decorative glyph is not a substitute. - admin.css: align icon and label in the picker tabs, and swap the favourite badge's text-shadow for drop-shadow, which is what applies to an inline SVG. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): fold PageBuilder's local icons into the shared Icons module (#418) * refactor(admin): fold PageBuilder's local icons into the shared module PageBuilder.tsx carried its own `Icons` object duplicating most of the glyphs already exported by Icons.tsx, with hardcoded sizes and slightly divergent paths. Migrate all 32 call sites to the shared module and delete the local object. Five glyphs had no counterpart and are added to Icons.tsx as 1:1 ports of the local paths: IconX, IconPlus, IconHome, IconCopy, IconImage. The local ExternalLink and Check are dropped rather than ported — both had zero call sites. Two glyphs change shape slightly, which is the point of consolidating: the shared IconCamera includes the viewfinder bump the local copy omitted, and drag handles now use IconGripVertical. IconGripVertical uses the module's square 24x24 viewBox, so `.svg-drag` goes from 12x18 to 18x18 — the old non-square box would letterbox the glyph down to 12x12 and shrink the handle. * fix(admin): resolve icon-module integration after #416 Merging dev brought in #416, which added a second IconImage to Icons.tsx and two <Icons.Camera>/<Icons.Folder> section headers that reference the local Icons object this PR removes. Git merged both cleanly but the result did not type-check. - drop the duplicate IconImage (both copies were byte-identical) - point the two section headers at the imported IconCamera/IconFolder - refresh the SORT_LABELS comment: the icon set is imported now, not declared below --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> * fix(config): allow an empty gallery, guard against a double /api suffix (#421) An empty gallery is now a valid, rendered state instead of a throw: deriveGallery() no longer requires at least one album or subpage, so a deployment with no albums yet renders a bare homepage the owner can fill in via /admin. getConfig() also stops appending /api to an Immich URL that already ends in it, which previously produced .../api/api and broke every upstream request. Includes a restore of the per-album sort test cases, which the branch had lost by being cut before #408/#414. * feat(admin): favicon upload, served from the content volume (#422) Adds a bundled default favicon, an upload widget in admin Settings > General, and a route that serves the icon from the writable content/ volume with a fallback to the bundled default. Raster uploads (PNG/ICO/JPEG) are wrapped in an SVG container; the response carries its own CSP so an uploaded SVG cannot execute script on the origin. The GET route revalidates with an ETag instead of caching immutably, so a newly uploaded icon shows up immediately. Uploads are written via temp file + rename, and a Reset button restores the bundled default. * ci: flag unformatted files in a PR, without blocking it (#424) Prettier is configured as an error rule in eslint.config.mjs but has never run in CI, so part of the tree predates it. A final CI step now diffs against the PR base, runs prettier --list-different over the changed files, and emits a warning annotation per offender plus a job summary. Advisory by design: it never fails the job. Blocking would turn a PR red for merely touching a file that was already unformatted, and normalising the tree in one commit would wreck git blame and conflict with the PRs in flight. Requires fetch-depth: 0, since diffing against the base needs its history. * feat(install): first-run wizard gated by a one-time setup token (#419) Adds /install, a four-step first-run wizard: connect to Immich, optionally pick albums, name the site, finish. It verifies the credentials against the Immich server before writing anything, then writes gallery.yaml, settings.yaml and a content/install.json carrying the Immich credentials and a generated site secret. install.json exists because a running process cannot pick up new env vars — the wizard has to write configuration that takes effect without a restart. getInstallCredentials() merges it under the real environment, so env vars always win and rotation stays a matter of setting one. Both the page and the API routes are gated by a one-time setup token printed to the server log, so a deployment that is reachable before gallery.yaml exists cannot be configured by whoever finds it first. The token is stored in content/.setup-token (0600) rather than a module variable: Next.js bundles the page and each route handler separately, so a module-level token left the page and the API disagreeing inside one process and the wizard stuck on step 1. It is removed once the install completes. The admin password is stored as an scrypt hash using the scheme lib/auth.ts already applies to album passwords; a plaintext ADMIN_PASSWORD env var keeps working. * docs: document the setup wizard, fix the read-only content mount (#425) Quick Start now leads with the /install wizard, with the hand-written YAML route kept alongside it, and a First-Run Setup section covers the setup token, the files the wizard writes, and env-var precedence. Two corrections: both Docker examples mounted content/ as :ro, which silently breaks the wizard, the admin panel and the backup rotation alike — docs/admin-panel.md already said so and the README contradicted it. And nothing documented that content/install.json holds the Immich API key, so a backup of content/ is a backup of credentials. Also adds a Contributors section crediting the people whose work is in the project. * feat(admin): floating save bar pinned to the bottom of the viewport (#426) The save bar was the first, static element inside .admin-main. Since the document itself scrolls, it left the viewport as soon as you scrolled down — editing a subpage section or a settings block far below gave no visible dirty hint and no reachable save button. Replace it with a bottom-pinned floating bar shared by both editors. It only mounts while there is something to act on (unsaved changes, an in-flight save, or a result message), so it never covers content while idle. The success message clears after 5s, which hides the bar again. - new SaveBar component, replacing the duplicated markup in PageBuilder and SettingsEditor - adopt the previously unused .floating-save-bar CSS: slide-in keyframes (carrying translateX(-50%)), dirty border, wrap/gap, mobile variant and a prefers-reduced-motion opt-out; z-index 900 keeps it below modals - .admin-main gains bottom padding so the bar never covers page content - drop the now-unreachable idle hints: the ⌘S hint becomes a button title, the Live Sync note becomes a static line above the settings layout - header "Site" link now bypasses the cache (/?fresh=1), so the preview stays reachable when the bar is hidden Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(admin): themed listbox for the album sort control (#427) The per-album "Photo order" control was a native <select>. Because an <option> cannot contain markup, its choices could not use the admin panel's currentColor SVG set — the reason #415 had to fall back to plain text after dropping the emoji labels. Adds a Listbox component implementing the ARIA combobox/listbox pattern, so options can render a glyph beside their label: - DOM focus stays on the trigger button; the active option is announced through aria-activedescendant, keeping focus management to one element - Keyboard: arrows (clamped at the ends, like a native select), Home/End, Enter/Space to commit, Escape to cancel, Tab commits and moves on, and prefix type-ahead with a repeat-key cycle - Outside dismissal on pointerdown, so a press starting outside closes the popup before the click retargets The sort options now carry an icon each: calendar, arrow-down, arrow-up, an A→Z marker, and the drag glyph for manual — matching the badge the album card already shows. SORT_LABELS stays plain text because the badge feeds it to a title attribute. Closes #417 Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(git): ignore generated design handoff folders * fix(admin): stop the album sort dropdown clipping, and simplify the panel (#428) * fix(admin): render listbox popup in a portal so it escapes modal clipping The sort control's popup was position:absolute inside three clipping ancestors (.album-drawer overflow:hidden > .album-drawer-body overflow-y:auto > .modal-right-column overflow-y:auto), so it was cut off at the bottom of the Edit Album Details modal. z-index could not help: clipping happens before stacking. It also always hung below the trigger, with no flip. Portal the popup to document.body and position it from the trigger's viewport rect, flipping above when there is more room there and capping max-height to the space available so it scrolls internally rather than overflowing. It is dismissed on scroll and resize, since the anchor is only measured on open. The outside-pointerdown handler now also treats the popup as inside; without that the portalled list counts as outside, and a click on an option would close it before the selection commits. * refactor(admin): single-column album details panel The left column spent 1.2fr on a cover thumbnail and three stat rows, two of which (Status, Custom Hero) only restated the form fields opposite them, while the form itself was squeezed into 1.8fr behind a second nested scroller. Stack the drawer in one column instead: cover as a banner, then the form at full width, with the UUID moved into the footer. The body is now the only scroll container, which also removes one of the ancestors that was clipping the sort popup. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> * fix(admin): give the portalled listbox its theme back, lock the page behind modals (#429) Two defects in the album editor. The sort listbox popup painted transparent. Every --admin-* variable is scoped to .admin-layout, and since the popup moved into document.body it sits outside that subtree, so background/border/text all resolved to nothing. It now carries its own copy of the palette in both colour schemes, plus the font it no longer inherits. Scrolling inside a modal also moved the page behind it. No admin modal ever locked body scroll: the overlay covers the page but does not absorb wheel events, so a scroll starting on the backdrop — or continuing past the end of the modal's own scroller — reaches the document. overscroll-behavior cannot cover that case on its own, because it only applies to scroll containers and the backdrop is not one. useScrollLock freezes body while a modal is open and compensates for the width the scrollbar gives up, so nothing shifts underneath. Each lock restores the inline value it found, which makes nesting work without a counter — a picker opened from the drawer restores the drawer's hidden state instead of clearing it. Applied to both drawers and all four picker modals, which share the defect. overscroll-behavior: contain on the scrollers stops the chaining they can handle themselves. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com> * fix(security): allow unsafe-eval in CSP script-src during dev mode * feat(journal): add Journal Studio with split-screen editor, live preview and dedicated routes * fix(build): separate client parser from server journal-service and fix build type errors * fix(journal): Fotos rendern, Layout und Lightbox-Steuerung korrigieren Fünf unabhängige Fehler in der öffentlichen Journal- und Essay-Ansicht: * Foto-Blöcke wurden nie angezeigt. EssayView löst ein Foto über PhotoItem.id auf, und das sind verschlüsselte Tokens — die Blöcke aus dem Markdown tragen aber rohe Asset-UUIDs. Jede Zuordnung lief ins Leere, und nicht auflösbare Blöcke werden still verworfen. Die IDs werden jetzt serverseitig übersetzt; damit verschwinden nebenbei die rohen UUIDs aus dem Client-Payload, die dort laut Projektregel nie auftauchen dürfen. Nicht auflösbare Referenzen werden geloggt. * Überschriften standen weiter links als der Fließtext. Jeder Block hatte einzeln `max-width: 68ch`, und `ch` ist relativ zur Schrift des Elements — die Serif-Überschrift ergab eine breitere Spalte. Ersetzt durch eine gemeinsame, font-unabhängige `--essay-measure`. * Fullbleed-Fotos bluteten nur nach links aus: `.essay-figure` ist `width: 100%`, wodurch die Box überbestimmt ist und der negative rechte Margin verworfen wird. * Foto-Paare stellten beide Bilder gleich breit dar, wodurch ein Hochformat neben einem Querformat doppelt so hoch wurde. Jetzt eine Justified-Reihe: Breite proportional zum Seitenverhältnis, dadurch exakt gleiche Höhen ohne Beschnitt. * Die Lightbox hatte im Journal keine Tastatursteuerung und keine Scroll-Sperre — beides lag in PhotoGrid, also nur im Album-Raster. Verlagert in die Lightbox selbst, der doppelte Handler in PhotoGrid entfernt (sonst wäre pro Pfeildruck zwei Bilder weitergesprungen). Zusätzlich sind Proofing-Herzen und das EXIF-Panel im redaktionellen Modus abschaltbar und im Journal aus: Client-Proofing ist ein Übergabe-Workflow für Alben, keine Funktion einer Reportage. Auf der Übersicht wurde der Untertitel doppelt gerendert, weil extractExcerpt() auf ihn zurückfällt. * feat(admin): eigene URLs für alle Bereiche und überarbeiteter Journal Studio Das Panel war eine einzige Client-Komponente, die ihre Tabs über useState umschaltet: keine Route pro Bereich, kein Deep-Link, kein Zurück-Button, und nach jedem Reload landete man wieder auf "Pages". Auch der Journal-Editor hatte keine eigene URL. Jetzt sieben echte Routen (/admin, /admin/pages, /admin/journal, /admin/journal/<slug>, /admin/settings, /admin/settings/<section>, /admin/analytics). Die Shell mit Auth-Prüfung und Kopfzeile sitzt im Layout und umschließt children — so bleibt die Session-Prüfung über Routenwechsel montiert, statt bei jedem Tab-Wechsel neu zu laufen und den Spinner aufblitzen zu lassen. Unbekannte Settings-Sections fallen auf General zurück. Im selben Zug der Journal Studio, der die Routing-Änderung ohnehin berührt: * Alle Eingabefelder nutzten die Klasse `admin-input`, die in keinem CSS definiert war — sie fielen auf Browser-Defaults zurück. Jetzt gestylt, gescoped, damit der generische Name nicht ins übrige Panel leckt. * Der Split View ist per Divider verschiebbar (Maus, Tastatur, Doppelklick zum Zurücksetzen), Breite in localStorage. * Das Studio bricht aus der 1120px-Spalte aus, die Preview hat Platz. * Die Preview zeigte für jedes Foto fest 3:2 und log damit über das Layout der veröffentlichten Seite; die echten Verhältnisse werden jetzt an den Thumbnails gemessen. * Blöcke mit alten positionsbasierten Foto-Referenzen werden markiert — die lassen sich auf einer eigenständigen Journal-Seite nicht auflösen und verschwanden bisher stillschweigend. * Blocktyp-Chips als gemeinsame Komponente, monochrom und per Icon unterschieden statt in einer eigenen Blau/Lila/Orange-Palette, die sonst nirgends im Panel vorkommt. * Emojis raus, SVG-Icons rein. * fix(admin): Designsystem-Lücken im Panel schließen Eine systematische Suche nach Klassen, die im TSX benutzt, aber in keinem CSS definiert sind, hat vier Stellen mit demselben Muster gefunden: * `admin-btn-secondary` und `admin-btn-danger` existierten nicht. Sämtliche Löschen-Buttons sahen aus wie normale Buttons — keine Warnwirkung. Als `.admin-btn.admin-btn-danger` geschrieben, weil die Varianten mit den Größenklassen kombiniert werden, die weiter unten ihren eigenen Hintergrund setzen. * `page-progress-fill` fehlte: die Balken im Analytics-Panel waren leere Rinnen, der Wert unsichtbar. Ebenso `analytics-empty` und `admin-loading-container`. * `subpage-drawer-section`, `subpage-drawer-title-group` und `input-with-icon` im PageBuilder waren wirkungslos und teils mit Inline-Styles notdürftig kompensiert. * `grid-card-preview` fehlte, wodurch alle Layout-Vorschauen auf Höhe null kollabierten. Nur "Showcase" war sichtbar — und das aus Versehen, weil sein Tile `hero-tile` hieß und damit die `aspect-ratio` einer fremden PageBuilder-Klasse erbte. Umbenannt. Dazu die Theme-Vorschauen, die praktisch identisch aussahen: alle sieben zeigten dieselben drei quadratischen Kacheln, einziger Unterschied war die Hintergrundfarbe. Sie spiegeln jetzt die echten Preset-Daten aus lib/config/theme.ts — Schriftcharakter, Eckradius, Rasterdichte, Passepartout bzw. Schatten. Die Kopfzeile richtet sich an einer gemeinsamen Steuerhöhe aus. Der "Site"-Link war höher als die Buttons daneben: `.admin-btn` hatte keine explizite line-height, und <button> bekommt box-sizing: border-box vom Browser, <a> nicht. Die Statusanzeige setzte weder Schriftfamilie noch -größe und fiel auf den Browser-Default zurück — sie war nie Teil des Designsystems. Jetzt gleiche Höhe und Typografie, Pillenform als Zustandsanzeige, Trenner zur Aktionsgruppe. Das dauerhafte Pulsieren des grünen Punkts entfällt; Animation bleibt den Zuständen vorbehalten, die Aufmerksamkeit brauchen. Restliche Emojis durch SVG-Icons ersetzt. * feat(admin): add scroll-to-top toggle and SVG arrow The back-to-top button was always on and drew its arrow with the ↑ text character. Add a `scrollToTop` setting (General section in the admin panel, defaults to on so existing sites are unaffected) and replace the glyph with a stroked SVG that inherits currentColor across all presets. Scroll handling is now rAF-throttled, and prefers-reduced-motion turns off both the hover lift and the smooth scroll. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * security(journal): escape author HTML instead of filtering it CodeQL flags 26 high-severity alerts on the release PR; the bulk of them point at sanitizeHtml(), a denylist of three regexes whose output goes into dangerouslySetInnerHTML. I reproduced the bypasses before changing anything — all four pass the old filter: <img src=x onerror=alert(1)> unquoted handler, regex wants quotes <img src=x onerror='alert(1)'> single quotes, same reason <svg onload=alert(1)> not a <script> tag javasjavascript:cript:alert(1) one-pass replace, the rest recombines Plus an attribute breakout in the link renderer, which interpolated the URL into href="${url}" unescaped: [x](" onmouseover=alert(1) x=") -> <a href="" onmouseover=alert(1" ...> Replaced with escaping. Every `&<>"'` in author text becomes an entity before any markdown rule runs, so the only tags in the output are the ones renderInlineMarkdown builds itself and a URL cannot leave its attribute. Link schemes are now an allowlist (http, https, mailto, tel, relative, anchor); anything else renders as plain text. The serializer needed decodeHtmlEntities to match: without it a save would write `&lt;` into the Markdown file and the next parse would escape the `&` again, corrupting the text further on every round trip. A test covers parse -> serialize -> parse stability. Two existing tests asserted the old behaviour and were rewritten rather than deleted: one expected the script tag to be *removed* from the output, the other expected the substring "onerror" to be absent. Both now assert the property that matters — that no tag can form — because `onerror` surviving as inert text is fine. Exploitation required admin access either way: journal and essay text comes from the studio or from content/*.md. This removes the weakness, it does not close an open door. * fix(journal): contain file paths, fix frontmatter escaping, defuse two regexes Follow-up to the CodeQL findings on release PR #432. I went through all 23 alerts individually; this addresses the ones that are worth addressing and documents the ones that are not. Path containment (12 alerts, all false positives). Every path built from a slug goes through isValidSlug(), a strict `/^[a-zA-Z0-9_-]+$/` allowlist — verified against `../../etc/passwd`, `foo/../../bar`, `a/b`, `..` and friends, all rejected. CodeQL cannot see it because the check lives in another module. Added a containedPath() helper that resolves the path and refuses anything landing outside the content directory: a second lock on a door that was already locked, and a barrier the analysis can follow. Also removed the dead `slug.endsWith('.md')` branches — isValidSlug rejects dots, so they could never be taken. Frontmatter escaping (1 alert, a real bug). The serializer escaped `"` but not `\`, and the parser never unescaped anything. A title containing either character gained a backslash on every save/load cycle: Path C:\Users "quoted" -> Path C:\\Users \"quoted\" -> ... Escaping now covers the backslash first and the parser undoes both. A round trip test covers quotes, backslashes, colons and apostrophes. Two of three ReDoS regexes (2 alerts). The heading pattern had `\s+` next to `(.+)`, which overlap, so the engine tried every split of the whitespace run before failing; it is `[ \t]+` and `(\S.*)` now. The quote author pattern wrapped a lazy group around an optional group — the quadratic case — and is an index split on the first separator now. The third regex, the bold/italic pass, is deliberately left alone. Rewriting it with a negated class removes the backtracking but breaks nesting: `**bold *and italic* here**` renders as `*<em>bold </em>and italic<em> here</em>*`. The input is Markdown from an authenticated admin, never a visitor, so the worst case is an author slowing down their own page. The comment in the code says so. Not addressed: 5 js/insufficient-password-hash alerts. They ask for a slow KDF where the code uses SHA-256/HMAC — correct in general, but the admin password comes from an environment variable and is never stored, so a stronger KDF protects nothing that is not already in plaintext in the environment. 399 unit tests pass (18 new), build and tsc clean. * fix(journal): split the quote author by scanning, not by pattern Cleaning up after myself. #439 replaced the quote author regex `/^(.*?)(?:\s+--\s+(.+))?$/` — a lazy group around an optional one, the quadratic case — with `/\s+--\s+/`, and CodeQL promptly flagged the replacement for the same reason. One reported pattern traded for another. splitQuoteAuthor() scans for the first `--` that has whitespace on both sides. Linear, and it needs no reasoning about the regex engine at all. Behaviour is identical to the original regex, checked case by case against it: separator, no separator, several separators, tabs, wide gaps, `a--b` without spaces, leading and trailing separators, empty string. All nine are covered by tests, plus one asserting it stays fast on a 50k whitespace run. * security(admin): derive the session signing key with scrypt getSigningKey() ran the admin password through a single SHA-256 digest. It is key derivation rather than password storage, so it was never a stored-hash problem — but if the derived key ever leaked, one fast hash makes recovering the password by brute force cheap. CodeQL flags it as js/insufficient-password-hash and, for this particular alert, has a point. scrypt now. Two details that matter: The salt has to be stable. A random salt would produce a different key on every call and invalidate every session; it is derived from AUTH_SECRET, which is deployment-specific. Verified across separate processes: same inputs produce a verifying token, so a restart or redeploy does not log everyone out. The result is cached for the process lifetime. scrypt is deliberately slow and getSigningKey() runs on every admin request — deriving per call would add ~24ms to each one. The cache key is a digest of secret plus password, so a rotation misses the cache and derives again, and no extra plaintext copy of the password is kept around. Measured: first derivation 24ms, subsequent calls 0.12ms. Password change and secret change both invalidate an existing token, checked in separate processes. Note the one-time effect: existing admin sessions are invalidated by the change in derivation, so everyone logs in once more. * security(admin): key the signing-key cache on its inputs, not a digest #441 removed the SHA-256 digest of the admin password from the key derivation and introduced a new one three lines above it, as the cache key. Same rule, same file: CodeQL reported it immediately. The comment justifying it was wrong too. It claimed no second plaintext copy of the password was retained, while building the digest input allocates exactly that in order to hash it. The cache now holds the two input strings and compares them directly. They are the same objects the env and install caches already hold, so nothing extra is retained, and no fast hash of the password exists in memory for the life of the process. Re-verified after the change, in separate processes: a token from one process verifies in another with the same inputs, a changed password or secret rejects it, first derivation 24ms, cached calls 0.001ms. That leaves scrypt as the only place the password is hashed here. The two HMACs further down operate on the derived key and on token data, not on the password; the constant-time comparison in verifyAdminPassword is the previously dismissed one. --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
2026-08-14 16:55:07 +02:00
gap: 0.45rem;
feat(admin): visual theme cards, album search, and status dashboard (#241) * feat(admin): implement visual theme cards, album search, and system status diagnostics * fix(admin): resolve type-checking build errors in SettingsEditor and status route --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-05-31 21:17:52 +02:00
border-bottom: 1px solid var(--admin-border);
position: relative;
overflow: hidden;
release: v0.11.0 — journal fixes, admin URLs, design system cleanup (#432) * fix(screenshots): sharp-Typen fuer 0.34 und 0.35 gleichzeitig (#410) sharp 0.35 ist von `export =` auf ESM umgestellt: der Modul-Namespace ist nicht mehr aufrufbar, die Factory sitzt unter .default. Der Type-Check brach damit in scripts/screenshots.ts weg, sobald der Next-Bump (#402) sharp von 0.34.5 auf 0.35.3 mitzieht -- sharp ist hier keine deklarierte Dependency, sondern kommt ueber Next mit. Die Form wird jetzt aus dem installierten Paket abgeleitet statt festgeschrieben, zur Laufzeit wie im Typ. Geprueft mit beiden Versionen: tsc laeuft mit 0.34.5 und mit 0.35.3 fehlerfrei durch. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(deps): bump the nextjs group across 1 directory with 2 updates (#402) Bumps the nextjs group with 2 updates in the / directory: [next](https://github.com/vercel/next.js) and [eslint-config-next](https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next). Updates `next` from 16.2.12 to 16.3.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/compare/v16.2.12...v16.3.0) Updates `eslint-config-next` from 16.2.12 to 16.3.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/commits/v16.3.0/packages/eslint-config-next) --- updated-dependencies: - dependency-name: eslint-config-next dependency-version: 16.3.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: nextjs - dependency-name: next dependency-version: 16.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nextjs ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps-dev): bump prettier from 3.8.3 to 3.9.6 (#405) Bumps [prettier](https://github.com/prettier/prettier) from 3.8.3 to 3.9.6. - [Release notes](https://github.com/prettier/prettier/releases) - [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md) - [Commits](https://github.com/prettier/prettier/compare/3.8.3...3.9.6) --- updated-dependencies: - dependency-name: prettier dependency-version: 3.9.6 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * docs(changelog): Unreleased-Sektion fuer die Bumps nach v0.10.0 (#413) Die Dependency-PRs sind nach dem Release auf dev gelandet, teils auch auf main. Ohne Eintrag waeren sie beim naechsten Release unsichtbar -- inklusive Next 16.3.0, das CVE-2025-13465 mitbringt. Ausserdem im 0.10.0-Abschnitt nachgetragen, dass der Trivy-Scan bis #409 nie gelaufen ist. Der Fix steckt im Tag v0.10.0, fehlte aber in der Aufzaehlung -- und "Images werden bei jedem Publish gescannt" stand im Changelog, waehrend der Job im Action-Setup abbrach. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(gallery): per-album sort order, independent of Immich (#408) (#414) Album order was dictated entirely by Immich: getAlbum() sorted by the album's own asc/desc flag, so a Folio album always mirrored the archive. A curated series has a narrative order that has nothing to do with capture time, and changing the Immich album's sort to fit the website changes it for the archive too. Adds an optional per-album `sort` in gallery.yaml, editable in /admin, defaulting to today's behaviour so every existing config is unchanged: immich (default) | newest | oldest | filename | manual `manual` is a pinned *prefix*: `assetOrder` lists only the photos placed by hand, everything else follows in the album's Immich order. A full permutation of a 2,000-photo album would be ~80 KB of UUIDs in a file that is rewritten and copied to content/.backups/ on every admin save. It also makes drift fall out for free — photos removed in Immich never match, new ones land in the tail rather than being hidden. Sorting is applied after the cache read, not before the cache write, so the LRU keeps one canonical Immich-ordered copy per album. That avoids putting the mode in the cache key, lets a config change take effect without depending on invalidation, and keeps the stale-serving path correct. cache.get() returns the stored object by reference, so withSort() returns a shallow clone with a new array — sorting in place would reorder the shared entry, and under request coalescing every concurrent caller would be sorting the same array. Also fixes a prerequisite bug: /api/admin/albums/[albumId]/assets read album.assets from GET /albums/:id, which Immich 3.x no longer populates (lib/immich.ts:507). The hero picker's "This Album" tab returned nothing and threw outright when the key was absent. It now goes through the client's paginated metadata search, with ?types=all to opt videos in for the reorder editor. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): drop decorative emoji from the sort select labels (#415) An <option> cannot contain markup, so the SVG set in Icons is not reachable there — but a decorative emoji is not a substitute for it. Plain text instead; the album card badge already uses a real icon. The remaining emoji in the admin panel (asset picker tabs, section headings, layout picker options) predate this branch and are left for a separate cleanup. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): replace emoji icons with the shared SVG icon set (#416) The admin panel mixed two icon conventions: inline SVGs from `Icons.tsx` in most components, and decorative emoji in the asset picker and a few PageBuilder labels. Emoji render inconsistently across platforms, ignore the accent colour, and cannot inherit the `.svg-icon` sizing rules. - Icons.tsx: add `IconStar` (filled — it marks a state, not an action) and `IconImage`. - AssetPicker: the three tab labels and the favourite tile badge now use IconFolder / IconStar / IconImage. - PageBuilder: the "Standalone Albums" and "Subpages" headings use the icon set instead of an emoji. - PageBuilder: the layout picker drops its emoji for plain text. An <option> cannot contain markup, so an SVG is impossible there and a decorative glyph is not a substitute. - admin.css: align icon and label in the picker tabs, and swap the favourite badge's text-shadow for drop-shadow, which is what applies to an inline SVG. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): fold PageBuilder's local icons into the shared Icons module (#418) * refactor(admin): fold PageBuilder's local icons into the shared module PageBuilder.tsx carried its own `Icons` object duplicating most of the glyphs already exported by Icons.tsx, with hardcoded sizes and slightly divergent paths. Migrate all 32 call sites to the shared module and delete the local object. Five glyphs had no counterpart and are added to Icons.tsx as 1:1 ports of the local paths: IconX, IconPlus, IconHome, IconCopy, IconImage. The local ExternalLink and Check are dropped rather than ported — both had zero call sites. Two glyphs change shape slightly, which is the point of consolidating: the shared IconCamera includes the viewfinder bump the local copy omitted, and drag handles now use IconGripVertical. IconGripVertical uses the module's square 24x24 viewBox, so `.svg-drag` goes from 12x18 to 18x18 — the old non-square box would letterbox the glyph down to 12x12 and shrink the handle. * fix(admin): resolve icon-module integration after #416 Merging dev brought in #416, which added a second IconImage to Icons.tsx and two <Icons.Camera>/<Icons.Folder> section headers that reference the local Icons object this PR removes. Git merged both cleanly but the result did not type-check. - drop the duplicate IconImage (both copies were byte-identical) - point the two section headers at the imported IconCamera/IconFolder - refresh the SORT_LABELS comment: the icon set is imported now, not declared below --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> * fix(config): allow an empty gallery, guard against a double /api suffix (#421) An empty gallery is now a valid, rendered state instead of a throw: deriveGallery() no longer requires at least one album or subpage, so a deployment with no albums yet renders a bare homepage the owner can fill in via /admin. getConfig() also stops appending /api to an Immich URL that already ends in it, which previously produced .../api/api and broke every upstream request. Includes a restore of the per-album sort test cases, which the branch had lost by being cut before #408/#414. * feat(admin): favicon upload, served from the content volume (#422) Adds a bundled default favicon, an upload widget in admin Settings > General, and a route that serves the icon from the writable content/ volume with a fallback to the bundled default. Raster uploads (PNG/ICO/JPEG) are wrapped in an SVG container; the response carries its own CSP so an uploaded SVG cannot execute script on the origin. The GET route revalidates with an ETag instead of caching immutably, so a newly uploaded icon shows up immediately. Uploads are written via temp file + rename, and a Reset button restores the bundled default. * ci: flag unformatted files in a PR, without blocking it (#424) Prettier is configured as an error rule in eslint.config.mjs but has never run in CI, so part of the tree predates it. A final CI step now diffs against the PR base, runs prettier --list-different over the changed files, and emits a warning annotation per offender plus a job summary. Advisory by design: it never fails the job. Blocking would turn a PR red for merely touching a file that was already unformatted, and normalising the tree in one commit would wreck git blame and conflict with the PRs in flight. Requires fetch-depth: 0, since diffing against the base needs its history. * feat(install): first-run wizard gated by a one-time setup token (#419) Adds /install, a four-step first-run wizard: connect to Immich, optionally pick albums, name the site, finish. It verifies the credentials against the Immich server before writing anything, then writes gallery.yaml, settings.yaml and a content/install.json carrying the Immich credentials and a generated site secret. install.json exists because a running process cannot pick up new env vars — the wizard has to write configuration that takes effect without a restart. getInstallCredentials() merges it under the real environment, so env vars always win and rotation stays a matter of setting one. Both the page and the API routes are gated by a one-time setup token printed to the server log, so a deployment that is reachable before gallery.yaml exists cannot be configured by whoever finds it first. The token is stored in content/.setup-token (0600) rather than a module variable: Next.js bundles the page and each route handler separately, so a module-level token left the page and the API disagreeing inside one process and the wizard stuck on step 1. It is removed once the install completes. The admin password is stored as an scrypt hash using the scheme lib/auth.ts already applies to album passwords; a plaintext ADMIN_PASSWORD env var keeps working. * docs: document the setup wizard, fix the read-only content mount (#425) Quick Start now leads with the /install wizard, with the hand-written YAML route kept alongside it, and a First-Run Setup section covers the setup token, the files the wizard writes, and env-var precedence. Two corrections: both Docker examples mounted content/ as :ro, which silently breaks the wizard, the admin panel and the backup rotation alike — docs/admin-panel.md already said so and the README contradicted it. And nothing documented that content/install.json holds the Immich API key, so a backup of content/ is a backup of credentials. Also adds a Contributors section crediting the people whose work is in the project. * feat(admin): floating save bar pinned to the bottom of the viewport (#426) The save bar was the first, static element inside .admin-main. Since the document itself scrolls, it left the viewport as soon as you scrolled down — editing a subpage section or a settings block far below gave no visible dirty hint and no reachable save button. Replace it with a bottom-pinned floating bar shared by both editors. It only mounts while there is something to act on (unsaved changes, an in-flight save, or a result message), so it never covers content while idle. The success message clears after 5s, which hides the bar again. - new SaveBar component, replacing the duplicated markup in PageBuilder and SettingsEditor - adopt the previously unused .floating-save-bar CSS: slide-in keyframes (carrying translateX(-50%)), dirty border, wrap/gap, mobile variant and a prefers-reduced-motion opt-out; z-index 900 keeps it below modals - .admin-main gains bottom padding so the bar never covers page content - drop the now-unreachable idle hints: the ⌘S hint becomes a button title, the Live Sync note becomes a static line above the settings layout - header "Site" link now bypasses the cache (/?fresh=1), so the preview stays reachable when the bar is hidden Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(admin): themed listbox for the album sort control (#427) The per-album "Photo order" control was a native <select>. Because an <option> cannot contain markup, its choices could not use the admin panel's currentColor SVG set — the reason #415 had to fall back to plain text after dropping the emoji labels. Adds a Listbox component implementing the ARIA combobox/listbox pattern, so options can render a glyph beside their label: - DOM focus stays on the trigger button; the active option is announced through aria-activedescendant, keeping focus management to one element - Keyboard: arrows (clamped at the ends, like a native select), Home/End, Enter/Space to commit, Escape to cancel, Tab commits and moves on, and prefix type-ahead with a repeat-key cycle - Outside dismissal on pointerdown, so a press starting outside closes the popup before the click retargets The sort options now carry an icon each: calendar, arrow-down, arrow-up, an A→Z marker, and the drag glyph for manual — matching the badge the album card already shows. SORT_LABELS stays plain text because the badge feeds it to a title attribute. Closes #417 Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(git): ignore generated design handoff folders * fix(admin): stop the album sort dropdown clipping, and simplify the panel (#428) * fix(admin): render listbox popup in a portal so it escapes modal clipping The sort control's popup was position:absolute inside three clipping ancestors (.album-drawer overflow:hidden > .album-drawer-body overflow-y:auto > .modal-right-column overflow-y:auto), so it was cut off at the bottom of the Edit Album Details modal. z-index could not help: clipping happens before stacking. It also always hung below the trigger, with no flip. Portal the popup to document.body and position it from the trigger's viewport rect, flipping above when there is more room there and capping max-height to the space available so it scrolls internally rather than overflowing. It is dismissed on scroll and resize, since the anchor is only measured on open. The outside-pointerdown handler now also treats the popup as inside; without that the portalled list counts as outside, and a click on an option would close it before the selection commits. * refactor(admin): single-column album details panel The left column spent 1.2fr on a cover thumbnail and three stat rows, two of which (Status, Custom Hero) only restated the form fields opposite them, while the form itself was squeezed into 1.8fr behind a second nested scroller. Stack the drawer in one column instead: cover as a banner, then the form at full width, with the UUID moved into the footer. The body is now the only scroll container, which also removes one of the ancestors that was clipping the sort popup. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> * fix(admin): give the portalled listbox its theme back, lock the page behind modals (#429) Two defects in the album editor. The sort listbox popup painted transparent. Every --admin-* variable is scoped to .admin-layout, and since the popup moved into document.body it sits outside that subtree, so background/border/text all resolved to nothing. It now carries its own copy of the palette in both colour schemes, plus the font it no longer inherits. Scrolling inside a modal also moved the page behind it. No admin modal ever locked body scroll: the overlay covers the page but does not absorb wheel events, so a scroll starting on the backdrop — or continuing past the end of the modal's own scroller — reaches the document. overscroll-behavior cannot cover that case on its own, because it only applies to scroll containers and the backdrop is not one. useScrollLock freezes body while a modal is open and compensates for the width the scrollbar gives up, so nothing shifts underneath. Each lock restores the inline value it found, which makes nesting work without a counter — a picker opened from the drawer restores the drawer's hidden state instead of clearing it. Applied to both drawers and all four picker modals, which share the defect. overscroll-behavior: contain on the scrollers stops the chaining they can handle themselves. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com> * fix(security): allow unsafe-eval in CSP script-src during dev mode * feat(journal): add Journal Studio with split-screen editor, live preview and dedicated routes * fix(build): separate client parser from server journal-service and fix build type errors * fix(journal): Fotos rendern, Layout und Lightbox-Steuerung korrigieren Fünf unabhängige Fehler in der öffentlichen Journal- und Essay-Ansicht: * Foto-Blöcke wurden nie angezeigt. EssayView löst ein Foto über PhotoItem.id auf, und das sind verschlüsselte Tokens — die Blöcke aus dem Markdown tragen aber rohe Asset-UUIDs. Jede Zuordnung lief ins Leere, und nicht auflösbare Blöcke werden still verworfen. Die IDs werden jetzt serverseitig übersetzt; damit verschwinden nebenbei die rohen UUIDs aus dem Client-Payload, die dort laut Projektregel nie auftauchen dürfen. Nicht auflösbare Referenzen werden geloggt. * Überschriften standen weiter links als der Fließtext. Jeder Block hatte einzeln `max-width: 68ch`, und `ch` ist relativ zur Schrift des Elements — die Serif-Überschrift ergab eine breitere Spalte. Ersetzt durch eine gemeinsame, font-unabhängige `--essay-measure`. * Fullbleed-Fotos bluteten nur nach links aus: `.essay-figure` ist `width: 100%`, wodurch die Box überbestimmt ist und der negative rechte Margin verworfen wird. * Foto-Paare stellten beide Bilder gleich breit dar, wodurch ein Hochformat neben einem Querformat doppelt so hoch wurde. Jetzt eine Justified-Reihe: Breite proportional zum Seitenverhältnis, dadurch exakt gleiche Höhen ohne Beschnitt. * Die Lightbox hatte im Journal keine Tastatursteuerung und keine Scroll-Sperre — beides lag in PhotoGrid, also nur im Album-Raster. Verlagert in die Lightbox selbst, der doppelte Handler in PhotoGrid entfernt (sonst wäre pro Pfeildruck zwei Bilder weitergesprungen). Zusätzlich sind Proofing-Herzen und das EXIF-Panel im redaktionellen Modus abschaltbar und im Journal aus: Client-Proofing ist ein Übergabe-Workflow für Alben, keine Funktion einer Reportage. Auf der Übersicht wurde der Untertitel doppelt gerendert, weil extractExcerpt() auf ihn zurückfällt. * feat(admin): eigene URLs für alle Bereiche und überarbeiteter Journal Studio Das Panel war eine einzige Client-Komponente, die ihre Tabs über useState umschaltet: keine Route pro Bereich, kein Deep-Link, kein Zurück-Button, und nach jedem Reload landete man wieder auf "Pages". Auch der Journal-Editor hatte keine eigene URL. Jetzt sieben echte Routen (/admin, /admin/pages, /admin/journal, /admin/journal/<slug>, /admin/settings, /admin/settings/<section>, /admin/analytics). Die Shell mit Auth-Prüfung und Kopfzeile sitzt im Layout und umschließt children — so bleibt die Session-Prüfung über Routenwechsel montiert, statt bei jedem Tab-Wechsel neu zu laufen und den Spinner aufblitzen zu lassen. Unbekannte Settings-Sections fallen auf General zurück. Im selben Zug der Journal Studio, der die Routing-Änderung ohnehin berührt: * Alle Eingabefelder nutzten die Klasse `admin-input`, die in keinem CSS definiert war — sie fielen auf Browser-Defaults zurück. Jetzt gestylt, gescoped, damit der generische Name nicht ins übrige Panel leckt. * Der Split View ist per Divider verschiebbar (Maus, Tastatur, Doppelklick zum Zurücksetzen), Breite in localStorage. * Das Studio bricht aus der 1120px-Spalte aus, die Preview hat Platz. * Die Preview zeigte für jedes Foto fest 3:2 und log damit über das Layout der veröffentlichten Seite; die echten Verhältnisse werden jetzt an den Thumbnails gemessen. * Blöcke mit alten positionsbasierten Foto-Referenzen werden markiert — die lassen sich auf einer eigenständigen Journal-Seite nicht auflösen und verschwanden bisher stillschweigend. * Blocktyp-Chips als gemeinsame Komponente, monochrom und per Icon unterschieden statt in einer eigenen Blau/Lila/Orange-Palette, die sonst nirgends im Panel vorkommt. * Emojis raus, SVG-Icons rein. * fix(admin): Designsystem-Lücken im Panel schließen Eine systematische Suche nach Klassen, die im TSX benutzt, aber in keinem CSS definiert sind, hat vier Stellen mit demselben Muster gefunden: * `admin-btn-secondary` und `admin-btn-danger` existierten nicht. Sämtliche Löschen-Buttons sahen aus wie normale Buttons — keine Warnwirkung. Als `.admin-btn.admin-btn-danger` geschrieben, weil die Varianten mit den Größenklassen kombiniert werden, die weiter unten ihren eigenen Hintergrund setzen. * `page-progress-fill` fehlte: die Balken im Analytics-Panel waren leere Rinnen, der Wert unsichtbar. Ebenso `analytics-empty` und `admin-loading-container`. * `subpage-drawer-section`, `subpage-drawer-title-group` und `input-with-icon` im PageBuilder waren wirkungslos und teils mit Inline-Styles notdürftig kompensiert. * `grid-card-preview` fehlte, wodurch alle Layout-Vorschauen auf Höhe null kollabierten. Nur "Showcase" war sichtbar — und das aus Versehen, weil sein Tile `hero-tile` hieß und damit die `aspect-ratio` einer fremden PageBuilder-Klasse erbte. Umbenannt. Dazu die Theme-Vorschauen, die praktisch identisch aussahen: alle sieben zeigten dieselben drei quadratischen Kacheln, einziger Unterschied war die Hintergrundfarbe. Sie spiegeln jetzt die echten Preset-Daten aus lib/config/theme.ts — Schriftcharakter, Eckradius, Rasterdichte, Passepartout bzw. Schatten. Die Kopfzeile richtet sich an einer gemeinsamen Steuerhöhe aus. Der "Site"-Link war höher als die Buttons daneben: `.admin-btn` hatte keine explizite line-height, und <button> bekommt box-sizing: border-box vom Browser, <a> nicht. Die Statusanzeige setzte weder Schriftfamilie noch -größe und fiel auf den Browser-Default zurück — sie war nie Teil des Designsystems. Jetzt gleiche Höhe und Typografie, Pillenform als Zustandsanzeige, Trenner zur Aktionsgruppe. Das dauerhafte Pulsieren des grünen Punkts entfällt; Animation bleibt den Zuständen vorbehalten, die Aufmerksamkeit brauchen. Restliche Emojis durch SVG-Icons ersetzt. * feat(admin): add scroll-to-top toggle and SVG arrow The back-to-top button was always on and drew its arrow with the ↑ text character. Add a `scrollToTop` setting (General section in the admin panel, defaults to on so existing sites are unaffected) and replace the glyph with a stroked SVG that inherits currentColor across all presets. Scroll handling is now rAF-throttled, and prefers-reduced-motion turns off both the hover lift and the smooth scroll. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * security(journal): escape author HTML instead of filtering it CodeQL flags 26 high-severity alerts on the release PR; the bulk of them point at sanitizeHtml(), a denylist of three regexes whose output goes into dangerouslySetInnerHTML. I reproduced the bypasses before changing anything — all four pass the old filter: <img src=x onerror=alert(1)> unquoted handler, regex wants quotes <img src=x onerror='alert(1)'> single quotes, same reason <svg onload=alert(1)> not a <script> tag javasjavascript:cript:alert(1) one-pass replace, the rest recombines Plus an attribute breakout in the link renderer, which interpolated the URL into href="${url}" unescaped: [x](" onmouseover=alert(1) x=") -> <a href="" onmouseover=alert(1" ...> Replaced with escaping. Every `&<>"'` in author text becomes an entity before any markdown rule runs, so the only tags in the output are the ones renderInlineMarkdown builds itself and a URL cannot leave its attribute. Link schemes are now an allowlist (http, https, mailto, tel, relative, anchor); anything else renders as plain text. The serializer needed decodeHtmlEntities to match: without it a save would write `&lt;` into the Markdown file and the next parse would escape the `&` again, corrupting the text further on every round trip. A test covers parse -> serialize -> parse stability. Two existing tests asserted the old behaviour and were rewritten rather than deleted: one expected the script tag to be *removed* from the output, the other expected the substring "onerror" to be absent. Both now assert the property that matters — that no tag can form — because `onerror` surviving as inert text is fine. Exploitation required admin access either way: journal and essay text comes from the studio or from content/*.md. This removes the weakness, it does not close an open door. * fix(journal): contain file paths, fix frontmatter escaping, defuse two regexes Follow-up to the CodeQL findings on release PR #432. I went through all 23 alerts individually; this addresses the ones that are worth addressing and documents the ones that are not. Path containment (12 alerts, all false positives). Every path built from a slug goes through isValidSlug(), a strict `/^[a-zA-Z0-9_-]+$/` allowlist — verified against `../../etc/passwd`, `foo/../../bar`, `a/b`, `..` and friends, all rejected. CodeQL cannot see it because the check lives in another module. Added a containedPath() helper that resolves the path and refuses anything landing outside the content directory: a second lock on a door that was already locked, and a barrier the analysis can follow. Also removed the dead `slug.endsWith('.md')` branches — isValidSlug rejects dots, so they could never be taken. Frontmatter escaping (1 alert, a real bug). The serializer escaped `"` but not `\`, and the parser never unescaped anything. A title containing either character gained a backslash on every save/load cycle: Path C:\Users "quoted" -> Path C:\\Users \"quoted\" -> ... Escaping now covers the backslash first and the parser undoes both. A round trip test covers quotes, backslashes, colons and apostrophes. Two of three ReDoS regexes (2 alerts). The heading pattern had `\s+` next to `(.+)`, which overlap, so the engine tried every split of the whitespace run before failing; it is `[ \t]+` and `(\S.*)` now. The quote author pattern wrapped a lazy group around an optional group — the quadratic case — and is an index split on the first separator now. The third regex, the bold/italic pass, is deliberately left alone. Rewriting it with a negated class removes the backtracking but breaks nesting: `**bold *and italic* here**` renders as `*<em>bold </em>and italic<em> here</em>*`. The input is Markdown from an authenticated admin, never a visitor, so the worst case is an author slowing down their own page. The comment in the code says so. Not addressed: 5 js/insufficient-password-hash alerts. They ask for a slow KDF where the code uses SHA-256/HMAC — correct in general, but the admin password comes from an environment variable and is never stored, so a stronger KDF protects nothing that is not already in plaintext in the environment. 399 unit tests pass (18 new), build and tsc clean. * fix(journal): split the quote author by scanning, not by pattern Cleaning up after myself. #439 replaced the quote author regex `/^(.*?)(?:\s+--\s+(.+))?$/` — a lazy group around an optional one, the quadratic case — with `/\s+--\s+/`, and CodeQL promptly flagged the replacement for the same reason. One reported pattern traded for another. splitQuoteAuthor() scans for the first `--` that has whitespace on both sides. Linear, and it needs no reasoning about the regex engine at all. Behaviour is identical to the original regex, checked case by case against it: separator, no separator, several separators, tabs, wide gaps, `a--b` without spaces, leading and trailing separators, empty string. All nine are covered by tests, plus one asserting it stays fast on a 50k whitespace run. * security(admin): derive the session signing key with scrypt getSigningKey() ran the admin password through a single SHA-256 digest. It is key derivation rather than password storage, so it was never a stored-hash problem — but if the derived key ever leaked, one fast hash makes recovering the password by brute force cheap. CodeQL flags it as js/insufficient-password-hash and, for this particular alert, has a point. scrypt now. Two details that matter: The salt has to be stable. A random salt would produce a different key on every call and invalidate every session; it is derived from AUTH_SECRET, which is deployment-specific. Verified across separate processes: same inputs produce a verifying token, so a restart or redeploy does not log everyone out. The result is cached for the process lifetime. scrypt is deliberately slow and getSigningKey() runs on every admin request — deriving per call would add ~24ms to each one. The cache key is a digest of secret plus password, so a rotation misses the cache and derives again, and no extra plaintext copy of the password is kept around. Measured: first derivation 24ms, subsequent calls 0.12ms. Password change and secret change both invalidate an existing token, checked in separate processes. Note the one-time effect: existing admin sessions are invalidated by the change in derivation, so everyone logs in once more. * security(admin): key the signing-key cache on its inputs, not a digest #441 removed the SHA-256 digest of the admin password from the key derivation and introduced a new one three lines above it, as the cache key. Same rule, same file: CodeQL reported it immediately. The comment justifying it was wrong too. It claimed no second plaintext copy of the password was retained, while building the digest input allocates exactly that in order to hash it. The cache now holds the two input strings and compares them directly. They are the same objects the env and install caches already hold, so nothing extra is retained, and no fast hash of the password exists in memory for the life of the process. Re-verified after the change, in separate processes: a token from one process verifies in another with the same inputs, a changed password or secret rejects it, first derivation 24ms, cached calls 0.001ms. That leaves scrypt as the only place the password is hashed here. The two HMACs further down operate on the derived key and on token data, not on the password; the constant-time comparison in verifyAdminPassword is the previously dismissed one. --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
2026-08-14 16:55:07 +02:00
background: var(--preset-bg);
feat: add visual admin panel with page builder and settings editor - Add /admin route with password-protected visual page builder - Page Builder: manage hero images, standalone albums, subpages, and sections - Album Picker: browse all shared Immich albums with search and filtering - Settings Editor: theme, grid, footer, legal, SEO configuration - YAML service with atomic writes and automatic backups (content/.backups/) - HMAC-signed admin sessions (24h expiry, HttpOnly cookies) - API endpoints: /api/admin/{auth,gallery,settings,albums,reload} - Enable with ADMIN_PASSWORD env var; disabled by default - invalidateConfigCache() export for hot-reload after saves
2026-05-29 17:04:37 +02:00
}
feat(admin): visual theme cards, album search, and status dashboard (#241) * feat(admin): implement visual theme cards, album search, and system status diagnostics * fix(admin): resolve type-checking build errors in SettingsEditor and status route --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-05-31 21:17:52 +02:00
.preset-card-preview .mini-header {
display: flex;
release: v0.11.0 — journal fixes, admin URLs, design system cleanup (#432) * fix(screenshots): sharp-Typen fuer 0.34 und 0.35 gleichzeitig (#410) sharp 0.35 ist von `export =` auf ESM umgestellt: der Modul-Namespace ist nicht mehr aufrufbar, die Factory sitzt unter .default. Der Type-Check brach damit in scripts/screenshots.ts weg, sobald der Next-Bump (#402) sharp von 0.34.5 auf 0.35.3 mitzieht -- sharp ist hier keine deklarierte Dependency, sondern kommt ueber Next mit. Die Form wird jetzt aus dem installierten Paket abgeleitet statt festgeschrieben, zur Laufzeit wie im Typ. Geprueft mit beiden Versionen: tsc laeuft mit 0.34.5 und mit 0.35.3 fehlerfrei durch. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(deps): bump the nextjs group across 1 directory with 2 updates (#402) Bumps the nextjs group with 2 updates in the / directory: [next](https://github.com/vercel/next.js) and [eslint-config-next](https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next). Updates `next` from 16.2.12 to 16.3.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/compare/v16.2.12...v16.3.0) Updates `eslint-config-next` from 16.2.12 to 16.3.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/commits/v16.3.0/packages/eslint-config-next) --- updated-dependencies: - dependency-name: eslint-config-next dependency-version: 16.3.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: nextjs - dependency-name: next dependency-version: 16.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nextjs ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps-dev): bump prettier from 3.8.3 to 3.9.6 (#405) Bumps [prettier](https://github.com/prettier/prettier) from 3.8.3 to 3.9.6. - [Release notes](https://github.com/prettier/prettier/releases) - [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md) - [Commits](https://github.com/prettier/prettier/compare/3.8.3...3.9.6) --- updated-dependencies: - dependency-name: prettier dependency-version: 3.9.6 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * docs(changelog): Unreleased-Sektion fuer die Bumps nach v0.10.0 (#413) Die Dependency-PRs sind nach dem Release auf dev gelandet, teils auch auf main. Ohne Eintrag waeren sie beim naechsten Release unsichtbar -- inklusive Next 16.3.0, das CVE-2025-13465 mitbringt. Ausserdem im 0.10.0-Abschnitt nachgetragen, dass der Trivy-Scan bis #409 nie gelaufen ist. Der Fix steckt im Tag v0.10.0, fehlte aber in der Aufzaehlung -- und "Images werden bei jedem Publish gescannt" stand im Changelog, waehrend der Job im Action-Setup abbrach. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(gallery): per-album sort order, independent of Immich (#408) (#414) Album order was dictated entirely by Immich: getAlbum() sorted by the album's own asc/desc flag, so a Folio album always mirrored the archive. A curated series has a narrative order that has nothing to do with capture time, and changing the Immich album's sort to fit the website changes it for the archive too. Adds an optional per-album `sort` in gallery.yaml, editable in /admin, defaulting to today's behaviour so every existing config is unchanged: immich (default) | newest | oldest | filename | manual `manual` is a pinned *prefix*: `assetOrder` lists only the photos placed by hand, everything else follows in the album's Immich order. A full permutation of a 2,000-photo album would be ~80 KB of UUIDs in a file that is rewritten and copied to content/.backups/ on every admin save. It also makes drift fall out for free — photos removed in Immich never match, new ones land in the tail rather than being hidden. Sorting is applied after the cache read, not before the cache write, so the LRU keeps one canonical Immich-ordered copy per album. That avoids putting the mode in the cache key, lets a config change take effect without depending on invalidation, and keeps the stale-serving path correct. cache.get() returns the stored object by reference, so withSort() returns a shallow clone with a new array — sorting in place would reorder the shared entry, and under request coalescing every concurrent caller would be sorting the same array. Also fixes a prerequisite bug: /api/admin/albums/[albumId]/assets read album.assets from GET /albums/:id, which Immich 3.x no longer populates (lib/immich.ts:507). The hero picker's "This Album" tab returned nothing and threw outright when the key was absent. It now goes through the client's paginated metadata search, with ?types=all to opt videos in for the reorder editor. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): drop decorative emoji from the sort select labels (#415) An <option> cannot contain markup, so the SVG set in Icons is not reachable there — but a decorative emoji is not a substitute for it. Plain text instead; the album card badge already uses a real icon. The remaining emoji in the admin panel (asset picker tabs, section headings, layout picker options) predate this branch and are left for a separate cleanup. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): replace emoji icons with the shared SVG icon set (#416) The admin panel mixed two icon conventions: inline SVGs from `Icons.tsx` in most components, and decorative emoji in the asset picker and a few PageBuilder labels. Emoji render inconsistently across platforms, ignore the accent colour, and cannot inherit the `.svg-icon` sizing rules. - Icons.tsx: add `IconStar` (filled — it marks a state, not an action) and `IconImage`. - AssetPicker: the three tab labels and the favourite tile badge now use IconFolder / IconStar / IconImage. - PageBuilder: the "Standalone Albums" and "Subpages" headings use the icon set instead of an emoji. - PageBuilder: the layout picker drops its emoji for plain text. An <option> cannot contain markup, so an SVG is impossible there and a decorative glyph is not a substitute. - admin.css: align icon and label in the picker tabs, and swap the favourite badge's text-shadow for drop-shadow, which is what applies to an inline SVG. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): fold PageBuilder's local icons into the shared Icons module (#418) * refactor(admin): fold PageBuilder's local icons into the shared module PageBuilder.tsx carried its own `Icons` object duplicating most of the glyphs already exported by Icons.tsx, with hardcoded sizes and slightly divergent paths. Migrate all 32 call sites to the shared module and delete the local object. Five glyphs had no counterpart and are added to Icons.tsx as 1:1 ports of the local paths: IconX, IconPlus, IconHome, IconCopy, IconImage. The local ExternalLink and Check are dropped rather than ported — both had zero call sites. Two glyphs change shape slightly, which is the point of consolidating: the shared IconCamera includes the viewfinder bump the local copy omitted, and drag handles now use IconGripVertical. IconGripVertical uses the module's square 24x24 viewBox, so `.svg-drag` goes from 12x18 to 18x18 — the old non-square box would letterbox the glyph down to 12x12 and shrink the handle. * fix(admin): resolve icon-module integration after #416 Merging dev brought in #416, which added a second IconImage to Icons.tsx and two <Icons.Camera>/<Icons.Folder> section headers that reference the local Icons object this PR removes. Git merged both cleanly but the result did not type-check. - drop the duplicate IconImage (both copies were byte-identical) - point the two section headers at the imported IconCamera/IconFolder - refresh the SORT_LABELS comment: the icon set is imported now, not declared below --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> * fix(config): allow an empty gallery, guard against a double /api suffix (#421) An empty gallery is now a valid, rendered state instead of a throw: deriveGallery() no longer requires at least one album or subpage, so a deployment with no albums yet renders a bare homepage the owner can fill in via /admin. getConfig() also stops appending /api to an Immich URL that already ends in it, which previously produced .../api/api and broke every upstream request. Includes a restore of the per-album sort test cases, which the branch had lost by being cut before #408/#414. * feat(admin): favicon upload, served from the content volume (#422) Adds a bundled default favicon, an upload widget in admin Settings > General, and a route that serves the icon from the writable content/ volume with a fallback to the bundled default. Raster uploads (PNG/ICO/JPEG) are wrapped in an SVG container; the response carries its own CSP so an uploaded SVG cannot execute script on the origin. The GET route revalidates with an ETag instead of caching immutably, so a newly uploaded icon shows up immediately. Uploads are written via temp file + rename, and a Reset button restores the bundled default. * ci: flag unformatted files in a PR, without blocking it (#424) Prettier is configured as an error rule in eslint.config.mjs but has never run in CI, so part of the tree predates it. A final CI step now diffs against the PR base, runs prettier --list-different over the changed files, and emits a warning annotation per offender plus a job summary. Advisory by design: it never fails the job. Blocking would turn a PR red for merely touching a file that was already unformatted, and normalising the tree in one commit would wreck git blame and conflict with the PRs in flight. Requires fetch-depth: 0, since diffing against the base needs its history. * feat(install): first-run wizard gated by a one-time setup token (#419) Adds /install, a four-step first-run wizard: connect to Immich, optionally pick albums, name the site, finish. It verifies the credentials against the Immich server before writing anything, then writes gallery.yaml, settings.yaml and a content/install.json carrying the Immich credentials and a generated site secret. install.json exists because a running process cannot pick up new env vars — the wizard has to write configuration that takes effect without a restart. getInstallCredentials() merges it under the real environment, so env vars always win and rotation stays a matter of setting one. Both the page and the API routes are gated by a one-time setup token printed to the server log, so a deployment that is reachable before gallery.yaml exists cannot be configured by whoever finds it first. The token is stored in content/.setup-token (0600) rather than a module variable: Next.js bundles the page and each route handler separately, so a module-level token left the page and the API disagreeing inside one process and the wizard stuck on step 1. It is removed once the install completes. The admin password is stored as an scrypt hash using the scheme lib/auth.ts already applies to album passwords; a plaintext ADMIN_PASSWORD env var keeps working. * docs: document the setup wizard, fix the read-only content mount (#425) Quick Start now leads with the /install wizard, with the hand-written YAML route kept alongside it, and a First-Run Setup section covers the setup token, the files the wizard writes, and env-var precedence. Two corrections: both Docker examples mounted content/ as :ro, which silently breaks the wizard, the admin panel and the backup rotation alike — docs/admin-panel.md already said so and the README contradicted it. And nothing documented that content/install.json holds the Immich API key, so a backup of content/ is a backup of credentials. Also adds a Contributors section crediting the people whose work is in the project. * feat(admin): floating save bar pinned to the bottom of the viewport (#426) The save bar was the first, static element inside .admin-main. Since the document itself scrolls, it left the viewport as soon as you scrolled down — editing a subpage section or a settings block far below gave no visible dirty hint and no reachable save button. Replace it with a bottom-pinned floating bar shared by both editors. It only mounts while there is something to act on (unsaved changes, an in-flight save, or a result message), so it never covers content while idle. The success message clears after 5s, which hides the bar again. - new SaveBar component, replacing the duplicated markup in PageBuilder and SettingsEditor - adopt the previously unused .floating-save-bar CSS: slide-in keyframes (carrying translateX(-50%)), dirty border, wrap/gap, mobile variant and a prefers-reduced-motion opt-out; z-index 900 keeps it below modals - .admin-main gains bottom padding so the bar never covers page content - drop the now-unreachable idle hints: the ⌘S hint becomes a button title, the Live Sync note becomes a static line above the settings layout - header "Site" link now bypasses the cache (/?fresh=1), so the preview stays reachable when the bar is hidden Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(admin): themed listbox for the album sort control (#427) The per-album "Photo order" control was a native <select>. Because an <option> cannot contain markup, its choices could not use the admin panel's currentColor SVG set — the reason #415 had to fall back to plain text after dropping the emoji labels. Adds a Listbox component implementing the ARIA combobox/listbox pattern, so options can render a glyph beside their label: - DOM focus stays on the trigger button; the active option is announced through aria-activedescendant, keeping focus management to one element - Keyboard: arrows (clamped at the ends, like a native select), Home/End, Enter/Space to commit, Escape to cancel, Tab commits and moves on, and prefix type-ahead with a repeat-key cycle - Outside dismissal on pointerdown, so a press starting outside closes the popup before the click retargets The sort options now carry an icon each: calendar, arrow-down, arrow-up, an A→Z marker, and the drag glyph for manual — matching the badge the album card already shows. SORT_LABELS stays plain text because the badge feeds it to a title attribute. Closes #417 Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(git): ignore generated design handoff folders * fix(admin): stop the album sort dropdown clipping, and simplify the panel (#428) * fix(admin): render listbox popup in a portal so it escapes modal clipping The sort control's popup was position:absolute inside three clipping ancestors (.album-drawer overflow:hidden > .album-drawer-body overflow-y:auto > .modal-right-column overflow-y:auto), so it was cut off at the bottom of the Edit Album Details modal. z-index could not help: clipping happens before stacking. It also always hung below the trigger, with no flip. Portal the popup to document.body and position it from the trigger's viewport rect, flipping above when there is more room there and capping max-height to the space available so it scrolls internally rather than overflowing. It is dismissed on scroll and resize, since the anchor is only measured on open. The outside-pointerdown handler now also treats the popup as inside; without that the portalled list counts as outside, and a click on an option would close it before the selection commits. * refactor(admin): single-column album details panel The left column spent 1.2fr on a cover thumbnail and three stat rows, two of which (Status, Custom Hero) only restated the form fields opposite them, while the form itself was squeezed into 1.8fr behind a second nested scroller. Stack the drawer in one column instead: cover as a banner, then the form at full width, with the UUID moved into the footer. The body is now the only scroll container, which also removes one of the ancestors that was clipping the sort popup. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> * fix(admin): give the portalled listbox its theme back, lock the page behind modals (#429) Two defects in the album editor. The sort listbox popup painted transparent. Every --admin-* variable is scoped to .admin-layout, and since the popup moved into document.body it sits outside that subtree, so background/border/text all resolved to nothing. It now carries its own copy of the palette in both colour schemes, plus the font it no longer inherits. Scrolling inside a modal also moved the page behind it. No admin modal ever locked body scroll: the overlay covers the page but does not absorb wheel events, so a scroll starting on the backdrop — or continuing past the end of the modal's own scroller — reaches the document. overscroll-behavior cannot cover that case on its own, because it only applies to scroll containers and the backdrop is not one. useScrollLock freezes body while a modal is open and compensates for the width the scrollbar gives up, so nothing shifts underneath. Each lock restores the inline value it found, which makes nesting work without a counter — a picker opened from the drawer restores the drawer's hidden state instead of clearing it. Applied to both drawers and all four picker modals, which share the defect. overscroll-behavior: contain on the scrollers stops the chaining they can handle themselves. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com> * fix(security): allow unsafe-eval in CSP script-src during dev mode * feat(journal): add Journal Studio with split-screen editor, live preview and dedicated routes * fix(build): separate client parser from server journal-service and fix build type errors * fix(journal): Fotos rendern, Layout und Lightbox-Steuerung korrigieren Fünf unabhängige Fehler in der öffentlichen Journal- und Essay-Ansicht: * Foto-Blöcke wurden nie angezeigt. EssayView löst ein Foto über PhotoItem.id auf, und das sind verschlüsselte Tokens — die Blöcke aus dem Markdown tragen aber rohe Asset-UUIDs. Jede Zuordnung lief ins Leere, und nicht auflösbare Blöcke werden still verworfen. Die IDs werden jetzt serverseitig übersetzt; damit verschwinden nebenbei die rohen UUIDs aus dem Client-Payload, die dort laut Projektregel nie auftauchen dürfen. Nicht auflösbare Referenzen werden geloggt. * Überschriften standen weiter links als der Fließtext. Jeder Block hatte einzeln `max-width: 68ch`, und `ch` ist relativ zur Schrift des Elements — die Serif-Überschrift ergab eine breitere Spalte. Ersetzt durch eine gemeinsame, font-unabhängige `--essay-measure`. * Fullbleed-Fotos bluteten nur nach links aus: `.essay-figure` ist `width: 100%`, wodurch die Box überbestimmt ist und der negative rechte Margin verworfen wird. * Foto-Paare stellten beide Bilder gleich breit dar, wodurch ein Hochformat neben einem Querformat doppelt so hoch wurde. Jetzt eine Justified-Reihe: Breite proportional zum Seitenverhältnis, dadurch exakt gleiche Höhen ohne Beschnitt. * Die Lightbox hatte im Journal keine Tastatursteuerung und keine Scroll-Sperre — beides lag in PhotoGrid, also nur im Album-Raster. Verlagert in die Lightbox selbst, der doppelte Handler in PhotoGrid entfernt (sonst wäre pro Pfeildruck zwei Bilder weitergesprungen). Zusätzlich sind Proofing-Herzen und das EXIF-Panel im redaktionellen Modus abschaltbar und im Journal aus: Client-Proofing ist ein Übergabe-Workflow für Alben, keine Funktion einer Reportage. Auf der Übersicht wurde der Untertitel doppelt gerendert, weil extractExcerpt() auf ihn zurückfällt. * feat(admin): eigene URLs für alle Bereiche und überarbeiteter Journal Studio Das Panel war eine einzige Client-Komponente, die ihre Tabs über useState umschaltet: keine Route pro Bereich, kein Deep-Link, kein Zurück-Button, und nach jedem Reload landete man wieder auf "Pages". Auch der Journal-Editor hatte keine eigene URL. Jetzt sieben echte Routen (/admin, /admin/pages, /admin/journal, /admin/journal/<slug>, /admin/settings, /admin/settings/<section>, /admin/analytics). Die Shell mit Auth-Prüfung und Kopfzeile sitzt im Layout und umschließt children — so bleibt die Session-Prüfung über Routenwechsel montiert, statt bei jedem Tab-Wechsel neu zu laufen und den Spinner aufblitzen zu lassen. Unbekannte Settings-Sections fallen auf General zurück. Im selben Zug der Journal Studio, der die Routing-Änderung ohnehin berührt: * Alle Eingabefelder nutzten die Klasse `admin-input`, die in keinem CSS definiert war — sie fielen auf Browser-Defaults zurück. Jetzt gestylt, gescoped, damit der generische Name nicht ins übrige Panel leckt. * Der Split View ist per Divider verschiebbar (Maus, Tastatur, Doppelklick zum Zurücksetzen), Breite in localStorage. * Das Studio bricht aus der 1120px-Spalte aus, die Preview hat Platz. * Die Preview zeigte für jedes Foto fest 3:2 und log damit über das Layout der veröffentlichten Seite; die echten Verhältnisse werden jetzt an den Thumbnails gemessen. * Blöcke mit alten positionsbasierten Foto-Referenzen werden markiert — die lassen sich auf einer eigenständigen Journal-Seite nicht auflösen und verschwanden bisher stillschweigend. * Blocktyp-Chips als gemeinsame Komponente, monochrom und per Icon unterschieden statt in einer eigenen Blau/Lila/Orange-Palette, die sonst nirgends im Panel vorkommt. * Emojis raus, SVG-Icons rein. * fix(admin): Designsystem-Lücken im Panel schließen Eine systematische Suche nach Klassen, die im TSX benutzt, aber in keinem CSS definiert sind, hat vier Stellen mit demselben Muster gefunden: * `admin-btn-secondary` und `admin-btn-danger` existierten nicht. Sämtliche Löschen-Buttons sahen aus wie normale Buttons — keine Warnwirkung. Als `.admin-btn.admin-btn-danger` geschrieben, weil die Varianten mit den Größenklassen kombiniert werden, die weiter unten ihren eigenen Hintergrund setzen. * `page-progress-fill` fehlte: die Balken im Analytics-Panel waren leere Rinnen, der Wert unsichtbar. Ebenso `analytics-empty` und `admin-loading-container`. * `subpage-drawer-section`, `subpage-drawer-title-group` und `input-with-icon` im PageBuilder waren wirkungslos und teils mit Inline-Styles notdürftig kompensiert. * `grid-card-preview` fehlte, wodurch alle Layout-Vorschauen auf Höhe null kollabierten. Nur "Showcase" war sichtbar — und das aus Versehen, weil sein Tile `hero-tile` hieß und damit die `aspect-ratio` einer fremden PageBuilder-Klasse erbte. Umbenannt. Dazu die Theme-Vorschauen, die praktisch identisch aussahen: alle sieben zeigten dieselben drei quadratischen Kacheln, einziger Unterschied war die Hintergrundfarbe. Sie spiegeln jetzt die echten Preset-Daten aus lib/config/theme.ts — Schriftcharakter, Eckradius, Rasterdichte, Passepartout bzw. Schatten. Die Kopfzeile richtet sich an einer gemeinsamen Steuerhöhe aus. Der "Site"-Link war höher als die Buttons daneben: `.admin-btn` hatte keine explizite line-height, und <button> bekommt box-sizing: border-box vom Browser, <a> nicht. Die Statusanzeige setzte weder Schriftfamilie noch -größe und fiel auf den Browser-Default zurück — sie war nie Teil des Designsystems. Jetzt gleiche Höhe und Typografie, Pillenform als Zustandsanzeige, Trenner zur Aktionsgruppe. Das dauerhafte Pulsieren des grünen Punkts entfällt; Animation bleibt den Zuständen vorbehalten, die Aufmerksamkeit brauchen. Restliche Emojis durch SVG-Icons ersetzt. * feat(admin): add scroll-to-top toggle and SVG arrow The back-to-top button was always on and drew its arrow with the ↑ text character. Add a `scrollToTop` setting (General section in the admin panel, defaults to on so existing sites are unaffected) and replace the glyph with a stroked SVG that inherits currentColor across all presets. Scroll handling is now rAF-throttled, and prefers-reduced-motion turns off both the hover lift and the smooth scroll. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * security(journal): escape author HTML instead of filtering it CodeQL flags 26 high-severity alerts on the release PR; the bulk of them point at sanitizeHtml(), a denylist of three regexes whose output goes into dangerouslySetInnerHTML. I reproduced the bypasses before changing anything — all four pass the old filter: <img src=x onerror=alert(1)> unquoted handler, regex wants quotes <img src=x onerror='alert(1)'> single quotes, same reason <svg onload=alert(1)> not a <script> tag javasjavascript:cript:alert(1) one-pass replace, the rest recombines Plus an attribute breakout in the link renderer, which interpolated the URL into href="${url}" unescaped: [x](" onmouseover=alert(1) x=") -> <a href="" onmouseover=alert(1" ...> Replaced with escaping. Every `&<>"'` in author text becomes an entity before any markdown rule runs, so the only tags in the output are the ones renderInlineMarkdown builds itself and a URL cannot leave its attribute. Link schemes are now an allowlist (http, https, mailto, tel, relative, anchor); anything else renders as plain text. The serializer needed decodeHtmlEntities to match: without it a save would write `&lt;` into the Markdown file and the next parse would escape the `&` again, corrupting the text further on every round trip. A test covers parse -> serialize -> parse stability. Two existing tests asserted the old behaviour and were rewritten rather than deleted: one expected the script tag to be *removed* from the output, the other expected the substring "onerror" to be absent. Both now assert the property that matters — that no tag can form — because `onerror` surviving as inert text is fine. Exploitation required admin access either way: journal and essay text comes from the studio or from content/*.md. This removes the weakness, it does not close an open door. * fix(journal): contain file paths, fix frontmatter escaping, defuse two regexes Follow-up to the CodeQL findings on release PR #432. I went through all 23 alerts individually; this addresses the ones that are worth addressing and documents the ones that are not. Path containment (12 alerts, all false positives). Every path built from a slug goes through isValidSlug(), a strict `/^[a-zA-Z0-9_-]+$/` allowlist — verified against `../../etc/passwd`, `foo/../../bar`, `a/b`, `..` and friends, all rejected. CodeQL cannot see it because the check lives in another module. Added a containedPath() helper that resolves the path and refuses anything landing outside the content directory: a second lock on a door that was already locked, and a barrier the analysis can follow. Also removed the dead `slug.endsWith('.md')` branches — isValidSlug rejects dots, so they could never be taken. Frontmatter escaping (1 alert, a real bug). The serializer escaped `"` but not `\`, and the parser never unescaped anything. A title containing either character gained a backslash on every save/load cycle: Path C:\Users "quoted" -> Path C:\\Users \"quoted\" -> ... Escaping now covers the backslash first and the parser undoes both. A round trip test covers quotes, backslashes, colons and apostrophes. Two of three ReDoS regexes (2 alerts). The heading pattern had `\s+` next to `(.+)`, which overlap, so the engine tried every split of the whitespace run before failing; it is `[ \t]+` and `(\S.*)` now. The quote author pattern wrapped a lazy group around an optional group — the quadratic case — and is an index split on the first separator now. The third regex, the bold/italic pass, is deliberately left alone. Rewriting it with a negated class removes the backtracking but breaks nesting: `**bold *and italic* here**` renders as `*<em>bold </em>and italic<em> here</em>*`. The input is Markdown from an authenticated admin, never a visitor, so the worst case is an author slowing down their own page. The comment in the code says so. Not addressed: 5 js/insufficient-password-hash alerts. They ask for a slow KDF where the code uses SHA-256/HMAC — correct in general, but the admin password comes from an environment variable and is never stored, so a stronger KDF protects nothing that is not already in plaintext in the environment. 399 unit tests pass (18 new), build and tsc clean. * fix(journal): split the quote author by scanning, not by pattern Cleaning up after myself. #439 replaced the quote author regex `/^(.*?)(?:\s+--\s+(.+))?$/` — a lazy group around an optional one, the quadratic case — with `/\s+--\s+/`, and CodeQL promptly flagged the replacement for the same reason. One reported pattern traded for another. splitQuoteAuthor() scans for the first `--` that has whitespace on both sides. Linear, and it needs no reasoning about the regex engine at all. Behaviour is identical to the original regex, checked case by case against it: separator, no separator, several separators, tabs, wide gaps, `a--b` without spaces, leading and trailing separators, empty string. All nine are covered by tests, plus one asserting it stays fast on a 50k whitespace run. * security(admin): derive the session signing key with scrypt getSigningKey() ran the admin password through a single SHA-256 digest. It is key derivation rather than password storage, so it was never a stored-hash problem — but if the derived key ever leaked, one fast hash makes recovering the password by brute force cheap. CodeQL flags it as js/insufficient-password-hash and, for this particular alert, has a point. scrypt now. Two details that matter: The salt has to be stable. A random salt would produce a different key on every call and invalidate every session; it is derived from AUTH_SECRET, which is deployment-specific. Verified across separate processes: same inputs produce a verifying token, so a restart or redeploy does not log everyone out. The result is cached for the process lifetime. scrypt is deliberately slow and getSigningKey() runs on every admin request — deriving per call would add ~24ms to each one. The cache key is a digest of secret plus password, so a rotation misses the cache and derives again, and no extra plaintext copy of the password is kept around. Measured: first derivation 24ms, subsequent calls 0.12ms. Password change and secret change both invalidate an existing token, checked in separate processes. Note the one-time effect: existing admin sessions are invalidated by the change in derivation, so everyone logs in once more. * security(admin): key the signing-key cache on its inputs, not a digest #441 removed the SHA-256 digest of the admin password from the key derivation and introduced a new one three lines above it, as the cache key. Same rule, same file: CodeQL reported it immediately. The comment justifying it was wrong too. It claimed no second plaintext copy of the password was retained, while building the digest input allocates exactly that in order to hash it. The cache now holds the two input strings and compares them directly. They are the same objects the env and install caches already hold, so nothing extra is retained, and no fast hash of the password exists in memory for the life of the process. Re-verified after the change, in separate processes: a token from one process verifies in another with the same inputs, a changed password or secret rejects it, first derivation 24ms, cached calls 0.001ms. That leaves scrypt as the only place the password is hashed here. The two HMACs further down operate on the derived key and on token data, not on the password; the constant-time comparison in verifyAdminPassword is the previously dismissed one. --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
2026-08-14 16:55:07 +02:00
align-items: baseline;
gap: 0.4rem;
flex-shrink: 0;
feat(admin): visual theme cards, album search, and status dashboard (#241) * feat(admin): implement visual theme cards, album search, and system status diagnostics * fix(admin): resolve type-checking build errors in SettingsEditor and status route --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-05-31 21:17:52 +02:00
}
release: v0.11.0 — journal fixes, admin URLs, design system cleanup (#432) * fix(screenshots): sharp-Typen fuer 0.34 und 0.35 gleichzeitig (#410) sharp 0.35 ist von `export =` auf ESM umgestellt: der Modul-Namespace ist nicht mehr aufrufbar, die Factory sitzt unter .default. Der Type-Check brach damit in scripts/screenshots.ts weg, sobald der Next-Bump (#402) sharp von 0.34.5 auf 0.35.3 mitzieht -- sharp ist hier keine deklarierte Dependency, sondern kommt ueber Next mit. Die Form wird jetzt aus dem installierten Paket abgeleitet statt festgeschrieben, zur Laufzeit wie im Typ. Geprueft mit beiden Versionen: tsc laeuft mit 0.34.5 und mit 0.35.3 fehlerfrei durch. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(deps): bump the nextjs group across 1 directory with 2 updates (#402) Bumps the nextjs group with 2 updates in the / directory: [next](https://github.com/vercel/next.js) and [eslint-config-next](https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next). Updates `next` from 16.2.12 to 16.3.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/compare/v16.2.12...v16.3.0) Updates `eslint-config-next` from 16.2.12 to 16.3.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/commits/v16.3.0/packages/eslint-config-next) --- updated-dependencies: - dependency-name: eslint-config-next dependency-version: 16.3.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: nextjs - dependency-name: next dependency-version: 16.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nextjs ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps-dev): bump prettier from 3.8.3 to 3.9.6 (#405) Bumps [prettier](https://github.com/prettier/prettier) from 3.8.3 to 3.9.6. - [Release notes](https://github.com/prettier/prettier/releases) - [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md) - [Commits](https://github.com/prettier/prettier/compare/3.8.3...3.9.6) --- updated-dependencies: - dependency-name: prettier dependency-version: 3.9.6 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * docs(changelog): Unreleased-Sektion fuer die Bumps nach v0.10.0 (#413) Die Dependency-PRs sind nach dem Release auf dev gelandet, teils auch auf main. Ohne Eintrag waeren sie beim naechsten Release unsichtbar -- inklusive Next 16.3.0, das CVE-2025-13465 mitbringt. Ausserdem im 0.10.0-Abschnitt nachgetragen, dass der Trivy-Scan bis #409 nie gelaufen ist. Der Fix steckt im Tag v0.10.0, fehlte aber in der Aufzaehlung -- und "Images werden bei jedem Publish gescannt" stand im Changelog, waehrend der Job im Action-Setup abbrach. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(gallery): per-album sort order, independent of Immich (#408) (#414) Album order was dictated entirely by Immich: getAlbum() sorted by the album's own asc/desc flag, so a Folio album always mirrored the archive. A curated series has a narrative order that has nothing to do with capture time, and changing the Immich album's sort to fit the website changes it for the archive too. Adds an optional per-album `sort` in gallery.yaml, editable in /admin, defaulting to today's behaviour so every existing config is unchanged: immich (default) | newest | oldest | filename | manual `manual` is a pinned *prefix*: `assetOrder` lists only the photos placed by hand, everything else follows in the album's Immich order. A full permutation of a 2,000-photo album would be ~80 KB of UUIDs in a file that is rewritten and copied to content/.backups/ on every admin save. It also makes drift fall out for free — photos removed in Immich never match, new ones land in the tail rather than being hidden. Sorting is applied after the cache read, not before the cache write, so the LRU keeps one canonical Immich-ordered copy per album. That avoids putting the mode in the cache key, lets a config change take effect without depending on invalidation, and keeps the stale-serving path correct. cache.get() returns the stored object by reference, so withSort() returns a shallow clone with a new array — sorting in place would reorder the shared entry, and under request coalescing every concurrent caller would be sorting the same array. Also fixes a prerequisite bug: /api/admin/albums/[albumId]/assets read album.assets from GET /albums/:id, which Immich 3.x no longer populates (lib/immich.ts:507). The hero picker's "This Album" tab returned nothing and threw outright when the key was absent. It now goes through the client's paginated metadata search, with ?types=all to opt videos in for the reorder editor. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): drop decorative emoji from the sort select labels (#415) An <option> cannot contain markup, so the SVG set in Icons is not reachable there — but a decorative emoji is not a substitute for it. Plain text instead; the album card badge already uses a real icon. The remaining emoji in the admin panel (asset picker tabs, section headings, layout picker options) predate this branch and are left for a separate cleanup. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): replace emoji icons with the shared SVG icon set (#416) The admin panel mixed two icon conventions: inline SVGs from `Icons.tsx` in most components, and decorative emoji in the asset picker and a few PageBuilder labels. Emoji render inconsistently across platforms, ignore the accent colour, and cannot inherit the `.svg-icon` sizing rules. - Icons.tsx: add `IconStar` (filled — it marks a state, not an action) and `IconImage`. - AssetPicker: the three tab labels and the favourite tile badge now use IconFolder / IconStar / IconImage. - PageBuilder: the "Standalone Albums" and "Subpages" headings use the icon set instead of an emoji. - PageBuilder: the layout picker drops its emoji for plain text. An <option> cannot contain markup, so an SVG is impossible there and a decorative glyph is not a substitute. - admin.css: align icon and label in the picker tabs, and swap the favourite badge's text-shadow for drop-shadow, which is what applies to an inline SVG. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): fold PageBuilder's local icons into the shared Icons module (#418) * refactor(admin): fold PageBuilder's local icons into the shared module PageBuilder.tsx carried its own `Icons` object duplicating most of the glyphs already exported by Icons.tsx, with hardcoded sizes and slightly divergent paths. Migrate all 32 call sites to the shared module and delete the local object. Five glyphs had no counterpart and are added to Icons.tsx as 1:1 ports of the local paths: IconX, IconPlus, IconHome, IconCopy, IconImage. The local ExternalLink and Check are dropped rather than ported — both had zero call sites. Two glyphs change shape slightly, which is the point of consolidating: the shared IconCamera includes the viewfinder bump the local copy omitted, and drag handles now use IconGripVertical. IconGripVertical uses the module's square 24x24 viewBox, so `.svg-drag` goes from 12x18 to 18x18 — the old non-square box would letterbox the glyph down to 12x12 and shrink the handle. * fix(admin): resolve icon-module integration after #416 Merging dev brought in #416, which added a second IconImage to Icons.tsx and two <Icons.Camera>/<Icons.Folder> section headers that reference the local Icons object this PR removes. Git merged both cleanly but the result did not type-check. - drop the duplicate IconImage (both copies were byte-identical) - point the two section headers at the imported IconCamera/IconFolder - refresh the SORT_LABELS comment: the icon set is imported now, not declared below --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> * fix(config): allow an empty gallery, guard against a double /api suffix (#421) An empty gallery is now a valid, rendered state instead of a throw: deriveGallery() no longer requires at least one album or subpage, so a deployment with no albums yet renders a bare homepage the owner can fill in via /admin. getConfig() also stops appending /api to an Immich URL that already ends in it, which previously produced .../api/api and broke every upstream request. Includes a restore of the per-album sort test cases, which the branch had lost by being cut before #408/#414. * feat(admin): favicon upload, served from the content volume (#422) Adds a bundled default favicon, an upload widget in admin Settings > General, and a route that serves the icon from the writable content/ volume with a fallback to the bundled default. Raster uploads (PNG/ICO/JPEG) are wrapped in an SVG container; the response carries its own CSP so an uploaded SVG cannot execute script on the origin. The GET route revalidates with an ETag instead of caching immutably, so a newly uploaded icon shows up immediately. Uploads are written via temp file + rename, and a Reset button restores the bundled default. * ci: flag unformatted files in a PR, without blocking it (#424) Prettier is configured as an error rule in eslint.config.mjs but has never run in CI, so part of the tree predates it. A final CI step now diffs against the PR base, runs prettier --list-different over the changed files, and emits a warning annotation per offender plus a job summary. Advisory by design: it never fails the job. Blocking would turn a PR red for merely touching a file that was already unformatted, and normalising the tree in one commit would wreck git blame and conflict with the PRs in flight. Requires fetch-depth: 0, since diffing against the base needs its history. * feat(install): first-run wizard gated by a one-time setup token (#419) Adds /install, a four-step first-run wizard: connect to Immich, optionally pick albums, name the site, finish. It verifies the credentials against the Immich server before writing anything, then writes gallery.yaml, settings.yaml and a content/install.json carrying the Immich credentials and a generated site secret. install.json exists because a running process cannot pick up new env vars — the wizard has to write configuration that takes effect without a restart. getInstallCredentials() merges it under the real environment, so env vars always win and rotation stays a matter of setting one. Both the page and the API routes are gated by a one-time setup token printed to the server log, so a deployment that is reachable before gallery.yaml exists cannot be configured by whoever finds it first. The token is stored in content/.setup-token (0600) rather than a module variable: Next.js bundles the page and each route handler separately, so a module-level token left the page and the API disagreeing inside one process and the wizard stuck on step 1. It is removed once the install completes. The admin password is stored as an scrypt hash using the scheme lib/auth.ts already applies to album passwords; a plaintext ADMIN_PASSWORD env var keeps working. * docs: document the setup wizard, fix the read-only content mount (#425) Quick Start now leads with the /install wizard, with the hand-written YAML route kept alongside it, and a First-Run Setup section covers the setup token, the files the wizard writes, and env-var precedence. Two corrections: both Docker examples mounted content/ as :ro, which silently breaks the wizard, the admin panel and the backup rotation alike — docs/admin-panel.md already said so and the README contradicted it. And nothing documented that content/install.json holds the Immich API key, so a backup of content/ is a backup of credentials. Also adds a Contributors section crediting the people whose work is in the project. * feat(admin): floating save bar pinned to the bottom of the viewport (#426) The save bar was the first, static element inside .admin-main. Since the document itself scrolls, it left the viewport as soon as you scrolled down — editing a subpage section or a settings block far below gave no visible dirty hint and no reachable save button. Replace it with a bottom-pinned floating bar shared by both editors. It only mounts while there is something to act on (unsaved changes, an in-flight save, or a result message), so it never covers content while idle. The success message clears after 5s, which hides the bar again. - new SaveBar component, replacing the duplicated markup in PageBuilder and SettingsEditor - adopt the previously unused .floating-save-bar CSS: slide-in keyframes (carrying translateX(-50%)), dirty border, wrap/gap, mobile variant and a prefers-reduced-motion opt-out; z-index 900 keeps it below modals - .admin-main gains bottom padding so the bar never covers page content - drop the now-unreachable idle hints: the ⌘S hint becomes a button title, the Live Sync note becomes a static line above the settings layout - header "Site" link now bypasses the cache (/?fresh=1), so the preview stays reachable when the bar is hidden Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(admin): themed listbox for the album sort control (#427) The per-album "Photo order" control was a native <select>. Because an <option> cannot contain markup, its choices could not use the admin panel's currentColor SVG set — the reason #415 had to fall back to plain text after dropping the emoji labels. Adds a Listbox component implementing the ARIA combobox/listbox pattern, so options can render a glyph beside their label: - DOM focus stays on the trigger button; the active option is announced through aria-activedescendant, keeping focus management to one element - Keyboard: arrows (clamped at the ends, like a native select), Home/End, Enter/Space to commit, Escape to cancel, Tab commits and moves on, and prefix type-ahead with a repeat-key cycle - Outside dismissal on pointerdown, so a press starting outside closes the popup before the click retargets The sort options now carry an icon each: calendar, arrow-down, arrow-up, an A→Z marker, and the drag glyph for manual — matching the badge the album card already shows. SORT_LABELS stays plain text because the badge feeds it to a title attribute. Closes #417 Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(git): ignore generated design handoff folders * fix(admin): stop the album sort dropdown clipping, and simplify the panel (#428) * fix(admin): render listbox popup in a portal so it escapes modal clipping The sort control's popup was position:absolute inside three clipping ancestors (.album-drawer overflow:hidden > .album-drawer-body overflow-y:auto > .modal-right-column overflow-y:auto), so it was cut off at the bottom of the Edit Album Details modal. z-index could not help: clipping happens before stacking. It also always hung below the trigger, with no flip. Portal the popup to document.body and position it from the trigger's viewport rect, flipping above when there is more room there and capping max-height to the space available so it scrolls internally rather than overflowing. It is dismissed on scroll and resize, since the anchor is only measured on open. The outside-pointerdown handler now also treats the popup as inside; without that the portalled list counts as outside, and a click on an option would close it before the selection commits. * refactor(admin): single-column album details panel The left column spent 1.2fr on a cover thumbnail and three stat rows, two of which (Status, Custom Hero) only restated the form fields opposite them, while the form itself was squeezed into 1.8fr behind a second nested scroller. Stack the drawer in one column instead: cover as a banner, then the form at full width, with the UUID moved into the footer. The body is now the only scroll container, which also removes one of the ancestors that was clipping the sort popup. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> * fix(admin): give the portalled listbox its theme back, lock the page behind modals (#429) Two defects in the album editor. The sort listbox popup painted transparent. Every --admin-* variable is scoped to .admin-layout, and since the popup moved into document.body it sits outside that subtree, so background/border/text all resolved to nothing. It now carries its own copy of the palette in both colour schemes, plus the font it no longer inherits. Scrolling inside a modal also moved the page behind it. No admin modal ever locked body scroll: the overlay covers the page but does not absorb wheel events, so a scroll starting on the backdrop — or continuing past the end of the modal's own scroller — reaches the document. overscroll-behavior cannot cover that case on its own, because it only applies to scroll containers and the backdrop is not one. useScrollLock freezes body while a modal is open and compensates for the width the scrollbar gives up, so nothing shifts underneath. Each lock restores the inline value it found, which makes nesting work without a counter — a picker opened from the drawer restores the drawer's hidden state instead of clearing it. Applied to both drawers and all four picker modals, which share the defect. overscroll-behavior: contain on the scrollers stops the chaining they can handle themselves. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com> * fix(security): allow unsafe-eval in CSP script-src during dev mode * feat(journal): add Journal Studio with split-screen editor, live preview and dedicated routes * fix(build): separate client parser from server journal-service and fix build type errors * fix(journal): Fotos rendern, Layout und Lightbox-Steuerung korrigieren Fünf unabhängige Fehler in der öffentlichen Journal- und Essay-Ansicht: * Foto-Blöcke wurden nie angezeigt. EssayView löst ein Foto über PhotoItem.id auf, und das sind verschlüsselte Tokens — die Blöcke aus dem Markdown tragen aber rohe Asset-UUIDs. Jede Zuordnung lief ins Leere, und nicht auflösbare Blöcke werden still verworfen. Die IDs werden jetzt serverseitig übersetzt; damit verschwinden nebenbei die rohen UUIDs aus dem Client-Payload, die dort laut Projektregel nie auftauchen dürfen. Nicht auflösbare Referenzen werden geloggt. * Überschriften standen weiter links als der Fließtext. Jeder Block hatte einzeln `max-width: 68ch`, und `ch` ist relativ zur Schrift des Elements — die Serif-Überschrift ergab eine breitere Spalte. Ersetzt durch eine gemeinsame, font-unabhängige `--essay-measure`. * Fullbleed-Fotos bluteten nur nach links aus: `.essay-figure` ist `width: 100%`, wodurch die Box überbestimmt ist und der negative rechte Margin verworfen wird. * Foto-Paare stellten beide Bilder gleich breit dar, wodurch ein Hochformat neben einem Querformat doppelt so hoch wurde. Jetzt eine Justified-Reihe: Breite proportional zum Seitenverhältnis, dadurch exakt gleiche Höhen ohne Beschnitt. * Die Lightbox hatte im Journal keine Tastatursteuerung und keine Scroll-Sperre — beides lag in PhotoGrid, also nur im Album-Raster. Verlagert in die Lightbox selbst, der doppelte Handler in PhotoGrid entfernt (sonst wäre pro Pfeildruck zwei Bilder weitergesprungen). Zusätzlich sind Proofing-Herzen und das EXIF-Panel im redaktionellen Modus abschaltbar und im Journal aus: Client-Proofing ist ein Übergabe-Workflow für Alben, keine Funktion einer Reportage. Auf der Übersicht wurde der Untertitel doppelt gerendert, weil extractExcerpt() auf ihn zurückfällt. * feat(admin): eigene URLs für alle Bereiche und überarbeiteter Journal Studio Das Panel war eine einzige Client-Komponente, die ihre Tabs über useState umschaltet: keine Route pro Bereich, kein Deep-Link, kein Zurück-Button, und nach jedem Reload landete man wieder auf "Pages". Auch der Journal-Editor hatte keine eigene URL. Jetzt sieben echte Routen (/admin, /admin/pages, /admin/journal, /admin/journal/<slug>, /admin/settings, /admin/settings/<section>, /admin/analytics). Die Shell mit Auth-Prüfung und Kopfzeile sitzt im Layout und umschließt children — so bleibt die Session-Prüfung über Routenwechsel montiert, statt bei jedem Tab-Wechsel neu zu laufen und den Spinner aufblitzen zu lassen. Unbekannte Settings-Sections fallen auf General zurück. Im selben Zug der Journal Studio, der die Routing-Änderung ohnehin berührt: * Alle Eingabefelder nutzten die Klasse `admin-input`, die in keinem CSS definiert war — sie fielen auf Browser-Defaults zurück. Jetzt gestylt, gescoped, damit der generische Name nicht ins übrige Panel leckt. * Der Split View ist per Divider verschiebbar (Maus, Tastatur, Doppelklick zum Zurücksetzen), Breite in localStorage. * Das Studio bricht aus der 1120px-Spalte aus, die Preview hat Platz. * Die Preview zeigte für jedes Foto fest 3:2 und log damit über das Layout der veröffentlichten Seite; die echten Verhältnisse werden jetzt an den Thumbnails gemessen. * Blöcke mit alten positionsbasierten Foto-Referenzen werden markiert — die lassen sich auf einer eigenständigen Journal-Seite nicht auflösen und verschwanden bisher stillschweigend. * Blocktyp-Chips als gemeinsame Komponente, monochrom und per Icon unterschieden statt in einer eigenen Blau/Lila/Orange-Palette, die sonst nirgends im Panel vorkommt. * Emojis raus, SVG-Icons rein. * fix(admin): Designsystem-Lücken im Panel schließen Eine systematische Suche nach Klassen, die im TSX benutzt, aber in keinem CSS definiert sind, hat vier Stellen mit demselben Muster gefunden: * `admin-btn-secondary` und `admin-btn-danger` existierten nicht. Sämtliche Löschen-Buttons sahen aus wie normale Buttons — keine Warnwirkung. Als `.admin-btn.admin-btn-danger` geschrieben, weil die Varianten mit den Größenklassen kombiniert werden, die weiter unten ihren eigenen Hintergrund setzen. * `page-progress-fill` fehlte: die Balken im Analytics-Panel waren leere Rinnen, der Wert unsichtbar. Ebenso `analytics-empty` und `admin-loading-container`. * `subpage-drawer-section`, `subpage-drawer-title-group` und `input-with-icon` im PageBuilder waren wirkungslos und teils mit Inline-Styles notdürftig kompensiert. * `grid-card-preview` fehlte, wodurch alle Layout-Vorschauen auf Höhe null kollabierten. Nur "Showcase" war sichtbar — und das aus Versehen, weil sein Tile `hero-tile` hieß und damit die `aspect-ratio` einer fremden PageBuilder-Klasse erbte. Umbenannt. Dazu die Theme-Vorschauen, die praktisch identisch aussahen: alle sieben zeigten dieselben drei quadratischen Kacheln, einziger Unterschied war die Hintergrundfarbe. Sie spiegeln jetzt die echten Preset-Daten aus lib/config/theme.ts — Schriftcharakter, Eckradius, Rasterdichte, Passepartout bzw. Schatten. Die Kopfzeile richtet sich an einer gemeinsamen Steuerhöhe aus. Der "Site"-Link war höher als die Buttons daneben: `.admin-btn` hatte keine explizite line-height, und <button> bekommt box-sizing: border-box vom Browser, <a> nicht. Die Statusanzeige setzte weder Schriftfamilie noch -größe und fiel auf den Browser-Default zurück — sie war nie Teil des Designsystems. Jetzt gleiche Höhe und Typografie, Pillenform als Zustandsanzeige, Trenner zur Aktionsgruppe. Das dauerhafte Pulsieren des grünen Punkts entfällt; Animation bleibt den Zuständen vorbehalten, die Aufmerksamkeit brauchen. Restliche Emojis durch SVG-Icons ersetzt. * feat(admin): add scroll-to-top toggle and SVG arrow The back-to-top button was always on and drew its arrow with the ↑ text character. Add a `scrollToTop` setting (General section in the admin panel, defaults to on so existing sites are unaffected) and replace the glyph with a stroked SVG that inherits currentColor across all presets. Scroll handling is now rAF-throttled, and prefers-reduced-motion turns off both the hover lift and the smooth scroll. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * security(journal): escape author HTML instead of filtering it CodeQL flags 26 high-severity alerts on the release PR; the bulk of them point at sanitizeHtml(), a denylist of three regexes whose output goes into dangerouslySetInnerHTML. I reproduced the bypasses before changing anything — all four pass the old filter: <img src=x onerror=alert(1)> unquoted handler, regex wants quotes <img src=x onerror='alert(1)'> single quotes, same reason <svg onload=alert(1)> not a <script> tag javasjavascript:cript:alert(1) one-pass replace, the rest recombines Plus an attribute breakout in the link renderer, which interpolated the URL into href="${url}" unescaped: [x](" onmouseover=alert(1) x=") -> <a href="" onmouseover=alert(1" ...> Replaced with escaping. Every `&<>"'` in author text becomes an entity before any markdown rule runs, so the only tags in the output are the ones renderInlineMarkdown builds itself and a URL cannot leave its attribute. Link schemes are now an allowlist (http, https, mailto, tel, relative, anchor); anything else renders as plain text. The serializer needed decodeHtmlEntities to match: without it a save would write `&lt;` into the Markdown file and the next parse would escape the `&` again, corrupting the text further on every round trip. A test covers parse -> serialize -> parse stability. Two existing tests asserted the old behaviour and were rewritten rather than deleted: one expected the script tag to be *removed* from the output, the other expected the substring "onerror" to be absent. Both now assert the property that matters — that no tag can form — because `onerror` surviving as inert text is fine. Exploitation required admin access either way: journal and essay text comes from the studio or from content/*.md. This removes the weakness, it does not close an open door. * fix(journal): contain file paths, fix frontmatter escaping, defuse two regexes Follow-up to the CodeQL findings on release PR #432. I went through all 23 alerts individually; this addresses the ones that are worth addressing and documents the ones that are not. Path containment (12 alerts, all false positives). Every path built from a slug goes through isValidSlug(), a strict `/^[a-zA-Z0-9_-]+$/` allowlist — verified against `../../etc/passwd`, `foo/../../bar`, `a/b`, `..` and friends, all rejected. CodeQL cannot see it because the check lives in another module. Added a containedPath() helper that resolves the path and refuses anything landing outside the content directory: a second lock on a door that was already locked, and a barrier the analysis can follow. Also removed the dead `slug.endsWith('.md')` branches — isValidSlug rejects dots, so they could never be taken. Frontmatter escaping (1 alert, a real bug). The serializer escaped `"` but not `\`, and the parser never unescaped anything. A title containing either character gained a backslash on every save/load cycle: Path C:\Users "quoted" -> Path C:\\Users \"quoted\" -> ... Escaping now covers the backslash first and the parser undoes both. A round trip test covers quotes, backslashes, colons and apostrophes. Two of three ReDoS regexes (2 alerts). The heading pattern had `\s+` next to `(.+)`, which overlap, so the engine tried every split of the whitespace run before failing; it is `[ \t]+` and `(\S.*)` now. The quote author pattern wrapped a lazy group around an optional group — the quadratic case — and is an index split on the first separator now. The third regex, the bold/italic pass, is deliberately left alone. Rewriting it with a negated class removes the backtracking but breaks nesting: `**bold *and italic* here**` renders as `*<em>bold </em>and italic<em> here</em>*`. The input is Markdown from an authenticated admin, never a visitor, so the worst case is an author slowing down their own page. The comment in the code says so. Not addressed: 5 js/insufficient-password-hash alerts. They ask for a slow KDF where the code uses SHA-256/HMAC — correct in general, but the admin password comes from an environment variable and is never stored, so a stronger KDF protects nothing that is not already in plaintext in the environment. 399 unit tests pass (18 new), build and tsc clean. * fix(journal): split the quote author by scanning, not by pattern Cleaning up after myself. #439 replaced the quote author regex `/^(.*?)(?:\s+--\s+(.+))?$/` — a lazy group around an optional one, the quadratic case — with `/\s+--\s+/`, and CodeQL promptly flagged the replacement for the same reason. One reported pattern traded for another. splitQuoteAuthor() scans for the first `--` that has whitespace on both sides. Linear, and it needs no reasoning about the regex engine at all. Behaviour is identical to the original regex, checked case by case against it: separator, no separator, several separators, tabs, wide gaps, `a--b` without spaces, leading and trailing separators, empty string. All nine are covered by tests, plus one asserting it stays fast on a 50k whitespace run. * security(admin): derive the session signing key with scrypt getSigningKey() ran the admin password through a single SHA-256 digest. It is key derivation rather than password storage, so it was never a stored-hash problem — but if the derived key ever leaked, one fast hash makes recovering the password by brute force cheap. CodeQL flags it as js/insufficient-password-hash and, for this particular alert, has a point. scrypt now. Two details that matter: The salt has to be stable. A random salt would produce a different key on every call and invalidate every session; it is derived from AUTH_SECRET, which is deployment-specific. Verified across separate processes: same inputs produce a verifying token, so a restart or redeploy does not log everyone out. The result is cached for the process lifetime. scrypt is deliberately slow and getSigningKey() runs on every admin request — deriving per call would add ~24ms to each one. The cache key is a digest of secret plus password, so a rotation misses the cache and derives again, and no extra plaintext copy of the password is kept around. Measured: first derivation 24ms, subsequent calls 0.12ms. Password change and secret change both invalidate an existing token, checked in separate processes. Note the one-time effect: existing admin sessions are invalidated by the change in derivation, so everyone logs in once more. * security(admin): key the signing-key cache on its inputs, not a digest #441 removed the SHA-256 digest of the admin password from the key derivation and introduced a new one three lines above it, as the cache key. Same rule, same file: CodeQL reported it immediately. The comment justifying it was wrong too. It claimed no second plaintext copy of the password was retained, while building the digest input allocates exactly that in order to hash it. The cache now holds the two input strings and compares them directly. They are the same objects the env and install caches already hold, so nothing extra is retained, and no fast hash of the password exists in memory for the life of the process. Re-verified after the change, in separate processes: a token from one process verifies in another with the same inputs, a changed password or secret rejects it, first derivation 24ms, cached calls 0.001ms. That leaves scrypt as the only place the password is hashed here. The two HMACs further down operate on the derived key and on token data, not on the password; the constant-time comparison in verifyAdminPassword is the previously dismissed one. --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
2026-08-14 16:55:07 +02:00
/* Type specimen: generic families stand in for the preset's real webfont,
* which is not loaded inside the admin panel. */
.preset-card-preview .mini-specimen {
font-size: 0.95rem;
line-height: 1;
color: var(--preset-accent);
}
.preset-card-preview .mini-specimen.type-serif {
font-family: Georgia, 'Times New Roman', serif;
}
.preset-card-preview .mini-specimen.type-sans {
font-family: 'Helvetica Neue', Arial, sans-serif;
font-weight: 600;
letter-spacing: -0.02em;
}
.preset-card-preview .mini-specimen.type-mono {
font-family: ui-monospace, SFMono-Regular, Menlo, monospace;
font-size: 0.85rem;
feat(admin): visual theme cards, album search, and status dashboard (#241) * feat(admin): implement visual theme cards, album search, and system status diagnostics * fix(admin): resolve type-checking build errors in SettingsEditor and status route --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-05-31 21:17:52 +02:00
}
.preset-card-preview .mini-line {
height: 2px;
release: v0.11.0 — journal fixes, admin URLs, design system cleanup (#432) * fix(screenshots): sharp-Typen fuer 0.34 und 0.35 gleichzeitig (#410) sharp 0.35 ist von `export =` auf ESM umgestellt: der Modul-Namespace ist nicht mehr aufrufbar, die Factory sitzt unter .default. Der Type-Check brach damit in scripts/screenshots.ts weg, sobald der Next-Bump (#402) sharp von 0.34.5 auf 0.35.3 mitzieht -- sharp ist hier keine deklarierte Dependency, sondern kommt ueber Next mit. Die Form wird jetzt aus dem installierten Paket abgeleitet statt festgeschrieben, zur Laufzeit wie im Typ. Geprueft mit beiden Versionen: tsc laeuft mit 0.34.5 und mit 0.35.3 fehlerfrei durch. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(deps): bump the nextjs group across 1 directory with 2 updates (#402) Bumps the nextjs group with 2 updates in the / directory: [next](https://github.com/vercel/next.js) and [eslint-config-next](https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next). Updates `next` from 16.2.12 to 16.3.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/compare/v16.2.12...v16.3.0) Updates `eslint-config-next` from 16.2.12 to 16.3.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/commits/v16.3.0/packages/eslint-config-next) --- updated-dependencies: - dependency-name: eslint-config-next dependency-version: 16.3.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: nextjs - dependency-name: next dependency-version: 16.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nextjs ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps-dev): bump prettier from 3.8.3 to 3.9.6 (#405) Bumps [prettier](https://github.com/prettier/prettier) from 3.8.3 to 3.9.6. - [Release notes](https://github.com/prettier/prettier/releases) - [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md) - [Commits](https://github.com/prettier/prettier/compare/3.8.3...3.9.6) --- updated-dependencies: - dependency-name: prettier dependency-version: 3.9.6 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * docs(changelog): Unreleased-Sektion fuer die Bumps nach v0.10.0 (#413) Die Dependency-PRs sind nach dem Release auf dev gelandet, teils auch auf main. Ohne Eintrag waeren sie beim naechsten Release unsichtbar -- inklusive Next 16.3.0, das CVE-2025-13465 mitbringt. Ausserdem im 0.10.0-Abschnitt nachgetragen, dass der Trivy-Scan bis #409 nie gelaufen ist. Der Fix steckt im Tag v0.10.0, fehlte aber in der Aufzaehlung -- und "Images werden bei jedem Publish gescannt" stand im Changelog, waehrend der Job im Action-Setup abbrach. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(gallery): per-album sort order, independent of Immich (#408) (#414) Album order was dictated entirely by Immich: getAlbum() sorted by the album's own asc/desc flag, so a Folio album always mirrored the archive. A curated series has a narrative order that has nothing to do with capture time, and changing the Immich album's sort to fit the website changes it for the archive too. Adds an optional per-album `sort` in gallery.yaml, editable in /admin, defaulting to today's behaviour so every existing config is unchanged: immich (default) | newest | oldest | filename | manual `manual` is a pinned *prefix*: `assetOrder` lists only the photos placed by hand, everything else follows in the album's Immich order. A full permutation of a 2,000-photo album would be ~80 KB of UUIDs in a file that is rewritten and copied to content/.backups/ on every admin save. It also makes drift fall out for free — photos removed in Immich never match, new ones land in the tail rather than being hidden. Sorting is applied after the cache read, not before the cache write, so the LRU keeps one canonical Immich-ordered copy per album. That avoids putting the mode in the cache key, lets a config change take effect without depending on invalidation, and keeps the stale-serving path correct. cache.get() returns the stored object by reference, so withSort() returns a shallow clone with a new array — sorting in place would reorder the shared entry, and under request coalescing every concurrent caller would be sorting the same array. Also fixes a prerequisite bug: /api/admin/albums/[albumId]/assets read album.assets from GET /albums/:id, which Immich 3.x no longer populates (lib/immich.ts:507). The hero picker's "This Album" tab returned nothing and threw outright when the key was absent. It now goes through the client's paginated metadata search, with ?types=all to opt videos in for the reorder editor. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): drop decorative emoji from the sort select labels (#415) An <option> cannot contain markup, so the SVG set in Icons is not reachable there — but a decorative emoji is not a substitute for it. Plain text instead; the album card badge already uses a real icon. The remaining emoji in the admin panel (asset picker tabs, section headings, layout picker options) predate this branch and are left for a separate cleanup. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): replace emoji icons with the shared SVG icon set (#416) The admin panel mixed two icon conventions: inline SVGs from `Icons.tsx` in most components, and decorative emoji in the asset picker and a few PageBuilder labels. Emoji render inconsistently across platforms, ignore the accent colour, and cannot inherit the `.svg-icon` sizing rules. - Icons.tsx: add `IconStar` (filled — it marks a state, not an action) and `IconImage`. - AssetPicker: the three tab labels and the favourite tile badge now use IconFolder / IconStar / IconImage. - PageBuilder: the "Standalone Albums" and "Subpages" headings use the icon set instead of an emoji. - PageBuilder: the layout picker drops its emoji for plain text. An <option> cannot contain markup, so an SVG is impossible there and a decorative glyph is not a substitute. - admin.css: align icon and label in the picker tabs, and swap the favourite badge's text-shadow for drop-shadow, which is what applies to an inline SVG. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): fold PageBuilder's local icons into the shared Icons module (#418) * refactor(admin): fold PageBuilder's local icons into the shared module PageBuilder.tsx carried its own `Icons` object duplicating most of the glyphs already exported by Icons.tsx, with hardcoded sizes and slightly divergent paths. Migrate all 32 call sites to the shared module and delete the local object. Five glyphs had no counterpart and are added to Icons.tsx as 1:1 ports of the local paths: IconX, IconPlus, IconHome, IconCopy, IconImage. The local ExternalLink and Check are dropped rather than ported — both had zero call sites. Two glyphs change shape slightly, which is the point of consolidating: the shared IconCamera includes the viewfinder bump the local copy omitted, and drag handles now use IconGripVertical. IconGripVertical uses the module's square 24x24 viewBox, so `.svg-drag` goes from 12x18 to 18x18 — the old non-square box would letterbox the glyph down to 12x12 and shrink the handle. * fix(admin): resolve icon-module integration after #416 Merging dev brought in #416, which added a second IconImage to Icons.tsx and two <Icons.Camera>/<Icons.Folder> section headers that reference the local Icons object this PR removes. Git merged both cleanly but the result did not type-check. - drop the duplicate IconImage (both copies were byte-identical) - point the two section headers at the imported IconCamera/IconFolder - refresh the SORT_LABELS comment: the icon set is imported now, not declared below --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> * fix(config): allow an empty gallery, guard against a double /api suffix (#421) An empty gallery is now a valid, rendered state instead of a throw: deriveGallery() no longer requires at least one album or subpage, so a deployment with no albums yet renders a bare homepage the owner can fill in via /admin. getConfig() also stops appending /api to an Immich URL that already ends in it, which previously produced .../api/api and broke every upstream request. Includes a restore of the per-album sort test cases, which the branch had lost by being cut before #408/#414. * feat(admin): favicon upload, served from the content volume (#422) Adds a bundled default favicon, an upload widget in admin Settings > General, and a route that serves the icon from the writable content/ volume with a fallback to the bundled default. Raster uploads (PNG/ICO/JPEG) are wrapped in an SVG container; the response carries its own CSP so an uploaded SVG cannot execute script on the origin. The GET route revalidates with an ETag instead of caching immutably, so a newly uploaded icon shows up immediately. Uploads are written via temp file + rename, and a Reset button restores the bundled default. * ci: flag unformatted files in a PR, without blocking it (#424) Prettier is configured as an error rule in eslint.config.mjs but has never run in CI, so part of the tree predates it. A final CI step now diffs against the PR base, runs prettier --list-different over the changed files, and emits a warning annotation per offender plus a job summary. Advisory by design: it never fails the job. Blocking would turn a PR red for merely touching a file that was already unformatted, and normalising the tree in one commit would wreck git blame and conflict with the PRs in flight. Requires fetch-depth: 0, since diffing against the base needs its history. * feat(install): first-run wizard gated by a one-time setup token (#419) Adds /install, a four-step first-run wizard: connect to Immich, optionally pick albums, name the site, finish. It verifies the credentials against the Immich server before writing anything, then writes gallery.yaml, settings.yaml and a content/install.json carrying the Immich credentials and a generated site secret. install.json exists because a running process cannot pick up new env vars — the wizard has to write configuration that takes effect without a restart. getInstallCredentials() merges it under the real environment, so env vars always win and rotation stays a matter of setting one. Both the page and the API routes are gated by a one-time setup token printed to the server log, so a deployment that is reachable before gallery.yaml exists cannot be configured by whoever finds it first. The token is stored in content/.setup-token (0600) rather than a module variable: Next.js bundles the page and each route handler separately, so a module-level token left the page and the API disagreeing inside one process and the wizard stuck on step 1. It is removed once the install completes. The admin password is stored as an scrypt hash using the scheme lib/auth.ts already applies to album passwords; a plaintext ADMIN_PASSWORD env var keeps working. * docs: document the setup wizard, fix the read-only content mount (#425) Quick Start now leads with the /install wizard, with the hand-written YAML route kept alongside it, and a First-Run Setup section covers the setup token, the files the wizard writes, and env-var precedence. Two corrections: both Docker examples mounted content/ as :ro, which silently breaks the wizard, the admin panel and the backup rotation alike — docs/admin-panel.md already said so and the README contradicted it. And nothing documented that content/install.json holds the Immich API key, so a backup of content/ is a backup of credentials. Also adds a Contributors section crediting the people whose work is in the project. * feat(admin): floating save bar pinned to the bottom of the viewport (#426) The save bar was the first, static element inside .admin-main. Since the document itself scrolls, it left the viewport as soon as you scrolled down — editing a subpage section or a settings block far below gave no visible dirty hint and no reachable save button. Replace it with a bottom-pinned floating bar shared by both editors. It only mounts while there is something to act on (unsaved changes, an in-flight save, or a result message), so it never covers content while idle. The success message clears after 5s, which hides the bar again. - new SaveBar component, replacing the duplicated markup in PageBuilder and SettingsEditor - adopt the previously unused .floating-save-bar CSS: slide-in keyframes (carrying translateX(-50%)), dirty border, wrap/gap, mobile variant and a prefers-reduced-motion opt-out; z-index 900 keeps it below modals - .admin-main gains bottom padding so the bar never covers page content - drop the now-unreachable idle hints: the ⌘S hint becomes a button title, the Live Sync note becomes a static line above the settings layout - header "Site" link now bypasses the cache (/?fresh=1), so the preview stays reachable when the bar is hidden Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(admin): themed listbox for the album sort control (#427) The per-album "Photo order" control was a native <select>. Because an <option> cannot contain markup, its choices could not use the admin panel's currentColor SVG set — the reason #415 had to fall back to plain text after dropping the emoji labels. Adds a Listbox component implementing the ARIA combobox/listbox pattern, so options can render a glyph beside their label: - DOM focus stays on the trigger button; the active option is announced through aria-activedescendant, keeping focus management to one element - Keyboard: arrows (clamped at the ends, like a native select), Home/End, Enter/Space to commit, Escape to cancel, Tab commits and moves on, and prefix type-ahead with a repeat-key cycle - Outside dismissal on pointerdown, so a press starting outside closes the popup before the click retargets The sort options now carry an icon each: calendar, arrow-down, arrow-up, an A→Z marker, and the drag glyph for manual — matching the badge the album card already shows. SORT_LABELS stays plain text because the badge feeds it to a title attribute. Closes #417 Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(git): ignore generated design handoff folders * fix(admin): stop the album sort dropdown clipping, and simplify the panel (#428) * fix(admin): render listbox popup in a portal so it escapes modal clipping The sort control's popup was position:absolute inside three clipping ancestors (.album-drawer overflow:hidden > .album-drawer-body overflow-y:auto > .modal-right-column overflow-y:auto), so it was cut off at the bottom of the Edit Album Details modal. z-index could not help: clipping happens before stacking. It also always hung below the trigger, with no flip. Portal the popup to document.body and position it from the trigger's viewport rect, flipping above when there is more room there and capping max-height to the space available so it scrolls internally rather than overflowing. It is dismissed on scroll and resize, since the anchor is only measured on open. The outside-pointerdown handler now also treats the popup as inside; without that the portalled list counts as outside, and a click on an option would close it before the selection commits. * refactor(admin): single-column album details panel The left column spent 1.2fr on a cover thumbnail and three stat rows, two of which (Status, Custom Hero) only restated the form fields opposite them, while the form itself was squeezed into 1.8fr behind a second nested scroller. Stack the drawer in one column instead: cover as a banner, then the form at full width, with the UUID moved into the footer. The body is now the only scroll container, which also removes one of the ancestors that was clipping the sort popup. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> * fix(admin): give the portalled listbox its theme back, lock the page behind modals (#429) Two defects in the album editor. The sort listbox popup painted transparent. Every --admin-* variable is scoped to .admin-layout, and since the popup moved into document.body it sits outside that subtree, so background/border/text all resolved to nothing. It now carries its own copy of the palette in both colour schemes, plus the font it no longer inherits. Scrolling inside a modal also moved the page behind it. No admin modal ever locked body scroll: the overlay covers the page but does not absorb wheel events, so a scroll starting on the backdrop — or continuing past the end of the modal's own scroller — reaches the document. overscroll-behavior cannot cover that case on its own, because it only applies to scroll containers and the backdrop is not one. useScrollLock freezes body while a modal is open and compensates for the width the scrollbar gives up, so nothing shifts underneath. Each lock restores the inline value it found, which makes nesting work without a counter — a picker opened from the drawer restores the drawer's hidden state instead of clearing it. Applied to both drawers and all four picker modals, which share the defect. overscroll-behavior: contain on the scrollers stops the chaining they can handle themselves. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com> * fix(security): allow unsafe-eval in CSP script-src during dev mode * feat(journal): add Journal Studio with split-screen editor, live preview and dedicated routes * fix(build): separate client parser from server journal-service and fix build type errors * fix(journal): Fotos rendern, Layout und Lightbox-Steuerung korrigieren Fünf unabhängige Fehler in der öffentlichen Journal- und Essay-Ansicht: * Foto-Blöcke wurden nie angezeigt. EssayView löst ein Foto über PhotoItem.id auf, und das sind verschlüsselte Tokens — die Blöcke aus dem Markdown tragen aber rohe Asset-UUIDs. Jede Zuordnung lief ins Leere, und nicht auflösbare Blöcke werden still verworfen. Die IDs werden jetzt serverseitig übersetzt; damit verschwinden nebenbei die rohen UUIDs aus dem Client-Payload, die dort laut Projektregel nie auftauchen dürfen. Nicht auflösbare Referenzen werden geloggt. * Überschriften standen weiter links als der Fließtext. Jeder Block hatte einzeln `max-width: 68ch`, und `ch` ist relativ zur Schrift des Elements — die Serif-Überschrift ergab eine breitere Spalte. Ersetzt durch eine gemeinsame, font-unabhängige `--essay-measure`. * Fullbleed-Fotos bluteten nur nach links aus: `.essay-figure` ist `width: 100%`, wodurch die Box überbestimmt ist und der negative rechte Margin verworfen wird. * Foto-Paare stellten beide Bilder gleich breit dar, wodurch ein Hochformat neben einem Querformat doppelt so hoch wurde. Jetzt eine Justified-Reihe: Breite proportional zum Seitenverhältnis, dadurch exakt gleiche Höhen ohne Beschnitt. * Die Lightbox hatte im Journal keine Tastatursteuerung und keine Scroll-Sperre — beides lag in PhotoGrid, also nur im Album-Raster. Verlagert in die Lightbox selbst, der doppelte Handler in PhotoGrid entfernt (sonst wäre pro Pfeildruck zwei Bilder weitergesprungen). Zusätzlich sind Proofing-Herzen und das EXIF-Panel im redaktionellen Modus abschaltbar und im Journal aus: Client-Proofing ist ein Übergabe-Workflow für Alben, keine Funktion einer Reportage. Auf der Übersicht wurde der Untertitel doppelt gerendert, weil extractExcerpt() auf ihn zurückfällt. * feat(admin): eigene URLs für alle Bereiche und überarbeiteter Journal Studio Das Panel war eine einzige Client-Komponente, die ihre Tabs über useState umschaltet: keine Route pro Bereich, kein Deep-Link, kein Zurück-Button, und nach jedem Reload landete man wieder auf "Pages". Auch der Journal-Editor hatte keine eigene URL. Jetzt sieben echte Routen (/admin, /admin/pages, /admin/journal, /admin/journal/<slug>, /admin/settings, /admin/settings/<section>, /admin/analytics). Die Shell mit Auth-Prüfung und Kopfzeile sitzt im Layout und umschließt children — so bleibt die Session-Prüfung über Routenwechsel montiert, statt bei jedem Tab-Wechsel neu zu laufen und den Spinner aufblitzen zu lassen. Unbekannte Settings-Sections fallen auf General zurück. Im selben Zug der Journal Studio, der die Routing-Änderung ohnehin berührt: * Alle Eingabefelder nutzten die Klasse `admin-input`, die in keinem CSS definiert war — sie fielen auf Browser-Defaults zurück. Jetzt gestylt, gescoped, damit der generische Name nicht ins übrige Panel leckt. * Der Split View ist per Divider verschiebbar (Maus, Tastatur, Doppelklick zum Zurücksetzen), Breite in localStorage. * Das Studio bricht aus der 1120px-Spalte aus, die Preview hat Platz. * Die Preview zeigte für jedes Foto fest 3:2 und log damit über das Layout der veröffentlichten Seite; die echten Verhältnisse werden jetzt an den Thumbnails gemessen. * Blöcke mit alten positionsbasierten Foto-Referenzen werden markiert — die lassen sich auf einer eigenständigen Journal-Seite nicht auflösen und verschwanden bisher stillschweigend. * Blocktyp-Chips als gemeinsame Komponente, monochrom und per Icon unterschieden statt in einer eigenen Blau/Lila/Orange-Palette, die sonst nirgends im Panel vorkommt. * Emojis raus, SVG-Icons rein. * fix(admin): Designsystem-Lücken im Panel schließen Eine systematische Suche nach Klassen, die im TSX benutzt, aber in keinem CSS definiert sind, hat vier Stellen mit demselben Muster gefunden: * `admin-btn-secondary` und `admin-btn-danger` existierten nicht. Sämtliche Löschen-Buttons sahen aus wie normale Buttons — keine Warnwirkung. Als `.admin-btn.admin-btn-danger` geschrieben, weil die Varianten mit den Größenklassen kombiniert werden, die weiter unten ihren eigenen Hintergrund setzen. * `page-progress-fill` fehlte: die Balken im Analytics-Panel waren leere Rinnen, der Wert unsichtbar. Ebenso `analytics-empty` und `admin-loading-container`. * `subpage-drawer-section`, `subpage-drawer-title-group` und `input-with-icon` im PageBuilder waren wirkungslos und teils mit Inline-Styles notdürftig kompensiert. * `grid-card-preview` fehlte, wodurch alle Layout-Vorschauen auf Höhe null kollabierten. Nur "Showcase" war sichtbar — und das aus Versehen, weil sein Tile `hero-tile` hieß und damit die `aspect-ratio` einer fremden PageBuilder-Klasse erbte. Umbenannt. Dazu die Theme-Vorschauen, die praktisch identisch aussahen: alle sieben zeigten dieselben drei quadratischen Kacheln, einziger Unterschied war die Hintergrundfarbe. Sie spiegeln jetzt die echten Preset-Daten aus lib/config/theme.ts — Schriftcharakter, Eckradius, Rasterdichte, Passepartout bzw. Schatten. Die Kopfzeile richtet sich an einer gemeinsamen Steuerhöhe aus. Der "Site"-Link war höher als die Buttons daneben: `.admin-btn` hatte keine explizite line-height, und <button> bekommt box-sizing: border-box vom Browser, <a> nicht. Die Statusanzeige setzte weder Schriftfamilie noch -größe und fiel auf den Browser-Default zurück — sie war nie Teil des Designsystems. Jetzt gleiche Höhe und Typografie, Pillenform als Zustandsanzeige, Trenner zur Aktionsgruppe. Das dauerhafte Pulsieren des grünen Punkts entfällt; Animation bleibt den Zuständen vorbehalten, die Aufmerksamkeit brauchen. Restliche Emojis durch SVG-Icons ersetzt. * feat(admin): add scroll-to-top toggle and SVG arrow The back-to-top button was always on and drew its arrow with the ↑ text character. Add a `scrollToTop` setting (General section in the admin panel, defaults to on so existing sites are unaffected) and replace the glyph with a stroked SVG that inherits currentColor across all presets. Scroll handling is now rAF-throttled, and prefers-reduced-motion turns off both the hover lift and the smooth scroll. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * security(journal): escape author HTML instead of filtering it CodeQL flags 26 high-severity alerts on the release PR; the bulk of them point at sanitizeHtml(), a denylist of three regexes whose output goes into dangerouslySetInnerHTML. I reproduced the bypasses before changing anything — all four pass the old filter: <img src=x onerror=alert(1)> unquoted handler, regex wants quotes <img src=x onerror='alert(1)'> single quotes, same reason <svg onload=alert(1)> not a <script> tag javasjavascript:cript:alert(1) one-pass replace, the rest recombines Plus an attribute breakout in the link renderer, which interpolated the URL into href="${url}" unescaped: [x](" onmouseover=alert(1) x=") -> <a href="" onmouseover=alert(1" ...> Replaced with escaping. Every `&<>"'` in author text becomes an entity before any markdown rule runs, so the only tags in the output are the ones renderInlineMarkdown builds itself and a URL cannot leave its attribute. Link schemes are now an allowlist (http, https, mailto, tel, relative, anchor); anything else renders as plain text. The serializer needed decodeHtmlEntities to match: without it a save would write `&lt;` into the Markdown file and the next parse would escape the `&` again, corrupting the text further on every round trip. A test covers parse -> serialize -> parse stability. Two existing tests asserted the old behaviour and were rewritten rather than deleted: one expected the script tag to be *removed* from the output, the other expected the substring "onerror" to be absent. Both now assert the property that matters — that no tag can form — because `onerror` surviving as inert text is fine. Exploitation required admin access either way: journal and essay text comes from the studio or from content/*.md. This removes the weakness, it does not close an open door. * fix(journal): contain file paths, fix frontmatter escaping, defuse two regexes Follow-up to the CodeQL findings on release PR #432. I went through all 23 alerts individually; this addresses the ones that are worth addressing and documents the ones that are not. Path containment (12 alerts, all false positives). Every path built from a slug goes through isValidSlug(), a strict `/^[a-zA-Z0-9_-]+$/` allowlist — verified against `../../etc/passwd`, `foo/../../bar`, `a/b`, `..` and friends, all rejected. CodeQL cannot see it because the check lives in another module. Added a containedPath() helper that resolves the path and refuses anything landing outside the content directory: a second lock on a door that was already locked, and a barrier the analysis can follow. Also removed the dead `slug.endsWith('.md')` branches — isValidSlug rejects dots, so they could never be taken. Frontmatter escaping (1 alert, a real bug). The serializer escaped `"` but not `\`, and the parser never unescaped anything. A title containing either character gained a backslash on every save/load cycle: Path C:\Users "quoted" -> Path C:\\Users \"quoted\" -> ... Escaping now covers the backslash first and the parser undoes both. A round trip test covers quotes, backslashes, colons and apostrophes. Two of three ReDoS regexes (2 alerts). The heading pattern had `\s+` next to `(.+)`, which overlap, so the engine tried every split of the whitespace run before failing; it is `[ \t]+` and `(\S.*)` now. The quote author pattern wrapped a lazy group around an optional group — the quadratic case — and is an index split on the first separator now. The third regex, the bold/italic pass, is deliberately left alone. Rewriting it with a negated class removes the backtracking but breaks nesting: `**bold *and italic* here**` renders as `*<em>bold </em>and italic<em> here</em>*`. The input is Markdown from an authenticated admin, never a visitor, so the worst case is an author slowing down their own page. The comment in the code says so. Not addressed: 5 js/insufficient-password-hash alerts. They ask for a slow KDF where the code uses SHA-256/HMAC — correct in general, but the admin password comes from an environment variable and is never stored, so a stronger KDF protects nothing that is not already in plaintext in the environment. 399 unit tests pass (18 new), build and tsc clean. * fix(journal): split the quote author by scanning, not by pattern Cleaning up after myself. #439 replaced the quote author regex `/^(.*?)(?:\s+--\s+(.+))?$/` — a lazy group around an optional one, the quadratic case — with `/\s+--\s+/`, and CodeQL promptly flagged the replacement for the same reason. One reported pattern traded for another. splitQuoteAuthor() scans for the first `--` that has whitespace on both sides. Linear, and it needs no reasoning about the regex engine at all. Behaviour is identical to the original regex, checked case by case against it: separator, no separator, several separators, tabs, wide gaps, `a--b` without spaces, leading and trailing separators, empty string. All nine are covered by tests, plus one asserting it stays fast on a 50k whitespace run. * security(admin): derive the session signing key with scrypt getSigningKey() ran the admin password through a single SHA-256 digest. It is key derivation rather than password storage, so it was never a stored-hash problem — but if the derived key ever leaked, one fast hash makes recovering the password by brute force cheap. CodeQL flags it as js/insufficient-password-hash and, for this particular alert, has a point. scrypt now. Two details that matter: The salt has to be stable. A random salt would produce a different key on every call and invalidate every session; it is derived from AUTH_SECRET, which is deployment-specific. Verified across separate processes: same inputs produce a verifying token, so a restart or redeploy does not log everyone out. The result is cached for the process lifetime. scrypt is deliberately slow and getSigningKey() runs on every admin request — deriving per call would add ~24ms to each one. The cache key is a digest of secret plus password, so a rotation misses the cache and derives again, and no extra plaintext copy of the password is kept around. Measured: first derivation 24ms, subsequent calls 0.12ms. Password change and secret change both invalidate an existing token, checked in separate processes. Note the one-time effect: existing admin sessions are invalidated by the change in derivation, so everyone logs in once more. * security(admin): key the signing-key cache on its inputs, not a digest #441 removed the SHA-256 digest of the admin password from the key derivation and introduced a new one three lines above it, as the cache key. Same rule, same file: CodeQL reported it immediately. The comment justifying it was wrong too. It claimed no second plaintext copy of the password was retained, while building the digest input allocates exactly that in order to hash it. The cache now holds the two input strings and compares them directly. They are the same objects the env and install caches already hold, so nothing extra is retained, and no fast hash of the password exists in memory for the life of the process. Re-verified after the change, in separate processes: a token from one process verifies in another with the same inputs, a changed password or secret rejects it, first derivation 24ms, cached calls 0.001ms. That leaves scrypt as the only place the password is hashed here. The two HMACs further down operate on the derived key and on token data, not on the password; the constant-time comparison in verifyAdminPassword is the previously dismissed one. --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
2026-08-14 16:55:07 +02:00
flex: 1;
max-width: 46px;
feat(admin): visual theme cards, album search, and status dashboard (#241) * feat(admin): implement visual theme cards, album search, and system status diagnostics * fix(admin): resolve type-checking build errors in SettingsEditor and status route --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-05-31 21:17:52 +02:00
border-radius: 1px;
release: v0.11.0 — journal fixes, admin URLs, design system cleanup (#432) * fix(screenshots): sharp-Typen fuer 0.34 und 0.35 gleichzeitig (#410) sharp 0.35 ist von `export =` auf ESM umgestellt: der Modul-Namespace ist nicht mehr aufrufbar, die Factory sitzt unter .default. Der Type-Check brach damit in scripts/screenshots.ts weg, sobald der Next-Bump (#402) sharp von 0.34.5 auf 0.35.3 mitzieht -- sharp ist hier keine deklarierte Dependency, sondern kommt ueber Next mit. Die Form wird jetzt aus dem installierten Paket abgeleitet statt festgeschrieben, zur Laufzeit wie im Typ. Geprueft mit beiden Versionen: tsc laeuft mit 0.34.5 und mit 0.35.3 fehlerfrei durch. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(deps): bump the nextjs group across 1 directory with 2 updates (#402) Bumps the nextjs group with 2 updates in the / directory: [next](https://github.com/vercel/next.js) and [eslint-config-next](https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next). Updates `next` from 16.2.12 to 16.3.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/compare/v16.2.12...v16.3.0) Updates `eslint-config-next` from 16.2.12 to 16.3.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/commits/v16.3.0/packages/eslint-config-next) --- updated-dependencies: - dependency-name: eslint-config-next dependency-version: 16.3.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: nextjs - dependency-name: next dependency-version: 16.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nextjs ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps-dev): bump prettier from 3.8.3 to 3.9.6 (#405) Bumps [prettier](https://github.com/prettier/prettier) from 3.8.3 to 3.9.6. - [Release notes](https://github.com/prettier/prettier/releases) - [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md) - [Commits](https://github.com/prettier/prettier/compare/3.8.3...3.9.6) --- updated-dependencies: - dependency-name: prettier dependency-version: 3.9.6 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * docs(changelog): Unreleased-Sektion fuer die Bumps nach v0.10.0 (#413) Die Dependency-PRs sind nach dem Release auf dev gelandet, teils auch auf main. Ohne Eintrag waeren sie beim naechsten Release unsichtbar -- inklusive Next 16.3.0, das CVE-2025-13465 mitbringt. Ausserdem im 0.10.0-Abschnitt nachgetragen, dass der Trivy-Scan bis #409 nie gelaufen ist. Der Fix steckt im Tag v0.10.0, fehlte aber in der Aufzaehlung -- und "Images werden bei jedem Publish gescannt" stand im Changelog, waehrend der Job im Action-Setup abbrach. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(gallery): per-album sort order, independent of Immich (#408) (#414) Album order was dictated entirely by Immich: getAlbum() sorted by the album's own asc/desc flag, so a Folio album always mirrored the archive. A curated series has a narrative order that has nothing to do with capture time, and changing the Immich album's sort to fit the website changes it for the archive too. Adds an optional per-album `sort` in gallery.yaml, editable in /admin, defaulting to today's behaviour so every existing config is unchanged: immich (default) | newest | oldest | filename | manual `manual` is a pinned *prefix*: `assetOrder` lists only the photos placed by hand, everything else follows in the album's Immich order. A full permutation of a 2,000-photo album would be ~80 KB of UUIDs in a file that is rewritten and copied to content/.backups/ on every admin save. It also makes drift fall out for free — photos removed in Immich never match, new ones land in the tail rather than being hidden. Sorting is applied after the cache read, not before the cache write, so the LRU keeps one canonical Immich-ordered copy per album. That avoids putting the mode in the cache key, lets a config change take effect without depending on invalidation, and keeps the stale-serving path correct. cache.get() returns the stored object by reference, so withSort() returns a shallow clone with a new array — sorting in place would reorder the shared entry, and under request coalescing every concurrent caller would be sorting the same array. Also fixes a prerequisite bug: /api/admin/albums/[albumId]/assets read album.assets from GET /albums/:id, which Immich 3.x no longer populates (lib/immich.ts:507). The hero picker's "This Album" tab returned nothing and threw outright when the key was absent. It now goes through the client's paginated metadata search, with ?types=all to opt videos in for the reorder editor. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): drop decorative emoji from the sort select labels (#415) An <option> cannot contain markup, so the SVG set in Icons is not reachable there — but a decorative emoji is not a substitute for it. Plain text instead; the album card badge already uses a real icon. The remaining emoji in the admin panel (asset picker tabs, section headings, layout picker options) predate this branch and are left for a separate cleanup. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): replace emoji icons with the shared SVG icon set (#416) The admin panel mixed two icon conventions: inline SVGs from `Icons.tsx` in most components, and decorative emoji in the asset picker and a few PageBuilder labels. Emoji render inconsistently across platforms, ignore the accent colour, and cannot inherit the `.svg-icon` sizing rules. - Icons.tsx: add `IconStar` (filled — it marks a state, not an action) and `IconImage`. - AssetPicker: the three tab labels and the favourite tile badge now use IconFolder / IconStar / IconImage. - PageBuilder: the "Standalone Albums" and "Subpages" headings use the icon set instead of an emoji. - PageBuilder: the layout picker drops its emoji for plain text. An <option> cannot contain markup, so an SVG is impossible there and a decorative glyph is not a substitute. - admin.css: align icon and label in the picker tabs, and swap the favourite badge's text-shadow for drop-shadow, which is what applies to an inline SVG. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): fold PageBuilder's local icons into the shared Icons module (#418) * refactor(admin): fold PageBuilder's local icons into the shared module PageBuilder.tsx carried its own `Icons` object duplicating most of the glyphs already exported by Icons.tsx, with hardcoded sizes and slightly divergent paths. Migrate all 32 call sites to the shared module and delete the local object. Five glyphs had no counterpart and are added to Icons.tsx as 1:1 ports of the local paths: IconX, IconPlus, IconHome, IconCopy, IconImage. The local ExternalLink and Check are dropped rather than ported — both had zero call sites. Two glyphs change shape slightly, which is the point of consolidating: the shared IconCamera includes the viewfinder bump the local copy omitted, and drag handles now use IconGripVertical. IconGripVertical uses the module's square 24x24 viewBox, so `.svg-drag` goes from 12x18 to 18x18 — the old non-square box would letterbox the glyph down to 12x12 and shrink the handle. * fix(admin): resolve icon-module integration after #416 Merging dev brought in #416, which added a second IconImage to Icons.tsx and two <Icons.Camera>/<Icons.Folder> section headers that reference the local Icons object this PR removes. Git merged both cleanly but the result did not type-check. - drop the duplicate IconImage (both copies were byte-identical) - point the two section headers at the imported IconCamera/IconFolder - refresh the SORT_LABELS comment: the icon set is imported now, not declared below --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> * fix(config): allow an empty gallery, guard against a double /api suffix (#421) An empty gallery is now a valid, rendered state instead of a throw: deriveGallery() no longer requires at least one album or subpage, so a deployment with no albums yet renders a bare homepage the owner can fill in via /admin. getConfig() also stops appending /api to an Immich URL that already ends in it, which previously produced .../api/api and broke every upstream request. Includes a restore of the per-album sort test cases, which the branch had lost by being cut before #408/#414. * feat(admin): favicon upload, served from the content volume (#422) Adds a bundled default favicon, an upload widget in admin Settings > General, and a route that serves the icon from the writable content/ volume with a fallback to the bundled default. Raster uploads (PNG/ICO/JPEG) are wrapped in an SVG container; the response carries its own CSP so an uploaded SVG cannot execute script on the origin. The GET route revalidates with an ETag instead of caching immutably, so a newly uploaded icon shows up immediately. Uploads are written via temp file + rename, and a Reset button restores the bundled default. * ci: flag unformatted files in a PR, without blocking it (#424) Prettier is configured as an error rule in eslint.config.mjs but has never run in CI, so part of the tree predates it. A final CI step now diffs against the PR base, runs prettier --list-different over the changed files, and emits a warning annotation per offender plus a job summary. Advisory by design: it never fails the job. Blocking would turn a PR red for merely touching a file that was already unformatted, and normalising the tree in one commit would wreck git blame and conflict with the PRs in flight. Requires fetch-depth: 0, since diffing against the base needs its history. * feat(install): first-run wizard gated by a one-time setup token (#419) Adds /install, a four-step first-run wizard: connect to Immich, optionally pick albums, name the site, finish. It verifies the credentials against the Immich server before writing anything, then writes gallery.yaml, settings.yaml and a content/install.json carrying the Immich credentials and a generated site secret. install.json exists because a running process cannot pick up new env vars — the wizard has to write configuration that takes effect without a restart. getInstallCredentials() merges it under the real environment, so env vars always win and rotation stays a matter of setting one. Both the page and the API routes are gated by a one-time setup token printed to the server log, so a deployment that is reachable before gallery.yaml exists cannot be configured by whoever finds it first. The token is stored in content/.setup-token (0600) rather than a module variable: Next.js bundles the page and each route handler separately, so a module-level token left the page and the API disagreeing inside one process and the wizard stuck on step 1. It is removed once the install completes. The admin password is stored as an scrypt hash using the scheme lib/auth.ts already applies to album passwords; a plaintext ADMIN_PASSWORD env var keeps working. * docs: document the setup wizard, fix the read-only content mount (#425) Quick Start now leads with the /install wizard, with the hand-written YAML route kept alongside it, and a First-Run Setup section covers the setup token, the files the wizard writes, and env-var precedence. Two corrections: both Docker examples mounted content/ as :ro, which silently breaks the wizard, the admin panel and the backup rotation alike — docs/admin-panel.md already said so and the README contradicted it. And nothing documented that content/install.json holds the Immich API key, so a backup of content/ is a backup of credentials. Also adds a Contributors section crediting the people whose work is in the project. * feat(admin): floating save bar pinned to the bottom of the viewport (#426) The save bar was the first, static element inside .admin-main. Since the document itself scrolls, it left the viewport as soon as you scrolled down — editing a subpage section or a settings block far below gave no visible dirty hint and no reachable save button. Replace it with a bottom-pinned floating bar shared by both editors. It only mounts while there is something to act on (unsaved changes, an in-flight save, or a result message), so it never covers content while idle. The success message clears after 5s, which hides the bar again. - new SaveBar component, replacing the duplicated markup in PageBuilder and SettingsEditor - adopt the previously unused .floating-save-bar CSS: slide-in keyframes (carrying translateX(-50%)), dirty border, wrap/gap, mobile variant and a prefers-reduced-motion opt-out; z-index 900 keeps it below modals - .admin-main gains bottom padding so the bar never covers page content - drop the now-unreachable idle hints: the ⌘S hint becomes a button title, the Live Sync note becomes a static line above the settings layout - header "Site" link now bypasses the cache (/?fresh=1), so the preview stays reachable when the bar is hidden Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(admin): themed listbox for the album sort control (#427) The per-album "Photo order" control was a native <select>. Because an <option> cannot contain markup, its choices could not use the admin panel's currentColor SVG set — the reason #415 had to fall back to plain text after dropping the emoji labels. Adds a Listbox component implementing the ARIA combobox/listbox pattern, so options can render a glyph beside their label: - DOM focus stays on the trigger button; the active option is announced through aria-activedescendant, keeping focus management to one element - Keyboard: arrows (clamped at the ends, like a native select), Home/End, Enter/Space to commit, Escape to cancel, Tab commits and moves on, and prefix type-ahead with a repeat-key cycle - Outside dismissal on pointerdown, so a press starting outside closes the popup before the click retargets The sort options now carry an icon each: calendar, arrow-down, arrow-up, an A→Z marker, and the drag glyph for manual — matching the badge the album card already shows. SORT_LABELS stays plain text because the badge feeds it to a title attribute. Closes #417 Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(git): ignore generated design handoff folders * fix(admin): stop the album sort dropdown clipping, and simplify the panel (#428) * fix(admin): render listbox popup in a portal so it escapes modal clipping The sort control's popup was position:absolute inside three clipping ancestors (.album-drawer overflow:hidden > .album-drawer-body overflow-y:auto > .modal-right-column overflow-y:auto), so it was cut off at the bottom of the Edit Album Details modal. z-index could not help: clipping happens before stacking. It also always hung below the trigger, with no flip. Portal the popup to document.body and position it from the trigger's viewport rect, flipping above when there is more room there and capping max-height to the space available so it scrolls internally rather than overflowing. It is dismissed on scroll and resize, since the anchor is only measured on open. The outside-pointerdown handler now also treats the popup as inside; without that the portalled list counts as outside, and a click on an option would close it before the selection commits. * refactor(admin): single-column album details panel The left column spent 1.2fr on a cover thumbnail and three stat rows, two of which (Status, Custom Hero) only restated the form fields opposite them, while the form itself was squeezed into 1.8fr behind a second nested scroller. Stack the drawer in one column instead: cover as a banner, then the form at full width, with the UUID moved into the footer. The body is now the only scroll container, which also removes one of the ancestors that was clipping the sort popup. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> * fix(admin): give the portalled listbox its theme back, lock the page behind modals (#429) Two defects in the album editor. The sort listbox popup painted transparent. Every --admin-* variable is scoped to .admin-layout, and since the popup moved into document.body it sits outside that subtree, so background/border/text all resolved to nothing. It now carries its own copy of the palette in both colour schemes, plus the font it no longer inherits. Scrolling inside a modal also moved the page behind it. No admin modal ever locked body scroll: the overlay covers the page but does not absorb wheel events, so a scroll starting on the backdrop — or continuing past the end of the modal's own scroller — reaches the document. overscroll-behavior cannot cover that case on its own, because it only applies to scroll containers and the backdrop is not one. useScrollLock freezes body while a modal is open and compensates for the width the scrollbar gives up, so nothing shifts underneath. Each lock restores the inline value it found, which makes nesting work without a counter — a picker opened from the drawer restores the drawer's hidden state instead of clearing it. Applied to both drawers and all four picker modals, which share the defect. overscroll-behavior: contain on the scrollers stops the chaining they can handle themselves. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com> * fix(security): allow unsafe-eval in CSP script-src during dev mode * feat(journal): add Journal Studio with split-screen editor, live preview and dedicated routes * fix(build): separate client parser from server journal-service and fix build type errors * fix(journal): Fotos rendern, Layout und Lightbox-Steuerung korrigieren Fünf unabhängige Fehler in der öffentlichen Journal- und Essay-Ansicht: * Foto-Blöcke wurden nie angezeigt. EssayView löst ein Foto über PhotoItem.id auf, und das sind verschlüsselte Tokens — die Blöcke aus dem Markdown tragen aber rohe Asset-UUIDs. Jede Zuordnung lief ins Leere, und nicht auflösbare Blöcke werden still verworfen. Die IDs werden jetzt serverseitig übersetzt; damit verschwinden nebenbei die rohen UUIDs aus dem Client-Payload, die dort laut Projektregel nie auftauchen dürfen. Nicht auflösbare Referenzen werden geloggt. * Überschriften standen weiter links als der Fließtext. Jeder Block hatte einzeln `max-width: 68ch`, und `ch` ist relativ zur Schrift des Elements — die Serif-Überschrift ergab eine breitere Spalte. Ersetzt durch eine gemeinsame, font-unabhängige `--essay-measure`. * Fullbleed-Fotos bluteten nur nach links aus: `.essay-figure` ist `width: 100%`, wodurch die Box überbestimmt ist und der negative rechte Margin verworfen wird. * Foto-Paare stellten beide Bilder gleich breit dar, wodurch ein Hochformat neben einem Querformat doppelt so hoch wurde. Jetzt eine Justified-Reihe: Breite proportional zum Seitenverhältnis, dadurch exakt gleiche Höhen ohne Beschnitt. * Die Lightbox hatte im Journal keine Tastatursteuerung und keine Scroll-Sperre — beides lag in PhotoGrid, also nur im Album-Raster. Verlagert in die Lightbox selbst, der doppelte Handler in PhotoGrid entfernt (sonst wäre pro Pfeildruck zwei Bilder weitergesprungen). Zusätzlich sind Proofing-Herzen und das EXIF-Panel im redaktionellen Modus abschaltbar und im Journal aus: Client-Proofing ist ein Übergabe-Workflow für Alben, keine Funktion einer Reportage. Auf der Übersicht wurde der Untertitel doppelt gerendert, weil extractExcerpt() auf ihn zurückfällt. * feat(admin): eigene URLs für alle Bereiche und überarbeiteter Journal Studio Das Panel war eine einzige Client-Komponente, die ihre Tabs über useState umschaltet: keine Route pro Bereich, kein Deep-Link, kein Zurück-Button, und nach jedem Reload landete man wieder auf "Pages". Auch der Journal-Editor hatte keine eigene URL. Jetzt sieben echte Routen (/admin, /admin/pages, /admin/journal, /admin/journal/<slug>, /admin/settings, /admin/settings/<section>, /admin/analytics). Die Shell mit Auth-Prüfung und Kopfzeile sitzt im Layout und umschließt children — so bleibt die Session-Prüfung über Routenwechsel montiert, statt bei jedem Tab-Wechsel neu zu laufen und den Spinner aufblitzen zu lassen. Unbekannte Settings-Sections fallen auf General zurück. Im selben Zug der Journal Studio, der die Routing-Änderung ohnehin berührt: * Alle Eingabefelder nutzten die Klasse `admin-input`, die in keinem CSS definiert war — sie fielen auf Browser-Defaults zurück. Jetzt gestylt, gescoped, damit der generische Name nicht ins übrige Panel leckt. * Der Split View ist per Divider verschiebbar (Maus, Tastatur, Doppelklick zum Zurücksetzen), Breite in localStorage. * Das Studio bricht aus der 1120px-Spalte aus, die Preview hat Platz. * Die Preview zeigte für jedes Foto fest 3:2 und log damit über das Layout der veröffentlichten Seite; die echten Verhältnisse werden jetzt an den Thumbnails gemessen. * Blöcke mit alten positionsbasierten Foto-Referenzen werden markiert — die lassen sich auf einer eigenständigen Journal-Seite nicht auflösen und verschwanden bisher stillschweigend. * Blocktyp-Chips als gemeinsame Komponente, monochrom und per Icon unterschieden statt in einer eigenen Blau/Lila/Orange-Palette, die sonst nirgends im Panel vorkommt. * Emojis raus, SVG-Icons rein. * fix(admin): Designsystem-Lücken im Panel schließen Eine systematische Suche nach Klassen, die im TSX benutzt, aber in keinem CSS definiert sind, hat vier Stellen mit demselben Muster gefunden: * `admin-btn-secondary` und `admin-btn-danger` existierten nicht. Sämtliche Löschen-Buttons sahen aus wie normale Buttons — keine Warnwirkung. Als `.admin-btn.admin-btn-danger` geschrieben, weil die Varianten mit den Größenklassen kombiniert werden, die weiter unten ihren eigenen Hintergrund setzen. * `page-progress-fill` fehlte: die Balken im Analytics-Panel waren leere Rinnen, der Wert unsichtbar. Ebenso `analytics-empty` und `admin-loading-container`. * `subpage-drawer-section`, `subpage-drawer-title-group` und `input-with-icon` im PageBuilder waren wirkungslos und teils mit Inline-Styles notdürftig kompensiert. * `grid-card-preview` fehlte, wodurch alle Layout-Vorschauen auf Höhe null kollabierten. Nur "Showcase" war sichtbar — und das aus Versehen, weil sein Tile `hero-tile` hieß und damit die `aspect-ratio` einer fremden PageBuilder-Klasse erbte. Umbenannt. Dazu die Theme-Vorschauen, die praktisch identisch aussahen: alle sieben zeigten dieselben drei quadratischen Kacheln, einziger Unterschied war die Hintergrundfarbe. Sie spiegeln jetzt die echten Preset-Daten aus lib/config/theme.ts — Schriftcharakter, Eckradius, Rasterdichte, Passepartout bzw. Schatten. Die Kopfzeile richtet sich an einer gemeinsamen Steuerhöhe aus. Der "Site"-Link war höher als die Buttons daneben: `.admin-btn` hatte keine explizite line-height, und <button> bekommt box-sizing: border-box vom Browser, <a> nicht. Die Statusanzeige setzte weder Schriftfamilie noch -größe und fiel auf den Browser-Default zurück — sie war nie Teil des Designsystems. Jetzt gleiche Höhe und Typografie, Pillenform als Zustandsanzeige, Trenner zur Aktionsgruppe. Das dauerhafte Pulsieren des grünen Punkts entfällt; Animation bleibt den Zuständen vorbehalten, die Aufmerksamkeit brauchen. Restliche Emojis durch SVG-Icons ersetzt. * feat(admin): add scroll-to-top toggle and SVG arrow The back-to-top button was always on and drew its arrow with the ↑ text character. Add a `scrollToTop` setting (General section in the admin panel, defaults to on so existing sites are unaffected) and replace the glyph with a stroked SVG that inherits currentColor across all presets. Scroll handling is now rAF-throttled, and prefers-reduced-motion turns off both the hover lift and the smooth scroll. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * security(journal): escape author HTML instead of filtering it CodeQL flags 26 high-severity alerts on the release PR; the bulk of them point at sanitizeHtml(), a denylist of three regexes whose output goes into dangerouslySetInnerHTML. I reproduced the bypasses before changing anything — all four pass the old filter: <img src=x onerror=alert(1)> unquoted handler, regex wants quotes <img src=x onerror='alert(1)'> single quotes, same reason <svg onload=alert(1)> not a <script> tag javasjavascript:cript:alert(1) one-pass replace, the rest recombines Plus an attribute breakout in the link renderer, which interpolated the URL into href="${url}" unescaped: [x](" onmouseover=alert(1) x=") -> <a href="" onmouseover=alert(1" ...> Replaced with escaping. Every `&<>"'` in author text becomes an entity before any markdown rule runs, so the only tags in the output are the ones renderInlineMarkdown builds itself and a URL cannot leave its attribute. Link schemes are now an allowlist (http, https, mailto, tel, relative, anchor); anything else renders as plain text. The serializer needed decodeHtmlEntities to match: without it a save would write `&lt;` into the Markdown file and the next parse would escape the `&` again, corrupting the text further on every round trip. A test covers parse -> serialize -> parse stability. Two existing tests asserted the old behaviour and were rewritten rather than deleted: one expected the script tag to be *removed* from the output, the other expected the substring "onerror" to be absent. Both now assert the property that matters — that no tag can form — because `onerror` surviving as inert text is fine. Exploitation required admin access either way: journal and essay text comes from the studio or from content/*.md. This removes the weakness, it does not close an open door. * fix(journal): contain file paths, fix frontmatter escaping, defuse two regexes Follow-up to the CodeQL findings on release PR #432. I went through all 23 alerts individually; this addresses the ones that are worth addressing and documents the ones that are not. Path containment (12 alerts, all false positives). Every path built from a slug goes through isValidSlug(), a strict `/^[a-zA-Z0-9_-]+$/` allowlist — verified against `../../etc/passwd`, `foo/../../bar`, `a/b`, `..` and friends, all rejected. CodeQL cannot see it because the check lives in another module. Added a containedPath() helper that resolves the path and refuses anything landing outside the content directory: a second lock on a door that was already locked, and a barrier the analysis can follow. Also removed the dead `slug.endsWith('.md')` branches — isValidSlug rejects dots, so they could never be taken. Frontmatter escaping (1 alert, a real bug). The serializer escaped `"` but not `\`, and the parser never unescaped anything. A title containing either character gained a backslash on every save/load cycle: Path C:\Users "quoted" -> Path C:\\Users \"quoted\" -> ... Escaping now covers the backslash first and the parser undoes both. A round trip test covers quotes, backslashes, colons and apostrophes. Two of three ReDoS regexes (2 alerts). The heading pattern had `\s+` next to `(.+)`, which overlap, so the engine tried every split of the whitespace run before failing; it is `[ \t]+` and `(\S.*)` now. The quote author pattern wrapped a lazy group around an optional group — the quadratic case — and is an index split on the first separator now. The third regex, the bold/italic pass, is deliberately left alone. Rewriting it with a negated class removes the backtracking but breaks nesting: `**bold *and italic* here**` renders as `*<em>bold </em>and italic<em> here</em>*`. The input is Markdown from an authenticated admin, never a visitor, so the worst case is an author slowing down their own page. The comment in the code says so. Not addressed: 5 js/insufficient-password-hash alerts. They ask for a slow KDF where the code uses SHA-256/HMAC — correct in general, but the admin password comes from an environment variable and is never stored, so a stronger KDF protects nothing that is not already in plaintext in the environment. 399 unit tests pass (18 new), build and tsc clean. * fix(journal): split the quote author by scanning, not by pattern Cleaning up after myself. #439 replaced the quote author regex `/^(.*?)(?:\s+--\s+(.+))?$/` — a lazy group around an optional one, the quadratic case — with `/\s+--\s+/`, and CodeQL promptly flagged the replacement for the same reason. One reported pattern traded for another. splitQuoteAuthor() scans for the first `--` that has whitespace on both sides. Linear, and it needs no reasoning about the regex engine at all. Behaviour is identical to the original regex, checked case by case against it: separator, no separator, several separators, tabs, wide gaps, `a--b` without spaces, leading and trailing separators, empty string. All nine are covered by tests, plus one asserting it stays fast on a 50k whitespace run. * security(admin): derive the session signing key with scrypt getSigningKey() ran the admin password through a single SHA-256 digest. It is key derivation rather than password storage, so it was never a stored-hash problem — but if the derived key ever leaked, one fast hash makes recovering the password by brute force cheap. CodeQL flags it as js/insufficient-password-hash and, for this particular alert, has a point. scrypt now. Two details that matter: The salt has to be stable. A random salt would produce a different key on every call and invalidate every session; it is derived from AUTH_SECRET, which is deployment-specific. Verified across separate processes: same inputs produce a verifying token, so a restart or redeploy does not log everyone out. The result is cached for the process lifetime. scrypt is deliberately slow and getSigningKey() runs on every admin request — deriving per call would add ~24ms to each one. The cache key is a digest of secret plus password, so a rotation misses the cache and derives again, and no extra plaintext copy of the password is kept around. Measured: first derivation 24ms, subsequent calls 0.12ms. Password change and secret change both invalidate an existing token, checked in separate processes. Note the one-time effect: existing admin sessions are invalidated by the change in derivation, so everyone logs in once more. * security(admin): key the signing-key cache on its inputs, not a digest #441 removed the SHA-256 digest of the admin password from the key derivation and introduced a new one three lines above it, as the cache key. Same rule, same file: CodeQL reported it immediately. The comment justifying it was wrong too. It claimed no second plaintext copy of the password was retained, while building the digest input allocates exactly that in order to hash it. The cache now holds the two input strings and compares them directly. They are the same objects the env and install caches already hold, so nothing extra is retained, and no fast hash of the password exists in memory for the life of the process. Re-verified after the change, in separate processes: a token from one process verifies in another with the same inputs, a changed password or secret rejects it, first derivation 24ms, cached calls 0.001ms. That leaves scrypt as the only place the password is hashed here. The two HMACs further down operate on the derived key and on token data, not on the password; the constant-time comparison in verifyAdminPassword is the previously dismissed one. --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
2026-08-14 16:55:07 +02:00
background: var(--preset-accent);
opacity: 0.4;
}
.preset-card.active .preset-card-preview .mini-line {
opacity: 1;
feat(admin): visual theme cards, album search, and status dashboard (#241) * feat(admin): implement visual theme cards, album search, and system status diagnostics * fix(admin): resolve type-checking build errors in SettingsEditor and status route --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-05-31 21:17:52 +02:00
}
.preset-card-preview .mini-grid {
flex: 1;
release: v0.11.0 — journal fixes, admin URLs, design system cleanup (#432) * fix(screenshots): sharp-Typen fuer 0.34 und 0.35 gleichzeitig (#410) sharp 0.35 ist von `export =` auf ESM umgestellt: der Modul-Namespace ist nicht mehr aufrufbar, die Factory sitzt unter .default. Der Type-Check brach damit in scripts/screenshots.ts weg, sobald der Next-Bump (#402) sharp von 0.34.5 auf 0.35.3 mitzieht -- sharp ist hier keine deklarierte Dependency, sondern kommt ueber Next mit. Die Form wird jetzt aus dem installierten Paket abgeleitet statt festgeschrieben, zur Laufzeit wie im Typ. Geprueft mit beiden Versionen: tsc laeuft mit 0.34.5 und mit 0.35.3 fehlerfrei durch. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(deps): bump the nextjs group across 1 directory with 2 updates (#402) Bumps the nextjs group with 2 updates in the / directory: [next](https://github.com/vercel/next.js) and [eslint-config-next](https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next). Updates `next` from 16.2.12 to 16.3.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/compare/v16.2.12...v16.3.0) Updates `eslint-config-next` from 16.2.12 to 16.3.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/commits/v16.3.0/packages/eslint-config-next) --- updated-dependencies: - dependency-name: eslint-config-next dependency-version: 16.3.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: nextjs - dependency-name: next dependency-version: 16.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nextjs ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps-dev): bump prettier from 3.8.3 to 3.9.6 (#405) Bumps [prettier](https://github.com/prettier/prettier) from 3.8.3 to 3.9.6. - [Release notes](https://github.com/prettier/prettier/releases) - [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md) - [Commits](https://github.com/prettier/prettier/compare/3.8.3...3.9.6) --- updated-dependencies: - dependency-name: prettier dependency-version: 3.9.6 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * docs(changelog): Unreleased-Sektion fuer die Bumps nach v0.10.0 (#413) Die Dependency-PRs sind nach dem Release auf dev gelandet, teils auch auf main. Ohne Eintrag waeren sie beim naechsten Release unsichtbar -- inklusive Next 16.3.0, das CVE-2025-13465 mitbringt. Ausserdem im 0.10.0-Abschnitt nachgetragen, dass der Trivy-Scan bis #409 nie gelaufen ist. Der Fix steckt im Tag v0.10.0, fehlte aber in der Aufzaehlung -- und "Images werden bei jedem Publish gescannt" stand im Changelog, waehrend der Job im Action-Setup abbrach. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(gallery): per-album sort order, independent of Immich (#408) (#414) Album order was dictated entirely by Immich: getAlbum() sorted by the album's own asc/desc flag, so a Folio album always mirrored the archive. A curated series has a narrative order that has nothing to do with capture time, and changing the Immich album's sort to fit the website changes it for the archive too. Adds an optional per-album `sort` in gallery.yaml, editable in /admin, defaulting to today's behaviour so every existing config is unchanged: immich (default) | newest | oldest | filename | manual `manual` is a pinned *prefix*: `assetOrder` lists only the photos placed by hand, everything else follows in the album's Immich order. A full permutation of a 2,000-photo album would be ~80 KB of UUIDs in a file that is rewritten and copied to content/.backups/ on every admin save. It also makes drift fall out for free — photos removed in Immich never match, new ones land in the tail rather than being hidden. Sorting is applied after the cache read, not before the cache write, so the LRU keeps one canonical Immich-ordered copy per album. That avoids putting the mode in the cache key, lets a config change take effect without depending on invalidation, and keeps the stale-serving path correct. cache.get() returns the stored object by reference, so withSort() returns a shallow clone with a new array — sorting in place would reorder the shared entry, and under request coalescing every concurrent caller would be sorting the same array. Also fixes a prerequisite bug: /api/admin/albums/[albumId]/assets read album.assets from GET /albums/:id, which Immich 3.x no longer populates (lib/immich.ts:507). The hero picker's "This Album" tab returned nothing and threw outright when the key was absent. It now goes through the client's paginated metadata search, with ?types=all to opt videos in for the reorder editor. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): drop decorative emoji from the sort select labels (#415) An <option> cannot contain markup, so the SVG set in Icons is not reachable there — but a decorative emoji is not a substitute for it. Plain text instead; the album card badge already uses a real icon. The remaining emoji in the admin panel (asset picker tabs, section headings, layout picker options) predate this branch and are left for a separate cleanup. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): replace emoji icons with the shared SVG icon set (#416) The admin panel mixed two icon conventions: inline SVGs from `Icons.tsx` in most components, and decorative emoji in the asset picker and a few PageBuilder labels. Emoji render inconsistently across platforms, ignore the accent colour, and cannot inherit the `.svg-icon` sizing rules. - Icons.tsx: add `IconStar` (filled — it marks a state, not an action) and `IconImage`. - AssetPicker: the three tab labels and the favourite tile badge now use IconFolder / IconStar / IconImage. - PageBuilder: the "Standalone Albums" and "Subpages" headings use the icon set instead of an emoji. - PageBuilder: the layout picker drops its emoji for plain text. An <option> cannot contain markup, so an SVG is impossible there and a decorative glyph is not a substitute. - admin.css: align icon and label in the picker tabs, and swap the favourite badge's text-shadow for drop-shadow, which is what applies to an inline SVG. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): fold PageBuilder's local icons into the shared Icons module (#418) * refactor(admin): fold PageBuilder's local icons into the shared module PageBuilder.tsx carried its own `Icons` object duplicating most of the glyphs already exported by Icons.tsx, with hardcoded sizes and slightly divergent paths. Migrate all 32 call sites to the shared module and delete the local object. Five glyphs had no counterpart and are added to Icons.tsx as 1:1 ports of the local paths: IconX, IconPlus, IconHome, IconCopy, IconImage. The local ExternalLink and Check are dropped rather than ported — both had zero call sites. Two glyphs change shape slightly, which is the point of consolidating: the shared IconCamera includes the viewfinder bump the local copy omitted, and drag handles now use IconGripVertical. IconGripVertical uses the module's square 24x24 viewBox, so `.svg-drag` goes from 12x18 to 18x18 — the old non-square box would letterbox the glyph down to 12x12 and shrink the handle. * fix(admin): resolve icon-module integration after #416 Merging dev brought in #416, which added a second IconImage to Icons.tsx and two <Icons.Camera>/<Icons.Folder> section headers that reference the local Icons object this PR removes. Git merged both cleanly but the result did not type-check. - drop the duplicate IconImage (both copies were byte-identical) - point the two section headers at the imported IconCamera/IconFolder - refresh the SORT_LABELS comment: the icon set is imported now, not declared below --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> * fix(config): allow an empty gallery, guard against a double /api suffix (#421) An empty gallery is now a valid, rendered state instead of a throw: deriveGallery() no longer requires at least one album or subpage, so a deployment with no albums yet renders a bare homepage the owner can fill in via /admin. getConfig() also stops appending /api to an Immich URL that already ends in it, which previously produced .../api/api and broke every upstream request. Includes a restore of the per-album sort test cases, which the branch had lost by being cut before #408/#414. * feat(admin): favicon upload, served from the content volume (#422) Adds a bundled default favicon, an upload widget in admin Settings > General, and a route that serves the icon from the writable content/ volume with a fallback to the bundled default. Raster uploads (PNG/ICO/JPEG) are wrapped in an SVG container; the response carries its own CSP so an uploaded SVG cannot execute script on the origin. The GET route revalidates with an ETag instead of caching immutably, so a newly uploaded icon shows up immediately. Uploads are written via temp file + rename, and a Reset button restores the bundled default. * ci: flag unformatted files in a PR, without blocking it (#424) Prettier is configured as an error rule in eslint.config.mjs but has never run in CI, so part of the tree predates it. A final CI step now diffs against the PR base, runs prettier --list-different over the changed files, and emits a warning annotation per offender plus a job summary. Advisory by design: it never fails the job. Blocking would turn a PR red for merely touching a file that was already unformatted, and normalising the tree in one commit would wreck git blame and conflict with the PRs in flight. Requires fetch-depth: 0, since diffing against the base needs its history. * feat(install): first-run wizard gated by a one-time setup token (#419) Adds /install, a four-step first-run wizard: connect to Immich, optionally pick albums, name the site, finish. It verifies the credentials against the Immich server before writing anything, then writes gallery.yaml, settings.yaml and a content/install.json carrying the Immich credentials and a generated site secret. install.json exists because a running process cannot pick up new env vars — the wizard has to write configuration that takes effect without a restart. getInstallCredentials() merges it under the real environment, so env vars always win and rotation stays a matter of setting one. Both the page and the API routes are gated by a one-time setup token printed to the server log, so a deployment that is reachable before gallery.yaml exists cannot be configured by whoever finds it first. The token is stored in content/.setup-token (0600) rather than a module variable: Next.js bundles the page and each route handler separately, so a module-level token left the page and the API disagreeing inside one process and the wizard stuck on step 1. It is removed once the install completes. The admin password is stored as an scrypt hash using the scheme lib/auth.ts already applies to album passwords; a plaintext ADMIN_PASSWORD env var keeps working. * docs: document the setup wizard, fix the read-only content mount (#425) Quick Start now leads with the /install wizard, with the hand-written YAML route kept alongside it, and a First-Run Setup section covers the setup token, the files the wizard writes, and env-var precedence. Two corrections: both Docker examples mounted content/ as :ro, which silently breaks the wizard, the admin panel and the backup rotation alike — docs/admin-panel.md already said so and the README contradicted it. And nothing documented that content/install.json holds the Immich API key, so a backup of content/ is a backup of credentials. Also adds a Contributors section crediting the people whose work is in the project. * feat(admin): floating save bar pinned to the bottom of the viewport (#426) The save bar was the first, static element inside .admin-main. Since the document itself scrolls, it left the viewport as soon as you scrolled down — editing a subpage section or a settings block far below gave no visible dirty hint and no reachable save button. Replace it with a bottom-pinned floating bar shared by both editors. It only mounts while there is something to act on (unsaved changes, an in-flight save, or a result message), so it never covers content while idle. The success message clears after 5s, which hides the bar again. - new SaveBar component, replacing the duplicated markup in PageBuilder and SettingsEditor - adopt the previously unused .floating-save-bar CSS: slide-in keyframes (carrying translateX(-50%)), dirty border, wrap/gap, mobile variant and a prefers-reduced-motion opt-out; z-index 900 keeps it below modals - .admin-main gains bottom padding so the bar never covers page content - drop the now-unreachable idle hints: the ⌘S hint becomes a button title, the Live Sync note becomes a static line above the settings layout - header "Site" link now bypasses the cache (/?fresh=1), so the preview stays reachable when the bar is hidden Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(admin): themed listbox for the album sort control (#427) The per-album "Photo order" control was a native <select>. Because an <option> cannot contain markup, its choices could not use the admin panel's currentColor SVG set — the reason #415 had to fall back to plain text after dropping the emoji labels. Adds a Listbox component implementing the ARIA combobox/listbox pattern, so options can render a glyph beside their label: - DOM focus stays on the trigger button; the active option is announced through aria-activedescendant, keeping focus management to one element - Keyboard: arrows (clamped at the ends, like a native select), Home/End, Enter/Space to commit, Escape to cancel, Tab commits and moves on, and prefix type-ahead with a repeat-key cycle - Outside dismissal on pointerdown, so a press starting outside closes the popup before the click retargets The sort options now carry an icon each: calendar, arrow-down, arrow-up, an A→Z marker, and the drag glyph for manual — matching the badge the album card already shows. SORT_LABELS stays plain text because the badge feeds it to a title attribute. Closes #417 Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(git): ignore generated design handoff folders * fix(admin): stop the album sort dropdown clipping, and simplify the panel (#428) * fix(admin): render listbox popup in a portal so it escapes modal clipping The sort control's popup was position:absolute inside three clipping ancestors (.album-drawer overflow:hidden > .album-drawer-body overflow-y:auto > .modal-right-column overflow-y:auto), so it was cut off at the bottom of the Edit Album Details modal. z-index could not help: clipping happens before stacking. It also always hung below the trigger, with no flip. Portal the popup to document.body and position it from the trigger's viewport rect, flipping above when there is more room there and capping max-height to the space available so it scrolls internally rather than overflowing. It is dismissed on scroll and resize, since the anchor is only measured on open. The outside-pointerdown handler now also treats the popup as inside; without that the portalled list counts as outside, and a click on an option would close it before the selection commits. * refactor(admin): single-column album details panel The left column spent 1.2fr on a cover thumbnail and three stat rows, two of which (Status, Custom Hero) only restated the form fields opposite them, while the form itself was squeezed into 1.8fr behind a second nested scroller. Stack the drawer in one column instead: cover as a banner, then the form at full width, with the UUID moved into the footer. The body is now the only scroll container, which also removes one of the ancestors that was clipping the sort popup. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> * fix(admin): give the portalled listbox its theme back, lock the page behind modals (#429) Two defects in the album editor. The sort listbox popup painted transparent. Every --admin-* variable is scoped to .admin-layout, and since the popup moved into document.body it sits outside that subtree, so background/border/text all resolved to nothing. It now carries its own copy of the palette in both colour schemes, plus the font it no longer inherits. Scrolling inside a modal also moved the page behind it. No admin modal ever locked body scroll: the overlay covers the page but does not absorb wheel events, so a scroll starting on the backdrop — or continuing past the end of the modal's own scroller — reaches the document. overscroll-behavior cannot cover that case on its own, because it only applies to scroll containers and the backdrop is not one. useScrollLock freezes body while a modal is open and compensates for the width the scrollbar gives up, so nothing shifts underneath. Each lock restores the inline value it found, which makes nesting work without a counter — a picker opened from the drawer restores the drawer's hidden state instead of clearing it. Applied to both drawers and all four picker modals, which share the defect. overscroll-behavior: contain on the scrollers stops the chaining they can handle themselves. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com> * fix(security): allow unsafe-eval in CSP script-src during dev mode * feat(journal): add Journal Studio with split-screen editor, live preview and dedicated routes * fix(build): separate client parser from server journal-service and fix build type errors * fix(journal): Fotos rendern, Layout und Lightbox-Steuerung korrigieren Fünf unabhängige Fehler in der öffentlichen Journal- und Essay-Ansicht: * Foto-Blöcke wurden nie angezeigt. EssayView löst ein Foto über PhotoItem.id auf, und das sind verschlüsselte Tokens — die Blöcke aus dem Markdown tragen aber rohe Asset-UUIDs. Jede Zuordnung lief ins Leere, und nicht auflösbare Blöcke werden still verworfen. Die IDs werden jetzt serverseitig übersetzt; damit verschwinden nebenbei die rohen UUIDs aus dem Client-Payload, die dort laut Projektregel nie auftauchen dürfen. Nicht auflösbare Referenzen werden geloggt. * Überschriften standen weiter links als der Fließtext. Jeder Block hatte einzeln `max-width: 68ch`, und `ch` ist relativ zur Schrift des Elements — die Serif-Überschrift ergab eine breitere Spalte. Ersetzt durch eine gemeinsame, font-unabhängige `--essay-measure`. * Fullbleed-Fotos bluteten nur nach links aus: `.essay-figure` ist `width: 100%`, wodurch die Box überbestimmt ist und der negative rechte Margin verworfen wird. * Foto-Paare stellten beide Bilder gleich breit dar, wodurch ein Hochformat neben einem Querformat doppelt so hoch wurde. Jetzt eine Justified-Reihe: Breite proportional zum Seitenverhältnis, dadurch exakt gleiche Höhen ohne Beschnitt. * Die Lightbox hatte im Journal keine Tastatursteuerung und keine Scroll-Sperre — beides lag in PhotoGrid, also nur im Album-Raster. Verlagert in die Lightbox selbst, der doppelte Handler in PhotoGrid entfernt (sonst wäre pro Pfeildruck zwei Bilder weitergesprungen). Zusätzlich sind Proofing-Herzen und das EXIF-Panel im redaktionellen Modus abschaltbar und im Journal aus: Client-Proofing ist ein Übergabe-Workflow für Alben, keine Funktion einer Reportage. Auf der Übersicht wurde der Untertitel doppelt gerendert, weil extractExcerpt() auf ihn zurückfällt. * feat(admin): eigene URLs für alle Bereiche und überarbeiteter Journal Studio Das Panel war eine einzige Client-Komponente, die ihre Tabs über useState umschaltet: keine Route pro Bereich, kein Deep-Link, kein Zurück-Button, und nach jedem Reload landete man wieder auf "Pages". Auch der Journal-Editor hatte keine eigene URL. Jetzt sieben echte Routen (/admin, /admin/pages, /admin/journal, /admin/journal/<slug>, /admin/settings, /admin/settings/<section>, /admin/analytics). Die Shell mit Auth-Prüfung und Kopfzeile sitzt im Layout und umschließt children — so bleibt die Session-Prüfung über Routenwechsel montiert, statt bei jedem Tab-Wechsel neu zu laufen und den Spinner aufblitzen zu lassen. Unbekannte Settings-Sections fallen auf General zurück. Im selben Zug der Journal Studio, der die Routing-Änderung ohnehin berührt: * Alle Eingabefelder nutzten die Klasse `admin-input`, die in keinem CSS definiert war — sie fielen auf Browser-Defaults zurück. Jetzt gestylt, gescoped, damit der generische Name nicht ins übrige Panel leckt. * Der Split View ist per Divider verschiebbar (Maus, Tastatur, Doppelklick zum Zurücksetzen), Breite in localStorage. * Das Studio bricht aus der 1120px-Spalte aus, die Preview hat Platz. * Die Preview zeigte für jedes Foto fest 3:2 und log damit über das Layout der veröffentlichten Seite; die echten Verhältnisse werden jetzt an den Thumbnails gemessen. * Blöcke mit alten positionsbasierten Foto-Referenzen werden markiert — die lassen sich auf einer eigenständigen Journal-Seite nicht auflösen und verschwanden bisher stillschweigend. * Blocktyp-Chips als gemeinsame Komponente, monochrom und per Icon unterschieden statt in einer eigenen Blau/Lila/Orange-Palette, die sonst nirgends im Panel vorkommt. * Emojis raus, SVG-Icons rein. * fix(admin): Designsystem-Lücken im Panel schließen Eine systematische Suche nach Klassen, die im TSX benutzt, aber in keinem CSS definiert sind, hat vier Stellen mit demselben Muster gefunden: * `admin-btn-secondary` und `admin-btn-danger` existierten nicht. Sämtliche Löschen-Buttons sahen aus wie normale Buttons — keine Warnwirkung. Als `.admin-btn.admin-btn-danger` geschrieben, weil die Varianten mit den Größenklassen kombiniert werden, die weiter unten ihren eigenen Hintergrund setzen. * `page-progress-fill` fehlte: die Balken im Analytics-Panel waren leere Rinnen, der Wert unsichtbar. Ebenso `analytics-empty` und `admin-loading-container`. * `subpage-drawer-section`, `subpage-drawer-title-group` und `input-with-icon` im PageBuilder waren wirkungslos und teils mit Inline-Styles notdürftig kompensiert. * `grid-card-preview` fehlte, wodurch alle Layout-Vorschauen auf Höhe null kollabierten. Nur "Showcase" war sichtbar — und das aus Versehen, weil sein Tile `hero-tile` hieß und damit die `aspect-ratio` einer fremden PageBuilder-Klasse erbte. Umbenannt. Dazu die Theme-Vorschauen, die praktisch identisch aussahen: alle sieben zeigten dieselben drei quadratischen Kacheln, einziger Unterschied war die Hintergrundfarbe. Sie spiegeln jetzt die echten Preset-Daten aus lib/config/theme.ts — Schriftcharakter, Eckradius, Rasterdichte, Passepartout bzw. Schatten. Die Kopfzeile richtet sich an einer gemeinsamen Steuerhöhe aus. Der "Site"-Link war höher als die Buttons daneben: `.admin-btn` hatte keine explizite line-height, und <button> bekommt box-sizing: border-box vom Browser, <a> nicht. Die Statusanzeige setzte weder Schriftfamilie noch -größe und fiel auf den Browser-Default zurück — sie war nie Teil des Designsystems. Jetzt gleiche Höhe und Typografie, Pillenform als Zustandsanzeige, Trenner zur Aktionsgruppe. Das dauerhafte Pulsieren des grünen Punkts entfällt; Animation bleibt den Zuständen vorbehalten, die Aufmerksamkeit brauchen. Restliche Emojis durch SVG-Icons ersetzt. * feat(admin): add scroll-to-top toggle and SVG arrow The back-to-top button was always on and drew its arrow with the ↑ text character. Add a `scrollToTop` setting (General section in the admin panel, defaults to on so existing sites are unaffected) and replace the glyph with a stroked SVG that inherits currentColor across all presets. Scroll handling is now rAF-throttled, and prefers-reduced-motion turns off both the hover lift and the smooth scroll. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * security(journal): escape author HTML instead of filtering it CodeQL flags 26 high-severity alerts on the release PR; the bulk of them point at sanitizeHtml(), a denylist of three regexes whose output goes into dangerouslySetInnerHTML. I reproduced the bypasses before changing anything — all four pass the old filter: <img src=x onerror=alert(1)> unquoted handler, regex wants quotes <img src=x onerror='alert(1)'> single quotes, same reason <svg onload=alert(1)> not a <script> tag javasjavascript:cript:alert(1) one-pass replace, the rest recombines Plus an attribute breakout in the link renderer, which interpolated the URL into href="${url}" unescaped: [x](" onmouseover=alert(1) x=") -> <a href="" onmouseover=alert(1" ...> Replaced with escaping. Every `&<>"'` in author text becomes an entity before any markdown rule runs, so the only tags in the output are the ones renderInlineMarkdown builds itself and a URL cannot leave its attribute. Link schemes are now an allowlist (http, https, mailto, tel, relative, anchor); anything else renders as plain text. The serializer needed decodeHtmlEntities to match: without it a save would write `&lt;` into the Markdown file and the next parse would escape the `&` again, corrupting the text further on every round trip. A test covers parse -> serialize -> parse stability. Two existing tests asserted the old behaviour and were rewritten rather than deleted: one expected the script tag to be *removed* from the output, the other expected the substring "onerror" to be absent. Both now assert the property that matters — that no tag can form — because `onerror` surviving as inert text is fine. Exploitation required admin access either way: journal and essay text comes from the studio or from content/*.md. This removes the weakness, it does not close an open door. * fix(journal): contain file paths, fix frontmatter escaping, defuse two regexes Follow-up to the CodeQL findings on release PR #432. I went through all 23 alerts individually; this addresses the ones that are worth addressing and documents the ones that are not. Path containment (12 alerts, all false positives). Every path built from a slug goes through isValidSlug(), a strict `/^[a-zA-Z0-9_-]+$/` allowlist — verified against `../../etc/passwd`, `foo/../../bar`, `a/b`, `..` and friends, all rejected. CodeQL cannot see it because the check lives in another module. Added a containedPath() helper that resolves the path and refuses anything landing outside the content directory: a second lock on a door that was already locked, and a barrier the analysis can follow. Also removed the dead `slug.endsWith('.md')` branches — isValidSlug rejects dots, so they could never be taken. Frontmatter escaping (1 alert, a real bug). The serializer escaped `"` but not `\`, and the parser never unescaped anything. A title containing either character gained a backslash on every save/load cycle: Path C:\Users "quoted" -> Path C:\\Users \"quoted\" -> ... Escaping now covers the backslash first and the parser undoes both. A round trip test covers quotes, backslashes, colons and apostrophes. Two of three ReDoS regexes (2 alerts). The heading pattern had `\s+` next to `(.+)`, which overlap, so the engine tried every split of the whitespace run before failing; it is `[ \t]+` and `(\S.*)` now. The quote author pattern wrapped a lazy group around an optional group — the quadratic case — and is an index split on the first separator now. The third regex, the bold/italic pass, is deliberately left alone. Rewriting it with a negated class removes the backtracking but breaks nesting: `**bold *and italic* here**` renders as `*<em>bold </em>and italic<em> here</em>*`. The input is Markdown from an authenticated admin, never a visitor, so the worst case is an author slowing down their own page. The comment in the code says so. Not addressed: 5 js/insufficient-password-hash alerts. They ask for a slow KDF where the code uses SHA-256/HMAC — correct in general, but the admin password comes from an environment variable and is never stored, so a stronger KDF protects nothing that is not already in plaintext in the environment. 399 unit tests pass (18 new), build and tsc clean. * fix(journal): split the quote author by scanning, not by pattern Cleaning up after myself. #439 replaced the quote author regex `/^(.*?)(?:\s+--\s+(.+))?$/` — a lazy group around an optional one, the quadratic case — with `/\s+--\s+/`, and CodeQL promptly flagged the replacement for the same reason. One reported pattern traded for another. splitQuoteAuthor() scans for the first `--` that has whitespace on both sides. Linear, and it needs no reasoning about the regex engine at all. Behaviour is identical to the original regex, checked case by case against it: separator, no separator, several separators, tabs, wide gaps, `a--b` without spaces, leading and trailing separators, empty string. All nine are covered by tests, plus one asserting it stays fast on a 50k whitespace run. * security(admin): derive the session signing key with scrypt getSigningKey() ran the admin password through a single SHA-256 digest. It is key derivation rather than password storage, so it was never a stored-hash problem — but if the derived key ever leaked, one fast hash makes recovering the password by brute force cheap. CodeQL flags it as js/insufficient-password-hash and, for this particular alert, has a point. scrypt now. Two details that matter: The salt has to be stable. A random salt would produce a different key on every call and invalidate every session; it is derived from AUTH_SECRET, which is deployment-specific. Verified across separate processes: same inputs produce a verifying token, so a restart or redeploy does not log everyone out. The result is cached for the process lifetime. scrypt is deliberately slow and getSigningKey() runs on every admin request — deriving per call would add ~24ms to each one. The cache key is a digest of secret plus password, so a rotation misses the cache and derives again, and no extra plaintext copy of the password is kept around. Measured: first derivation 24ms, subsequent calls 0.12ms. Password change and secret change both invalidate an existing token, checked in separate processes. Note the one-time effect: existing admin sessions are invalidated by the change in derivation, so everyone logs in once more. * security(admin): key the signing-key cache on its inputs, not a digest #441 removed the SHA-256 digest of the admin password from the key derivation and introduced a new one three lines above it, as the cache key. Same rule, same file: CodeQL reported it immediately. The comment justifying it was wrong too. It claimed no second plaintext copy of the password was retained, while building the digest input allocates exactly that in order to hash it. The cache now holds the two input strings and compares them directly. They are the same objects the env and install caches already hold, so nothing extra is retained, and no fast hash of the password exists in memory for the life of the process. Re-verified after the change, in separate processes: a token from one process verifies in another with the same inputs, a changed password or secret rejects it, first derivation 24ms, cached calls 0.001ms. That leaves scrypt as the only place the password is hashed here. The two HMACs further down operate on the derived key and on token data, not on the password; the constant-time comparison in verifyAdminPassword is the previously dismissed one. --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
2026-08-14 16:55:07 +02:00
min-height: 0;
feat(admin): visual theme cards, album search, and status dashboard (#241) * feat(admin): implement visual theme cards, album search, and system status diagnostics * fix(admin): resolve type-checking build errors in SettingsEditor and status route --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-05-31 21:17:52 +02:00
display: grid;
grid-template-columns: repeat(3, 1fr);
release: v0.11.0 — journal fixes, admin URLs, design system cleanup (#432) * fix(screenshots): sharp-Typen fuer 0.34 und 0.35 gleichzeitig (#410) sharp 0.35 ist von `export =` auf ESM umgestellt: der Modul-Namespace ist nicht mehr aufrufbar, die Factory sitzt unter .default. Der Type-Check brach damit in scripts/screenshots.ts weg, sobald der Next-Bump (#402) sharp von 0.34.5 auf 0.35.3 mitzieht -- sharp ist hier keine deklarierte Dependency, sondern kommt ueber Next mit. Die Form wird jetzt aus dem installierten Paket abgeleitet statt festgeschrieben, zur Laufzeit wie im Typ. Geprueft mit beiden Versionen: tsc laeuft mit 0.34.5 und mit 0.35.3 fehlerfrei durch. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(deps): bump the nextjs group across 1 directory with 2 updates (#402) Bumps the nextjs group with 2 updates in the / directory: [next](https://github.com/vercel/next.js) and [eslint-config-next](https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next). Updates `next` from 16.2.12 to 16.3.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/compare/v16.2.12...v16.3.0) Updates `eslint-config-next` from 16.2.12 to 16.3.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/commits/v16.3.0/packages/eslint-config-next) --- updated-dependencies: - dependency-name: eslint-config-next dependency-version: 16.3.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: nextjs - dependency-name: next dependency-version: 16.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nextjs ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps-dev): bump prettier from 3.8.3 to 3.9.6 (#405) Bumps [prettier](https://github.com/prettier/prettier) from 3.8.3 to 3.9.6. - [Release notes](https://github.com/prettier/prettier/releases) - [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md) - [Commits](https://github.com/prettier/prettier/compare/3.8.3...3.9.6) --- updated-dependencies: - dependency-name: prettier dependency-version: 3.9.6 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * docs(changelog): Unreleased-Sektion fuer die Bumps nach v0.10.0 (#413) Die Dependency-PRs sind nach dem Release auf dev gelandet, teils auch auf main. Ohne Eintrag waeren sie beim naechsten Release unsichtbar -- inklusive Next 16.3.0, das CVE-2025-13465 mitbringt. Ausserdem im 0.10.0-Abschnitt nachgetragen, dass der Trivy-Scan bis #409 nie gelaufen ist. Der Fix steckt im Tag v0.10.0, fehlte aber in der Aufzaehlung -- und "Images werden bei jedem Publish gescannt" stand im Changelog, waehrend der Job im Action-Setup abbrach. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(gallery): per-album sort order, independent of Immich (#408) (#414) Album order was dictated entirely by Immich: getAlbum() sorted by the album's own asc/desc flag, so a Folio album always mirrored the archive. A curated series has a narrative order that has nothing to do with capture time, and changing the Immich album's sort to fit the website changes it for the archive too. Adds an optional per-album `sort` in gallery.yaml, editable in /admin, defaulting to today's behaviour so every existing config is unchanged: immich (default) | newest | oldest | filename | manual `manual` is a pinned *prefix*: `assetOrder` lists only the photos placed by hand, everything else follows in the album's Immich order. A full permutation of a 2,000-photo album would be ~80 KB of UUIDs in a file that is rewritten and copied to content/.backups/ on every admin save. It also makes drift fall out for free — photos removed in Immich never match, new ones land in the tail rather than being hidden. Sorting is applied after the cache read, not before the cache write, so the LRU keeps one canonical Immich-ordered copy per album. That avoids putting the mode in the cache key, lets a config change take effect without depending on invalidation, and keeps the stale-serving path correct. cache.get() returns the stored object by reference, so withSort() returns a shallow clone with a new array — sorting in place would reorder the shared entry, and under request coalescing every concurrent caller would be sorting the same array. Also fixes a prerequisite bug: /api/admin/albums/[albumId]/assets read album.assets from GET /albums/:id, which Immich 3.x no longer populates (lib/immich.ts:507). The hero picker's "This Album" tab returned nothing and threw outright when the key was absent. It now goes through the client's paginated metadata search, with ?types=all to opt videos in for the reorder editor. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): drop decorative emoji from the sort select labels (#415) An <option> cannot contain markup, so the SVG set in Icons is not reachable there — but a decorative emoji is not a substitute for it. Plain text instead; the album card badge already uses a real icon. The remaining emoji in the admin panel (asset picker tabs, section headings, layout picker options) predate this branch and are left for a separate cleanup. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): replace emoji icons with the shared SVG icon set (#416) The admin panel mixed two icon conventions: inline SVGs from `Icons.tsx` in most components, and decorative emoji in the asset picker and a few PageBuilder labels. Emoji render inconsistently across platforms, ignore the accent colour, and cannot inherit the `.svg-icon` sizing rules. - Icons.tsx: add `IconStar` (filled — it marks a state, not an action) and `IconImage`. - AssetPicker: the three tab labels and the favourite tile badge now use IconFolder / IconStar / IconImage. - PageBuilder: the "Standalone Albums" and "Subpages" headings use the icon set instead of an emoji. - PageBuilder: the layout picker drops its emoji for plain text. An <option> cannot contain markup, so an SVG is impossible there and a decorative glyph is not a substitute. - admin.css: align icon and label in the picker tabs, and swap the favourite badge's text-shadow for drop-shadow, which is what applies to an inline SVG. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): fold PageBuilder's local icons into the shared Icons module (#418) * refactor(admin): fold PageBuilder's local icons into the shared module PageBuilder.tsx carried its own `Icons` object duplicating most of the glyphs already exported by Icons.tsx, with hardcoded sizes and slightly divergent paths. Migrate all 32 call sites to the shared module and delete the local object. Five glyphs had no counterpart and are added to Icons.tsx as 1:1 ports of the local paths: IconX, IconPlus, IconHome, IconCopy, IconImage. The local ExternalLink and Check are dropped rather than ported — both had zero call sites. Two glyphs change shape slightly, which is the point of consolidating: the shared IconCamera includes the viewfinder bump the local copy omitted, and drag handles now use IconGripVertical. IconGripVertical uses the module's square 24x24 viewBox, so `.svg-drag` goes from 12x18 to 18x18 — the old non-square box would letterbox the glyph down to 12x12 and shrink the handle. * fix(admin): resolve icon-module integration after #416 Merging dev brought in #416, which added a second IconImage to Icons.tsx and two <Icons.Camera>/<Icons.Folder> section headers that reference the local Icons object this PR removes. Git merged both cleanly but the result did not type-check. - drop the duplicate IconImage (both copies were byte-identical) - point the two section headers at the imported IconCamera/IconFolder - refresh the SORT_LABELS comment: the icon set is imported now, not declared below --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> * fix(config): allow an empty gallery, guard against a double /api suffix (#421) An empty gallery is now a valid, rendered state instead of a throw: deriveGallery() no longer requires at least one album or subpage, so a deployment with no albums yet renders a bare homepage the owner can fill in via /admin. getConfig() also stops appending /api to an Immich URL that already ends in it, which previously produced .../api/api and broke every upstream request. Includes a restore of the per-album sort test cases, which the branch had lost by being cut before #408/#414. * feat(admin): favicon upload, served from the content volume (#422) Adds a bundled default favicon, an upload widget in admin Settings > General, and a route that serves the icon from the writable content/ volume with a fallback to the bundled default. Raster uploads (PNG/ICO/JPEG) are wrapped in an SVG container; the response carries its own CSP so an uploaded SVG cannot execute script on the origin. The GET route revalidates with an ETag instead of caching immutably, so a newly uploaded icon shows up immediately. Uploads are written via temp file + rename, and a Reset button restores the bundled default. * ci: flag unformatted files in a PR, without blocking it (#424) Prettier is configured as an error rule in eslint.config.mjs but has never run in CI, so part of the tree predates it. A final CI step now diffs against the PR base, runs prettier --list-different over the changed files, and emits a warning annotation per offender plus a job summary. Advisory by design: it never fails the job. Blocking would turn a PR red for merely touching a file that was already unformatted, and normalising the tree in one commit would wreck git blame and conflict with the PRs in flight. Requires fetch-depth: 0, since diffing against the base needs its history. * feat(install): first-run wizard gated by a one-time setup token (#419) Adds /install, a four-step first-run wizard: connect to Immich, optionally pick albums, name the site, finish. It verifies the credentials against the Immich server before writing anything, then writes gallery.yaml, settings.yaml and a content/install.json carrying the Immich credentials and a generated site secret. install.json exists because a running process cannot pick up new env vars — the wizard has to write configuration that takes effect without a restart. getInstallCredentials() merges it under the real environment, so env vars always win and rotation stays a matter of setting one. Both the page and the API routes are gated by a one-time setup token printed to the server log, so a deployment that is reachable before gallery.yaml exists cannot be configured by whoever finds it first. The token is stored in content/.setup-token (0600) rather than a module variable: Next.js bundles the page and each route handler separately, so a module-level token left the page and the API disagreeing inside one process and the wizard stuck on step 1. It is removed once the install completes. The admin password is stored as an scrypt hash using the scheme lib/auth.ts already applies to album passwords; a plaintext ADMIN_PASSWORD env var keeps working. * docs: document the setup wizard, fix the read-only content mount (#425) Quick Start now leads with the /install wizard, with the hand-written YAML route kept alongside it, and a First-Run Setup section covers the setup token, the files the wizard writes, and env-var precedence. Two corrections: both Docker examples mounted content/ as :ro, which silently breaks the wizard, the admin panel and the backup rotation alike — docs/admin-panel.md already said so and the README contradicted it. And nothing documented that content/install.json holds the Immich API key, so a backup of content/ is a backup of credentials. Also adds a Contributors section crediting the people whose work is in the project. * feat(admin): floating save bar pinned to the bottom of the viewport (#426) The save bar was the first, static element inside .admin-main. Since the document itself scrolls, it left the viewport as soon as you scrolled down — editing a subpage section or a settings block far below gave no visible dirty hint and no reachable save button. Replace it with a bottom-pinned floating bar shared by both editors. It only mounts while there is something to act on (unsaved changes, an in-flight save, or a result message), so it never covers content while idle. The success message clears after 5s, which hides the bar again. - new SaveBar component, replacing the duplicated markup in PageBuilder and SettingsEditor - adopt the previously unused .floating-save-bar CSS: slide-in keyframes (carrying translateX(-50%)), dirty border, wrap/gap, mobile variant and a prefers-reduced-motion opt-out; z-index 900 keeps it below modals - .admin-main gains bottom padding so the bar never covers page content - drop the now-unreachable idle hints: the ⌘S hint becomes a button title, the Live Sync note becomes a static line above the settings layout - header "Site" link now bypasses the cache (/?fresh=1), so the preview stays reachable when the bar is hidden Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(admin): themed listbox for the album sort control (#427) The per-album "Photo order" control was a native <select>. Because an <option> cannot contain markup, its choices could not use the admin panel's currentColor SVG set — the reason #415 had to fall back to plain text after dropping the emoji labels. Adds a Listbox component implementing the ARIA combobox/listbox pattern, so options can render a glyph beside their label: - DOM focus stays on the trigger button; the active option is announced through aria-activedescendant, keeping focus management to one element - Keyboard: arrows (clamped at the ends, like a native select), Home/End, Enter/Space to commit, Escape to cancel, Tab commits and moves on, and prefix type-ahead with a repeat-key cycle - Outside dismissal on pointerdown, so a press starting outside closes the popup before the click retargets The sort options now carry an icon each: calendar, arrow-down, arrow-up, an A→Z marker, and the drag glyph for manual — matching the badge the album card already shows. SORT_LABELS stays plain text because the badge feeds it to a title attribute. Closes #417 Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(git): ignore generated design handoff folders * fix(admin): stop the album sort dropdown clipping, and simplify the panel (#428) * fix(admin): render listbox popup in a portal so it escapes modal clipping The sort control's popup was position:absolute inside three clipping ancestors (.album-drawer overflow:hidden > .album-drawer-body overflow-y:auto > .modal-right-column overflow-y:auto), so it was cut off at the bottom of the Edit Album Details modal. z-index could not help: clipping happens before stacking. It also always hung below the trigger, with no flip. Portal the popup to document.body and position it from the trigger's viewport rect, flipping above when there is more room there and capping max-height to the space available so it scrolls internally rather than overflowing. It is dismissed on scroll and resize, since the anchor is only measured on open. The outside-pointerdown handler now also treats the popup as inside; without that the portalled list counts as outside, and a click on an option would close it before the selection commits. * refactor(admin): single-column album details panel The left column spent 1.2fr on a cover thumbnail and three stat rows, two of which (Status, Custom Hero) only restated the form fields opposite them, while the form itself was squeezed into 1.8fr behind a second nested scroller. Stack the drawer in one column instead: cover as a banner, then the form at full width, with the UUID moved into the footer. The body is now the only scroll container, which also removes one of the ancestors that was clipping the sort popup. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> * fix(admin): give the portalled listbox its theme back, lock the page behind modals (#429) Two defects in the album editor. The sort listbox popup painted transparent. Every --admin-* variable is scoped to .admin-layout, and since the popup moved into document.body it sits outside that subtree, so background/border/text all resolved to nothing. It now carries its own copy of the palette in both colour schemes, plus the font it no longer inherits. Scrolling inside a modal also moved the page behind it. No admin modal ever locked body scroll: the overlay covers the page but does not absorb wheel events, so a scroll starting on the backdrop — or continuing past the end of the modal's own scroller — reaches the document. overscroll-behavior cannot cover that case on its own, because it only applies to scroll containers and the backdrop is not one. useScrollLock freezes body while a modal is open and compensates for the width the scrollbar gives up, so nothing shifts underneath. Each lock restores the inline value it found, which makes nesting work without a counter — a picker opened from the drawer restores the drawer's hidden state instead of clearing it. Applied to both drawers and all four picker modals, which share the defect. overscroll-behavior: contain on the scrollers stops the chaining they can handle themselves. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com> * fix(security): allow unsafe-eval in CSP script-src during dev mode * feat(journal): add Journal Studio with split-screen editor, live preview and dedicated routes * fix(build): separate client parser from server journal-service and fix build type errors * fix(journal): Fotos rendern, Layout und Lightbox-Steuerung korrigieren Fünf unabhängige Fehler in der öffentlichen Journal- und Essay-Ansicht: * Foto-Blöcke wurden nie angezeigt. EssayView löst ein Foto über PhotoItem.id auf, und das sind verschlüsselte Tokens — die Blöcke aus dem Markdown tragen aber rohe Asset-UUIDs. Jede Zuordnung lief ins Leere, und nicht auflösbare Blöcke werden still verworfen. Die IDs werden jetzt serverseitig übersetzt; damit verschwinden nebenbei die rohen UUIDs aus dem Client-Payload, die dort laut Projektregel nie auftauchen dürfen. Nicht auflösbare Referenzen werden geloggt. * Überschriften standen weiter links als der Fließtext. Jeder Block hatte einzeln `max-width: 68ch`, und `ch` ist relativ zur Schrift des Elements — die Serif-Überschrift ergab eine breitere Spalte. Ersetzt durch eine gemeinsame, font-unabhängige `--essay-measure`. * Fullbleed-Fotos bluteten nur nach links aus: `.essay-figure` ist `width: 100%`, wodurch die Box überbestimmt ist und der negative rechte Margin verworfen wird. * Foto-Paare stellten beide Bilder gleich breit dar, wodurch ein Hochformat neben einem Querformat doppelt so hoch wurde. Jetzt eine Justified-Reihe: Breite proportional zum Seitenverhältnis, dadurch exakt gleiche Höhen ohne Beschnitt. * Die Lightbox hatte im Journal keine Tastatursteuerung und keine Scroll-Sperre — beides lag in PhotoGrid, also nur im Album-Raster. Verlagert in die Lightbox selbst, der doppelte Handler in PhotoGrid entfernt (sonst wäre pro Pfeildruck zwei Bilder weitergesprungen). Zusätzlich sind Proofing-Herzen und das EXIF-Panel im redaktionellen Modus abschaltbar und im Journal aus: Client-Proofing ist ein Übergabe-Workflow für Alben, keine Funktion einer Reportage. Auf der Übersicht wurde der Untertitel doppelt gerendert, weil extractExcerpt() auf ihn zurückfällt. * feat(admin): eigene URLs für alle Bereiche und überarbeiteter Journal Studio Das Panel war eine einzige Client-Komponente, die ihre Tabs über useState umschaltet: keine Route pro Bereich, kein Deep-Link, kein Zurück-Button, und nach jedem Reload landete man wieder auf "Pages". Auch der Journal-Editor hatte keine eigene URL. Jetzt sieben echte Routen (/admin, /admin/pages, /admin/journal, /admin/journal/<slug>, /admin/settings, /admin/settings/<section>, /admin/analytics). Die Shell mit Auth-Prüfung und Kopfzeile sitzt im Layout und umschließt children — so bleibt die Session-Prüfung über Routenwechsel montiert, statt bei jedem Tab-Wechsel neu zu laufen und den Spinner aufblitzen zu lassen. Unbekannte Settings-Sections fallen auf General zurück. Im selben Zug der Journal Studio, der die Routing-Änderung ohnehin berührt: * Alle Eingabefelder nutzten die Klasse `admin-input`, die in keinem CSS definiert war — sie fielen auf Browser-Defaults zurück. Jetzt gestylt, gescoped, damit der generische Name nicht ins übrige Panel leckt. * Der Split View ist per Divider verschiebbar (Maus, Tastatur, Doppelklick zum Zurücksetzen), Breite in localStorage. * Das Studio bricht aus der 1120px-Spalte aus, die Preview hat Platz. * Die Preview zeigte für jedes Foto fest 3:2 und log damit über das Layout der veröffentlichten Seite; die echten Verhältnisse werden jetzt an den Thumbnails gemessen. * Blöcke mit alten positionsbasierten Foto-Referenzen werden markiert — die lassen sich auf einer eigenständigen Journal-Seite nicht auflösen und verschwanden bisher stillschweigend. * Blocktyp-Chips als gemeinsame Komponente, monochrom und per Icon unterschieden statt in einer eigenen Blau/Lila/Orange-Palette, die sonst nirgends im Panel vorkommt. * Emojis raus, SVG-Icons rein. * fix(admin): Designsystem-Lücken im Panel schließen Eine systematische Suche nach Klassen, die im TSX benutzt, aber in keinem CSS definiert sind, hat vier Stellen mit demselben Muster gefunden: * `admin-btn-secondary` und `admin-btn-danger` existierten nicht. Sämtliche Löschen-Buttons sahen aus wie normale Buttons — keine Warnwirkung. Als `.admin-btn.admin-btn-danger` geschrieben, weil die Varianten mit den Größenklassen kombiniert werden, die weiter unten ihren eigenen Hintergrund setzen. * `page-progress-fill` fehlte: die Balken im Analytics-Panel waren leere Rinnen, der Wert unsichtbar. Ebenso `analytics-empty` und `admin-loading-container`. * `subpage-drawer-section`, `subpage-drawer-title-group` und `input-with-icon` im PageBuilder waren wirkungslos und teils mit Inline-Styles notdürftig kompensiert. * `grid-card-preview` fehlte, wodurch alle Layout-Vorschauen auf Höhe null kollabierten. Nur "Showcase" war sichtbar — und das aus Versehen, weil sein Tile `hero-tile` hieß und damit die `aspect-ratio` einer fremden PageBuilder-Klasse erbte. Umbenannt. Dazu die Theme-Vorschauen, die praktisch identisch aussahen: alle sieben zeigten dieselben drei quadratischen Kacheln, einziger Unterschied war die Hintergrundfarbe. Sie spiegeln jetzt die echten Preset-Daten aus lib/config/theme.ts — Schriftcharakter, Eckradius, Rasterdichte, Passepartout bzw. Schatten. Die Kopfzeile richtet sich an einer gemeinsamen Steuerhöhe aus. Der "Site"-Link war höher als die Buttons daneben: `.admin-btn` hatte keine explizite line-height, und <button> bekommt box-sizing: border-box vom Browser, <a> nicht. Die Statusanzeige setzte weder Schriftfamilie noch -größe und fiel auf den Browser-Default zurück — sie war nie Teil des Designsystems. Jetzt gleiche Höhe und Typografie, Pillenform als Zustandsanzeige, Trenner zur Aktionsgruppe. Das dauerhafte Pulsieren des grünen Punkts entfällt; Animation bleibt den Zuständen vorbehalten, die Aufmerksamkeit brauchen. Restliche Emojis durch SVG-Icons ersetzt. * feat(admin): add scroll-to-top toggle and SVG arrow The back-to-top button was always on and drew its arrow with the ↑ text character. Add a `scrollToTop` setting (General section in the admin panel, defaults to on so existing sites are unaffected) and replace the glyph with a stroked SVG that inherits currentColor across all presets. Scroll handling is now rAF-throttled, and prefers-reduced-motion turns off both the hover lift and the smooth scroll. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * security(journal): escape author HTML instead of filtering it CodeQL flags 26 high-severity alerts on the release PR; the bulk of them point at sanitizeHtml(), a denylist of three regexes whose output goes into dangerouslySetInnerHTML. I reproduced the bypasses before changing anything — all four pass the old filter: <img src=x onerror=alert(1)> unquoted handler, regex wants quotes <img src=x onerror='alert(1)'> single quotes, same reason <svg onload=alert(1)> not a <script> tag javasjavascript:cript:alert(1) one-pass replace, the rest recombines Plus an attribute breakout in the link renderer, which interpolated the URL into href="${url}" unescaped: [x](" onmouseover=alert(1) x=") -> <a href="" onmouseover=alert(1" ...> Replaced with escaping. Every `&<>"'` in author text becomes an entity before any markdown rule runs, so the only tags in the output are the ones renderInlineMarkdown builds itself and a URL cannot leave its attribute. Link schemes are now an allowlist (http, https, mailto, tel, relative, anchor); anything else renders as plain text. The serializer needed decodeHtmlEntities to match: without it a save would write `&lt;` into the Markdown file and the next parse would escape the `&` again, corrupting the text further on every round trip. A test covers parse -> serialize -> parse stability. Two existing tests asserted the old behaviour and were rewritten rather than deleted: one expected the script tag to be *removed* from the output, the other expected the substring "onerror" to be absent. Both now assert the property that matters — that no tag can form — because `onerror` surviving as inert text is fine. Exploitation required admin access either way: journal and essay text comes from the studio or from content/*.md. This removes the weakness, it does not close an open door. * fix(journal): contain file paths, fix frontmatter escaping, defuse two regexes Follow-up to the CodeQL findings on release PR #432. I went through all 23 alerts individually; this addresses the ones that are worth addressing and documents the ones that are not. Path containment (12 alerts, all false positives). Every path built from a slug goes through isValidSlug(), a strict `/^[a-zA-Z0-9_-]+$/` allowlist — verified against `../../etc/passwd`, `foo/../../bar`, `a/b`, `..` and friends, all rejected. CodeQL cannot see it because the check lives in another module. Added a containedPath() helper that resolves the path and refuses anything landing outside the content directory: a second lock on a door that was already locked, and a barrier the analysis can follow. Also removed the dead `slug.endsWith('.md')` branches — isValidSlug rejects dots, so they could never be taken. Frontmatter escaping (1 alert, a real bug). The serializer escaped `"` but not `\`, and the parser never unescaped anything. A title containing either character gained a backslash on every save/load cycle: Path C:\Users "quoted" -> Path C:\\Users \"quoted\" -> ... Escaping now covers the backslash first and the parser undoes both. A round trip test covers quotes, backslashes, colons and apostrophes. Two of three ReDoS regexes (2 alerts). The heading pattern had `\s+` next to `(.+)`, which overlap, so the engine tried every split of the whitespace run before failing; it is `[ \t]+` and `(\S.*)` now. The quote author pattern wrapped a lazy group around an optional group — the quadratic case — and is an index split on the first separator now. The third regex, the bold/italic pass, is deliberately left alone. Rewriting it with a negated class removes the backtracking but breaks nesting: `**bold *and italic* here**` renders as `*<em>bold </em>and italic<em> here</em>*`. The input is Markdown from an authenticated admin, never a visitor, so the worst case is an author slowing down their own page. The comment in the code says so. Not addressed: 5 js/insufficient-password-hash alerts. They ask for a slow KDF where the code uses SHA-256/HMAC — correct in general, but the admin password comes from an environment variable and is never stored, so a stronger KDF protects nothing that is not already in plaintext in the environment. 399 unit tests pass (18 new), build and tsc clean. * fix(journal): split the quote author by scanning, not by pattern Cleaning up after myself. #439 replaced the quote author regex `/^(.*?)(?:\s+--\s+(.+))?$/` — a lazy group around an optional one, the quadratic case — with `/\s+--\s+/`, and CodeQL promptly flagged the replacement for the same reason. One reported pattern traded for another. splitQuoteAuthor() scans for the first `--` that has whitespace on both sides. Linear, and it needs no reasoning about the regex engine at all. Behaviour is identical to the original regex, checked case by case against it: separator, no separator, several separators, tabs, wide gaps, `a--b` without spaces, leading and trailing separators, empty string. All nine are covered by tests, plus one asserting it stays fast on a 50k whitespace run. * security(admin): derive the session signing key with scrypt getSigningKey() ran the admin password through a single SHA-256 digest. It is key derivation rather than password storage, so it was never a stored-hash problem — but if the derived key ever leaked, one fast hash makes recovering the password by brute force cheap. CodeQL flags it as js/insufficient-password-hash and, for this particular alert, has a point. scrypt now. Two details that matter: The salt has to be stable. A random salt would produce a different key on every call and invalidate every session; it is derived from AUTH_SECRET, which is deployment-specific. Verified across separate processes: same inputs produce a verifying token, so a restart or redeploy does not log everyone out. The result is cached for the process lifetime. scrypt is deliberately slow and getSigningKey() runs on every admin request — deriving per call would add ~24ms to each one. The cache key is a digest of secret plus password, so a rotation misses the cache and derives again, and no extra plaintext copy of the password is kept around. Measured: first derivation 24ms, subsequent calls 0.12ms. Password change and secret change both invalidate an existing token, checked in separate processes. Note the one-time effect: existing admin sessions are invalidated by the change in derivation, so everyone logs in once more. * security(admin): key the signing-key cache on its inputs, not a digest #441 removed the SHA-256 digest of the admin password from the key derivation and introduced a new one three lines above it, as the cache key. Same rule, same file: CodeQL reported it immediately. The comment justifying it was wrong too. It claimed no second plaintext copy of the password was retained, while building the digest input allocates exactly that in order to hash it. The cache now holds the two input strings and compares them directly. They are the same objects the env and install caches already hold, so nothing extra is retained, and no fast hash of the password exists in memory for the life of the process. Re-verified after the change, in separate processes: a token from one process verifies in another with the same inputs, a changed password or secret rejects it, first derivation 24ms, cached calls 0.001ms. That leaves scrypt as the only place the password is hashed here. The two HMACs further down operate on the derived key and on token data, not on the password; the constant-time comparison in verifyAdminPassword is the previously dismissed one. --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
2026-08-14 16:55:07 +02:00
gap: var(--preset-gap, 4px);
feat(admin): visual theme cards, album search, and status dashboard (#241) * feat(admin): implement visual theme cards, album search, and system status diagnostics * fix(admin): resolve type-checking build errors in SettingsEditor and status route --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-05-31 21:17:52 +02:00
}
.preset-card-preview .mini-tile {
release: v0.11.0 — journal fixes, admin URLs, design system cleanup (#432) * fix(screenshots): sharp-Typen fuer 0.34 und 0.35 gleichzeitig (#410) sharp 0.35 ist von `export =` auf ESM umgestellt: der Modul-Namespace ist nicht mehr aufrufbar, die Factory sitzt unter .default. Der Type-Check brach damit in scripts/screenshots.ts weg, sobald der Next-Bump (#402) sharp von 0.34.5 auf 0.35.3 mitzieht -- sharp ist hier keine deklarierte Dependency, sondern kommt ueber Next mit. Die Form wird jetzt aus dem installierten Paket abgeleitet statt festgeschrieben, zur Laufzeit wie im Typ. Geprueft mit beiden Versionen: tsc laeuft mit 0.34.5 und mit 0.35.3 fehlerfrei durch. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(deps): bump the nextjs group across 1 directory with 2 updates (#402) Bumps the nextjs group with 2 updates in the / directory: [next](https://github.com/vercel/next.js) and [eslint-config-next](https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next). Updates `next` from 16.2.12 to 16.3.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/compare/v16.2.12...v16.3.0) Updates `eslint-config-next` from 16.2.12 to 16.3.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/commits/v16.3.0/packages/eslint-config-next) --- updated-dependencies: - dependency-name: eslint-config-next dependency-version: 16.3.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: nextjs - dependency-name: next dependency-version: 16.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nextjs ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps-dev): bump prettier from 3.8.3 to 3.9.6 (#405) Bumps [prettier](https://github.com/prettier/prettier) from 3.8.3 to 3.9.6. - [Release notes](https://github.com/prettier/prettier/releases) - [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md) - [Commits](https://github.com/prettier/prettier/compare/3.8.3...3.9.6) --- updated-dependencies: - dependency-name: prettier dependency-version: 3.9.6 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * docs(changelog): Unreleased-Sektion fuer die Bumps nach v0.10.0 (#413) Die Dependency-PRs sind nach dem Release auf dev gelandet, teils auch auf main. Ohne Eintrag waeren sie beim naechsten Release unsichtbar -- inklusive Next 16.3.0, das CVE-2025-13465 mitbringt. Ausserdem im 0.10.0-Abschnitt nachgetragen, dass der Trivy-Scan bis #409 nie gelaufen ist. Der Fix steckt im Tag v0.10.0, fehlte aber in der Aufzaehlung -- und "Images werden bei jedem Publish gescannt" stand im Changelog, waehrend der Job im Action-Setup abbrach. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(gallery): per-album sort order, independent of Immich (#408) (#414) Album order was dictated entirely by Immich: getAlbum() sorted by the album's own asc/desc flag, so a Folio album always mirrored the archive. A curated series has a narrative order that has nothing to do with capture time, and changing the Immich album's sort to fit the website changes it for the archive too. Adds an optional per-album `sort` in gallery.yaml, editable in /admin, defaulting to today's behaviour so every existing config is unchanged: immich (default) | newest | oldest | filename | manual `manual` is a pinned *prefix*: `assetOrder` lists only the photos placed by hand, everything else follows in the album's Immich order. A full permutation of a 2,000-photo album would be ~80 KB of UUIDs in a file that is rewritten and copied to content/.backups/ on every admin save. It also makes drift fall out for free — photos removed in Immich never match, new ones land in the tail rather than being hidden. Sorting is applied after the cache read, not before the cache write, so the LRU keeps one canonical Immich-ordered copy per album. That avoids putting the mode in the cache key, lets a config change take effect without depending on invalidation, and keeps the stale-serving path correct. cache.get() returns the stored object by reference, so withSort() returns a shallow clone with a new array — sorting in place would reorder the shared entry, and under request coalescing every concurrent caller would be sorting the same array. Also fixes a prerequisite bug: /api/admin/albums/[albumId]/assets read album.assets from GET /albums/:id, which Immich 3.x no longer populates (lib/immich.ts:507). The hero picker's "This Album" tab returned nothing and threw outright when the key was absent. It now goes through the client's paginated metadata search, with ?types=all to opt videos in for the reorder editor. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): drop decorative emoji from the sort select labels (#415) An <option> cannot contain markup, so the SVG set in Icons is not reachable there — but a decorative emoji is not a substitute for it. Plain text instead; the album card badge already uses a real icon. The remaining emoji in the admin panel (asset picker tabs, section headings, layout picker options) predate this branch and are left for a separate cleanup. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): replace emoji icons with the shared SVG icon set (#416) The admin panel mixed two icon conventions: inline SVGs from `Icons.tsx` in most components, and decorative emoji in the asset picker and a few PageBuilder labels. Emoji render inconsistently across platforms, ignore the accent colour, and cannot inherit the `.svg-icon` sizing rules. - Icons.tsx: add `IconStar` (filled — it marks a state, not an action) and `IconImage`. - AssetPicker: the three tab labels and the favourite tile badge now use IconFolder / IconStar / IconImage. - PageBuilder: the "Standalone Albums" and "Subpages" headings use the icon set instead of an emoji. - PageBuilder: the layout picker drops its emoji for plain text. An <option> cannot contain markup, so an SVG is impossible there and a decorative glyph is not a substitute. - admin.css: align icon and label in the picker tabs, and swap the favourite badge's text-shadow for drop-shadow, which is what applies to an inline SVG. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): fold PageBuilder's local icons into the shared Icons module (#418) * refactor(admin): fold PageBuilder's local icons into the shared module PageBuilder.tsx carried its own `Icons` object duplicating most of the glyphs already exported by Icons.tsx, with hardcoded sizes and slightly divergent paths. Migrate all 32 call sites to the shared module and delete the local object. Five glyphs had no counterpart and are added to Icons.tsx as 1:1 ports of the local paths: IconX, IconPlus, IconHome, IconCopy, IconImage. The local ExternalLink and Check are dropped rather than ported — both had zero call sites. Two glyphs change shape slightly, which is the point of consolidating: the shared IconCamera includes the viewfinder bump the local copy omitted, and drag handles now use IconGripVertical. IconGripVertical uses the module's square 24x24 viewBox, so `.svg-drag` goes from 12x18 to 18x18 — the old non-square box would letterbox the glyph down to 12x12 and shrink the handle. * fix(admin): resolve icon-module integration after #416 Merging dev brought in #416, which added a second IconImage to Icons.tsx and two <Icons.Camera>/<Icons.Folder> section headers that reference the local Icons object this PR removes. Git merged both cleanly but the result did not type-check. - drop the duplicate IconImage (both copies were byte-identical) - point the two section headers at the imported IconCamera/IconFolder - refresh the SORT_LABELS comment: the icon set is imported now, not declared below --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> * fix(config): allow an empty gallery, guard against a double /api suffix (#421) An empty gallery is now a valid, rendered state instead of a throw: deriveGallery() no longer requires at least one album or subpage, so a deployment with no albums yet renders a bare homepage the owner can fill in via /admin. getConfig() also stops appending /api to an Immich URL that already ends in it, which previously produced .../api/api and broke every upstream request. Includes a restore of the per-album sort test cases, which the branch had lost by being cut before #408/#414. * feat(admin): favicon upload, served from the content volume (#422) Adds a bundled default favicon, an upload widget in admin Settings > General, and a route that serves the icon from the writable content/ volume with a fallback to the bundled default. Raster uploads (PNG/ICO/JPEG) are wrapped in an SVG container; the response carries its own CSP so an uploaded SVG cannot execute script on the origin. The GET route revalidates with an ETag instead of caching immutably, so a newly uploaded icon shows up immediately. Uploads are written via temp file + rename, and a Reset button restores the bundled default. * ci: flag unformatted files in a PR, without blocking it (#424) Prettier is configured as an error rule in eslint.config.mjs but has never run in CI, so part of the tree predates it. A final CI step now diffs against the PR base, runs prettier --list-different over the changed files, and emits a warning annotation per offender plus a job summary. Advisory by design: it never fails the job. Blocking would turn a PR red for merely touching a file that was already unformatted, and normalising the tree in one commit would wreck git blame and conflict with the PRs in flight. Requires fetch-depth: 0, since diffing against the base needs its history. * feat(install): first-run wizard gated by a one-time setup token (#419) Adds /install, a four-step first-run wizard: connect to Immich, optionally pick albums, name the site, finish. It verifies the credentials against the Immich server before writing anything, then writes gallery.yaml, settings.yaml and a content/install.json carrying the Immich credentials and a generated site secret. install.json exists because a running process cannot pick up new env vars — the wizard has to write configuration that takes effect without a restart. getInstallCredentials() merges it under the real environment, so env vars always win and rotation stays a matter of setting one. Both the page and the API routes are gated by a one-time setup token printed to the server log, so a deployment that is reachable before gallery.yaml exists cannot be configured by whoever finds it first. The token is stored in content/.setup-token (0600) rather than a module variable: Next.js bundles the page and each route handler separately, so a module-level token left the page and the API disagreeing inside one process and the wizard stuck on step 1. It is removed once the install completes. The admin password is stored as an scrypt hash using the scheme lib/auth.ts already applies to album passwords; a plaintext ADMIN_PASSWORD env var keeps working. * docs: document the setup wizard, fix the read-only content mount (#425) Quick Start now leads with the /install wizard, with the hand-written YAML route kept alongside it, and a First-Run Setup section covers the setup token, the files the wizard writes, and env-var precedence. Two corrections: both Docker examples mounted content/ as :ro, which silently breaks the wizard, the admin panel and the backup rotation alike — docs/admin-panel.md already said so and the README contradicted it. And nothing documented that content/install.json holds the Immich API key, so a backup of content/ is a backup of credentials. Also adds a Contributors section crediting the people whose work is in the project. * feat(admin): floating save bar pinned to the bottom of the viewport (#426) The save bar was the first, static element inside .admin-main. Since the document itself scrolls, it left the viewport as soon as you scrolled down — editing a subpage section or a settings block far below gave no visible dirty hint and no reachable save button. Replace it with a bottom-pinned floating bar shared by both editors. It only mounts while there is something to act on (unsaved changes, an in-flight save, or a result message), so it never covers content while idle. The success message clears after 5s, which hides the bar again. - new SaveBar component, replacing the duplicated markup in PageBuilder and SettingsEditor - adopt the previously unused .floating-save-bar CSS: slide-in keyframes (carrying translateX(-50%)), dirty border, wrap/gap, mobile variant and a prefers-reduced-motion opt-out; z-index 900 keeps it below modals - .admin-main gains bottom padding so the bar never covers page content - drop the now-unreachable idle hints: the ⌘S hint becomes a button title, the Live Sync note becomes a static line above the settings layout - header "Site" link now bypasses the cache (/?fresh=1), so the preview stays reachable when the bar is hidden Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(admin): themed listbox for the album sort control (#427) The per-album "Photo order" control was a native <select>. Because an <option> cannot contain markup, its choices could not use the admin panel's currentColor SVG set — the reason #415 had to fall back to plain text after dropping the emoji labels. Adds a Listbox component implementing the ARIA combobox/listbox pattern, so options can render a glyph beside their label: - DOM focus stays on the trigger button; the active option is announced through aria-activedescendant, keeping focus management to one element - Keyboard: arrows (clamped at the ends, like a native select), Home/End, Enter/Space to commit, Escape to cancel, Tab commits and moves on, and prefix type-ahead with a repeat-key cycle - Outside dismissal on pointerdown, so a press starting outside closes the popup before the click retargets The sort options now carry an icon each: calendar, arrow-down, arrow-up, an A→Z marker, and the drag glyph for manual — matching the badge the album card already shows. SORT_LABELS stays plain text because the badge feeds it to a title attribute. Closes #417 Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(git): ignore generated design handoff folders * fix(admin): stop the album sort dropdown clipping, and simplify the panel (#428) * fix(admin): render listbox popup in a portal so it escapes modal clipping The sort control's popup was position:absolute inside three clipping ancestors (.album-drawer overflow:hidden > .album-drawer-body overflow-y:auto > .modal-right-column overflow-y:auto), so it was cut off at the bottom of the Edit Album Details modal. z-index could not help: clipping happens before stacking. It also always hung below the trigger, with no flip. Portal the popup to document.body and position it from the trigger's viewport rect, flipping above when there is more room there and capping max-height to the space available so it scrolls internally rather than overflowing. It is dismissed on scroll and resize, since the anchor is only measured on open. The outside-pointerdown handler now also treats the popup as inside; without that the portalled list counts as outside, and a click on an option would close it before the selection commits. * refactor(admin): single-column album details panel The left column spent 1.2fr on a cover thumbnail and three stat rows, two of which (Status, Custom Hero) only restated the form fields opposite them, while the form itself was squeezed into 1.8fr behind a second nested scroller. Stack the drawer in one column instead: cover as a banner, then the form at full width, with the UUID moved into the footer. The body is now the only scroll container, which also removes one of the ancestors that was clipping the sort popup. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> * fix(admin): give the portalled listbox its theme back, lock the page behind modals (#429) Two defects in the album editor. The sort listbox popup painted transparent. Every --admin-* variable is scoped to .admin-layout, and since the popup moved into document.body it sits outside that subtree, so background/border/text all resolved to nothing. It now carries its own copy of the palette in both colour schemes, plus the font it no longer inherits. Scrolling inside a modal also moved the page behind it. No admin modal ever locked body scroll: the overlay covers the page but does not absorb wheel events, so a scroll starting on the backdrop — or continuing past the end of the modal's own scroller — reaches the document. overscroll-behavior cannot cover that case on its own, because it only applies to scroll containers and the backdrop is not one. useScrollLock freezes body while a modal is open and compensates for the width the scrollbar gives up, so nothing shifts underneath. Each lock restores the inline value it found, which makes nesting work without a counter — a picker opened from the drawer restores the drawer's hidden state instead of clearing it. Applied to both drawers and all four picker modals, which share the defect. overscroll-behavior: contain on the scrollers stops the chaining they can handle themselves. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com> * fix(security): allow unsafe-eval in CSP script-src during dev mode * feat(journal): add Journal Studio with split-screen editor, live preview and dedicated routes * fix(build): separate client parser from server journal-service and fix build type errors * fix(journal): Fotos rendern, Layout und Lightbox-Steuerung korrigieren Fünf unabhängige Fehler in der öffentlichen Journal- und Essay-Ansicht: * Foto-Blöcke wurden nie angezeigt. EssayView löst ein Foto über PhotoItem.id auf, und das sind verschlüsselte Tokens — die Blöcke aus dem Markdown tragen aber rohe Asset-UUIDs. Jede Zuordnung lief ins Leere, und nicht auflösbare Blöcke werden still verworfen. Die IDs werden jetzt serverseitig übersetzt; damit verschwinden nebenbei die rohen UUIDs aus dem Client-Payload, die dort laut Projektregel nie auftauchen dürfen. Nicht auflösbare Referenzen werden geloggt. * Überschriften standen weiter links als der Fließtext. Jeder Block hatte einzeln `max-width: 68ch`, und `ch` ist relativ zur Schrift des Elements — die Serif-Überschrift ergab eine breitere Spalte. Ersetzt durch eine gemeinsame, font-unabhängige `--essay-measure`. * Fullbleed-Fotos bluteten nur nach links aus: `.essay-figure` ist `width: 100%`, wodurch die Box überbestimmt ist und der negative rechte Margin verworfen wird. * Foto-Paare stellten beide Bilder gleich breit dar, wodurch ein Hochformat neben einem Querformat doppelt so hoch wurde. Jetzt eine Justified-Reihe: Breite proportional zum Seitenverhältnis, dadurch exakt gleiche Höhen ohne Beschnitt. * Die Lightbox hatte im Journal keine Tastatursteuerung und keine Scroll-Sperre — beides lag in PhotoGrid, also nur im Album-Raster. Verlagert in die Lightbox selbst, der doppelte Handler in PhotoGrid entfernt (sonst wäre pro Pfeildruck zwei Bilder weitergesprungen). Zusätzlich sind Proofing-Herzen und das EXIF-Panel im redaktionellen Modus abschaltbar und im Journal aus: Client-Proofing ist ein Übergabe-Workflow für Alben, keine Funktion einer Reportage. Auf der Übersicht wurde der Untertitel doppelt gerendert, weil extractExcerpt() auf ihn zurückfällt. * feat(admin): eigene URLs für alle Bereiche und überarbeiteter Journal Studio Das Panel war eine einzige Client-Komponente, die ihre Tabs über useState umschaltet: keine Route pro Bereich, kein Deep-Link, kein Zurück-Button, und nach jedem Reload landete man wieder auf "Pages". Auch der Journal-Editor hatte keine eigene URL. Jetzt sieben echte Routen (/admin, /admin/pages, /admin/journal, /admin/journal/<slug>, /admin/settings, /admin/settings/<section>, /admin/analytics). Die Shell mit Auth-Prüfung und Kopfzeile sitzt im Layout und umschließt children — so bleibt die Session-Prüfung über Routenwechsel montiert, statt bei jedem Tab-Wechsel neu zu laufen und den Spinner aufblitzen zu lassen. Unbekannte Settings-Sections fallen auf General zurück. Im selben Zug der Journal Studio, der die Routing-Änderung ohnehin berührt: * Alle Eingabefelder nutzten die Klasse `admin-input`, die in keinem CSS definiert war — sie fielen auf Browser-Defaults zurück. Jetzt gestylt, gescoped, damit der generische Name nicht ins übrige Panel leckt. * Der Split View ist per Divider verschiebbar (Maus, Tastatur, Doppelklick zum Zurücksetzen), Breite in localStorage. * Das Studio bricht aus der 1120px-Spalte aus, die Preview hat Platz. * Die Preview zeigte für jedes Foto fest 3:2 und log damit über das Layout der veröffentlichten Seite; die echten Verhältnisse werden jetzt an den Thumbnails gemessen. * Blöcke mit alten positionsbasierten Foto-Referenzen werden markiert — die lassen sich auf einer eigenständigen Journal-Seite nicht auflösen und verschwanden bisher stillschweigend. * Blocktyp-Chips als gemeinsame Komponente, monochrom und per Icon unterschieden statt in einer eigenen Blau/Lila/Orange-Palette, die sonst nirgends im Panel vorkommt. * Emojis raus, SVG-Icons rein. * fix(admin): Designsystem-Lücken im Panel schließen Eine systematische Suche nach Klassen, die im TSX benutzt, aber in keinem CSS definiert sind, hat vier Stellen mit demselben Muster gefunden: * `admin-btn-secondary` und `admin-btn-danger` existierten nicht. Sämtliche Löschen-Buttons sahen aus wie normale Buttons — keine Warnwirkung. Als `.admin-btn.admin-btn-danger` geschrieben, weil die Varianten mit den Größenklassen kombiniert werden, die weiter unten ihren eigenen Hintergrund setzen. * `page-progress-fill` fehlte: die Balken im Analytics-Panel waren leere Rinnen, der Wert unsichtbar. Ebenso `analytics-empty` und `admin-loading-container`. * `subpage-drawer-section`, `subpage-drawer-title-group` und `input-with-icon` im PageBuilder waren wirkungslos und teils mit Inline-Styles notdürftig kompensiert. * `grid-card-preview` fehlte, wodurch alle Layout-Vorschauen auf Höhe null kollabierten. Nur "Showcase" war sichtbar — und das aus Versehen, weil sein Tile `hero-tile` hieß und damit die `aspect-ratio` einer fremden PageBuilder-Klasse erbte. Umbenannt. Dazu die Theme-Vorschauen, die praktisch identisch aussahen: alle sieben zeigten dieselben drei quadratischen Kacheln, einziger Unterschied war die Hintergrundfarbe. Sie spiegeln jetzt die echten Preset-Daten aus lib/config/theme.ts — Schriftcharakter, Eckradius, Rasterdichte, Passepartout bzw. Schatten. Die Kopfzeile richtet sich an einer gemeinsamen Steuerhöhe aus. Der "Site"-Link war höher als die Buttons daneben: `.admin-btn` hatte keine explizite line-height, und <button> bekommt box-sizing: border-box vom Browser, <a> nicht. Die Statusanzeige setzte weder Schriftfamilie noch -größe und fiel auf den Browser-Default zurück — sie war nie Teil des Designsystems. Jetzt gleiche Höhe und Typografie, Pillenform als Zustandsanzeige, Trenner zur Aktionsgruppe. Das dauerhafte Pulsieren des grünen Punkts entfällt; Animation bleibt den Zuständen vorbehalten, die Aufmerksamkeit brauchen. Restliche Emojis durch SVG-Icons ersetzt. * feat(admin): add scroll-to-top toggle and SVG arrow The back-to-top button was always on and drew its arrow with the ↑ text character. Add a `scrollToTop` setting (General section in the admin panel, defaults to on so existing sites are unaffected) and replace the glyph with a stroked SVG that inherits currentColor across all presets. Scroll handling is now rAF-throttled, and prefers-reduced-motion turns off both the hover lift and the smooth scroll. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * security(journal): escape author HTML instead of filtering it CodeQL flags 26 high-severity alerts on the release PR; the bulk of them point at sanitizeHtml(), a denylist of three regexes whose output goes into dangerouslySetInnerHTML. I reproduced the bypasses before changing anything — all four pass the old filter: <img src=x onerror=alert(1)> unquoted handler, regex wants quotes <img src=x onerror='alert(1)'> single quotes, same reason <svg onload=alert(1)> not a <script> tag javasjavascript:cript:alert(1) one-pass replace, the rest recombines Plus an attribute breakout in the link renderer, which interpolated the URL into href="${url}" unescaped: [x](" onmouseover=alert(1) x=") -> <a href="" onmouseover=alert(1" ...> Replaced with escaping. Every `&<>"'` in author text becomes an entity before any markdown rule runs, so the only tags in the output are the ones renderInlineMarkdown builds itself and a URL cannot leave its attribute. Link schemes are now an allowlist (http, https, mailto, tel, relative, anchor); anything else renders as plain text. The serializer needed decodeHtmlEntities to match: without it a save would write `&lt;` into the Markdown file and the next parse would escape the `&` again, corrupting the text further on every round trip. A test covers parse -> serialize -> parse stability. Two existing tests asserted the old behaviour and were rewritten rather than deleted: one expected the script tag to be *removed* from the output, the other expected the substring "onerror" to be absent. Both now assert the property that matters — that no tag can form — because `onerror` surviving as inert text is fine. Exploitation required admin access either way: journal and essay text comes from the studio or from content/*.md. This removes the weakness, it does not close an open door. * fix(journal): contain file paths, fix frontmatter escaping, defuse two regexes Follow-up to the CodeQL findings on release PR #432. I went through all 23 alerts individually; this addresses the ones that are worth addressing and documents the ones that are not. Path containment (12 alerts, all false positives). Every path built from a slug goes through isValidSlug(), a strict `/^[a-zA-Z0-9_-]+$/` allowlist — verified against `../../etc/passwd`, `foo/../../bar`, `a/b`, `..` and friends, all rejected. CodeQL cannot see it because the check lives in another module. Added a containedPath() helper that resolves the path and refuses anything landing outside the content directory: a second lock on a door that was already locked, and a barrier the analysis can follow. Also removed the dead `slug.endsWith('.md')` branches — isValidSlug rejects dots, so they could never be taken. Frontmatter escaping (1 alert, a real bug). The serializer escaped `"` but not `\`, and the parser never unescaped anything. A title containing either character gained a backslash on every save/load cycle: Path C:\Users "quoted" -> Path C:\\Users \"quoted\" -> ... Escaping now covers the backslash first and the parser undoes both. A round trip test covers quotes, backslashes, colons and apostrophes. Two of three ReDoS regexes (2 alerts). The heading pattern had `\s+` next to `(.+)`, which overlap, so the engine tried every split of the whitespace run before failing; it is `[ \t]+` and `(\S.*)` now. The quote author pattern wrapped a lazy group around an optional group — the quadratic case — and is an index split on the first separator now. The third regex, the bold/italic pass, is deliberately left alone. Rewriting it with a negated class removes the backtracking but breaks nesting: `**bold *and italic* here**` renders as `*<em>bold </em>and italic<em> here</em>*`. The input is Markdown from an authenticated admin, never a visitor, so the worst case is an author slowing down their own page. The comment in the code says so. Not addressed: 5 js/insufficient-password-hash alerts. They ask for a slow KDF where the code uses SHA-256/HMAC — correct in general, but the admin password comes from an environment variable and is never stored, so a stronger KDF protects nothing that is not already in plaintext in the environment. 399 unit tests pass (18 new), build and tsc clean. * fix(journal): split the quote author by scanning, not by pattern Cleaning up after myself. #439 replaced the quote author regex `/^(.*?)(?:\s+--\s+(.+))?$/` — a lazy group around an optional one, the quadratic case — with `/\s+--\s+/`, and CodeQL promptly flagged the replacement for the same reason. One reported pattern traded for another. splitQuoteAuthor() scans for the first `--` that has whitespace on both sides. Linear, and it needs no reasoning about the regex engine at all. Behaviour is identical to the original regex, checked case by case against it: separator, no separator, several separators, tabs, wide gaps, `a--b` without spaces, leading and trailing separators, empty string. All nine are covered by tests, plus one asserting it stays fast on a 50k whitespace run. * security(admin): derive the session signing key with scrypt getSigningKey() ran the admin password through a single SHA-256 digest. It is key derivation rather than password storage, so it was never a stored-hash problem — but if the derived key ever leaked, one fast hash makes recovering the password by brute force cheap. CodeQL flags it as js/insufficient-password-hash and, for this particular alert, has a point. scrypt now. Two details that matter: The salt has to be stable. A random salt would produce a different key on every call and invalidate every session; it is derived from AUTH_SECRET, which is deployment-specific. Verified across separate processes: same inputs produce a verifying token, so a restart or redeploy does not log everyone out. The result is cached for the process lifetime. scrypt is deliberately slow and getSigningKey() runs on every admin request — deriving per call would add ~24ms to each one. The cache key is a digest of secret plus password, so a rotation misses the cache and derives again, and no extra plaintext copy of the password is kept around. Measured: first derivation 24ms, subsequent calls 0.12ms. Password change and secret change both invalidate an existing token, checked in separate processes. Note the one-time effect: existing admin sessions are invalidated by the change in derivation, so everyone logs in once more. * security(admin): key the signing-key cache on its inputs, not a digest #441 removed the SHA-256 digest of the admin password from the key derivation and introduced a new one three lines above it, as the cache key. Same rule, same file: CodeQL reported it immediately. The comment justifying it was wrong too. It claimed no second plaintext copy of the password was retained, while building the digest input allocates exactly that in order to hash it. The cache now holds the two input strings and compares them directly. They are the same objects the env and install caches already hold, so nothing extra is retained, and no fast hash of the password exists in memory for the life of the process. Re-verified after the change, in separate processes: a token from one process verifies in another with the same inputs, a changed password or secret rejects it, first derivation 24ms, cached calls 0.001ms. That leaves scrypt as the only place the password is hashed here. The two HMACs further down operate on the derived key and on token data, not on the password; the constant-time comparison in verifyAdminPassword is the previously dismissed one. --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
2026-08-14 16:55:07 +02:00
background: var(--preset-tile);
border-radius: var(--preset-radius, 0);
/* Keeps near-white tiles on a white page (Minimal, Classic) readable. */
box-shadow: inset 0 0 0 1px rgba(128, 128, 128, 0.16);
}
/* Passepartout: a mat board in the page colour framing the photo. */
.preset-card-preview[data-frame='passepartout'] .mini-tile {
padding: 4px;
background-clip: content-box;
border: 1px solid rgba(128, 128, 128, 0.3);
}
.preset-card-preview[data-frame='shadow'] .mini-tile {
box-shadow:
0 2px 5px rgba(0, 0, 0, 0.28),
inset 0 0 0 1px rgba(128, 128, 128, 0.16);
}
.preset-card-specs {
font-size: 0.62rem;
font-family: ui-monospace, SFMono-Regular, Menlo, monospace;
color: var(--admin-text-muted);
opacity: 0.75;
margin-top: 0.15rem;
feat(admin): visual theme cards, album search, and status dashboard (#241) * feat(admin): implement visual theme cards, album search, and system status diagnostics * fix(admin): resolve type-checking build errors in SettingsEditor and status route --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-05-31 21:17:52 +02:00
}
.preset-card-info {
padding: 0.6rem 0.75rem;
display: flex;
flex-direction: column;
gap: 0.15rem;
}
.preset-card-name {
font-size: 0.85rem;
font-weight: 600;
color: var(--admin-text);
text-transform: capitalize;
}
.preset-card-desc {
font-size: 0.68rem;
color: var(--admin-text-muted);
line-height: 1.3;
}
/* ── Status Diagnostics & Badge ──────────────────────────────── */
.status-indicator-container {
position: relative;
display: inline-block;
margin-right: 0.5rem;
}
release: v0.11.0 — journal fixes, admin URLs, design system cleanup (#432) * fix(screenshots): sharp-Typen fuer 0.34 und 0.35 gleichzeitig (#410) sharp 0.35 ist von `export =` auf ESM umgestellt: der Modul-Namespace ist nicht mehr aufrufbar, die Factory sitzt unter .default. Der Type-Check brach damit in scripts/screenshots.ts weg, sobald der Next-Bump (#402) sharp von 0.34.5 auf 0.35.3 mitzieht -- sharp ist hier keine deklarierte Dependency, sondern kommt ueber Next mit. Die Form wird jetzt aus dem installierten Paket abgeleitet statt festgeschrieben, zur Laufzeit wie im Typ. Geprueft mit beiden Versionen: tsc laeuft mit 0.34.5 und mit 0.35.3 fehlerfrei durch. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(deps): bump the nextjs group across 1 directory with 2 updates (#402) Bumps the nextjs group with 2 updates in the / directory: [next](https://github.com/vercel/next.js) and [eslint-config-next](https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next). Updates `next` from 16.2.12 to 16.3.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/compare/v16.2.12...v16.3.0) Updates `eslint-config-next` from 16.2.12 to 16.3.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/commits/v16.3.0/packages/eslint-config-next) --- updated-dependencies: - dependency-name: eslint-config-next dependency-version: 16.3.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: nextjs - dependency-name: next dependency-version: 16.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nextjs ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps-dev): bump prettier from 3.8.3 to 3.9.6 (#405) Bumps [prettier](https://github.com/prettier/prettier) from 3.8.3 to 3.9.6. - [Release notes](https://github.com/prettier/prettier/releases) - [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md) - [Commits](https://github.com/prettier/prettier/compare/3.8.3...3.9.6) --- updated-dependencies: - dependency-name: prettier dependency-version: 3.9.6 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * docs(changelog): Unreleased-Sektion fuer die Bumps nach v0.10.0 (#413) Die Dependency-PRs sind nach dem Release auf dev gelandet, teils auch auf main. Ohne Eintrag waeren sie beim naechsten Release unsichtbar -- inklusive Next 16.3.0, das CVE-2025-13465 mitbringt. Ausserdem im 0.10.0-Abschnitt nachgetragen, dass der Trivy-Scan bis #409 nie gelaufen ist. Der Fix steckt im Tag v0.10.0, fehlte aber in der Aufzaehlung -- und "Images werden bei jedem Publish gescannt" stand im Changelog, waehrend der Job im Action-Setup abbrach. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(gallery): per-album sort order, independent of Immich (#408) (#414) Album order was dictated entirely by Immich: getAlbum() sorted by the album's own asc/desc flag, so a Folio album always mirrored the archive. A curated series has a narrative order that has nothing to do with capture time, and changing the Immich album's sort to fit the website changes it for the archive too. Adds an optional per-album `sort` in gallery.yaml, editable in /admin, defaulting to today's behaviour so every existing config is unchanged: immich (default) | newest | oldest | filename | manual `manual` is a pinned *prefix*: `assetOrder` lists only the photos placed by hand, everything else follows in the album's Immich order. A full permutation of a 2,000-photo album would be ~80 KB of UUIDs in a file that is rewritten and copied to content/.backups/ on every admin save. It also makes drift fall out for free — photos removed in Immich never match, new ones land in the tail rather than being hidden. Sorting is applied after the cache read, not before the cache write, so the LRU keeps one canonical Immich-ordered copy per album. That avoids putting the mode in the cache key, lets a config change take effect without depending on invalidation, and keeps the stale-serving path correct. cache.get() returns the stored object by reference, so withSort() returns a shallow clone with a new array — sorting in place would reorder the shared entry, and under request coalescing every concurrent caller would be sorting the same array. Also fixes a prerequisite bug: /api/admin/albums/[albumId]/assets read album.assets from GET /albums/:id, which Immich 3.x no longer populates (lib/immich.ts:507). The hero picker's "This Album" tab returned nothing and threw outright when the key was absent. It now goes through the client's paginated metadata search, with ?types=all to opt videos in for the reorder editor. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): drop decorative emoji from the sort select labels (#415) An <option> cannot contain markup, so the SVG set in Icons is not reachable there — but a decorative emoji is not a substitute for it. Plain text instead; the album card badge already uses a real icon. The remaining emoji in the admin panel (asset picker tabs, section headings, layout picker options) predate this branch and are left for a separate cleanup. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): replace emoji icons with the shared SVG icon set (#416) The admin panel mixed two icon conventions: inline SVGs from `Icons.tsx` in most components, and decorative emoji in the asset picker and a few PageBuilder labels. Emoji render inconsistently across platforms, ignore the accent colour, and cannot inherit the `.svg-icon` sizing rules. - Icons.tsx: add `IconStar` (filled — it marks a state, not an action) and `IconImage`. - AssetPicker: the three tab labels and the favourite tile badge now use IconFolder / IconStar / IconImage. - PageBuilder: the "Standalone Albums" and "Subpages" headings use the icon set instead of an emoji. - PageBuilder: the layout picker drops its emoji for plain text. An <option> cannot contain markup, so an SVG is impossible there and a decorative glyph is not a substitute. - admin.css: align icon and label in the picker tabs, and swap the favourite badge's text-shadow for drop-shadow, which is what applies to an inline SVG. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): fold PageBuilder's local icons into the shared Icons module (#418) * refactor(admin): fold PageBuilder's local icons into the shared module PageBuilder.tsx carried its own `Icons` object duplicating most of the glyphs already exported by Icons.tsx, with hardcoded sizes and slightly divergent paths. Migrate all 32 call sites to the shared module and delete the local object. Five glyphs had no counterpart and are added to Icons.tsx as 1:1 ports of the local paths: IconX, IconPlus, IconHome, IconCopy, IconImage. The local ExternalLink and Check are dropped rather than ported — both had zero call sites. Two glyphs change shape slightly, which is the point of consolidating: the shared IconCamera includes the viewfinder bump the local copy omitted, and drag handles now use IconGripVertical. IconGripVertical uses the module's square 24x24 viewBox, so `.svg-drag` goes from 12x18 to 18x18 — the old non-square box would letterbox the glyph down to 12x12 and shrink the handle. * fix(admin): resolve icon-module integration after #416 Merging dev brought in #416, which added a second IconImage to Icons.tsx and two <Icons.Camera>/<Icons.Folder> section headers that reference the local Icons object this PR removes. Git merged both cleanly but the result did not type-check. - drop the duplicate IconImage (both copies were byte-identical) - point the two section headers at the imported IconCamera/IconFolder - refresh the SORT_LABELS comment: the icon set is imported now, not declared below --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> * fix(config): allow an empty gallery, guard against a double /api suffix (#421) An empty gallery is now a valid, rendered state instead of a throw: deriveGallery() no longer requires at least one album or subpage, so a deployment with no albums yet renders a bare homepage the owner can fill in via /admin. getConfig() also stops appending /api to an Immich URL that already ends in it, which previously produced .../api/api and broke every upstream request. Includes a restore of the per-album sort test cases, which the branch had lost by being cut before #408/#414. * feat(admin): favicon upload, served from the content volume (#422) Adds a bundled default favicon, an upload widget in admin Settings > General, and a route that serves the icon from the writable content/ volume with a fallback to the bundled default. Raster uploads (PNG/ICO/JPEG) are wrapped in an SVG container; the response carries its own CSP so an uploaded SVG cannot execute script on the origin. The GET route revalidates with an ETag instead of caching immutably, so a newly uploaded icon shows up immediately. Uploads are written via temp file + rename, and a Reset button restores the bundled default. * ci: flag unformatted files in a PR, without blocking it (#424) Prettier is configured as an error rule in eslint.config.mjs but has never run in CI, so part of the tree predates it. A final CI step now diffs against the PR base, runs prettier --list-different over the changed files, and emits a warning annotation per offender plus a job summary. Advisory by design: it never fails the job. Blocking would turn a PR red for merely touching a file that was already unformatted, and normalising the tree in one commit would wreck git blame and conflict with the PRs in flight. Requires fetch-depth: 0, since diffing against the base needs its history. * feat(install): first-run wizard gated by a one-time setup token (#419) Adds /install, a four-step first-run wizard: connect to Immich, optionally pick albums, name the site, finish. It verifies the credentials against the Immich server before writing anything, then writes gallery.yaml, settings.yaml and a content/install.json carrying the Immich credentials and a generated site secret. install.json exists because a running process cannot pick up new env vars — the wizard has to write configuration that takes effect without a restart. getInstallCredentials() merges it under the real environment, so env vars always win and rotation stays a matter of setting one. Both the page and the API routes are gated by a one-time setup token printed to the server log, so a deployment that is reachable before gallery.yaml exists cannot be configured by whoever finds it first. The token is stored in content/.setup-token (0600) rather than a module variable: Next.js bundles the page and each route handler separately, so a module-level token left the page and the API disagreeing inside one process and the wizard stuck on step 1. It is removed once the install completes. The admin password is stored as an scrypt hash using the scheme lib/auth.ts already applies to album passwords; a plaintext ADMIN_PASSWORD env var keeps working. * docs: document the setup wizard, fix the read-only content mount (#425) Quick Start now leads with the /install wizard, with the hand-written YAML route kept alongside it, and a First-Run Setup section covers the setup token, the files the wizard writes, and env-var precedence. Two corrections: both Docker examples mounted content/ as :ro, which silently breaks the wizard, the admin panel and the backup rotation alike — docs/admin-panel.md already said so and the README contradicted it. And nothing documented that content/install.json holds the Immich API key, so a backup of content/ is a backup of credentials. Also adds a Contributors section crediting the people whose work is in the project. * feat(admin): floating save bar pinned to the bottom of the viewport (#426) The save bar was the first, static element inside .admin-main. Since the document itself scrolls, it left the viewport as soon as you scrolled down — editing a subpage section or a settings block far below gave no visible dirty hint and no reachable save button. Replace it with a bottom-pinned floating bar shared by both editors. It only mounts while there is something to act on (unsaved changes, an in-flight save, or a result message), so it never covers content while idle. The success message clears after 5s, which hides the bar again. - new SaveBar component, replacing the duplicated markup in PageBuilder and SettingsEditor - adopt the previously unused .floating-save-bar CSS: slide-in keyframes (carrying translateX(-50%)), dirty border, wrap/gap, mobile variant and a prefers-reduced-motion opt-out; z-index 900 keeps it below modals - .admin-main gains bottom padding so the bar never covers page content - drop the now-unreachable idle hints: the ⌘S hint becomes a button title, the Live Sync note becomes a static line above the settings layout - header "Site" link now bypasses the cache (/?fresh=1), so the preview stays reachable when the bar is hidden Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(admin): themed listbox for the album sort control (#427) The per-album "Photo order" control was a native <select>. Because an <option> cannot contain markup, its choices could not use the admin panel's currentColor SVG set — the reason #415 had to fall back to plain text after dropping the emoji labels. Adds a Listbox component implementing the ARIA combobox/listbox pattern, so options can render a glyph beside their label: - DOM focus stays on the trigger button; the active option is announced through aria-activedescendant, keeping focus management to one element - Keyboard: arrows (clamped at the ends, like a native select), Home/End, Enter/Space to commit, Escape to cancel, Tab commits and moves on, and prefix type-ahead with a repeat-key cycle - Outside dismissal on pointerdown, so a press starting outside closes the popup before the click retargets The sort options now carry an icon each: calendar, arrow-down, arrow-up, an A→Z marker, and the drag glyph for manual — matching the badge the album card already shows. SORT_LABELS stays plain text because the badge feeds it to a title attribute. Closes #417 Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(git): ignore generated design handoff folders * fix(admin): stop the album sort dropdown clipping, and simplify the panel (#428) * fix(admin): render listbox popup in a portal so it escapes modal clipping The sort control's popup was position:absolute inside three clipping ancestors (.album-drawer overflow:hidden > .album-drawer-body overflow-y:auto > .modal-right-column overflow-y:auto), so it was cut off at the bottom of the Edit Album Details modal. z-index could not help: clipping happens before stacking. It also always hung below the trigger, with no flip. Portal the popup to document.body and position it from the trigger's viewport rect, flipping above when there is more room there and capping max-height to the space available so it scrolls internally rather than overflowing. It is dismissed on scroll and resize, since the anchor is only measured on open. The outside-pointerdown handler now also treats the popup as inside; without that the portalled list counts as outside, and a click on an option would close it before the selection commits. * refactor(admin): single-column album details panel The left column spent 1.2fr on a cover thumbnail and three stat rows, two of which (Status, Custom Hero) only restated the form fields opposite them, while the form itself was squeezed into 1.8fr behind a second nested scroller. Stack the drawer in one column instead: cover as a banner, then the form at full width, with the UUID moved into the footer. The body is now the only scroll container, which also removes one of the ancestors that was clipping the sort popup. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> * fix(admin): give the portalled listbox its theme back, lock the page behind modals (#429) Two defects in the album editor. The sort listbox popup painted transparent. Every --admin-* variable is scoped to .admin-layout, and since the popup moved into document.body it sits outside that subtree, so background/border/text all resolved to nothing. It now carries its own copy of the palette in both colour schemes, plus the font it no longer inherits. Scrolling inside a modal also moved the page behind it. No admin modal ever locked body scroll: the overlay covers the page but does not absorb wheel events, so a scroll starting on the backdrop — or continuing past the end of the modal's own scroller — reaches the document. overscroll-behavior cannot cover that case on its own, because it only applies to scroll containers and the backdrop is not one. useScrollLock freezes body while a modal is open and compensates for the width the scrollbar gives up, so nothing shifts underneath. Each lock restores the inline value it found, which makes nesting work without a counter — a picker opened from the drawer restores the drawer's hidden state instead of clearing it. Applied to both drawers and all four picker modals, which share the defect. overscroll-behavior: contain on the scrollers stops the chaining they can handle themselves. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com> * fix(security): allow unsafe-eval in CSP script-src during dev mode * feat(journal): add Journal Studio with split-screen editor, live preview and dedicated routes * fix(build): separate client parser from server journal-service and fix build type errors * fix(journal): Fotos rendern, Layout und Lightbox-Steuerung korrigieren Fünf unabhängige Fehler in der öffentlichen Journal- und Essay-Ansicht: * Foto-Blöcke wurden nie angezeigt. EssayView löst ein Foto über PhotoItem.id auf, und das sind verschlüsselte Tokens — die Blöcke aus dem Markdown tragen aber rohe Asset-UUIDs. Jede Zuordnung lief ins Leere, und nicht auflösbare Blöcke werden still verworfen. Die IDs werden jetzt serverseitig übersetzt; damit verschwinden nebenbei die rohen UUIDs aus dem Client-Payload, die dort laut Projektregel nie auftauchen dürfen. Nicht auflösbare Referenzen werden geloggt. * Überschriften standen weiter links als der Fließtext. Jeder Block hatte einzeln `max-width: 68ch`, und `ch` ist relativ zur Schrift des Elements — die Serif-Überschrift ergab eine breitere Spalte. Ersetzt durch eine gemeinsame, font-unabhängige `--essay-measure`. * Fullbleed-Fotos bluteten nur nach links aus: `.essay-figure` ist `width: 100%`, wodurch die Box überbestimmt ist und der negative rechte Margin verworfen wird. * Foto-Paare stellten beide Bilder gleich breit dar, wodurch ein Hochformat neben einem Querformat doppelt so hoch wurde. Jetzt eine Justified-Reihe: Breite proportional zum Seitenverhältnis, dadurch exakt gleiche Höhen ohne Beschnitt. * Die Lightbox hatte im Journal keine Tastatursteuerung und keine Scroll-Sperre — beides lag in PhotoGrid, also nur im Album-Raster. Verlagert in die Lightbox selbst, der doppelte Handler in PhotoGrid entfernt (sonst wäre pro Pfeildruck zwei Bilder weitergesprungen). Zusätzlich sind Proofing-Herzen und das EXIF-Panel im redaktionellen Modus abschaltbar und im Journal aus: Client-Proofing ist ein Übergabe-Workflow für Alben, keine Funktion einer Reportage. Auf der Übersicht wurde der Untertitel doppelt gerendert, weil extractExcerpt() auf ihn zurückfällt. * feat(admin): eigene URLs für alle Bereiche und überarbeiteter Journal Studio Das Panel war eine einzige Client-Komponente, die ihre Tabs über useState umschaltet: keine Route pro Bereich, kein Deep-Link, kein Zurück-Button, und nach jedem Reload landete man wieder auf "Pages". Auch der Journal-Editor hatte keine eigene URL. Jetzt sieben echte Routen (/admin, /admin/pages, /admin/journal, /admin/journal/<slug>, /admin/settings, /admin/settings/<section>, /admin/analytics). Die Shell mit Auth-Prüfung und Kopfzeile sitzt im Layout und umschließt children — so bleibt die Session-Prüfung über Routenwechsel montiert, statt bei jedem Tab-Wechsel neu zu laufen und den Spinner aufblitzen zu lassen. Unbekannte Settings-Sections fallen auf General zurück. Im selben Zug der Journal Studio, der die Routing-Änderung ohnehin berührt: * Alle Eingabefelder nutzten die Klasse `admin-input`, die in keinem CSS definiert war — sie fielen auf Browser-Defaults zurück. Jetzt gestylt, gescoped, damit der generische Name nicht ins übrige Panel leckt. * Der Split View ist per Divider verschiebbar (Maus, Tastatur, Doppelklick zum Zurücksetzen), Breite in localStorage. * Das Studio bricht aus der 1120px-Spalte aus, die Preview hat Platz. * Die Preview zeigte für jedes Foto fest 3:2 und log damit über das Layout der veröffentlichten Seite; die echten Verhältnisse werden jetzt an den Thumbnails gemessen. * Blöcke mit alten positionsbasierten Foto-Referenzen werden markiert — die lassen sich auf einer eigenständigen Journal-Seite nicht auflösen und verschwanden bisher stillschweigend. * Blocktyp-Chips als gemeinsame Komponente, monochrom und per Icon unterschieden statt in einer eigenen Blau/Lila/Orange-Palette, die sonst nirgends im Panel vorkommt. * Emojis raus, SVG-Icons rein. * fix(admin): Designsystem-Lücken im Panel schließen Eine systematische Suche nach Klassen, die im TSX benutzt, aber in keinem CSS definiert sind, hat vier Stellen mit demselben Muster gefunden: * `admin-btn-secondary` und `admin-btn-danger` existierten nicht. Sämtliche Löschen-Buttons sahen aus wie normale Buttons — keine Warnwirkung. Als `.admin-btn.admin-btn-danger` geschrieben, weil die Varianten mit den Größenklassen kombiniert werden, die weiter unten ihren eigenen Hintergrund setzen. * `page-progress-fill` fehlte: die Balken im Analytics-Panel waren leere Rinnen, der Wert unsichtbar. Ebenso `analytics-empty` und `admin-loading-container`. * `subpage-drawer-section`, `subpage-drawer-title-group` und `input-with-icon` im PageBuilder waren wirkungslos und teils mit Inline-Styles notdürftig kompensiert. * `grid-card-preview` fehlte, wodurch alle Layout-Vorschauen auf Höhe null kollabierten. Nur "Showcase" war sichtbar — und das aus Versehen, weil sein Tile `hero-tile` hieß und damit die `aspect-ratio` einer fremden PageBuilder-Klasse erbte. Umbenannt. Dazu die Theme-Vorschauen, die praktisch identisch aussahen: alle sieben zeigten dieselben drei quadratischen Kacheln, einziger Unterschied war die Hintergrundfarbe. Sie spiegeln jetzt die echten Preset-Daten aus lib/config/theme.ts — Schriftcharakter, Eckradius, Rasterdichte, Passepartout bzw. Schatten. Die Kopfzeile richtet sich an einer gemeinsamen Steuerhöhe aus. Der "Site"-Link war höher als die Buttons daneben: `.admin-btn` hatte keine explizite line-height, und <button> bekommt box-sizing: border-box vom Browser, <a> nicht. Die Statusanzeige setzte weder Schriftfamilie noch -größe und fiel auf den Browser-Default zurück — sie war nie Teil des Designsystems. Jetzt gleiche Höhe und Typografie, Pillenform als Zustandsanzeige, Trenner zur Aktionsgruppe. Das dauerhafte Pulsieren des grünen Punkts entfällt; Animation bleibt den Zuständen vorbehalten, die Aufmerksamkeit brauchen. Restliche Emojis durch SVG-Icons ersetzt. * feat(admin): add scroll-to-top toggle and SVG arrow The back-to-top button was always on and drew its arrow with the ↑ text character. Add a `scrollToTop` setting (General section in the admin panel, defaults to on so existing sites are unaffected) and replace the glyph with a stroked SVG that inherits currentColor across all presets. Scroll handling is now rAF-throttled, and prefers-reduced-motion turns off both the hover lift and the smooth scroll. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * security(journal): escape author HTML instead of filtering it CodeQL flags 26 high-severity alerts on the release PR; the bulk of them point at sanitizeHtml(), a denylist of three regexes whose output goes into dangerouslySetInnerHTML. I reproduced the bypasses before changing anything — all four pass the old filter: <img src=x onerror=alert(1)> unquoted handler, regex wants quotes <img src=x onerror='alert(1)'> single quotes, same reason <svg onload=alert(1)> not a <script> tag javasjavascript:cript:alert(1) one-pass replace, the rest recombines Plus an attribute breakout in the link renderer, which interpolated the URL into href="${url}" unescaped: [x](" onmouseover=alert(1) x=") -> <a href="" onmouseover=alert(1" ...> Replaced with escaping. Every `&<>"'` in author text becomes an entity before any markdown rule runs, so the only tags in the output are the ones renderInlineMarkdown builds itself and a URL cannot leave its attribute. Link schemes are now an allowlist (http, https, mailto, tel, relative, anchor); anything else renders as plain text. The serializer needed decodeHtmlEntities to match: without it a save would write `&lt;` into the Markdown file and the next parse would escape the `&` again, corrupting the text further on every round trip. A test covers parse -> serialize -> parse stability. Two existing tests asserted the old behaviour and were rewritten rather than deleted: one expected the script tag to be *removed* from the output, the other expected the substring "onerror" to be absent. Both now assert the property that matters — that no tag can form — because `onerror` surviving as inert text is fine. Exploitation required admin access either way: journal and essay text comes from the studio or from content/*.md. This removes the weakness, it does not close an open door. * fix(journal): contain file paths, fix frontmatter escaping, defuse two regexes Follow-up to the CodeQL findings on release PR #432. I went through all 23 alerts individually; this addresses the ones that are worth addressing and documents the ones that are not. Path containment (12 alerts, all false positives). Every path built from a slug goes through isValidSlug(), a strict `/^[a-zA-Z0-9_-]+$/` allowlist — verified against `../../etc/passwd`, `foo/../../bar`, `a/b`, `..` and friends, all rejected. CodeQL cannot see it because the check lives in another module. Added a containedPath() helper that resolves the path and refuses anything landing outside the content directory: a second lock on a door that was already locked, and a barrier the analysis can follow. Also removed the dead `slug.endsWith('.md')` branches — isValidSlug rejects dots, so they could never be taken. Frontmatter escaping (1 alert, a real bug). The serializer escaped `"` but not `\`, and the parser never unescaped anything. A title containing either character gained a backslash on every save/load cycle: Path C:\Users "quoted" -> Path C:\\Users \"quoted\" -> ... Escaping now covers the backslash first and the parser undoes both. A round trip test covers quotes, backslashes, colons and apostrophes. Two of three ReDoS regexes (2 alerts). The heading pattern had `\s+` next to `(.+)`, which overlap, so the engine tried every split of the whitespace run before failing; it is `[ \t]+` and `(\S.*)` now. The quote author pattern wrapped a lazy group around an optional group — the quadratic case — and is an index split on the first separator now. The third regex, the bold/italic pass, is deliberately left alone. Rewriting it with a negated class removes the backtracking but breaks nesting: `**bold *and italic* here**` renders as `*<em>bold </em>and italic<em> here</em>*`. The input is Markdown from an authenticated admin, never a visitor, so the worst case is an author slowing down their own page. The comment in the code says so. Not addressed: 5 js/insufficient-password-hash alerts. They ask for a slow KDF where the code uses SHA-256/HMAC — correct in general, but the admin password comes from an environment variable and is never stored, so a stronger KDF protects nothing that is not already in plaintext in the environment. 399 unit tests pass (18 new), build and tsc clean. * fix(journal): split the quote author by scanning, not by pattern Cleaning up after myself. #439 replaced the quote author regex `/^(.*?)(?:\s+--\s+(.+))?$/` — a lazy group around an optional one, the quadratic case — with `/\s+--\s+/`, and CodeQL promptly flagged the replacement for the same reason. One reported pattern traded for another. splitQuoteAuthor() scans for the first `--` that has whitespace on both sides. Linear, and it needs no reasoning about the regex engine at all. Behaviour is identical to the original regex, checked case by case against it: separator, no separator, several separators, tabs, wide gaps, `a--b` without spaces, leading and trailing separators, empty string. All nine are covered by tests, plus one asserting it stays fast on a 50k whitespace run. * security(admin): derive the session signing key with scrypt getSigningKey() ran the admin password through a single SHA-256 digest. It is key derivation rather than password storage, so it was never a stored-hash problem — but if the derived key ever leaked, one fast hash makes recovering the password by brute force cheap. CodeQL flags it as js/insufficient-password-hash and, for this particular alert, has a point. scrypt now. Two details that matter: The salt has to be stable. A random salt would produce a different key on every call and invalidate every session; it is derived from AUTH_SECRET, which is deployment-specific. Verified across separate processes: same inputs produce a verifying token, so a restart or redeploy does not log everyone out. The result is cached for the process lifetime. scrypt is deliberately slow and getSigningKey() runs on every admin request — deriving per call would add ~24ms to each one. The cache key is a digest of secret plus password, so a rotation misses the cache and derives again, and no extra plaintext copy of the password is kept around. Measured: first derivation 24ms, subsequent calls 0.12ms. Password change and secret change both invalidate an existing token, checked in separate processes. Note the one-time effect: existing admin sessions are invalidated by the change in derivation, so everyone logs in once more. * security(admin): key the signing-key cache on its inputs, not a digest #441 removed the SHA-256 digest of the admin password from the key derivation and introduced a new one three lines above it, as the cache key. Same rule, same file: CodeQL reported it immediately. The comment justifying it was wrong too. It claimed no second plaintext copy of the password was retained, while building the digest input allocates exactly that in order to hash it. The cache now holds the two input strings and compares them directly. They are the same objects the env and install caches already hold, so nothing extra is retained, and no fast hash of the password exists in memory for the life of the process. Re-verified after the change, in separate processes: a token from one process verifies in another with the same inputs, a changed password or secret rejects it, first derivation 24ms, cached calls 0.001ms. That leaves scrypt as the only place the password is hashed here. The two HMACs further down operate on the derived key and on token data, not on the password; the constant-time comparison in verifyAdminPassword is the previously dismissed one. --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
2026-08-14 16:55:07 +02:00
/*
* A status readout, not an action: same height and typography as the buttons
* beside it, but pill-shaped so the row still reads as "state | actions".
* It inherited the browser's default button font before, which is why it looked
* like it came from a different app.
*/
feat(admin): visual theme cards, album search, and status dashboard (#241) * feat(admin): implement visual theme cards, album search, and system status diagnostics * fix(admin): resolve type-checking build errors in SettingsEditor and status route --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-05-31 21:17:52 +02:00
.status-badge-btn {
release: v0.11.0 — journal fixes, admin URLs, design system cleanup (#432) * fix(screenshots): sharp-Typen fuer 0.34 und 0.35 gleichzeitig (#410) sharp 0.35 ist von `export =` auf ESM umgestellt: der Modul-Namespace ist nicht mehr aufrufbar, die Factory sitzt unter .default. Der Type-Check brach damit in scripts/screenshots.ts weg, sobald der Next-Bump (#402) sharp von 0.34.5 auf 0.35.3 mitzieht -- sharp ist hier keine deklarierte Dependency, sondern kommt ueber Next mit. Die Form wird jetzt aus dem installierten Paket abgeleitet statt festgeschrieben, zur Laufzeit wie im Typ. Geprueft mit beiden Versionen: tsc laeuft mit 0.34.5 und mit 0.35.3 fehlerfrei durch. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(deps): bump the nextjs group across 1 directory with 2 updates (#402) Bumps the nextjs group with 2 updates in the / directory: [next](https://github.com/vercel/next.js) and [eslint-config-next](https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next). Updates `next` from 16.2.12 to 16.3.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/compare/v16.2.12...v16.3.0) Updates `eslint-config-next` from 16.2.12 to 16.3.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/commits/v16.3.0/packages/eslint-config-next) --- updated-dependencies: - dependency-name: eslint-config-next dependency-version: 16.3.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: nextjs - dependency-name: next dependency-version: 16.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nextjs ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps-dev): bump prettier from 3.8.3 to 3.9.6 (#405) Bumps [prettier](https://github.com/prettier/prettier) from 3.8.3 to 3.9.6. - [Release notes](https://github.com/prettier/prettier/releases) - [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md) - [Commits](https://github.com/prettier/prettier/compare/3.8.3...3.9.6) --- updated-dependencies: - dependency-name: prettier dependency-version: 3.9.6 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * docs(changelog): Unreleased-Sektion fuer die Bumps nach v0.10.0 (#413) Die Dependency-PRs sind nach dem Release auf dev gelandet, teils auch auf main. Ohne Eintrag waeren sie beim naechsten Release unsichtbar -- inklusive Next 16.3.0, das CVE-2025-13465 mitbringt. Ausserdem im 0.10.0-Abschnitt nachgetragen, dass der Trivy-Scan bis #409 nie gelaufen ist. Der Fix steckt im Tag v0.10.0, fehlte aber in der Aufzaehlung -- und "Images werden bei jedem Publish gescannt" stand im Changelog, waehrend der Job im Action-Setup abbrach. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(gallery): per-album sort order, independent of Immich (#408) (#414) Album order was dictated entirely by Immich: getAlbum() sorted by the album's own asc/desc flag, so a Folio album always mirrored the archive. A curated series has a narrative order that has nothing to do with capture time, and changing the Immich album's sort to fit the website changes it for the archive too. Adds an optional per-album `sort` in gallery.yaml, editable in /admin, defaulting to today's behaviour so every existing config is unchanged: immich (default) | newest | oldest | filename | manual `manual` is a pinned *prefix*: `assetOrder` lists only the photos placed by hand, everything else follows in the album's Immich order. A full permutation of a 2,000-photo album would be ~80 KB of UUIDs in a file that is rewritten and copied to content/.backups/ on every admin save. It also makes drift fall out for free — photos removed in Immich never match, new ones land in the tail rather than being hidden. Sorting is applied after the cache read, not before the cache write, so the LRU keeps one canonical Immich-ordered copy per album. That avoids putting the mode in the cache key, lets a config change take effect without depending on invalidation, and keeps the stale-serving path correct. cache.get() returns the stored object by reference, so withSort() returns a shallow clone with a new array — sorting in place would reorder the shared entry, and under request coalescing every concurrent caller would be sorting the same array. Also fixes a prerequisite bug: /api/admin/albums/[albumId]/assets read album.assets from GET /albums/:id, which Immich 3.x no longer populates (lib/immich.ts:507). The hero picker's "This Album" tab returned nothing and threw outright when the key was absent. It now goes through the client's paginated metadata search, with ?types=all to opt videos in for the reorder editor. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): drop decorative emoji from the sort select labels (#415) An <option> cannot contain markup, so the SVG set in Icons is not reachable there — but a decorative emoji is not a substitute for it. Plain text instead; the album card badge already uses a real icon. The remaining emoji in the admin panel (asset picker tabs, section headings, layout picker options) predate this branch and are left for a separate cleanup. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): replace emoji icons with the shared SVG icon set (#416) The admin panel mixed two icon conventions: inline SVGs from `Icons.tsx` in most components, and decorative emoji in the asset picker and a few PageBuilder labels. Emoji render inconsistently across platforms, ignore the accent colour, and cannot inherit the `.svg-icon` sizing rules. - Icons.tsx: add `IconStar` (filled — it marks a state, not an action) and `IconImage`. - AssetPicker: the three tab labels and the favourite tile badge now use IconFolder / IconStar / IconImage. - PageBuilder: the "Standalone Albums" and "Subpages" headings use the icon set instead of an emoji. - PageBuilder: the layout picker drops its emoji for plain text. An <option> cannot contain markup, so an SVG is impossible there and a decorative glyph is not a substitute. - admin.css: align icon and label in the picker tabs, and swap the favourite badge's text-shadow for drop-shadow, which is what applies to an inline SVG. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): fold PageBuilder's local icons into the shared Icons module (#418) * refactor(admin): fold PageBuilder's local icons into the shared module PageBuilder.tsx carried its own `Icons` object duplicating most of the glyphs already exported by Icons.tsx, with hardcoded sizes and slightly divergent paths. Migrate all 32 call sites to the shared module and delete the local object. Five glyphs had no counterpart and are added to Icons.tsx as 1:1 ports of the local paths: IconX, IconPlus, IconHome, IconCopy, IconImage. The local ExternalLink and Check are dropped rather than ported — both had zero call sites. Two glyphs change shape slightly, which is the point of consolidating: the shared IconCamera includes the viewfinder bump the local copy omitted, and drag handles now use IconGripVertical. IconGripVertical uses the module's square 24x24 viewBox, so `.svg-drag` goes from 12x18 to 18x18 — the old non-square box would letterbox the glyph down to 12x12 and shrink the handle. * fix(admin): resolve icon-module integration after #416 Merging dev brought in #416, which added a second IconImage to Icons.tsx and two <Icons.Camera>/<Icons.Folder> section headers that reference the local Icons object this PR removes. Git merged both cleanly but the result did not type-check. - drop the duplicate IconImage (both copies were byte-identical) - point the two section headers at the imported IconCamera/IconFolder - refresh the SORT_LABELS comment: the icon set is imported now, not declared below --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> * fix(config): allow an empty gallery, guard against a double /api suffix (#421) An empty gallery is now a valid, rendered state instead of a throw: deriveGallery() no longer requires at least one album or subpage, so a deployment with no albums yet renders a bare homepage the owner can fill in via /admin. getConfig() also stops appending /api to an Immich URL that already ends in it, which previously produced .../api/api and broke every upstream request. Includes a restore of the per-album sort test cases, which the branch had lost by being cut before #408/#414. * feat(admin): favicon upload, served from the content volume (#422) Adds a bundled default favicon, an upload widget in admin Settings > General, and a route that serves the icon from the writable content/ volume with a fallback to the bundled default. Raster uploads (PNG/ICO/JPEG) are wrapped in an SVG container; the response carries its own CSP so an uploaded SVG cannot execute script on the origin. The GET route revalidates with an ETag instead of caching immutably, so a newly uploaded icon shows up immediately. Uploads are written via temp file + rename, and a Reset button restores the bundled default. * ci: flag unformatted files in a PR, without blocking it (#424) Prettier is configured as an error rule in eslint.config.mjs but has never run in CI, so part of the tree predates it. A final CI step now diffs against the PR base, runs prettier --list-different over the changed files, and emits a warning annotation per offender plus a job summary. Advisory by design: it never fails the job. Blocking would turn a PR red for merely touching a file that was already unformatted, and normalising the tree in one commit would wreck git blame and conflict with the PRs in flight. Requires fetch-depth: 0, since diffing against the base needs its history. * feat(install): first-run wizard gated by a one-time setup token (#419) Adds /install, a four-step first-run wizard: connect to Immich, optionally pick albums, name the site, finish. It verifies the credentials against the Immich server before writing anything, then writes gallery.yaml, settings.yaml and a content/install.json carrying the Immich credentials and a generated site secret. install.json exists because a running process cannot pick up new env vars — the wizard has to write configuration that takes effect without a restart. getInstallCredentials() merges it under the real environment, so env vars always win and rotation stays a matter of setting one. Both the page and the API routes are gated by a one-time setup token printed to the server log, so a deployment that is reachable before gallery.yaml exists cannot be configured by whoever finds it first. The token is stored in content/.setup-token (0600) rather than a module variable: Next.js bundles the page and each route handler separately, so a module-level token left the page and the API disagreeing inside one process and the wizard stuck on step 1. It is removed once the install completes. The admin password is stored as an scrypt hash using the scheme lib/auth.ts already applies to album passwords; a plaintext ADMIN_PASSWORD env var keeps working. * docs: document the setup wizard, fix the read-only content mount (#425) Quick Start now leads with the /install wizard, with the hand-written YAML route kept alongside it, and a First-Run Setup section covers the setup token, the files the wizard writes, and env-var precedence. Two corrections: both Docker examples mounted content/ as :ro, which silently breaks the wizard, the admin panel and the backup rotation alike — docs/admin-panel.md already said so and the README contradicted it. And nothing documented that content/install.json holds the Immich API key, so a backup of content/ is a backup of credentials. Also adds a Contributors section crediting the people whose work is in the project. * feat(admin): floating save bar pinned to the bottom of the viewport (#426) The save bar was the first, static element inside .admin-main. Since the document itself scrolls, it left the viewport as soon as you scrolled down — editing a subpage section or a settings block far below gave no visible dirty hint and no reachable save button. Replace it with a bottom-pinned floating bar shared by both editors. It only mounts while there is something to act on (unsaved changes, an in-flight save, or a result message), so it never covers content while idle. The success message clears after 5s, which hides the bar again. - new SaveBar component, replacing the duplicated markup in PageBuilder and SettingsEditor - adopt the previously unused .floating-save-bar CSS: slide-in keyframes (carrying translateX(-50%)), dirty border, wrap/gap, mobile variant and a prefers-reduced-motion opt-out; z-index 900 keeps it below modals - .admin-main gains bottom padding so the bar never covers page content - drop the now-unreachable idle hints: the ⌘S hint becomes a button title, the Live Sync note becomes a static line above the settings layout - header "Site" link now bypasses the cache (/?fresh=1), so the preview stays reachable when the bar is hidden Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(admin): themed listbox for the album sort control (#427) The per-album "Photo order" control was a native <select>. Because an <option> cannot contain markup, its choices could not use the admin panel's currentColor SVG set — the reason #415 had to fall back to plain text after dropping the emoji labels. Adds a Listbox component implementing the ARIA combobox/listbox pattern, so options can render a glyph beside their label: - DOM focus stays on the trigger button; the active option is announced through aria-activedescendant, keeping focus management to one element - Keyboard: arrows (clamped at the ends, like a native select), Home/End, Enter/Space to commit, Escape to cancel, Tab commits and moves on, and prefix type-ahead with a repeat-key cycle - Outside dismissal on pointerdown, so a press starting outside closes the popup before the click retargets The sort options now carry an icon each: calendar, arrow-down, arrow-up, an A→Z marker, and the drag glyph for manual — matching the badge the album card already shows. SORT_LABELS stays plain text because the badge feeds it to a title attribute. Closes #417 Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(git): ignore generated design handoff folders * fix(admin): stop the album sort dropdown clipping, and simplify the panel (#428) * fix(admin): render listbox popup in a portal so it escapes modal clipping The sort control's popup was position:absolute inside three clipping ancestors (.album-drawer overflow:hidden > .album-drawer-body overflow-y:auto > .modal-right-column overflow-y:auto), so it was cut off at the bottom of the Edit Album Details modal. z-index could not help: clipping happens before stacking. It also always hung below the trigger, with no flip. Portal the popup to document.body and position it from the trigger's viewport rect, flipping above when there is more room there and capping max-height to the space available so it scrolls internally rather than overflowing. It is dismissed on scroll and resize, since the anchor is only measured on open. The outside-pointerdown handler now also treats the popup as inside; without that the portalled list counts as outside, and a click on an option would close it before the selection commits. * refactor(admin): single-column album details panel The left column spent 1.2fr on a cover thumbnail and three stat rows, two of which (Status, Custom Hero) only restated the form fields opposite them, while the form itself was squeezed into 1.8fr behind a second nested scroller. Stack the drawer in one column instead: cover as a banner, then the form at full width, with the UUID moved into the footer. The body is now the only scroll container, which also removes one of the ancestors that was clipping the sort popup. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> * fix(admin): give the portalled listbox its theme back, lock the page behind modals (#429) Two defects in the album editor. The sort listbox popup painted transparent. Every --admin-* variable is scoped to .admin-layout, and since the popup moved into document.body it sits outside that subtree, so background/border/text all resolved to nothing. It now carries its own copy of the palette in both colour schemes, plus the font it no longer inherits. Scrolling inside a modal also moved the page behind it. No admin modal ever locked body scroll: the overlay covers the page but does not absorb wheel events, so a scroll starting on the backdrop — or continuing past the end of the modal's own scroller — reaches the document. overscroll-behavior cannot cover that case on its own, because it only applies to scroll containers and the backdrop is not one. useScrollLock freezes body while a modal is open and compensates for the width the scrollbar gives up, so nothing shifts underneath. Each lock restores the inline value it found, which makes nesting work without a counter — a picker opened from the drawer restores the drawer's hidden state instead of clearing it. Applied to both drawers and all four picker modals, which share the defect. overscroll-behavior: contain on the scrollers stops the chaining they can handle themselves. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com> * fix(security): allow unsafe-eval in CSP script-src during dev mode * feat(journal): add Journal Studio with split-screen editor, live preview and dedicated routes * fix(build): separate client parser from server journal-service and fix build type errors * fix(journal): Fotos rendern, Layout und Lightbox-Steuerung korrigieren Fünf unabhängige Fehler in der öffentlichen Journal- und Essay-Ansicht: * Foto-Blöcke wurden nie angezeigt. EssayView löst ein Foto über PhotoItem.id auf, und das sind verschlüsselte Tokens — die Blöcke aus dem Markdown tragen aber rohe Asset-UUIDs. Jede Zuordnung lief ins Leere, und nicht auflösbare Blöcke werden still verworfen. Die IDs werden jetzt serverseitig übersetzt; damit verschwinden nebenbei die rohen UUIDs aus dem Client-Payload, die dort laut Projektregel nie auftauchen dürfen. Nicht auflösbare Referenzen werden geloggt. * Überschriften standen weiter links als der Fließtext. Jeder Block hatte einzeln `max-width: 68ch`, und `ch` ist relativ zur Schrift des Elements — die Serif-Überschrift ergab eine breitere Spalte. Ersetzt durch eine gemeinsame, font-unabhängige `--essay-measure`. * Fullbleed-Fotos bluteten nur nach links aus: `.essay-figure` ist `width: 100%`, wodurch die Box überbestimmt ist und der negative rechte Margin verworfen wird. * Foto-Paare stellten beide Bilder gleich breit dar, wodurch ein Hochformat neben einem Querformat doppelt so hoch wurde. Jetzt eine Justified-Reihe: Breite proportional zum Seitenverhältnis, dadurch exakt gleiche Höhen ohne Beschnitt. * Die Lightbox hatte im Journal keine Tastatursteuerung und keine Scroll-Sperre — beides lag in PhotoGrid, also nur im Album-Raster. Verlagert in die Lightbox selbst, der doppelte Handler in PhotoGrid entfernt (sonst wäre pro Pfeildruck zwei Bilder weitergesprungen). Zusätzlich sind Proofing-Herzen und das EXIF-Panel im redaktionellen Modus abschaltbar und im Journal aus: Client-Proofing ist ein Übergabe-Workflow für Alben, keine Funktion einer Reportage. Auf der Übersicht wurde der Untertitel doppelt gerendert, weil extractExcerpt() auf ihn zurückfällt. * feat(admin): eigene URLs für alle Bereiche und überarbeiteter Journal Studio Das Panel war eine einzige Client-Komponente, die ihre Tabs über useState umschaltet: keine Route pro Bereich, kein Deep-Link, kein Zurück-Button, und nach jedem Reload landete man wieder auf "Pages". Auch der Journal-Editor hatte keine eigene URL. Jetzt sieben echte Routen (/admin, /admin/pages, /admin/journal, /admin/journal/<slug>, /admin/settings, /admin/settings/<section>, /admin/analytics). Die Shell mit Auth-Prüfung und Kopfzeile sitzt im Layout und umschließt children — so bleibt die Session-Prüfung über Routenwechsel montiert, statt bei jedem Tab-Wechsel neu zu laufen und den Spinner aufblitzen zu lassen. Unbekannte Settings-Sections fallen auf General zurück. Im selben Zug der Journal Studio, der die Routing-Änderung ohnehin berührt: * Alle Eingabefelder nutzten die Klasse `admin-input`, die in keinem CSS definiert war — sie fielen auf Browser-Defaults zurück. Jetzt gestylt, gescoped, damit der generische Name nicht ins übrige Panel leckt. * Der Split View ist per Divider verschiebbar (Maus, Tastatur, Doppelklick zum Zurücksetzen), Breite in localStorage. * Das Studio bricht aus der 1120px-Spalte aus, die Preview hat Platz. * Die Preview zeigte für jedes Foto fest 3:2 und log damit über das Layout der veröffentlichten Seite; die echten Verhältnisse werden jetzt an den Thumbnails gemessen. * Blöcke mit alten positionsbasierten Foto-Referenzen werden markiert — die lassen sich auf einer eigenständigen Journal-Seite nicht auflösen und verschwanden bisher stillschweigend. * Blocktyp-Chips als gemeinsame Komponente, monochrom und per Icon unterschieden statt in einer eigenen Blau/Lila/Orange-Palette, die sonst nirgends im Panel vorkommt. * Emojis raus, SVG-Icons rein. * fix(admin): Designsystem-Lücken im Panel schließen Eine systematische Suche nach Klassen, die im TSX benutzt, aber in keinem CSS definiert sind, hat vier Stellen mit demselben Muster gefunden: * `admin-btn-secondary` und `admin-btn-danger` existierten nicht. Sämtliche Löschen-Buttons sahen aus wie normale Buttons — keine Warnwirkung. Als `.admin-btn.admin-btn-danger` geschrieben, weil die Varianten mit den Größenklassen kombiniert werden, die weiter unten ihren eigenen Hintergrund setzen. * `page-progress-fill` fehlte: die Balken im Analytics-Panel waren leere Rinnen, der Wert unsichtbar. Ebenso `analytics-empty` und `admin-loading-container`. * `subpage-drawer-section`, `subpage-drawer-title-group` und `input-with-icon` im PageBuilder waren wirkungslos und teils mit Inline-Styles notdürftig kompensiert. * `grid-card-preview` fehlte, wodurch alle Layout-Vorschauen auf Höhe null kollabierten. Nur "Showcase" war sichtbar — und das aus Versehen, weil sein Tile `hero-tile` hieß und damit die `aspect-ratio` einer fremden PageBuilder-Klasse erbte. Umbenannt. Dazu die Theme-Vorschauen, die praktisch identisch aussahen: alle sieben zeigten dieselben drei quadratischen Kacheln, einziger Unterschied war die Hintergrundfarbe. Sie spiegeln jetzt die echten Preset-Daten aus lib/config/theme.ts — Schriftcharakter, Eckradius, Rasterdichte, Passepartout bzw. Schatten. Die Kopfzeile richtet sich an einer gemeinsamen Steuerhöhe aus. Der "Site"-Link war höher als die Buttons daneben: `.admin-btn` hatte keine explizite line-height, und <button> bekommt box-sizing: border-box vom Browser, <a> nicht. Die Statusanzeige setzte weder Schriftfamilie noch -größe und fiel auf den Browser-Default zurück — sie war nie Teil des Designsystems. Jetzt gleiche Höhe und Typografie, Pillenform als Zustandsanzeige, Trenner zur Aktionsgruppe. Das dauerhafte Pulsieren des grünen Punkts entfällt; Animation bleibt den Zuständen vorbehalten, die Aufmerksamkeit brauchen. Restliche Emojis durch SVG-Icons ersetzt. * feat(admin): add scroll-to-top toggle and SVG arrow The back-to-top button was always on and drew its arrow with the ↑ text character. Add a `scrollToTop` setting (General section in the admin panel, defaults to on so existing sites are unaffected) and replace the glyph with a stroked SVG that inherits currentColor across all presets. Scroll handling is now rAF-throttled, and prefers-reduced-motion turns off both the hover lift and the smooth scroll. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * security(journal): escape author HTML instead of filtering it CodeQL flags 26 high-severity alerts on the release PR; the bulk of them point at sanitizeHtml(), a denylist of three regexes whose output goes into dangerouslySetInnerHTML. I reproduced the bypasses before changing anything — all four pass the old filter: <img src=x onerror=alert(1)> unquoted handler, regex wants quotes <img src=x onerror='alert(1)'> single quotes, same reason <svg onload=alert(1)> not a <script> tag javasjavascript:cript:alert(1) one-pass replace, the rest recombines Plus an attribute breakout in the link renderer, which interpolated the URL into href="${url}" unescaped: [x](" onmouseover=alert(1) x=") -> <a href="" onmouseover=alert(1" ...> Replaced with escaping. Every `&<>"'` in author text becomes an entity before any markdown rule runs, so the only tags in the output are the ones renderInlineMarkdown builds itself and a URL cannot leave its attribute. Link schemes are now an allowlist (http, https, mailto, tel, relative, anchor); anything else renders as plain text. The serializer needed decodeHtmlEntities to match: without it a save would write `&lt;` into the Markdown file and the next parse would escape the `&` again, corrupting the text further on every round trip. A test covers parse -> serialize -> parse stability. Two existing tests asserted the old behaviour and were rewritten rather than deleted: one expected the script tag to be *removed* from the output, the other expected the substring "onerror" to be absent. Both now assert the property that matters — that no tag can form — because `onerror` surviving as inert text is fine. Exploitation required admin access either way: journal and essay text comes from the studio or from content/*.md. This removes the weakness, it does not close an open door. * fix(journal): contain file paths, fix frontmatter escaping, defuse two regexes Follow-up to the CodeQL findings on release PR #432. I went through all 23 alerts individually; this addresses the ones that are worth addressing and documents the ones that are not. Path containment (12 alerts, all false positives). Every path built from a slug goes through isValidSlug(), a strict `/^[a-zA-Z0-9_-]+$/` allowlist — verified against `../../etc/passwd`, `foo/../../bar`, `a/b`, `..` and friends, all rejected. CodeQL cannot see it because the check lives in another module. Added a containedPath() helper that resolves the path and refuses anything landing outside the content directory: a second lock on a door that was already locked, and a barrier the analysis can follow. Also removed the dead `slug.endsWith('.md')` branches — isValidSlug rejects dots, so they could never be taken. Frontmatter escaping (1 alert, a real bug). The serializer escaped `"` but not `\`, and the parser never unescaped anything. A title containing either character gained a backslash on every save/load cycle: Path C:\Users "quoted" -> Path C:\\Users \"quoted\" -> ... Escaping now covers the backslash first and the parser undoes both. A round trip test covers quotes, backslashes, colons and apostrophes. Two of three ReDoS regexes (2 alerts). The heading pattern had `\s+` next to `(.+)`, which overlap, so the engine tried every split of the whitespace run before failing; it is `[ \t]+` and `(\S.*)` now. The quote author pattern wrapped a lazy group around an optional group — the quadratic case — and is an index split on the first separator now. The third regex, the bold/italic pass, is deliberately left alone. Rewriting it with a negated class removes the backtracking but breaks nesting: `**bold *and italic* here**` renders as `*<em>bold </em>and italic<em> here</em>*`. The input is Markdown from an authenticated admin, never a visitor, so the worst case is an author slowing down their own page. The comment in the code says so. Not addressed: 5 js/insufficient-password-hash alerts. They ask for a slow KDF where the code uses SHA-256/HMAC — correct in general, but the admin password comes from an environment variable and is never stored, so a stronger KDF protects nothing that is not already in plaintext in the environment. 399 unit tests pass (18 new), build and tsc clean. * fix(journal): split the quote author by scanning, not by pattern Cleaning up after myself. #439 replaced the quote author regex `/^(.*?)(?:\s+--\s+(.+))?$/` — a lazy group around an optional one, the quadratic case — with `/\s+--\s+/`, and CodeQL promptly flagged the replacement for the same reason. One reported pattern traded for another. splitQuoteAuthor() scans for the first `--` that has whitespace on both sides. Linear, and it needs no reasoning about the regex engine at all. Behaviour is identical to the original regex, checked case by case against it: separator, no separator, several separators, tabs, wide gaps, `a--b` without spaces, leading and trailing separators, empty string. All nine are covered by tests, plus one asserting it stays fast on a 50k whitespace run. * security(admin): derive the session signing key with scrypt getSigningKey() ran the admin password through a single SHA-256 digest. It is key derivation rather than password storage, so it was never a stored-hash problem — but if the derived key ever leaked, one fast hash makes recovering the password by brute force cheap. CodeQL flags it as js/insufficient-password-hash and, for this particular alert, has a point. scrypt now. Two details that matter: The salt has to be stable. A random salt would produce a different key on every call and invalidate every session; it is derived from AUTH_SECRET, which is deployment-specific. Verified across separate processes: same inputs produce a verifying token, so a restart or redeploy does not log everyone out. The result is cached for the process lifetime. scrypt is deliberately slow and getSigningKey() runs on every admin request — deriving per call would add ~24ms to each one. The cache key is a digest of secret plus password, so a rotation misses the cache and derives again, and no extra plaintext copy of the password is kept around. Measured: first derivation 24ms, subsequent calls 0.12ms. Password change and secret change both invalidate an existing token, checked in separate processes. Note the one-time effect: existing admin sessions are invalidated by the change in derivation, so everyone logs in once more. * security(admin): key the signing-key cache on its inputs, not a digest #441 removed the SHA-256 digest of the admin password from the key derivation and introduced a new one three lines above it, as the cache key. Same rule, same file: CodeQL reported it immediately. The comment justifying it was wrong too. It claimed no second plaintext copy of the password was retained, while building the digest input allocates exactly that in order to hash it. The cache now holds the two input strings and compares them directly. They are the same objects the env and install caches already hold, so nothing extra is retained, and no fast hash of the password exists in memory for the life of the process. Re-verified after the change, in separate processes: a token from one process verifies in another with the same inputs, a changed password or secret rejects it, first derivation 24ms, cached calls 0.001ms. That leaves scrypt as the only place the password is hashed here. The two HMACs further down operate on the derived key and on token data, not on the password; the constant-time comparison in verifyAdminPassword is the previously dismissed one. --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
2026-08-14 16:55:07 +02:00
display: inline-flex;
feat(admin): visual theme cards, album search, and status dashboard (#241) * feat(admin): implement visual theme cards, album search, and system status diagnostics * fix(admin): resolve type-checking build errors in SettingsEditor and status route --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-05-31 21:17:52 +02:00
align-items: center;
release: v0.11.0 — journal fixes, admin URLs, design system cleanup (#432) * fix(screenshots): sharp-Typen fuer 0.34 und 0.35 gleichzeitig (#410) sharp 0.35 ist von `export =` auf ESM umgestellt: der Modul-Namespace ist nicht mehr aufrufbar, die Factory sitzt unter .default. Der Type-Check brach damit in scripts/screenshots.ts weg, sobald der Next-Bump (#402) sharp von 0.34.5 auf 0.35.3 mitzieht -- sharp ist hier keine deklarierte Dependency, sondern kommt ueber Next mit. Die Form wird jetzt aus dem installierten Paket abgeleitet statt festgeschrieben, zur Laufzeit wie im Typ. Geprueft mit beiden Versionen: tsc laeuft mit 0.34.5 und mit 0.35.3 fehlerfrei durch. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(deps): bump the nextjs group across 1 directory with 2 updates (#402) Bumps the nextjs group with 2 updates in the / directory: [next](https://github.com/vercel/next.js) and [eslint-config-next](https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next). Updates `next` from 16.2.12 to 16.3.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/compare/v16.2.12...v16.3.0) Updates `eslint-config-next` from 16.2.12 to 16.3.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/commits/v16.3.0/packages/eslint-config-next) --- updated-dependencies: - dependency-name: eslint-config-next dependency-version: 16.3.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: nextjs - dependency-name: next dependency-version: 16.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nextjs ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps-dev): bump prettier from 3.8.3 to 3.9.6 (#405) Bumps [prettier](https://github.com/prettier/prettier) from 3.8.3 to 3.9.6. - [Release notes](https://github.com/prettier/prettier/releases) - [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md) - [Commits](https://github.com/prettier/prettier/compare/3.8.3...3.9.6) --- updated-dependencies: - dependency-name: prettier dependency-version: 3.9.6 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * docs(changelog): Unreleased-Sektion fuer die Bumps nach v0.10.0 (#413) Die Dependency-PRs sind nach dem Release auf dev gelandet, teils auch auf main. Ohne Eintrag waeren sie beim naechsten Release unsichtbar -- inklusive Next 16.3.0, das CVE-2025-13465 mitbringt. Ausserdem im 0.10.0-Abschnitt nachgetragen, dass der Trivy-Scan bis #409 nie gelaufen ist. Der Fix steckt im Tag v0.10.0, fehlte aber in der Aufzaehlung -- und "Images werden bei jedem Publish gescannt" stand im Changelog, waehrend der Job im Action-Setup abbrach. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(gallery): per-album sort order, independent of Immich (#408) (#414) Album order was dictated entirely by Immich: getAlbum() sorted by the album's own asc/desc flag, so a Folio album always mirrored the archive. A curated series has a narrative order that has nothing to do with capture time, and changing the Immich album's sort to fit the website changes it for the archive too. Adds an optional per-album `sort` in gallery.yaml, editable in /admin, defaulting to today's behaviour so every existing config is unchanged: immich (default) | newest | oldest | filename | manual `manual` is a pinned *prefix*: `assetOrder` lists only the photos placed by hand, everything else follows in the album's Immich order. A full permutation of a 2,000-photo album would be ~80 KB of UUIDs in a file that is rewritten and copied to content/.backups/ on every admin save. It also makes drift fall out for free — photos removed in Immich never match, new ones land in the tail rather than being hidden. Sorting is applied after the cache read, not before the cache write, so the LRU keeps one canonical Immich-ordered copy per album. That avoids putting the mode in the cache key, lets a config change take effect without depending on invalidation, and keeps the stale-serving path correct. cache.get() returns the stored object by reference, so withSort() returns a shallow clone with a new array — sorting in place would reorder the shared entry, and under request coalescing every concurrent caller would be sorting the same array. Also fixes a prerequisite bug: /api/admin/albums/[albumId]/assets read album.assets from GET /albums/:id, which Immich 3.x no longer populates (lib/immich.ts:507). The hero picker's "This Album" tab returned nothing and threw outright when the key was absent. It now goes through the client's paginated metadata search, with ?types=all to opt videos in for the reorder editor. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): drop decorative emoji from the sort select labels (#415) An <option> cannot contain markup, so the SVG set in Icons is not reachable there — but a decorative emoji is not a substitute for it. Plain text instead; the album card badge already uses a real icon. The remaining emoji in the admin panel (asset picker tabs, section headings, layout picker options) predate this branch and are left for a separate cleanup. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): replace emoji icons with the shared SVG icon set (#416) The admin panel mixed two icon conventions: inline SVGs from `Icons.tsx` in most components, and decorative emoji in the asset picker and a few PageBuilder labels. Emoji render inconsistently across platforms, ignore the accent colour, and cannot inherit the `.svg-icon` sizing rules. - Icons.tsx: add `IconStar` (filled — it marks a state, not an action) and `IconImage`. - AssetPicker: the three tab labels and the favourite tile badge now use IconFolder / IconStar / IconImage. - PageBuilder: the "Standalone Albums" and "Subpages" headings use the icon set instead of an emoji. - PageBuilder: the layout picker drops its emoji for plain text. An <option> cannot contain markup, so an SVG is impossible there and a decorative glyph is not a substitute. - admin.css: align icon and label in the picker tabs, and swap the favourite badge's text-shadow for drop-shadow, which is what applies to an inline SVG. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): fold PageBuilder's local icons into the shared Icons module (#418) * refactor(admin): fold PageBuilder's local icons into the shared module PageBuilder.tsx carried its own `Icons` object duplicating most of the glyphs already exported by Icons.tsx, with hardcoded sizes and slightly divergent paths. Migrate all 32 call sites to the shared module and delete the local object. Five glyphs had no counterpart and are added to Icons.tsx as 1:1 ports of the local paths: IconX, IconPlus, IconHome, IconCopy, IconImage. The local ExternalLink and Check are dropped rather than ported — both had zero call sites. Two glyphs change shape slightly, which is the point of consolidating: the shared IconCamera includes the viewfinder bump the local copy omitted, and drag handles now use IconGripVertical. IconGripVertical uses the module's square 24x24 viewBox, so `.svg-drag` goes from 12x18 to 18x18 — the old non-square box would letterbox the glyph down to 12x12 and shrink the handle. * fix(admin): resolve icon-module integration after #416 Merging dev brought in #416, which added a second IconImage to Icons.tsx and two <Icons.Camera>/<Icons.Folder> section headers that reference the local Icons object this PR removes. Git merged both cleanly but the result did not type-check. - drop the duplicate IconImage (both copies were byte-identical) - point the two section headers at the imported IconCamera/IconFolder - refresh the SORT_LABELS comment: the icon set is imported now, not declared below --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> * fix(config): allow an empty gallery, guard against a double /api suffix (#421) An empty gallery is now a valid, rendered state instead of a throw: deriveGallery() no longer requires at least one album or subpage, so a deployment with no albums yet renders a bare homepage the owner can fill in via /admin. getConfig() also stops appending /api to an Immich URL that already ends in it, which previously produced .../api/api and broke every upstream request. Includes a restore of the per-album sort test cases, which the branch had lost by being cut before #408/#414. * feat(admin): favicon upload, served from the content volume (#422) Adds a bundled default favicon, an upload widget in admin Settings > General, and a route that serves the icon from the writable content/ volume with a fallback to the bundled default. Raster uploads (PNG/ICO/JPEG) are wrapped in an SVG container; the response carries its own CSP so an uploaded SVG cannot execute script on the origin. The GET route revalidates with an ETag instead of caching immutably, so a newly uploaded icon shows up immediately. Uploads are written via temp file + rename, and a Reset button restores the bundled default. * ci: flag unformatted files in a PR, without blocking it (#424) Prettier is configured as an error rule in eslint.config.mjs but has never run in CI, so part of the tree predates it. A final CI step now diffs against the PR base, runs prettier --list-different over the changed files, and emits a warning annotation per offender plus a job summary. Advisory by design: it never fails the job. Blocking would turn a PR red for merely touching a file that was already unformatted, and normalising the tree in one commit would wreck git blame and conflict with the PRs in flight. Requires fetch-depth: 0, since diffing against the base needs its history. * feat(install): first-run wizard gated by a one-time setup token (#419) Adds /install, a four-step first-run wizard: connect to Immich, optionally pick albums, name the site, finish. It verifies the credentials against the Immich server before writing anything, then writes gallery.yaml, settings.yaml and a content/install.json carrying the Immich credentials and a generated site secret. install.json exists because a running process cannot pick up new env vars — the wizard has to write configuration that takes effect without a restart. getInstallCredentials() merges it under the real environment, so env vars always win and rotation stays a matter of setting one. Both the page and the API routes are gated by a one-time setup token printed to the server log, so a deployment that is reachable before gallery.yaml exists cannot be configured by whoever finds it first. The token is stored in content/.setup-token (0600) rather than a module variable: Next.js bundles the page and each route handler separately, so a module-level token left the page and the API disagreeing inside one process and the wizard stuck on step 1. It is removed once the install completes. The admin password is stored as an scrypt hash using the scheme lib/auth.ts already applies to album passwords; a plaintext ADMIN_PASSWORD env var keeps working. * docs: document the setup wizard, fix the read-only content mount (#425) Quick Start now leads with the /install wizard, with the hand-written YAML route kept alongside it, and a First-Run Setup section covers the setup token, the files the wizard writes, and env-var precedence. Two corrections: both Docker examples mounted content/ as :ro, which silently breaks the wizard, the admin panel and the backup rotation alike — docs/admin-panel.md already said so and the README contradicted it. And nothing documented that content/install.json holds the Immich API key, so a backup of content/ is a backup of credentials. Also adds a Contributors section crediting the people whose work is in the project. * feat(admin): floating save bar pinned to the bottom of the viewport (#426) The save bar was the first, static element inside .admin-main. Since the document itself scrolls, it left the viewport as soon as you scrolled down — editing a subpage section or a settings block far below gave no visible dirty hint and no reachable save button. Replace it with a bottom-pinned floating bar shared by both editors. It only mounts while there is something to act on (unsaved changes, an in-flight save, or a result message), so it never covers content while idle. The success message clears after 5s, which hides the bar again. - new SaveBar component, replacing the duplicated markup in PageBuilder and SettingsEditor - adopt the previously unused .floating-save-bar CSS: slide-in keyframes (carrying translateX(-50%)), dirty border, wrap/gap, mobile variant and a prefers-reduced-motion opt-out; z-index 900 keeps it below modals - .admin-main gains bottom padding so the bar never covers page content - drop the now-unreachable idle hints: the ⌘S hint becomes a button title, the Live Sync note becomes a static line above the settings layout - header "Site" link now bypasses the cache (/?fresh=1), so the preview stays reachable when the bar is hidden Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(admin): themed listbox for the album sort control (#427) The per-album "Photo order" control was a native <select>. Because an <option> cannot contain markup, its choices could not use the admin panel's currentColor SVG set — the reason #415 had to fall back to plain text after dropping the emoji labels. Adds a Listbox component implementing the ARIA combobox/listbox pattern, so options can render a glyph beside their label: - DOM focus stays on the trigger button; the active option is announced through aria-activedescendant, keeping focus management to one element - Keyboard: arrows (clamped at the ends, like a native select), Home/End, Enter/Space to commit, Escape to cancel, Tab commits and moves on, and prefix type-ahead with a repeat-key cycle - Outside dismissal on pointerdown, so a press starting outside closes the popup before the click retargets The sort options now carry an icon each: calendar, arrow-down, arrow-up, an A→Z marker, and the drag glyph for manual — matching the badge the album card already shows. SORT_LABELS stays plain text because the badge feeds it to a title attribute. Closes #417 Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(git): ignore generated design handoff folders * fix(admin): stop the album sort dropdown clipping, and simplify the panel (#428) * fix(admin): render listbox popup in a portal so it escapes modal clipping The sort control's popup was position:absolute inside three clipping ancestors (.album-drawer overflow:hidden > .album-drawer-body overflow-y:auto > .modal-right-column overflow-y:auto), so it was cut off at the bottom of the Edit Album Details modal. z-index could not help: clipping happens before stacking. It also always hung below the trigger, with no flip. Portal the popup to document.body and position it from the trigger's viewport rect, flipping above when there is more room there and capping max-height to the space available so it scrolls internally rather than overflowing. It is dismissed on scroll and resize, since the anchor is only measured on open. The outside-pointerdown handler now also treats the popup as inside; without that the portalled list counts as outside, and a click on an option would close it before the selection commits. * refactor(admin): single-column album details panel The left column spent 1.2fr on a cover thumbnail and three stat rows, two of which (Status, Custom Hero) only restated the form fields opposite them, while the form itself was squeezed into 1.8fr behind a second nested scroller. Stack the drawer in one column instead: cover as a banner, then the form at full width, with the UUID moved into the footer. The body is now the only scroll container, which also removes one of the ancestors that was clipping the sort popup. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> * fix(admin): give the portalled listbox its theme back, lock the page behind modals (#429) Two defects in the album editor. The sort listbox popup painted transparent. Every --admin-* variable is scoped to .admin-layout, and since the popup moved into document.body it sits outside that subtree, so background/border/text all resolved to nothing. It now carries its own copy of the palette in both colour schemes, plus the font it no longer inherits. Scrolling inside a modal also moved the page behind it. No admin modal ever locked body scroll: the overlay covers the page but does not absorb wheel events, so a scroll starting on the backdrop — or continuing past the end of the modal's own scroller — reaches the document. overscroll-behavior cannot cover that case on its own, because it only applies to scroll containers and the backdrop is not one. useScrollLock freezes body while a modal is open and compensates for the width the scrollbar gives up, so nothing shifts underneath. Each lock restores the inline value it found, which makes nesting work without a counter — a picker opened from the drawer restores the drawer's hidden state instead of clearing it. Applied to both drawers and all four picker modals, which share the defect. overscroll-behavior: contain on the scrollers stops the chaining they can handle themselves. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com> * fix(security): allow unsafe-eval in CSP script-src during dev mode * feat(journal): add Journal Studio with split-screen editor, live preview and dedicated routes * fix(build): separate client parser from server journal-service and fix build type errors * fix(journal): Fotos rendern, Layout und Lightbox-Steuerung korrigieren Fünf unabhängige Fehler in der öffentlichen Journal- und Essay-Ansicht: * Foto-Blöcke wurden nie angezeigt. EssayView löst ein Foto über PhotoItem.id auf, und das sind verschlüsselte Tokens — die Blöcke aus dem Markdown tragen aber rohe Asset-UUIDs. Jede Zuordnung lief ins Leere, und nicht auflösbare Blöcke werden still verworfen. Die IDs werden jetzt serverseitig übersetzt; damit verschwinden nebenbei die rohen UUIDs aus dem Client-Payload, die dort laut Projektregel nie auftauchen dürfen. Nicht auflösbare Referenzen werden geloggt. * Überschriften standen weiter links als der Fließtext. Jeder Block hatte einzeln `max-width: 68ch`, und `ch` ist relativ zur Schrift des Elements — die Serif-Überschrift ergab eine breitere Spalte. Ersetzt durch eine gemeinsame, font-unabhängige `--essay-measure`. * Fullbleed-Fotos bluteten nur nach links aus: `.essay-figure` ist `width: 100%`, wodurch die Box überbestimmt ist und der negative rechte Margin verworfen wird. * Foto-Paare stellten beide Bilder gleich breit dar, wodurch ein Hochformat neben einem Querformat doppelt so hoch wurde. Jetzt eine Justified-Reihe: Breite proportional zum Seitenverhältnis, dadurch exakt gleiche Höhen ohne Beschnitt. * Die Lightbox hatte im Journal keine Tastatursteuerung und keine Scroll-Sperre — beides lag in PhotoGrid, also nur im Album-Raster. Verlagert in die Lightbox selbst, der doppelte Handler in PhotoGrid entfernt (sonst wäre pro Pfeildruck zwei Bilder weitergesprungen). Zusätzlich sind Proofing-Herzen und das EXIF-Panel im redaktionellen Modus abschaltbar und im Journal aus: Client-Proofing ist ein Übergabe-Workflow für Alben, keine Funktion einer Reportage. Auf der Übersicht wurde der Untertitel doppelt gerendert, weil extractExcerpt() auf ihn zurückfällt. * feat(admin): eigene URLs für alle Bereiche und überarbeiteter Journal Studio Das Panel war eine einzige Client-Komponente, die ihre Tabs über useState umschaltet: keine Route pro Bereich, kein Deep-Link, kein Zurück-Button, und nach jedem Reload landete man wieder auf "Pages". Auch der Journal-Editor hatte keine eigene URL. Jetzt sieben echte Routen (/admin, /admin/pages, /admin/journal, /admin/journal/<slug>, /admin/settings, /admin/settings/<section>, /admin/analytics). Die Shell mit Auth-Prüfung und Kopfzeile sitzt im Layout und umschließt children — so bleibt die Session-Prüfung über Routenwechsel montiert, statt bei jedem Tab-Wechsel neu zu laufen und den Spinner aufblitzen zu lassen. Unbekannte Settings-Sections fallen auf General zurück. Im selben Zug der Journal Studio, der die Routing-Änderung ohnehin berührt: * Alle Eingabefelder nutzten die Klasse `admin-input`, die in keinem CSS definiert war — sie fielen auf Browser-Defaults zurück. Jetzt gestylt, gescoped, damit der generische Name nicht ins übrige Panel leckt. * Der Split View ist per Divider verschiebbar (Maus, Tastatur, Doppelklick zum Zurücksetzen), Breite in localStorage. * Das Studio bricht aus der 1120px-Spalte aus, die Preview hat Platz. * Die Preview zeigte für jedes Foto fest 3:2 und log damit über das Layout der veröffentlichten Seite; die echten Verhältnisse werden jetzt an den Thumbnails gemessen. * Blöcke mit alten positionsbasierten Foto-Referenzen werden markiert — die lassen sich auf einer eigenständigen Journal-Seite nicht auflösen und verschwanden bisher stillschweigend. * Blocktyp-Chips als gemeinsame Komponente, monochrom und per Icon unterschieden statt in einer eigenen Blau/Lila/Orange-Palette, die sonst nirgends im Panel vorkommt. * Emojis raus, SVG-Icons rein. * fix(admin): Designsystem-Lücken im Panel schließen Eine systematische Suche nach Klassen, die im TSX benutzt, aber in keinem CSS definiert sind, hat vier Stellen mit demselben Muster gefunden: * `admin-btn-secondary` und `admin-btn-danger` existierten nicht. Sämtliche Löschen-Buttons sahen aus wie normale Buttons — keine Warnwirkung. Als `.admin-btn.admin-btn-danger` geschrieben, weil die Varianten mit den Größenklassen kombiniert werden, die weiter unten ihren eigenen Hintergrund setzen. * `page-progress-fill` fehlte: die Balken im Analytics-Panel waren leere Rinnen, der Wert unsichtbar. Ebenso `analytics-empty` und `admin-loading-container`. * `subpage-drawer-section`, `subpage-drawer-title-group` und `input-with-icon` im PageBuilder waren wirkungslos und teils mit Inline-Styles notdürftig kompensiert. * `grid-card-preview` fehlte, wodurch alle Layout-Vorschauen auf Höhe null kollabierten. Nur "Showcase" war sichtbar — und das aus Versehen, weil sein Tile `hero-tile` hieß und damit die `aspect-ratio` einer fremden PageBuilder-Klasse erbte. Umbenannt. Dazu die Theme-Vorschauen, die praktisch identisch aussahen: alle sieben zeigten dieselben drei quadratischen Kacheln, einziger Unterschied war die Hintergrundfarbe. Sie spiegeln jetzt die echten Preset-Daten aus lib/config/theme.ts — Schriftcharakter, Eckradius, Rasterdichte, Passepartout bzw. Schatten. Die Kopfzeile richtet sich an einer gemeinsamen Steuerhöhe aus. Der "Site"-Link war höher als die Buttons daneben: `.admin-btn` hatte keine explizite line-height, und <button> bekommt box-sizing: border-box vom Browser, <a> nicht. Die Statusanzeige setzte weder Schriftfamilie noch -größe und fiel auf den Browser-Default zurück — sie war nie Teil des Designsystems. Jetzt gleiche Höhe und Typografie, Pillenform als Zustandsanzeige, Trenner zur Aktionsgruppe. Das dauerhafte Pulsieren des grünen Punkts entfällt; Animation bleibt den Zuständen vorbehalten, die Aufmerksamkeit brauchen. Restliche Emojis durch SVG-Icons ersetzt. * feat(admin): add scroll-to-top toggle and SVG arrow The back-to-top button was always on and drew its arrow with the ↑ text character. Add a `scrollToTop` setting (General section in the admin panel, defaults to on so existing sites are unaffected) and replace the glyph with a stroked SVG that inherits currentColor across all presets. Scroll handling is now rAF-throttled, and prefers-reduced-motion turns off both the hover lift and the smooth scroll. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * security(journal): escape author HTML instead of filtering it CodeQL flags 26 high-severity alerts on the release PR; the bulk of them point at sanitizeHtml(), a denylist of three regexes whose output goes into dangerouslySetInnerHTML. I reproduced the bypasses before changing anything — all four pass the old filter: <img src=x onerror=alert(1)> unquoted handler, regex wants quotes <img src=x onerror='alert(1)'> single quotes, same reason <svg onload=alert(1)> not a <script> tag javasjavascript:cript:alert(1) one-pass replace, the rest recombines Plus an attribute breakout in the link renderer, which interpolated the URL into href="${url}" unescaped: [x](" onmouseover=alert(1) x=") -> <a href="" onmouseover=alert(1" ...> Replaced with escaping. Every `&<>"'` in author text becomes an entity before any markdown rule runs, so the only tags in the output are the ones renderInlineMarkdown builds itself and a URL cannot leave its attribute. Link schemes are now an allowlist (http, https, mailto, tel, relative, anchor); anything else renders as plain text. The serializer needed decodeHtmlEntities to match: without it a save would write `&lt;` into the Markdown file and the next parse would escape the `&` again, corrupting the text further on every round trip. A test covers parse -> serialize -> parse stability. Two existing tests asserted the old behaviour and were rewritten rather than deleted: one expected the script tag to be *removed* from the output, the other expected the substring "onerror" to be absent. Both now assert the property that matters — that no tag can form — because `onerror` surviving as inert text is fine. Exploitation required admin access either way: journal and essay text comes from the studio or from content/*.md. This removes the weakness, it does not close an open door. * fix(journal): contain file paths, fix frontmatter escaping, defuse two regexes Follow-up to the CodeQL findings on release PR #432. I went through all 23 alerts individually; this addresses the ones that are worth addressing and documents the ones that are not. Path containment (12 alerts, all false positives). Every path built from a slug goes through isValidSlug(), a strict `/^[a-zA-Z0-9_-]+$/` allowlist — verified against `../../etc/passwd`, `foo/../../bar`, `a/b`, `..` and friends, all rejected. CodeQL cannot see it because the check lives in another module. Added a containedPath() helper that resolves the path and refuses anything landing outside the content directory: a second lock on a door that was already locked, and a barrier the analysis can follow. Also removed the dead `slug.endsWith('.md')` branches — isValidSlug rejects dots, so they could never be taken. Frontmatter escaping (1 alert, a real bug). The serializer escaped `"` but not `\`, and the parser never unescaped anything. A title containing either character gained a backslash on every save/load cycle: Path C:\Users "quoted" -> Path C:\\Users \"quoted\" -> ... Escaping now covers the backslash first and the parser undoes both. A round trip test covers quotes, backslashes, colons and apostrophes. Two of three ReDoS regexes (2 alerts). The heading pattern had `\s+` next to `(.+)`, which overlap, so the engine tried every split of the whitespace run before failing; it is `[ \t]+` and `(\S.*)` now. The quote author pattern wrapped a lazy group around an optional group — the quadratic case — and is an index split on the first separator now. The third regex, the bold/italic pass, is deliberately left alone. Rewriting it with a negated class removes the backtracking but breaks nesting: `**bold *and italic* here**` renders as `*<em>bold </em>and italic<em> here</em>*`. The input is Markdown from an authenticated admin, never a visitor, so the worst case is an author slowing down their own page. The comment in the code says so. Not addressed: 5 js/insufficient-password-hash alerts. They ask for a slow KDF where the code uses SHA-256/HMAC — correct in general, but the admin password comes from an environment variable and is never stored, so a stronger KDF protects nothing that is not already in plaintext in the environment. 399 unit tests pass (18 new), build and tsc clean. * fix(journal): split the quote author by scanning, not by pattern Cleaning up after myself. #439 replaced the quote author regex `/^(.*?)(?:\s+--\s+(.+))?$/` — a lazy group around an optional one, the quadratic case — with `/\s+--\s+/`, and CodeQL promptly flagged the replacement for the same reason. One reported pattern traded for another. splitQuoteAuthor() scans for the first `--` that has whitespace on both sides. Linear, and it needs no reasoning about the regex engine at all. Behaviour is identical to the original regex, checked case by case against it: separator, no separator, several separators, tabs, wide gaps, `a--b` without spaces, leading and trailing separators, empty string. All nine are covered by tests, plus one asserting it stays fast on a 50k whitespace run. * security(admin): derive the session signing key with scrypt getSigningKey() ran the admin password through a single SHA-256 digest. It is key derivation rather than password storage, so it was never a stored-hash problem — but if the derived key ever leaked, one fast hash makes recovering the password by brute force cheap. CodeQL flags it as js/insufficient-password-hash and, for this particular alert, has a point. scrypt now. Two details that matter: The salt has to be stable. A random salt would produce a different key on every call and invalidate every session; it is derived from AUTH_SECRET, which is deployment-specific. Verified across separate processes: same inputs produce a verifying token, so a restart or redeploy does not log everyone out. The result is cached for the process lifetime. scrypt is deliberately slow and getSigningKey() runs on every admin request — deriving per call would add ~24ms to each one. The cache key is a digest of secret plus password, so a rotation misses the cache and derives again, and no extra plaintext copy of the password is kept around. Measured: first derivation 24ms, subsequent calls 0.12ms. Password change and secret change both invalidate an existing token, checked in separate processes. Note the one-time effect: existing admin sessions are invalidated by the change in derivation, so everyone logs in once more. * security(admin): key the signing-key cache on its inputs, not a digest #441 removed the SHA-256 digest of the admin password from the key derivation and introduced a new one three lines above it, as the cache key. Same rule, same file: CodeQL reported it immediately. The comment justifying it was wrong too. It claimed no second plaintext copy of the password was retained, while building the digest input allocates exactly that in order to hash it. The cache now holds the two input strings and compares them directly. They are the same objects the env and install caches already hold, so nothing extra is retained, and no fast hash of the password exists in memory for the life of the process. Re-verified after the change, in separate processes: a token from one process verifies in another with the same inputs, a changed password or secret rejects it, first derivation 24ms, cached calls 0.001ms. That leaves scrypt as the only place the password is hashed here. The two HMACs further down operate on the derived key and on token data, not on the password; the constant-time comparison in verifyAdminPassword is the previously dismissed one. --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
2026-08-14 16:55:07 +02:00
gap: 0.45rem;
padding: 0 0.85rem;
min-height: var(--admin-control-height);
fix: admin panel light/dark theme support, improved contrast, and backup confirmation a) Admin panel now respects the site's light/dark theme toggle via CSS custom properties that respond to [data-theme='light'] on <html>. All hardcoded dark colors replaced with semantic CSS variables. b) Improved contrast in dark mode: secondary text changed from #666/#555 to #a0a0a0, muted text from #555 to #707070. All text is now clearly readable against dark backgrounds. c) Backup system was already implemented in yaml-service.ts (creates timestamped backups in content/.backups/ before each save, keeps last 10 versions). Now the UI shows a confirmation message that a backup was created after each successful save.
2026-05-29 17:20:56 +02:00
background: var(--admin-bg-raised);
border: 1px solid var(--admin-border);
release: v0.11.0 — journal fixes, admin URLs, design system cleanup (#432) * fix(screenshots): sharp-Typen fuer 0.34 und 0.35 gleichzeitig (#410) sharp 0.35 ist von `export =` auf ESM umgestellt: der Modul-Namespace ist nicht mehr aufrufbar, die Factory sitzt unter .default. Der Type-Check brach damit in scripts/screenshots.ts weg, sobald der Next-Bump (#402) sharp von 0.34.5 auf 0.35.3 mitzieht -- sharp ist hier keine deklarierte Dependency, sondern kommt ueber Next mit. Die Form wird jetzt aus dem installierten Paket abgeleitet statt festgeschrieben, zur Laufzeit wie im Typ. Geprueft mit beiden Versionen: tsc laeuft mit 0.34.5 und mit 0.35.3 fehlerfrei durch. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(deps): bump the nextjs group across 1 directory with 2 updates (#402) Bumps the nextjs group with 2 updates in the / directory: [next](https://github.com/vercel/next.js) and [eslint-config-next](https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next). Updates `next` from 16.2.12 to 16.3.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/compare/v16.2.12...v16.3.0) Updates `eslint-config-next` from 16.2.12 to 16.3.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/commits/v16.3.0/packages/eslint-config-next) --- updated-dependencies: - dependency-name: eslint-config-next dependency-version: 16.3.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: nextjs - dependency-name: next dependency-version: 16.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nextjs ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps-dev): bump prettier from 3.8.3 to 3.9.6 (#405) Bumps [prettier](https://github.com/prettier/prettier) from 3.8.3 to 3.9.6. - [Release notes](https://github.com/prettier/prettier/releases) - [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md) - [Commits](https://github.com/prettier/prettier/compare/3.8.3...3.9.6) --- updated-dependencies: - dependency-name: prettier dependency-version: 3.9.6 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * docs(changelog): Unreleased-Sektion fuer die Bumps nach v0.10.0 (#413) Die Dependency-PRs sind nach dem Release auf dev gelandet, teils auch auf main. Ohne Eintrag waeren sie beim naechsten Release unsichtbar -- inklusive Next 16.3.0, das CVE-2025-13465 mitbringt. Ausserdem im 0.10.0-Abschnitt nachgetragen, dass der Trivy-Scan bis #409 nie gelaufen ist. Der Fix steckt im Tag v0.10.0, fehlte aber in der Aufzaehlung -- und "Images werden bei jedem Publish gescannt" stand im Changelog, waehrend der Job im Action-Setup abbrach. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(gallery): per-album sort order, independent of Immich (#408) (#414) Album order was dictated entirely by Immich: getAlbum() sorted by the album's own asc/desc flag, so a Folio album always mirrored the archive. A curated series has a narrative order that has nothing to do with capture time, and changing the Immich album's sort to fit the website changes it for the archive too. Adds an optional per-album `sort` in gallery.yaml, editable in /admin, defaulting to today's behaviour so every existing config is unchanged: immich (default) | newest | oldest | filename | manual `manual` is a pinned *prefix*: `assetOrder` lists only the photos placed by hand, everything else follows in the album's Immich order. A full permutation of a 2,000-photo album would be ~80 KB of UUIDs in a file that is rewritten and copied to content/.backups/ on every admin save. It also makes drift fall out for free — photos removed in Immich never match, new ones land in the tail rather than being hidden. Sorting is applied after the cache read, not before the cache write, so the LRU keeps one canonical Immich-ordered copy per album. That avoids putting the mode in the cache key, lets a config change take effect without depending on invalidation, and keeps the stale-serving path correct. cache.get() returns the stored object by reference, so withSort() returns a shallow clone with a new array — sorting in place would reorder the shared entry, and under request coalescing every concurrent caller would be sorting the same array. Also fixes a prerequisite bug: /api/admin/albums/[albumId]/assets read album.assets from GET /albums/:id, which Immich 3.x no longer populates (lib/immich.ts:507). The hero picker's "This Album" tab returned nothing and threw outright when the key was absent. It now goes through the client's paginated metadata search, with ?types=all to opt videos in for the reorder editor. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): drop decorative emoji from the sort select labels (#415) An <option> cannot contain markup, so the SVG set in Icons is not reachable there — but a decorative emoji is not a substitute for it. Plain text instead; the album card badge already uses a real icon. The remaining emoji in the admin panel (asset picker tabs, section headings, layout picker options) predate this branch and are left for a separate cleanup. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): replace emoji icons with the shared SVG icon set (#416) The admin panel mixed two icon conventions: inline SVGs from `Icons.tsx` in most components, and decorative emoji in the asset picker and a few PageBuilder labels. Emoji render inconsistently across platforms, ignore the accent colour, and cannot inherit the `.svg-icon` sizing rules. - Icons.tsx: add `IconStar` (filled — it marks a state, not an action) and `IconImage`. - AssetPicker: the three tab labels and the favourite tile badge now use IconFolder / IconStar / IconImage. - PageBuilder: the "Standalone Albums" and "Subpages" headings use the icon set instead of an emoji. - PageBuilder: the layout picker drops its emoji for plain text. An <option> cannot contain markup, so an SVG is impossible there and a decorative glyph is not a substitute. - admin.css: align icon and label in the picker tabs, and swap the favourite badge's text-shadow for drop-shadow, which is what applies to an inline SVG. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): fold PageBuilder's local icons into the shared Icons module (#418) * refactor(admin): fold PageBuilder's local icons into the shared module PageBuilder.tsx carried its own `Icons` object duplicating most of the glyphs already exported by Icons.tsx, with hardcoded sizes and slightly divergent paths. Migrate all 32 call sites to the shared module and delete the local object. Five glyphs had no counterpart and are added to Icons.tsx as 1:1 ports of the local paths: IconX, IconPlus, IconHome, IconCopy, IconImage. The local ExternalLink and Check are dropped rather than ported — both had zero call sites. Two glyphs change shape slightly, which is the point of consolidating: the shared IconCamera includes the viewfinder bump the local copy omitted, and drag handles now use IconGripVertical. IconGripVertical uses the module's square 24x24 viewBox, so `.svg-drag` goes from 12x18 to 18x18 — the old non-square box would letterbox the glyph down to 12x12 and shrink the handle. * fix(admin): resolve icon-module integration after #416 Merging dev brought in #416, which added a second IconImage to Icons.tsx and two <Icons.Camera>/<Icons.Folder> section headers that reference the local Icons object this PR removes. Git merged both cleanly but the result did not type-check. - drop the duplicate IconImage (both copies were byte-identical) - point the two section headers at the imported IconCamera/IconFolder - refresh the SORT_LABELS comment: the icon set is imported now, not declared below --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> * fix(config): allow an empty gallery, guard against a double /api suffix (#421) An empty gallery is now a valid, rendered state instead of a throw: deriveGallery() no longer requires at least one album or subpage, so a deployment with no albums yet renders a bare homepage the owner can fill in via /admin. getConfig() also stops appending /api to an Immich URL that already ends in it, which previously produced .../api/api and broke every upstream request. Includes a restore of the per-album sort test cases, which the branch had lost by being cut before #408/#414. * feat(admin): favicon upload, served from the content volume (#422) Adds a bundled default favicon, an upload widget in admin Settings > General, and a route that serves the icon from the writable content/ volume with a fallback to the bundled default. Raster uploads (PNG/ICO/JPEG) are wrapped in an SVG container; the response carries its own CSP so an uploaded SVG cannot execute script on the origin. The GET route revalidates with an ETag instead of caching immutably, so a newly uploaded icon shows up immediately. Uploads are written via temp file + rename, and a Reset button restores the bundled default. * ci: flag unformatted files in a PR, without blocking it (#424) Prettier is configured as an error rule in eslint.config.mjs but has never run in CI, so part of the tree predates it. A final CI step now diffs against the PR base, runs prettier --list-different over the changed files, and emits a warning annotation per offender plus a job summary. Advisory by design: it never fails the job. Blocking would turn a PR red for merely touching a file that was already unformatted, and normalising the tree in one commit would wreck git blame and conflict with the PRs in flight. Requires fetch-depth: 0, since diffing against the base needs its history. * feat(install): first-run wizard gated by a one-time setup token (#419) Adds /install, a four-step first-run wizard: connect to Immich, optionally pick albums, name the site, finish. It verifies the credentials against the Immich server before writing anything, then writes gallery.yaml, settings.yaml and a content/install.json carrying the Immich credentials and a generated site secret. install.json exists because a running process cannot pick up new env vars — the wizard has to write configuration that takes effect without a restart. getInstallCredentials() merges it under the real environment, so env vars always win and rotation stays a matter of setting one. Both the page and the API routes are gated by a one-time setup token printed to the server log, so a deployment that is reachable before gallery.yaml exists cannot be configured by whoever finds it first. The token is stored in content/.setup-token (0600) rather than a module variable: Next.js bundles the page and each route handler separately, so a module-level token left the page and the API disagreeing inside one process and the wizard stuck on step 1. It is removed once the install completes. The admin password is stored as an scrypt hash using the scheme lib/auth.ts already applies to album passwords; a plaintext ADMIN_PASSWORD env var keeps working. * docs: document the setup wizard, fix the read-only content mount (#425) Quick Start now leads with the /install wizard, with the hand-written YAML route kept alongside it, and a First-Run Setup section covers the setup token, the files the wizard writes, and env-var precedence. Two corrections: both Docker examples mounted content/ as :ro, which silently breaks the wizard, the admin panel and the backup rotation alike — docs/admin-panel.md already said so and the README contradicted it. And nothing documented that content/install.json holds the Immich API key, so a backup of content/ is a backup of credentials. Also adds a Contributors section crediting the people whose work is in the project. * feat(admin): floating save bar pinned to the bottom of the viewport (#426) The save bar was the first, static element inside .admin-main. Since the document itself scrolls, it left the viewport as soon as you scrolled down — editing a subpage section or a settings block far below gave no visible dirty hint and no reachable save button. Replace it with a bottom-pinned floating bar shared by both editors. It only mounts while there is something to act on (unsaved changes, an in-flight save, or a result message), so it never covers content while idle. The success message clears after 5s, which hides the bar again. - new SaveBar component, replacing the duplicated markup in PageBuilder and SettingsEditor - adopt the previously unused .floating-save-bar CSS: slide-in keyframes (carrying translateX(-50%)), dirty border, wrap/gap, mobile variant and a prefers-reduced-motion opt-out; z-index 900 keeps it below modals - .admin-main gains bottom padding so the bar never covers page content - drop the now-unreachable idle hints: the ⌘S hint becomes a button title, the Live Sync note becomes a static line above the settings layout - header "Site" link now bypasses the cache (/?fresh=1), so the preview stays reachable when the bar is hidden Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(admin): themed listbox for the album sort control (#427) The per-album "Photo order" control was a native <select>. Because an <option> cannot contain markup, its choices could not use the admin panel's currentColor SVG set — the reason #415 had to fall back to plain text after dropping the emoji labels. Adds a Listbox component implementing the ARIA combobox/listbox pattern, so options can render a glyph beside their label: - DOM focus stays on the trigger button; the active option is announced through aria-activedescendant, keeping focus management to one element - Keyboard: arrows (clamped at the ends, like a native select), Home/End, Enter/Space to commit, Escape to cancel, Tab commits and moves on, and prefix type-ahead with a repeat-key cycle - Outside dismissal on pointerdown, so a press starting outside closes the popup before the click retargets The sort options now carry an icon each: calendar, arrow-down, arrow-up, an A→Z marker, and the drag glyph for manual — matching the badge the album card already shows. SORT_LABELS stays plain text because the badge feeds it to a title attribute. Closes #417 Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(git): ignore generated design handoff folders * fix(admin): stop the album sort dropdown clipping, and simplify the panel (#428) * fix(admin): render listbox popup in a portal so it escapes modal clipping The sort control's popup was position:absolute inside three clipping ancestors (.album-drawer overflow:hidden > .album-drawer-body overflow-y:auto > .modal-right-column overflow-y:auto), so it was cut off at the bottom of the Edit Album Details modal. z-index could not help: clipping happens before stacking. It also always hung below the trigger, with no flip. Portal the popup to document.body and position it from the trigger's viewport rect, flipping above when there is more room there and capping max-height to the space available so it scrolls internally rather than overflowing. It is dismissed on scroll and resize, since the anchor is only measured on open. The outside-pointerdown handler now also treats the popup as inside; without that the portalled list counts as outside, and a click on an option would close it before the selection commits. * refactor(admin): single-column album details panel The left column spent 1.2fr on a cover thumbnail and three stat rows, two of which (Status, Custom Hero) only restated the form fields opposite them, while the form itself was squeezed into 1.8fr behind a second nested scroller. Stack the drawer in one column instead: cover as a banner, then the form at full width, with the UUID moved into the footer. The body is now the only scroll container, which also removes one of the ancestors that was clipping the sort popup. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> * fix(admin): give the portalled listbox its theme back, lock the page behind modals (#429) Two defects in the album editor. The sort listbox popup painted transparent. Every --admin-* variable is scoped to .admin-layout, and since the popup moved into document.body it sits outside that subtree, so background/border/text all resolved to nothing. It now carries its own copy of the palette in both colour schemes, plus the font it no longer inherits. Scrolling inside a modal also moved the page behind it. No admin modal ever locked body scroll: the overlay covers the page but does not absorb wheel events, so a scroll starting on the backdrop — or continuing past the end of the modal's own scroller — reaches the document. overscroll-behavior cannot cover that case on its own, because it only applies to scroll containers and the backdrop is not one. useScrollLock freezes body while a modal is open and compensates for the width the scrollbar gives up, so nothing shifts underneath. Each lock restores the inline value it found, which makes nesting work without a counter — a picker opened from the drawer restores the drawer's hidden state instead of clearing it. Applied to both drawers and all four picker modals, which share the defect. overscroll-behavior: contain on the scrollers stops the chaining they can handle themselves. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com> * fix(security): allow unsafe-eval in CSP script-src during dev mode * feat(journal): add Journal Studio with split-screen editor, live preview and dedicated routes * fix(build): separate client parser from server journal-service and fix build type errors * fix(journal): Fotos rendern, Layout und Lightbox-Steuerung korrigieren Fünf unabhängige Fehler in der öffentlichen Journal- und Essay-Ansicht: * Foto-Blöcke wurden nie angezeigt. EssayView löst ein Foto über PhotoItem.id auf, und das sind verschlüsselte Tokens — die Blöcke aus dem Markdown tragen aber rohe Asset-UUIDs. Jede Zuordnung lief ins Leere, und nicht auflösbare Blöcke werden still verworfen. Die IDs werden jetzt serverseitig übersetzt; damit verschwinden nebenbei die rohen UUIDs aus dem Client-Payload, die dort laut Projektregel nie auftauchen dürfen. Nicht auflösbare Referenzen werden geloggt. * Überschriften standen weiter links als der Fließtext. Jeder Block hatte einzeln `max-width: 68ch`, und `ch` ist relativ zur Schrift des Elements — die Serif-Überschrift ergab eine breitere Spalte. Ersetzt durch eine gemeinsame, font-unabhängige `--essay-measure`. * Fullbleed-Fotos bluteten nur nach links aus: `.essay-figure` ist `width: 100%`, wodurch die Box überbestimmt ist und der negative rechte Margin verworfen wird. * Foto-Paare stellten beide Bilder gleich breit dar, wodurch ein Hochformat neben einem Querformat doppelt so hoch wurde. Jetzt eine Justified-Reihe: Breite proportional zum Seitenverhältnis, dadurch exakt gleiche Höhen ohne Beschnitt. * Die Lightbox hatte im Journal keine Tastatursteuerung und keine Scroll-Sperre — beides lag in PhotoGrid, also nur im Album-Raster. Verlagert in die Lightbox selbst, der doppelte Handler in PhotoGrid entfernt (sonst wäre pro Pfeildruck zwei Bilder weitergesprungen). Zusätzlich sind Proofing-Herzen und das EXIF-Panel im redaktionellen Modus abschaltbar und im Journal aus: Client-Proofing ist ein Übergabe-Workflow für Alben, keine Funktion einer Reportage. Auf der Übersicht wurde der Untertitel doppelt gerendert, weil extractExcerpt() auf ihn zurückfällt. * feat(admin): eigene URLs für alle Bereiche und überarbeiteter Journal Studio Das Panel war eine einzige Client-Komponente, die ihre Tabs über useState umschaltet: keine Route pro Bereich, kein Deep-Link, kein Zurück-Button, und nach jedem Reload landete man wieder auf "Pages". Auch der Journal-Editor hatte keine eigene URL. Jetzt sieben echte Routen (/admin, /admin/pages, /admin/journal, /admin/journal/<slug>, /admin/settings, /admin/settings/<section>, /admin/analytics). Die Shell mit Auth-Prüfung und Kopfzeile sitzt im Layout und umschließt children — so bleibt die Session-Prüfung über Routenwechsel montiert, statt bei jedem Tab-Wechsel neu zu laufen und den Spinner aufblitzen zu lassen. Unbekannte Settings-Sections fallen auf General zurück. Im selben Zug der Journal Studio, der die Routing-Änderung ohnehin berührt: * Alle Eingabefelder nutzten die Klasse `admin-input`, die in keinem CSS definiert war — sie fielen auf Browser-Defaults zurück. Jetzt gestylt, gescoped, damit der generische Name nicht ins übrige Panel leckt. * Der Split View ist per Divider verschiebbar (Maus, Tastatur, Doppelklick zum Zurücksetzen), Breite in localStorage. * Das Studio bricht aus der 1120px-Spalte aus, die Preview hat Platz. * Die Preview zeigte für jedes Foto fest 3:2 und log damit über das Layout der veröffentlichten Seite; die echten Verhältnisse werden jetzt an den Thumbnails gemessen. * Blöcke mit alten positionsbasierten Foto-Referenzen werden markiert — die lassen sich auf einer eigenständigen Journal-Seite nicht auflösen und verschwanden bisher stillschweigend. * Blocktyp-Chips als gemeinsame Komponente, monochrom und per Icon unterschieden statt in einer eigenen Blau/Lila/Orange-Palette, die sonst nirgends im Panel vorkommt. * Emojis raus, SVG-Icons rein. * fix(admin): Designsystem-Lücken im Panel schließen Eine systematische Suche nach Klassen, die im TSX benutzt, aber in keinem CSS definiert sind, hat vier Stellen mit demselben Muster gefunden: * `admin-btn-secondary` und `admin-btn-danger` existierten nicht. Sämtliche Löschen-Buttons sahen aus wie normale Buttons — keine Warnwirkung. Als `.admin-btn.admin-btn-danger` geschrieben, weil die Varianten mit den Größenklassen kombiniert werden, die weiter unten ihren eigenen Hintergrund setzen. * `page-progress-fill` fehlte: die Balken im Analytics-Panel waren leere Rinnen, der Wert unsichtbar. Ebenso `analytics-empty` und `admin-loading-container`. * `subpage-drawer-section`, `subpage-drawer-title-group` und `input-with-icon` im PageBuilder waren wirkungslos und teils mit Inline-Styles notdürftig kompensiert. * `grid-card-preview` fehlte, wodurch alle Layout-Vorschauen auf Höhe null kollabierten. Nur "Showcase" war sichtbar — und das aus Versehen, weil sein Tile `hero-tile` hieß und damit die `aspect-ratio` einer fremden PageBuilder-Klasse erbte. Umbenannt. Dazu die Theme-Vorschauen, die praktisch identisch aussahen: alle sieben zeigten dieselben drei quadratischen Kacheln, einziger Unterschied war die Hintergrundfarbe. Sie spiegeln jetzt die echten Preset-Daten aus lib/config/theme.ts — Schriftcharakter, Eckradius, Rasterdichte, Passepartout bzw. Schatten. Die Kopfzeile richtet sich an einer gemeinsamen Steuerhöhe aus. Der "Site"-Link war höher als die Buttons daneben: `.admin-btn` hatte keine explizite line-height, und <button> bekommt box-sizing: border-box vom Browser, <a> nicht. Die Statusanzeige setzte weder Schriftfamilie noch -größe und fiel auf den Browser-Default zurück — sie war nie Teil des Designsystems. Jetzt gleiche Höhe und Typografie, Pillenform als Zustandsanzeige, Trenner zur Aktionsgruppe. Das dauerhafte Pulsieren des grünen Punkts entfällt; Animation bleibt den Zuständen vorbehalten, die Aufmerksamkeit brauchen. Restliche Emojis durch SVG-Icons ersetzt. * feat(admin): add scroll-to-top toggle and SVG arrow The back-to-top button was always on and drew its arrow with the ↑ text character. Add a `scrollToTop` setting (General section in the admin panel, defaults to on so existing sites are unaffected) and replace the glyph with a stroked SVG that inherits currentColor across all presets. Scroll handling is now rAF-throttled, and prefers-reduced-motion turns off both the hover lift and the smooth scroll. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * security(journal): escape author HTML instead of filtering it CodeQL flags 26 high-severity alerts on the release PR; the bulk of them point at sanitizeHtml(), a denylist of three regexes whose output goes into dangerouslySetInnerHTML. I reproduced the bypasses before changing anything — all four pass the old filter: <img src=x onerror=alert(1)> unquoted handler, regex wants quotes <img src=x onerror='alert(1)'> single quotes, same reason <svg onload=alert(1)> not a <script> tag javasjavascript:cript:alert(1) one-pass replace, the rest recombines Plus an attribute breakout in the link renderer, which interpolated the URL into href="${url}" unescaped: [x](" onmouseover=alert(1) x=") -> <a href="" onmouseover=alert(1" ...> Replaced with escaping. Every `&<>"'` in author text becomes an entity before any markdown rule runs, so the only tags in the output are the ones renderInlineMarkdown builds itself and a URL cannot leave its attribute. Link schemes are now an allowlist (http, https, mailto, tel, relative, anchor); anything else renders as plain text. The serializer needed decodeHtmlEntities to match: without it a save would write `&lt;` into the Markdown file and the next parse would escape the `&` again, corrupting the text further on every round trip. A test covers parse -> serialize -> parse stability. Two existing tests asserted the old behaviour and were rewritten rather than deleted: one expected the script tag to be *removed* from the output, the other expected the substring "onerror" to be absent. Both now assert the property that matters — that no tag can form — because `onerror` surviving as inert text is fine. Exploitation required admin access either way: journal and essay text comes from the studio or from content/*.md. This removes the weakness, it does not close an open door. * fix(journal): contain file paths, fix frontmatter escaping, defuse two regexes Follow-up to the CodeQL findings on release PR #432. I went through all 23 alerts individually; this addresses the ones that are worth addressing and documents the ones that are not. Path containment (12 alerts, all false positives). Every path built from a slug goes through isValidSlug(), a strict `/^[a-zA-Z0-9_-]+$/` allowlist — verified against `../../etc/passwd`, `foo/../../bar`, `a/b`, `..` and friends, all rejected. CodeQL cannot see it because the check lives in another module. Added a containedPath() helper that resolves the path and refuses anything landing outside the content directory: a second lock on a door that was already locked, and a barrier the analysis can follow. Also removed the dead `slug.endsWith('.md')` branches — isValidSlug rejects dots, so they could never be taken. Frontmatter escaping (1 alert, a real bug). The serializer escaped `"` but not `\`, and the parser never unescaped anything. A title containing either character gained a backslash on every save/load cycle: Path C:\Users "quoted" -> Path C:\\Users \"quoted\" -> ... Escaping now covers the backslash first and the parser undoes both. A round trip test covers quotes, backslashes, colons and apostrophes. Two of three ReDoS regexes (2 alerts). The heading pattern had `\s+` next to `(.+)`, which overlap, so the engine tried every split of the whitespace run before failing; it is `[ \t]+` and `(\S.*)` now. The quote author pattern wrapped a lazy group around an optional group — the quadratic case — and is an index split on the first separator now. The third regex, the bold/italic pass, is deliberately left alone. Rewriting it with a negated class removes the backtracking but breaks nesting: `**bold *and italic* here**` renders as `*<em>bold </em>and italic<em> here</em>*`. The input is Markdown from an authenticated admin, never a visitor, so the worst case is an author slowing down their own page. The comment in the code says so. Not addressed: 5 js/insufficient-password-hash alerts. They ask for a slow KDF where the code uses SHA-256/HMAC — correct in general, but the admin password comes from an environment variable and is never stored, so a stronger KDF protects nothing that is not already in plaintext in the environment. 399 unit tests pass (18 new), build and tsc clean. * fix(journal): split the quote author by scanning, not by pattern Cleaning up after myself. #439 replaced the quote author regex `/^(.*?)(?:\s+--\s+(.+))?$/` — a lazy group around an optional one, the quadratic case — with `/\s+--\s+/`, and CodeQL promptly flagged the replacement for the same reason. One reported pattern traded for another. splitQuoteAuthor() scans for the first `--` that has whitespace on both sides. Linear, and it needs no reasoning about the regex engine at all. Behaviour is identical to the original regex, checked case by case against it: separator, no separator, several separators, tabs, wide gaps, `a--b` without spaces, leading and trailing separators, empty string. All nine are covered by tests, plus one asserting it stays fast on a 50k whitespace run. * security(admin): derive the session signing key with scrypt getSigningKey() ran the admin password through a single SHA-256 digest. It is key derivation rather than password storage, so it was never a stored-hash problem — but if the derived key ever leaked, one fast hash makes recovering the password by brute force cheap. CodeQL flags it as js/insufficient-password-hash and, for this particular alert, has a point. scrypt now. Two details that matter: The salt has to be stable. A random salt would produce a different key on every call and invalidate every session; it is derived from AUTH_SECRET, which is deployment-specific. Verified across separate processes: same inputs produce a verifying token, so a restart or redeploy does not log everyone out. The result is cached for the process lifetime. scrypt is deliberately slow and getSigningKey() runs on every admin request — deriving per call would add ~24ms to each one. The cache key is a digest of secret plus password, so a rotation misses the cache and derives again, and no extra plaintext copy of the password is kept around. Measured: first derivation 24ms, subsequent calls 0.12ms. Password change and secret change both invalidate an existing token, checked in separate processes. Note the one-time effect: existing admin sessions are invalidated by the change in derivation, so everyone logs in once more. * security(admin): key the signing-key cache on its inputs, not a digest #441 removed the SHA-256 digest of the admin password from the key derivation and introduced a new one three lines above it, as the cache key. Same rule, same file: CodeQL reported it immediately. The comment justifying it was wrong too. It claimed no second plaintext copy of the password was retained, while building the digest input allocates exactly that in order to hash it. The cache now holds the two input strings and compares them directly. They are the same objects the env and install caches already hold, so nothing extra is retained, and no fast hash of the password exists in memory for the life of the process. Re-verified after the change, in separate processes: a token from one process verifies in another with the same inputs, a changed password or secret rejects it, first derivation 24ms, cached calls 0.001ms. That leaves scrypt as the only place the password is hashed here. The two HMACs further down operate on the derived key and on token data, not on the password; the constant-time comparison in verifyAdminPassword is the previously dismissed one. --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
2026-08-14 16:55:07 +02:00
border-radius: 999px;
font-family: inherit;
font-size: 0.8rem;
font-weight: 500;
line-height: 1;
color: var(--admin-text-secondary);
feat(admin): visual theme cards, album search, and status dashboard (#241) * feat(admin): implement visual theme cards, album search, and system status diagnostics * fix(admin): resolve type-checking build errors in SettingsEditor and status route --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-05-31 21:17:52 +02:00
cursor: pointer;
transition: all 0.15s;
}
.status-badge-btn:hover {
background: var(--admin-bg-elevated);
border-color: var(--admin-border-hover);
}
.status-dot {
width: 7px;
height: 7px;
border-radius: 50%;
position: relative;
}
release: v0.11.0 — journal fixes, admin URLs, design system cleanup (#432) * fix(screenshots): sharp-Typen fuer 0.34 und 0.35 gleichzeitig (#410) sharp 0.35 ist von `export =` auf ESM umgestellt: der Modul-Namespace ist nicht mehr aufrufbar, die Factory sitzt unter .default. Der Type-Check brach damit in scripts/screenshots.ts weg, sobald der Next-Bump (#402) sharp von 0.34.5 auf 0.35.3 mitzieht -- sharp ist hier keine deklarierte Dependency, sondern kommt ueber Next mit. Die Form wird jetzt aus dem installierten Paket abgeleitet statt festgeschrieben, zur Laufzeit wie im Typ. Geprueft mit beiden Versionen: tsc laeuft mit 0.34.5 und mit 0.35.3 fehlerfrei durch. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(deps): bump the nextjs group across 1 directory with 2 updates (#402) Bumps the nextjs group with 2 updates in the / directory: [next](https://github.com/vercel/next.js) and [eslint-config-next](https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next). Updates `next` from 16.2.12 to 16.3.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/compare/v16.2.12...v16.3.0) Updates `eslint-config-next` from 16.2.12 to 16.3.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/commits/v16.3.0/packages/eslint-config-next) --- updated-dependencies: - dependency-name: eslint-config-next dependency-version: 16.3.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: nextjs - dependency-name: next dependency-version: 16.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nextjs ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps-dev): bump prettier from 3.8.3 to 3.9.6 (#405) Bumps [prettier](https://github.com/prettier/prettier) from 3.8.3 to 3.9.6. - [Release notes](https://github.com/prettier/prettier/releases) - [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md) - [Commits](https://github.com/prettier/prettier/compare/3.8.3...3.9.6) --- updated-dependencies: - dependency-name: prettier dependency-version: 3.9.6 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * docs(changelog): Unreleased-Sektion fuer die Bumps nach v0.10.0 (#413) Die Dependency-PRs sind nach dem Release auf dev gelandet, teils auch auf main. Ohne Eintrag waeren sie beim naechsten Release unsichtbar -- inklusive Next 16.3.0, das CVE-2025-13465 mitbringt. Ausserdem im 0.10.0-Abschnitt nachgetragen, dass der Trivy-Scan bis #409 nie gelaufen ist. Der Fix steckt im Tag v0.10.0, fehlte aber in der Aufzaehlung -- und "Images werden bei jedem Publish gescannt" stand im Changelog, waehrend der Job im Action-Setup abbrach. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(gallery): per-album sort order, independent of Immich (#408) (#414) Album order was dictated entirely by Immich: getAlbum() sorted by the album's own asc/desc flag, so a Folio album always mirrored the archive. A curated series has a narrative order that has nothing to do with capture time, and changing the Immich album's sort to fit the website changes it for the archive too. Adds an optional per-album `sort` in gallery.yaml, editable in /admin, defaulting to today's behaviour so every existing config is unchanged: immich (default) | newest | oldest | filename | manual `manual` is a pinned *prefix*: `assetOrder` lists only the photos placed by hand, everything else follows in the album's Immich order. A full permutation of a 2,000-photo album would be ~80 KB of UUIDs in a file that is rewritten and copied to content/.backups/ on every admin save. It also makes drift fall out for free — photos removed in Immich never match, new ones land in the tail rather than being hidden. Sorting is applied after the cache read, not before the cache write, so the LRU keeps one canonical Immich-ordered copy per album. That avoids putting the mode in the cache key, lets a config change take effect without depending on invalidation, and keeps the stale-serving path correct. cache.get() returns the stored object by reference, so withSort() returns a shallow clone with a new array — sorting in place would reorder the shared entry, and under request coalescing every concurrent caller would be sorting the same array. Also fixes a prerequisite bug: /api/admin/albums/[albumId]/assets read album.assets from GET /albums/:id, which Immich 3.x no longer populates (lib/immich.ts:507). The hero picker's "This Album" tab returned nothing and threw outright when the key was absent. It now goes through the client's paginated metadata search, with ?types=all to opt videos in for the reorder editor. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): drop decorative emoji from the sort select labels (#415) An <option> cannot contain markup, so the SVG set in Icons is not reachable there — but a decorative emoji is not a substitute for it. Plain text instead; the album card badge already uses a real icon. The remaining emoji in the admin panel (asset picker tabs, section headings, layout picker options) predate this branch and are left for a separate cleanup. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): replace emoji icons with the shared SVG icon set (#416) The admin panel mixed two icon conventions: inline SVGs from `Icons.tsx` in most components, and decorative emoji in the asset picker and a few PageBuilder labels. Emoji render inconsistently across platforms, ignore the accent colour, and cannot inherit the `.svg-icon` sizing rules. - Icons.tsx: add `IconStar` (filled — it marks a state, not an action) and `IconImage`. - AssetPicker: the three tab labels and the favourite tile badge now use IconFolder / IconStar / IconImage. - PageBuilder: the "Standalone Albums" and "Subpages" headings use the icon set instead of an emoji. - PageBuilder: the layout picker drops its emoji for plain text. An <option> cannot contain markup, so an SVG is impossible there and a decorative glyph is not a substitute. - admin.css: align icon and label in the picker tabs, and swap the favourite badge's text-shadow for drop-shadow, which is what applies to an inline SVG. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): fold PageBuilder's local icons into the shared Icons module (#418) * refactor(admin): fold PageBuilder's local icons into the shared module PageBuilder.tsx carried its own `Icons` object duplicating most of the glyphs already exported by Icons.tsx, with hardcoded sizes and slightly divergent paths. Migrate all 32 call sites to the shared module and delete the local object. Five glyphs had no counterpart and are added to Icons.tsx as 1:1 ports of the local paths: IconX, IconPlus, IconHome, IconCopy, IconImage. The local ExternalLink and Check are dropped rather than ported — both had zero call sites. Two glyphs change shape slightly, which is the point of consolidating: the shared IconCamera includes the viewfinder bump the local copy omitted, and drag handles now use IconGripVertical. IconGripVertical uses the module's square 24x24 viewBox, so `.svg-drag` goes from 12x18 to 18x18 — the old non-square box would letterbox the glyph down to 12x12 and shrink the handle. * fix(admin): resolve icon-module integration after #416 Merging dev brought in #416, which added a second IconImage to Icons.tsx and two <Icons.Camera>/<Icons.Folder> section headers that reference the local Icons object this PR removes. Git merged both cleanly but the result did not type-check. - drop the duplicate IconImage (both copies were byte-identical) - point the two section headers at the imported IconCamera/IconFolder - refresh the SORT_LABELS comment: the icon set is imported now, not declared below --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> * fix(config): allow an empty gallery, guard against a double /api suffix (#421) An empty gallery is now a valid, rendered state instead of a throw: deriveGallery() no longer requires at least one album or subpage, so a deployment with no albums yet renders a bare homepage the owner can fill in via /admin. getConfig() also stops appending /api to an Immich URL that already ends in it, which previously produced .../api/api and broke every upstream request. Includes a restore of the per-album sort test cases, which the branch had lost by being cut before #408/#414. * feat(admin): favicon upload, served from the content volume (#422) Adds a bundled default favicon, an upload widget in admin Settings > General, and a route that serves the icon from the writable content/ volume with a fallback to the bundled default. Raster uploads (PNG/ICO/JPEG) are wrapped in an SVG container; the response carries its own CSP so an uploaded SVG cannot execute script on the origin. The GET route revalidates with an ETag instead of caching immutably, so a newly uploaded icon shows up immediately. Uploads are written via temp file + rename, and a Reset button restores the bundled default. * ci: flag unformatted files in a PR, without blocking it (#424) Prettier is configured as an error rule in eslint.config.mjs but has never run in CI, so part of the tree predates it. A final CI step now diffs against the PR base, runs prettier --list-different over the changed files, and emits a warning annotation per offender plus a job summary. Advisory by design: it never fails the job. Blocking would turn a PR red for merely touching a file that was already unformatted, and normalising the tree in one commit would wreck git blame and conflict with the PRs in flight. Requires fetch-depth: 0, since diffing against the base needs its history. * feat(install): first-run wizard gated by a one-time setup token (#419) Adds /install, a four-step first-run wizard: connect to Immich, optionally pick albums, name the site, finish. It verifies the credentials against the Immich server before writing anything, then writes gallery.yaml, settings.yaml and a content/install.json carrying the Immich credentials and a generated site secret. install.json exists because a running process cannot pick up new env vars — the wizard has to write configuration that takes effect without a restart. getInstallCredentials() merges it under the real environment, so env vars always win and rotation stays a matter of setting one. Both the page and the API routes are gated by a one-time setup token printed to the server log, so a deployment that is reachable before gallery.yaml exists cannot be configured by whoever finds it first. The token is stored in content/.setup-token (0600) rather than a module variable: Next.js bundles the page and each route handler separately, so a module-level token left the page and the API disagreeing inside one process and the wizard stuck on step 1. It is removed once the install completes. The admin password is stored as an scrypt hash using the scheme lib/auth.ts already applies to album passwords; a plaintext ADMIN_PASSWORD env var keeps working. * docs: document the setup wizard, fix the read-only content mount (#425) Quick Start now leads with the /install wizard, with the hand-written YAML route kept alongside it, and a First-Run Setup section covers the setup token, the files the wizard writes, and env-var precedence. Two corrections: both Docker examples mounted content/ as :ro, which silently breaks the wizard, the admin panel and the backup rotation alike — docs/admin-panel.md already said so and the README contradicted it. And nothing documented that content/install.json holds the Immich API key, so a backup of content/ is a backup of credentials. Also adds a Contributors section crediting the people whose work is in the project. * feat(admin): floating save bar pinned to the bottom of the viewport (#426) The save bar was the first, static element inside .admin-main. Since the document itself scrolls, it left the viewport as soon as you scrolled down — editing a subpage section or a settings block far below gave no visible dirty hint and no reachable save button. Replace it with a bottom-pinned floating bar shared by both editors. It only mounts while there is something to act on (unsaved changes, an in-flight save, or a result message), so it never covers content while idle. The success message clears after 5s, which hides the bar again. - new SaveBar component, replacing the duplicated markup in PageBuilder and SettingsEditor - adopt the previously unused .floating-save-bar CSS: slide-in keyframes (carrying translateX(-50%)), dirty border, wrap/gap, mobile variant and a prefers-reduced-motion opt-out; z-index 900 keeps it below modals - .admin-main gains bottom padding so the bar never covers page content - drop the now-unreachable idle hints: the ⌘S hint becomes a button title, the Live Sync note becomes a static line above the settings layout - header "Site" link now bypasses the cache (/?fresh=1), so the preview stays reachable when the bar is hidden Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(admin): themed listbox for the album sort control (#427) The per-album "Photo order" control was a native <select>. Because an <option> cannot contain markup, its choices could not use the admin panel's currentColor SVG set — the reason #415 had to fall back to plain text after dropping the emoji labels. Adds a Listbox component implementing the ARIA combobox/listbox pattern, so options can render a glyph beside their label: - DOM focus stays on the trigger button; the active option is announced through aria-activedescendant, keeping focus management to one element - Keyboard: arrows (clamped at the ends, like a native select), Home/End, Enter/Space to commit, Escape to cancel, Tab commits and moves on, and prefix type-ahead with a repeat-key cycle - Outside dismissal on pointerdown, so a press starting outside closes the popup before the click retargets The sort options now carry an icon each: calendar, arrow-down, arrow-up, an A→Z marker, and the drag glyph for manual — matching the badge the album card already shows. SORT_LABELS stays plain text because the badge feeds it to a title attribute. Closes #417 Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(git): ignore generated design handoff folders * fix(admin): stop the album sort dropdown clipping, and simplify the panel (#428) * fix(admin): render listbox popup in a portal so it escapes modal clipping The sort control's popup was position:absolute inside three clipping ancestors (.album-drawer overflow:hidden > .album-drawer-body overflow-y:auto > .modal-right-column overflow-y:auto), so it was cut off at the bottom of the Edit Album Details modal. z-index could not help: clipping happens before stacking. It also always hung below the trigger, with no flip. Portal the popup to document.body and position it from the trigger's viewport rect, flipping above when there is more room there and capping max-height to the space available so it scrolls internally rather than overflowing. It is dismissed on scroll and resize, since the anchor is only measured on open. The outside-pointerdown handler now also treats the popup as inside; without that the portalled list counts as outside, and a click on an option would close it before the selection commits. * refactor(admin): single-column album details panel The left column spent 1.2fr on a cover thumbnail and three stat rows, two of which (Status, Custom Hero) only restated the form fields opposite them, while the form itself was squeezed into 1.8fr behind a second nested scroller. Stack the drawer in one column instead: cover as a banner, then the form at full width, with the UUID moved into the footer. The body is now the only scroll container, which also removes one of the ancestors that was clipping the sort popup. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> * fix(admin): give the portalled listbox its theme back, lock the page behind modals (#429) Two defects in the album editor. The sort listbox popup painted transparent. Every --admin-* variable is scoped to .admin-layout, and since the popup moved into document.body it sits outside that subtree, so background/border/text all resolved to nothing. It now carries its own copy of the palette in both colour schemes, plus the font it no longer inherits. Scrolling inside a modal also moved the page behind it. No admin modal ever locked body scroll: the overlay covers the page but does not absorb wheel events, so a scroll starting on the backdrop — or continuing past the end of the modal's own scroller — reaches the document. overscroll-behavior cannot cover that case on its own, because it only applies to scroll containers and the backdrop is not one. useScrollLock freezes body while a modal is open and compensates for the width the scrollbar gives up, so nothing shifts underneath. Each lock restores the inline value it found, which makes nesting work without a counter — a picker opened from the drawer restores the drawer's hidden state instead of clearing it. Applied to both drawers and all four picker modals, which share the defect. overscroll-behavior: contain on the scrollers stops the chaining they can handle themselves. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com> * fix(security): allow unsafe-eval in CSP script-src during dev mode * feat(journal): add Journal Studio with split-screen editor, live preview and dedicated routes * fix(build): separate client parser from server journal-service and fix build type errors * fix(journal): Fotos rendern, Layout und Lightbox-Steuerung korrigieren Fünf unabhängige Fehler in der öffentlichen Journal- und Essay-Ansicht: * Foto-Blöcke wurden nie angezeigt. EssayView löst ein Foto über PhotoItem.id auf, und das sind verschlüsselte Tokens — die Blöcke aus dem Markdown tragen aber rohe Asset-UUIDs. Jede Zuordnung lief ins Leere, und nicht auflösbare Blöcke werden still verworfen. Die IDs werden jetzt serverseitig übersetzt; damit verschwinden nebenbei die rohen UUIDs aus dem Client-Payload, die dort laut Projektregel nie auftauchen dürfen. Nicht auflösbare Referenzen werden geloggt. * Überschriften standen weiter links als der Fließtext. Jeder Block hatte einzeln `max-width: 68ch`, und `ch` ist relativ zur Schrift des Elements — die Serif-Überschrift ergab eine breitere Spalte. Ersetzt durch eine gemeinsame, font-unabhängige `--essay-measure`. * Fullbleed-Fotos bluteten nur nach links aus: `.essay-figure` ist `width: 100%`, wodurch die Box überbestimmt ist und der negative rechte Margin verworfen wird. * Foto-Paare stellten beide Bilder gleich breit dar, wodurch ein Hochformat neben einem Querformat doppelt so hoch wurde. Jetzt eine Justified-Reihe: Breite proportional zum Seitenverhältnis, dadurch exakt gleiche Höhen ohne Beschnitt. * Die Lightbox hatte im Journal keine Tastatursteuerung und keine Scroll-Sperre — beides lag in PhotoGrid, also nur im Album-Raster. Verlagert in die Lightbox selbst, der doppelte Handler in PhotoGrid entfernt (sonst wäre pro Pfeildruck zwei Bilder weitergesprungen). Zusätzlich sind Proofing-Herzen und das EXIF-Panel im redaktionellen Modus abschaltbar und im Journal aus: Client-Proofing ist ein Übergabe-Workflow für Alben, keine Funktion einer Reportage. Auf der Übersicht wurde der Untertitel doppelt gerendert, weil extractExcerpt() auf ihn zurückfällt. * feat(admin): eigene URLs für alle Bereiche und überarbeiteter Journal Studio Das Panel war eine einzige Client-Komponente, die ihre Tabs über useState umschaltet: keine Route pro Bereich, kein Deep-Link, kein Zurück-Button, und nach jedem Reload landete man wieder auf "Pages". Auch der Journal-Editor hatte keine eigene URL. Jetzt sieben echte Routen (/admin, /admin/pages, /admin/journal, /admin/journal/<slug>, /admin/settings, /admin/settings/<section>, /admin/analytics). Die Shell mit Auth-Prüfung und Kopfzeile sitzt im Layout und umschließt children — so bleibt die Session-Prüfung über Routenwechsel montiert, statt bei jedem Tab-Wechsel neu zu laufen und den Spinner aufblitzen zu lassen. Unbekannte Settings-Sections fallen auf General zurück. Im selben Zug der Journal Studio, der die Routing-Änderung ohnehin berührt: * Alle Eingabefelder nutzten die Klasse `admin-input`, die in keinem CSS definiert war — sie fielen auf Browser-Defaults zurück. Jetzt gestylt, gescoped, damit der generische Name nicht ins übrige Panel leckt. * Der Split View ist per Divider verschiebbar (Maus, Tastatur, Doppelklick zum Zurücksetzen), Breite in localStorage. * Das Studio bricht aus der 1120px-Spalte aus, die Preview hat Platz. * Die Preview zeigte für jedes Foto fest 3:2 und log damit über das Layout der veröffentlichten Seite; die echten Verhältnisse werden jetzt an den Thumbnails gemessen. * Blöcke mit alten positionsbasierten Foto-Referenzen werden markiert — die lassen sich auf einer eigenständigen Journal-Seite nicht auflösen und verschwanden bisher stillschweigend. * Blocktyp-Chips als gemeinsame Komponente, monochrom und per Icon unterschieden statt in einer eigenen Blau/Lila/Orange-Palette, die sonst nirgends im Panel vorkommt. * Emojis raus, SVG-Icons rein. * fix(admin): Designsystem-Lücken im Panel schließen Eine systematische Suche nach Klassen, die im TSX benutzt, aber in keinem CSS definiert sind, hat vier Stellen mit demselben Muster gefunden: * `admin-btn-secondary` und `admin-btn-danger` existierten nicht. Sämtliche Löschen-Buttons sahen aus wie normale Buttons — keine Warnwirkung. Als `.admin-btn.admin-btn-danger` geschrieben, weil die Varianten mit den Größenklassen kombiniert werden, die weiter unten ihren eigenen Hintergrund setzen. * `page-progress-fill` fehlte: die Balken im Analytics-Panel waren leere Rinnen, der Wert unsichtbar. Ebenso `analytics-empty` und `admin-loading-container`. * `subpage-drawer-section`, `subpage-drawer-title-group` und `input-with-icon` im PageBuilder waren wirkungslos und teils mit Inline-Styles notdürftig kompensiert. * `grid-card-preview` fehlte, wodurch alle Layout-Vorschauen auf Höhe null kollabierten. Nur "Showcase" war sichtbar — und das aus Versehen, weil sein Tile `hero-tile` hieß und damit die `aspect-ratio` einer fremden PageBuilder-Klasse erbte. Umbenannt. Dazu die Theme-Vorschauen, die praktisch identisch aussahen: alle sieben zeigten dieselben drei quadratischen Kacheln, einziger Unterschied war die Hintergrundfarbe. Sie spiegeln jetzt die echten Preset-Daten aus lib/config/theme.ts — Schriftcharakter, Eckradius, Rasterdichte, Passepartout bzw. Schatten. Die Kopfzeile richtet sich an einer gemeinsamen Steuerhöhe aus. Der "Site"-Link war höher als die Buttons daneben: `.admin-btn` hatte keine explizite line-height, und <button> bekommt box-sizing: border-box vom Browser, <a> nicht. Die Statusanzeige setzte weder Schriftfamilie noch -größe und fiel auf den Browser-Default zurück — sie war nie Teil des Designsystems. Jetzt gleiche Höhe und Typografie, Pillenform als Zustandsanzeige, Trenner zur Aktionsgruppe. Das dauerhafte Pulsieren des grünen Punkts entfällt; Animation bleibt den Zuständen vorbehalten, die Aufmerksamkeit brauchen. Restliche Emojis durch SVG-Icons ersetzt. * feat(admin): add scroll-to-top toggle and SVG arrow The back-to-top button was always on and drew its arrow with the ↑ text character. Add a `scrollToTop` setting (General section in the admin panel, defaults to on so existing sites are unaffected) and replace the glyph with a stroked SVG that inherits currentColor across all presets. Scroll handling is now rAF-throttled, and prefers-reduced-motion turns off both the hover lift and the smooth scroll. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * security(journal): escape author HTML instead of filtering it CodeQL flags 26 high-severity alerts on the release PR; the bulk of them point at sanitizeHtml(), a denylist of three regexes whose output goes into dangerouslySetInnerHTML. I reproduced the bypasses before changing anything — all four pass the old filter: <img src=x onerror=alert(1)> unquoted handler, regex wants quotes <img src=x onerror='alert(1)'> single quotes, same reason <svg onload=alert(1)> not a <script> tag javasjavascript:cript:alert(1) one-pass replace, the rest recombines Plus an attribute breakout in the link renderer, which interpolated the URL into href="${url}" unescaped: [x](" onmouseover=alert(1) x=") -> <a href="" onmouseover=alert(1" ...> Replaced with escaping. Every `&<>"'` in author text becomes an entity before any markdown rule runs, so the only tags in the output are the ones renderInlineMarkdown builds itself and a URL cannot leave its attribute. Link schemes are now an allowlist (http, https, mailto, tel, relative, anchor); anything else renders as plain text. The serializer needed decodeHtmlEntities to match: without it a save would write `&lt;` into the Markdown file and the next parse would escape the `&` again, corrupting the text further on every round trip. A test covers parse -> serialize -> parse stability. Two existing tests asserted the old behaviour and were rewritten rather than deleted: one expected the script tag to be *removed* from the output, the other expected the substring "onerror" to be absent. Both now assert the property that matters — that no tag can form — because `onerror` surviving as inert text is fine. Exploitation required admin access either way: journal and essay text comes from the studio or from content/*.md. This removes the weakness, it does not close an open door. * fix(journal): contain file paths, fix frontmatter escaping, defuse two regexes Follow-up to the CodeQL findings on release PR #432. I went through all 23 alerts individually; this addresses the ones that are worth addressing and documents the ones that are not. Path containment (12 alerts, all false positives). Every path built from a slug goes through isValidSlug(), a strict `/^[a-zA-Z0-9_-]+$/` allowlist — verified against `../../etc/passwd`, `foo/../../bar`, `a/b`, `..` and friends, all rejected. CodeQL cannot see it because the check lives in another module. Added a containedPath() helper that resolves the path and refuses anything landing outside the content directory: a second lock on a door that was already locked, and a barrier the analysis can follow. Also removed the dead `slug.endsWith('.md')` branches — isValidSlug rejects dots, so they could never be taken. Frontmatter escaping (1 alert, a real bug). The serializer escaped `"` but not `\`, and the parser never unescaped anything. A title containing either character gained a backslash on every save/load cycle: Path C:\Users "quoted" -> Path C:\\Users \"quoted\" -> ... Escaping now covers the backslash first and the parser undoes both. A round trip test covers quotes, backslashes, colons and apostrophes. Two of three ReDoS regexes (2 alerts). The heading pattern had `\s+` next to `(.+)`, which overlap, so the engine tried every split of the whitespace run before failing; it is `[ \t]+` and `(\S.*)` now. The quote author pattern wrapped a lazy group around an optional group — the quadratic case — and is an index split on the first separator now. The third regex, the bold/italic pass, is deliberately left alone. Rewriting it with a negated class removes the backtracking but breaks nesting: `**bold *and italic* here**` renders as `*<em>bold </em>and italic<em> here</em>*`. The input is Markdown from an authenticated admin, never a visitor, so the worst case is an author slowing down their own page. The comment in the code says so. Not addressed: 5 js/insufficient-password-hash alerts. They ask for a slow KDF where the code uses SHA-256/HMAC — correct in general, but the admin password comes from an environment variable and is never stored, so a stronger KDF protects nothing that is not already in plaintext in the environment. 399 unit tests pass (18 new), build and tsc clean. * fix(journal): split the quote author by scanning, not by pattern Cleaning up after myself. #439 replaced the quote author regex `/^(.*?)(?:\s+--\s+(.+))?$/` — a lazy group around an optional one, the quadratic case — with `/\s+--\s+/`, and CodeQL promptly flagged the replacement for the same reason. One reported pattern traded for another. splitQuoteAuthor() scans for the first `--` that has whitespace on both sides. Linear, and it needs no reasoning about the regex engine at all. Behaviour is identical to the original regex, checked case by case against it: separator, no separator, several separators, tabs, wide gaps, `a--b` without spaces, leading and trailing separators, empty string. All nine are covered by tests, plus one asserting it stays fast on a 50k whitespace run. * security(admin): derive the session signing key with scrypt getSigningKey() ran the admin password through a single SHA-256 digest. It is key derivation rather than password storage, so it was never a stored-hash problem — but if the derived key ever leaked, one fast hash makes recovering the password by brute force cheap. CodeQL flags it as js/insufficient-password-hash and, for this particular alert, has a point. scrypt now. Two details that matter: The salt has to be stable. A random salt would produce a different key on every call and invalidate every session; it is derived from AUTH_SECRET, which is deployment-specific. Verified across separate processes: same inputs produce a verifying token, so a restart or redeploy does not log everyone out. The result is cached for the process lifetime. scrypt is deliberately slow and getSigningKey() runs on every admin request — deriving per call would add ~24ms to each one. The cache key is a digest of secret plus password, so a rotation misses the cache and derives again, and no extra plaintext copy of the password is kept around. Measured: first derivation 24ms, subsequent calls 0.12ms. Password change and secret change both invalidate an existing token, checked in separate processes. Note the one-time effect: existing admin sessions are invalidated by the change in derivation, so everyone logs in once more. * security(admin): key the signing-key cache on its inputs, not a digest #441 removed the SHA-256 digest of the admin password from the key derivation and introduced a new one three lines above it, as the cache key. Same rule, same file: CodeQL reported it immediately. The comment justifying it was wrong too. It claimed no second plaintext copy of the password was retained, while building the digest input allocates exactly that in order to hash it. The cache now holds the two input strings and compares them directly. They are the same objects the env and install caches already hold, so nothing extra is retained, and no fast hash of the password exists in memory for the life of the process. Re-verified after the change, in separate processes: a token from one process verifies in another with the same inputs, a changed password or secret rejects it, first derivation 24ms, cached calls 0.001ms. That leaves scrypt as the only place the password is hashed here. The two HMACs further down operate on the derived key and on token data, not on the password; the constant-time comparison in verifyAdminPassword is the previously dismissed one. --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
2026-08-14 16:55:07 +02:00
/* Healthy is the resting state — no animation. A permanently pulsing dot pulls
* the eye toward the one thing that needs no attention. */
feat(admin): visual theme cards, album search, and status dashboard (#241) * feat(admin): implement visual theme cards, album search, and system status diagnostics * fix(admin): resolve type-checking build errors in SettingsEditor and status route --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-05-31 21:17:52 +02:00
.status-badge-btn.connected .status-dot {
background-color: var(--admin-success, #10b981);
release: v0.11.0 — journal fixes, admin URLs, design system cleanup (#432) * fix(screenshots): sharp-Typen fuer 0.34 und 0.35 gleichzeitig (#410) sharp 0.35 ist von `export =` auf ESM umgestellt: der Modul-Namespace ist nicht mehr aufrufbar, die Factory sitzt unter .default. Der Type-Check brach damit in scripts/screenshots.ts weg, sobald der Next-Bump (#402) sharp von 0.34.5 auf 0.35.3 mitzieht -- sharp ist hier keine deklarierte Dependency, sondern kommt ueber Next mit. Die Form wird jetzt aus dem installierten Paket abgeleitet statt festgeschrieben, zur Laufzeit wie im Typ. Geprueft mit beiden Versionen: tsc laeuft mit 0.34.5 und mit 0.35.3 fehlerfrei durch. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(deps): bump the nextjs group across 1 directory with 2 updates (#402) Bumps the nextjs group with 2 updates in the / directory: [next](https://github.com/vercel/next.js) and [eslint-config-next](https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next). Updates `next` from 16.2.12 to 16.3.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/compare/v16.2.12...v16.3.0) Updates `eslint-config-next` from 16.2.12 to 16.3.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/commits/v16.3.0/packages/eslint-config-next) --- updated-dependencies: - dependency-name: eslint-config-next dependency-version: 16.3.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: nextjs - dependency-name: next dependency-version: 16.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nextjs ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps-dev): bump prettier from 3.8.3 to 3.9.6 (#405) Bumps [prettier](https://github.com/prettier/prettier) from 3.8.3 to 3.9.6. - [Release notes](https://github.com/prettier/prettier/releases) - [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md) - [Commits](https://github.com/prettier/prettier/compare/3.8.3...3.9.6) --- updated-dependencies: - dependency-name: prettier dependency-version: 3.9.6 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * docs(changelog): Unreleased-Sektion fuer die Bumps nach v0.10.0 (#413) Die Dependency-PRs sind nach dem Release auf dev gelandet, teils auch auf main. Ohne Eintrag waeren sie beim naechsten Release unsichtbar -- inklusive Next 16.3.0, das CVE-2025-13465 mitbringt. Ausserdem im 0.10.0-Abschnitt nachgetragen, dass der Trivy-Scan bis #409 nie gelaufen ist. Der Fix steckt im Tag v0.10.0, fehlte aber in der Aufzaehlung -- und "Images werden bei jedem Publish gescannt" stand im Changelog, waehrend der Job im Action-Setup abbrach. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(gallery): per-album sort order, independent of Immich (#408) (#414) Album order was dictated entirely by Immich: getAlbum() sorted by the album's own asc/desc flag, so a Folio album always mirrored the archive. A curated series has a narrative order that has nothing to do with capture time, and changing the Immich album's sort to fit the website changes it for the archive too. Adds an optional per-album `sort` in gallery.yaml, editable in /admin, defaulting to today's behaviour so every existing config is unchanged: immich (default) | newest | oldest | filename | manual `manual` is a pinned *prefix*: `assetOrder` lists only the photos placed by hand, everything else follows in the album's Immich order. A full permutation of a 2,000-photo album would be ~80 KB of UUIDs in a file that is rewritten and copied to content/.backups/ on every admin save. It also makes drift fall out for free — photos removed in Immich never match, new ones land in the tail rather than being hidden. Sorting is applied after the cache read, not before the cache write, so the LRU keeps one canonical Immich-ordered copy per album. That avoids putting the mode in the cache key, lets a config change take effect without depending on invalidation, and keeps the stale-serving path correct. cache.get() returns the stored object by reference, so withSort() returns a shallow clone with a new array — sorting in place would reorder the shared entry, and under request coalescing every concurrent caller would be sorting the same array. Also fixes a prerequisite bug: /api/admin/albums/[albumId]/assets read album.assets from GET /albums/:id, which Immich 3.x no longer populates (lib/immich.ts:507). The hero picker's "This Album" tab returned nothing and threw outright when the key was absent. It now goes through the client's paginated metadata search, with ?types=all to opt videos in for the reorder editor. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): drop decorative emoji from the sort select labels (#415) An <option> cannot contain markup, so the SVG set in Icons is not reachable there — but a decorative emoji is not a substitute for it. Plain text instead; the album card badge already uses a real icon. The remaining emoji in the admin panel (asset picker tabs, section headings, layout picker options) predate this branch and are left for a separate cleanup. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): replace emoji icons with the shared SVG icon set (#416) The admin panel mixed two icon conventions: inline SVGs from `Icons.tsx` in most components, and decorative emoji in the asset picker and a few PageBuilder labels. Emoji render inconsistently across platforms, ignore the accent colour, and cannot inherit the `.svg-icon` sizing rules. - Icons.tsx: add `IconStar` (filled — it marks a state, not an action) and `IconImage`. - AssetPicker: the three tab labels and the favourite tile badge now use IconFolder / IconStar / IconImage. - PageBuilder: the "Standalone Albums" and "Subpages" headings use the icon set instead of an emoji. - PageBuilder: the layout picker drops its emoji for plain text. An <option> cannot contain markup, so an SVG is impossible there and a decorative glyph is not a substitute. - admin.css: align icon and label in the picker tabs, and swap the favourite badge's text-shadow for drop-shadow, which is what applies to an inline SVG. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): fold PageBuilder's local icons into the shared Icons module (#418) * refactor(admin): fold PageBuilder's local icons into the shared module PageBuilder.tsx carried its own `Icons` object duplicating most of the glyphs already exported by Icons.tsx, with hardcoded sizes and slightly divergent paths. Migrate all 32 call sites to the shared module and delete the local object. Five glyphs had no counterpart and are added to Icons.tsx as 1:1 ports of the local paths: IconX, IconPlus, IconHome, IconCopy, IconImage. The local ExternalLink and Check are dropped rather than ported — both had zero call sites. Two glyphs change shape slightly, which is the point of consolidating: the shared IconCamera includes the viewfinder bump the local copy omitted, and drag handles now use IconGripVertical. IconGripVertical uses the module's square 24x24 viewBox, so `.svg-drag` goes from 12x18 to 18x18 — the old non-square box would letterbox the glyph down to 12x12 and shrink the handle. * fix(admin): resolve icon-module integration after #416 Merging dev brought in #416, which added a second IconImage to Icons.tsx and two <Icons.Camera>/<Icons.Folder> section headers that reference the local Icons object this PR removes. Git merged both cleanly but the result did not type-check. - drop the duplicate IconImage (both copies were byte-identical) - point the two section headers at the imported IconCamera/IconFolder - refresh the SORT_LABELS comment: the icon set is imported now, not declared below --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> * fix(config): allow an empty gallery, guard against a double /api suffix (#421) An empty gallery is now a valid, rendered state instead of a throw: deriveGallery() no longer requires at least one album or subpage, so a deployment with no albums yet renders a bare homepage the owner can fill in via /admin. getConfig() also stops appending /api to an Immich URL that already ends in it, which previously produced .../api/api and broke every upstream request. Includes a restore of the per-album sort test cases, which the branch had lost by being cut before #408/#414. * feat(admin): favicon upload, served from the content volume (#422) Adds a bundled default favicon, an upload widget in admin Settings > General, and a route that serves the icon from the writable content/ volume with a fallback to the bundled default. Raster uploads (PNG/ICO/JPEG) are wrapped in an SVG container; the response carries its own CSP so an uploaded SVG cannot execute script on the origin. The GET route revalidates with an ETag instead of caching immutably, so a newly uploaded icon shows up immediately. Uploads are written via temp file + rename, and a Reset button restores the bundled default. * ci: flag unformatted files in a PR, without blocking it (#424) Prettier is configured as an error rule in eslint.config.mjs but has never run in CI, so part of the tree predates it. A final CI step now diffs against the PR base, runs prettier --list-different over the changed files, and emits a warning annotation per offender plus a job summary. Advisory by design: it never fails the job. Blocking would turn a PR red for merely touching a file that was already unformatted, and normalising the tree in one commit would wreck git blame and conflict with the PRs in flight. Requires fetch-depth: 0, since diffing against the base needs its history. * feat(install): first-run wizard gated by a one-time setup token (#419) Adds /install, a four-step first-run wizard: connect to Immich, optionally pick albums, name the site, finish. It verifies the credentials against the Immich server before writing anything, then writes gallery.yaml, settings.yaml and a content/install.json carrying the Immich credentials and a generated site secret. install.json exists because a running process cannot pick up new env vars — the wizard has to write configuration that takes effect without a restart. getInstallCredentials() merges it under the real environment, so env vars always win and rotation stays a matter of setting one. Both the page and the API routes are gated by a one-time setup token printed to the server log, so a deployment that is reachable before gallery.yaml exists cannot be configured by whoever finds it first. The token is stored in content/.setup-token (0600) rather than a module variable: Next.js bundles the page and each route handler separately, so a module-level token left the page and the API disagreeing inside one process and the wizard stuck on step 1. It is removed once the install completes. The admin password is stored as an scrypt hash using the scheme lib/auth.ts already applies to album passwords; a plaintext ADMIN_PASSWORD env var keeps working. * docs: document the setup wizard, fix the read-only content mount (#425) Quick Start now leads with the /install wizard, with the hand-written YAML route kept alongside it, and a First-Run Setup section covers the setup token, the files the wizard writes, and env-var precedence. Two corrections: both Docker examples mounted content/ as :ro, which silently breaks the wizard, the admin panel and the backup rotation alike — docs/admin-panel.md already said so and the README contradicted it. And nothing documented that content/install.json holds the Immich API key, so a backup of content/ is a backup of credentials. Also adds a Contributors section crediting the people whose work is in the project. * feat(admin): floating save bar pinned to the bottom of the viewport (#426) The save bar was the first, static element inside .admin-main. Since the document itself scrolls, it left the viewport as soon as you scrolled down — editing a subpage section or a settings block far below gave no visible dirty hint and no reachable save button. Replace it with a bottom-pinned floating bar shared by both editors. It only mounts while there is something to act on (unsaved changes, an in-flight save, or a result message), so it never covers content while idle. The success message clears after 5s, which hides the bar again. - new SaveBar component, replacing the duplicated markup in PageBuilder and SettingsEditor - adopt the previously unused .floating-save-bar CSS: slide-in keyframes (carrying translateX(-50%)), dirty border, wrap/gap, mobile variant and a prefers-reduced-motion opt-out; z-index 900 keeps it below modals - .admin-main gains bottom padding so the bar never covers page content - drop the now-unreachable idle hints: the ⌘S hint becomes a button title, the Live Sync note becomes a static line above the settings layout - header "Site" link now bypasses the cache (/?fresh=1), so the preview stays reachable when the bar is hidden Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(admin): themed listbox for the album sort control (#427) The per-album "Photo order" control was a native <select>. Because an <option> cannot contain markup, its choices could not use the admin panel's currentColor SVG set — the reason #415 had to fall back to plain text after dropping the emoji labels. Adds a Listbox component implementing the ARIA combobox/listbox pattern, so options can render a glyph beside their label: - DOM focus stays on the trigger button; the active option is announced through aria-activedescendant, keeping focus management to one element - Keyboard: arrows (clamped at the ends, like a native select), Home/End, Enter/Space to commit, Escape to cancel, Tab commits and moves on, and prefix type-ahead with a repeat-key cycle - Outside dismissal on pointerdown, so a press starting outside closes the popup before the click retargets The sort options now carry an icon each: calendar, arrow-down, arrow-up, an A→Z marker, and the drag glyph for manual — matching the badge the album card already shows. SORT_LABELS stays plain text because the badge feeds it to a title attribute. Closes #417 Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(git): ignore generated design handoff folders * fix(admin): stop the album sort dropdown clipping, and simplify the panel (#428) * fix(admin): render listbox popup in a portal so it escapes modal clipping The sort control's popup was position:absolute inside three clipping ancestors (.album-drawer overflow:hidden > .album-drawer-body overflow-y:auto > .modal-right-column overflow-y:auto), so it was cut off at the bottom of the Edit Album Details modal. z-index could not help: clipping happens before stacking. It also always hung below the trigger, with no flip. Portal the popup to document.body and position it from the trigger's viewport rect, flipping above when there is more room there and capping max-height to the space available so it scrolls internally rather than overflowing. It is dismissed on scroll and resize, since the anchor is only measured on open. The outside-pointerdown handler now also treats the popup as inside; without that the portalled list counts as outside, and a click on an option would close it before the selection commits. * refactor(admin): single-column album details panel The left column spent 1.2fr on a cover thumbnail and three stat rows, two of which (Status, Custom Hero) only restated the form fields opposite them, while the form itself was squeezed into 1.8fr behind a second nested scroller. Stack the drawer in one column instead: cover as a banner, then the form at full width, with the UUID moved into the footer. The body is now the only scroll container, which also removes one of the ancestors that was clipping the sort popup. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> * fix(admin): give the portalled listbox its theme back, lock the page behind modals (#429) Two defects in the album editor. The sort listbox popup painted transparent. Every --admin-* variable is scoped to .admin-layout, and since the popup moved into document.body it sits outside that subtree, so background/border/text all resolved to nothing. It now carries its own copy of the palette in both colour schemes, plus the font it no longer inherits. Scrolling inside a modal also moved the page behind it. No admin modal ever locked body scroll: the overlay covers the page but does not absorb wheel events, so a scroll starting on the backdrop — or continuing past the end of the modal's own scroller — reaches the document. overscroll-behavior cannot cover that case on its own, because it only applies to scroll containers and the backdrop is not one. useScrollLock freezes body while a modal is open and compensates for the width the scrollbar gives up, so nothing shifts underneath. Each lock restores the inline value it found, which makes nesting work without a counter — a picker opened from the drawer restores the drawer's hidden state instead of clearing it. Applied to both drawers and all four picker modals, which share the defect. overscroll-behavior: contain on the scrollers stops the chaining they can handle themselves. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com> * fix(security): allow unsafe-eval in CSP script-src during dev mode * feat(journal): add Journal Studio with split-screen editor, live preview and dedicated routes * fix(build): separate client parser from server journal-service and fix build type errors * fix(journal): Fotos rendern, Layout und Lightbox-Steuerung korrigieren Fünf unabhängige Fehler in der öffentlichen Journal- und Essay-Ansicht: * Foto-Blöcke wurden nie angezeigt. EssayView löst ein Foto über PhotoItem.id auf, und das sind verschlüsselte Tokens — die Blöcke aus dem Markdown tragen aber rohe Asset-UUIDs. Jede Zuordnung lief ins Leere, und nicht auflösbare Blöcke werden still verworfen. Die IDs werden jetzt serverseitig übersetzt; damit verschwinden nebenbei die rohen UUIDs aus dem Client-Payload, die dort laut Projektregel nie auftauchen dürfen. Nicht auflösbare Referenzen werden geloggt. * Überschriften standen weiter links als der Fließtext. Jeder Block hatte einzeln `max-width: 68ch`, und `ch` ist relativ zur Schrift des Elements — die Serif-Überschrift ergab eine breitere Spalte. Ersetzt durch eine gemeinsame, font-unabhängige `--essay-measure`. * Fullbleed-Fotos bluteten nur nach links aus: `.essay-figure` ist `width: 100%`, wodurch die Box überbestimmt ist und der negative rechte Margin verworfen wird. * Foto-Paare stellten beide Bilder gleich breit dar, wodurch ein Hochformat neben einem Querformat doppelt so hoch wurde. Jetzt eine Justified-Reihe: Breite proportional zum Seitenverhältnis, dadurch exakt gleiche Höhen ohne Beschnitt. * Die Lightbox hatte im Journal keine Tastatursteuerung und keine Scroll-Sperre — beides lag in PhotoGrid, also nur im Album-Raster. Verlagert in die Lightbox selbst, der doppelte Handler in PhotoGrid entfernt (sonst wäre pro Pfeildruck zwei Bilder weitergesprungen). Zusätzlich sind Proofing-Herzen und das EXIF-Panel im redaktionellen Modus abschaltbar und im Journal aus: Client-Proofing ist ein Übergabe-Workflow für Alben, keine Funktion einer Reportage. Auf der Übersicht wurde der Untertitel doppelt gerendert, weil extractExcerpt() auf ihn zurückfällt. * feat(admin): eigene URLs für alle Bereiche und überarbeiteter Journal Studio Das Panel war eine einzige Client-Komponente, die ihre Tabs über useState umschaltet: keine Route pro Bereich, kein Deep-Link, kein Zurück-Button, und nach jedem Reload landete man wieder auf "Pages". Auch der Journal-Editor hatte keine eigene URL. Jetzt sieben echte Routen (/admin, /admin/pages, /admin/journal, /admin/journal/<slug>, /admin/settings, /admin/settings/<section>, /admin/analytics). Die Shell mit Auth-Prüfung und Kopfzeile sitzt im Layout und umschließt children — so bleibt die Session-Prüfung über Routenwechsel montiert, statt bei jedem Tab-Wechsel neu zu laufen und den Spinner aufblitzen zu lassen. Unbekannte Settings-Sections fallen auf General zurück. Im selben Zug der Journal Studio, der die Routing-Änderung ohnehin berührt: * Alle Eingabefelder nutzten die Klasse `admin-input`, die in keinem CSS definiert war — sie fielen auf Browser-Defaults zurück. Jetzt gestylt, gescoped, damit der generische Name nicht ins übrige Panel leckt. * Der Split View ist per Divider verschiebbar (Maus, Tastatur, Doppelklick zum Zurücksetzen), Breite in localStorage. * Das Studio bricht aus der 1120px-Spalte aus, die Preview hat Platz. * Die Preview zeigte für jedes Foto fest 3:2 und log damit über das Layout der veröffentlichten Seite; die echten Verhältnisse werden jetzt an den Thumbnails gemessen. * Blöcke mit alten positionsbasierten Foto-Referenzen werden markiert — die lassen sich auf einer eigenständigen Journal-Seite nicht auflösen und verschwanden bisher stillschweigend. * Blocktyp-Chips als gemeinsame Komponente, monochrom und per Icon unterschieden statt in einer eigenen Blau/Lila/Orange-Palette, die sonst nirgends im Panel vorkommt. * Emojis raus, SVG-Icons rein. * fix(admin): Designsystem-Lücken im Panel schließen Eine systematische Suche nach Klassen, die im TSX benutzt, aber in keinem CSS definiert sind, hat vier Stellen mit demselben Muster gefunden: * `admin-btn-secondary` und `admin-btn-danger` existierten nicht. Sämtliche Löschen-Buttons sahen aus wie normale Buttons — keine Warnwirkung. Als `.admin-btn.admin-btn-danger` geschrieben, weil die Varianten mit den Größenklassen kombiniert werden, die weiter unten ihren eigenen Hintergrund setzen. * `page-progress-fill` fehlte: die Balken im Analytics-Panel waren leere Rinnen, der Wert unsichtbar. Ebenso `analytics-empty` und `admin-loading-container`. * `subpage-drawer-section`, `subpage-drawer-title-group` und `input-with-icon` im PageBuilder waren wirkungslos und teils mit Inline-Styles notdürftig kompensiert. * `grid-card-preview` fehlte, wodurch alle Layout-Vorschauen auf Höhe null kollabierten. Nur "Showcase" war sichtbar — und das aus Versehen, weil sein Tile `hero-tile` hieß und damit die `aspect-ratio` einer fremden PageBuilder-Klasse erbte. Umbenannt. Dazu die Theme-Vorschauen, die praktisch identisch aussahen: alle sieben zeigten dieselben drei quadratischen Kacheln, einziger Unterschied war die Hintergrundfarbe. Sie spiegeln jetzt die echten Preset-Daten aus lib/config/theme.ts — Schriftcharakter, Eckradius, Rasterdichte, Passepartout bzw. Schatten. Die Kopfzeile richtet sich an einer gemeinsamen Steuerhöhe aus. Der "Site"-Link war höher als die Buttons daneben: `.admin-btn` hatte keine explizite line-height, und <button> bekommt box-sizing: border-box vom Browser, <a> nicht. Die Statusanzeige setzte weder Schriftfamilie noch -größe und fiel auf den Browser-Default zurück — sie war nie Teil des Designsystems. Jetzt gleiche Höhe und Typografie, Pillenform als Zustandsanzeige, Trenner zur Aktionsgruppe. Das dauerhafte Pulsieren des grünen Punkts entfällt; Animation bleibt den Zuständen vorbehalten, die Aufmerksamkeit brauchen. Restliche Emojis durch SVG-Icons ersetzt. * feat(admin): add scroll-to-top toggle and SVG arrow The back-to-top button was always on and drew its arrow with the ↑ text character. Add a `scrollToTop` setting (General section in the admin panel, defaults to on so existing sites are unaffected) and replace the glyph with a stroked SVG that inherits currentColor across all presets. Scroll handling is now rAF-throttled, and prefers-reduced-motion turns off both the hover lift and the smooth scroll. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * security(journal): escape author HTML instead of filtering it CodeQL flags 26 high-severity alerts on the release PR; the bulk of them point at sanitizeHtml(), a denylist of three regexes whose output goes into dangerouslySetInnerHTML. I reproduced the bypasses before changing anything — all four pass the old filter: <img src=x onerror=alert(1)> unquoted handler, regex wants quotes <img src=x onerror='alert(1)'> single quotes, same reason <svg onload=alert(1)> not a <script> tag javasjavascript:cript:alert(1) one-pass replace, the rest recombines Plus an attribute breakout in the link renderer, which interpolated the URL into href="${url}" unescaped: [x](" onmouseover=alert(1) x=") -> <a href="" onmouseover=alert(1" ...> Replaced with escaping. Every `&<>"'` in author text becomes an entity before any markdown rule runs, so the only tags in the output are the ones renderInlineMarkdown builds itself and a URL cannot leave its attribute. Link schemes are now an allowlist (http, https, mailto, tel, relative, anchor); anything else renders as plain text. The serializer needed decodeHtmlEntities to match: without it a save would write `&lt;` into the Markdown file and the next parse would escape the `&` again, corrupting the text further on every round trip. A test covers parse -> serialize -> parse stability. Two existing tests asserted the old behaviour and were rewritten rather than deleted: one expected the script tag to be *removed* from the output, the other expected the substring "onerror" to be absent. Both now assert the property that matters — that no tag can form — because `onerror` surviving as inert text is fine. Exploitation required admin access either way: journal and essay text comes from the studio or from content/*.md. This removes the weakness, it does not close an open door. * fix(journal): contain file paths, fix frontmatter escaping, defuse two regexes Follow-up to the CodeQL findings on release PR #432. I went through all 23 alerts individually; this addresses the ones that are worth addressing and documents the ones that are not. Path containment (12 alerts, all false positives). Every path built from a slug goes through isValidSlug(), a strict `/^[a-zA-Z0-9_-]+$/` allowlist — verified against `../../etc/passwd`, `foo/../../bar`, `a/b`, `..` and friends, all rejected. CodeQL cannot see it because the check lives in another module. Added a containedPath() helper that resolves the path and refuses anything landing outside the content directory: a second lock on a door that was already locked, and a barrier the analysis can follow. Also removed the dead `slug.endsWith('.md')` branches — isValidSlug rejects dots, so they could never be taken. Frontmatter escaping (1 alert, a real bug). The serializer escaped `"` but not `\`, and the parser never unescaped anything. A title containing either character gained a backslash on every save/load cycle: Path C:\Users "quoted" -> Path C:\\Users \"quoted\" -> ... Escaping now covers the backslash first and the parser undoes both. A round trip test covers quotes, backslashes, colons and apostrophes. Two of three ReDoS regexes (2 alerts). The heading pattern had `\s+` next to `(.+)`, which overlap, so the engine tried every split of the whitespace run before failing; it is `[ \t]+` and `(\S.*)` now. The quote author pattern wrapped a lazy group around an optional group — the quadratic case — and is an index split on the first separator now. The third regex, the bold/italic pass, is deliberately left alone. Rewriting it with a negated class removes the backtracking but breaks nesting: `**bold *and italic* here**` renders as `*<em>bold </em>and italic<em> here</em>*`. The input is Markdown from an authenticated admin, never a visitor, so the worst case is an author slowing down their own page. The comment in the code says so. Not addressed: 5 js/insufficient-password-hash alerts. They ask for a slow KDF where the code uses SHA-256/HMAC — correct in general, but the admin password comes from an environment variable and is never stored, so a stronger KDF protects nothing that is not already in plaintext in the environment. 399 unit tests pass (18 new), build and tsc clean. * fix(journal): split the quote author by scanning, not by pattern Cleaning up after myself. #439 replaced the quote author regex `/^(.*?)(?:\s+--\s+(.+))?$/` — a lazy group around an optional one, the quadratic case — with `/\s+--\s+/`, and CodeQL promptly flagged the replacement for the same reason. One reported pattern traded for another. splitQuoteAuthor() scans for the first `--` that has whitespace on both sides. Linear, and it needs no reasoning about the regex engine at all. Behaviour is identical to the original regex, checked case by case against it: separator, no separator, several separators, tabs, wide gaps, `a--b` without spaces, leading and trailing separators, empty string. All nine are covered by tests, plus one asserting it stays fast on a 50k whitespace run. * security(admin): derive the session signing key with scrypt getSigningKey() ran the admin password through a single SHA-256 digest. It is key derivation rather than password storage, so it was never a stored-hash problem — but if the derived key ever leaked, one fast hash makes recovering the password by brute force cheap. CodeQL flags it as js/insufficient-password-hash and, for this particular alert, has a point. scrypt now. Two details that matter: The salt has to be stable. A random salt would produce a different key on every call and invalidate every session; it is derived from AUTH_SECRET, which is deployment-specific. Verified across separate processes: same inputs produce a verifying token, so a restart or redeploy does not log everyone out. The result is cached for the process lifetime. scrypt is deliberately slow and getSigningKey() runs on every admin request — deriving per call would add ~24ms to each one. The cache key is a digest of secret plus password, so a rotation misses the cache and derives again, and no extra plaintext copy of the password is kept around. Measured: first derivation 24ms, subsequent calls 0.12ms. Password change and secret change both invalidate an existing token, checked in separate processes. Note the one-time effect: existing admin sessions are invalidated by the change in derivation, so everyone logs in once more. * security(admin): key the signing-key cache on its inputs, not a digest #441 removed the SHA-256 digest of the admin password from the key derivation and introduced a new one three lines above it, as the cache key. Same rule, same file: CodeQL reported it immediately. The comment justifying it was wrong too. It claimed no second plaintext copy of the password was retained, while building the digest input allocates exactly that in order to hash it. The cache now holds the two input strings and compares them directly. They are the same objects the env and install caches already hold, so nothing extra is retained, and no fast hash of the password exists in memory for the life of the process. Re-verified after the change, in separate processes: a token from one process verifies in another with the same inputs, a changed password or secret rejects it, first derivation 24ms, cached calls 0.001ms. That leaves scrypt as the only place the password is hashed here. The two HMACs further down operate on the derived key and on token data, not on the password; the constant-time comparison in verifyAdminPassword is the previously dismissed one. --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
2026-08-14 16:55:07 +02:00
box-shadow: 0 0 0 3px rgba(16, 185, 129, 0.18);
feat(admin): visual theme cards, album search, and status dashboard (#241) * feat(admin): implement visual theme cards, album search, and system status diagnostics * fix(admin): resolve type-checking build errors in SettingsEditor and status route --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-05-31 21:17:52 +02:00
}
.status-badge-btn.disconnected .status-dot {
background-color: var(--admin-error, #ef4444);
box-shadow: 0 0 8px var(--admin-error, #ef4444);
animation: pulse-red 1.5s infinite;
}
chore(release): v0.10.0 (#400) Photo Essay mode, client proofing, studio-modern preset, admin panel overhaul, watermark, cookieless analytics, subpage toggle, SEO title templates. Analytics API now admin-only, Trivy scan on publish. Album order mirrors the Immich timeline; map theme, admin status panel, lightbox counter and Docker health check fixed. See CHANGELOG.md for the full list and the health-check upgrade note.
2026-08-10 09:56:20 +02:00
/* The diagnostics request itself did not run — deliberately not red, and not
animated: an unanswered check is not a fault report. */
.status-badge-btn.unknown .status-dot {
background-color: var(--admin-text-secondary);
}
feat(admin): visual theme cards, album search, and status dashboard (#241) * feat(admin): implement visual theme cards, album search, and system status diagnostics * fix(admin): resolve type-checking build errors in SettingsEditor and status route --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-05-31 21:17:52 +02:00
.status-text {
release: v0.11.0 — journal fixes, admin URLs, design system cleanup (#432) * fix(screenshots): sharp-Typen fuer 0.34 und 0.35 gleichzeitig (#410) sharp 0.35 ist von `export =` auf ESM umgestellt: der Modul-Namespace ist nicht mehr aufrufbar, die Factory sitzt unter .default. Der Type-Check brach damit in scripts/screenshots.ts weg, sobald der Next-Bump (#402) sharp von 0.34.5 auf 0.35.3 mitzieht -- sharp ist hier keine deklarierte Dependency, sondern kommt ueber Next mit. Die Form wird jetzt aus dem installierten Paket abgeleitet statt festgeschrieben, zur Laufzeit wie im Typ. Geprueft mit beiden Versionen: tsc laeuft mit 0.34.5 und mit 0.35.3 fehlerfrei durch. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(deps): bump the nextjs group across 1 directory with 2 updates (#402) Bumps the nextjs group with 2 updates in the / directory: [next](https://github.com/vercel/next.js) and [eslint-config-next](https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next). Updates `next` from 16.2.12 to 16.3.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/compare/v16.2.12...v16.3.0) Updates `eslint-config-next` from 16.2.12 to 16.3.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/commits/v16.3.0/packages/eslint-config-next) --- updated-dependencies: - dependency-name: eslint-config-next dependency-version: 16.3.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: nextjs - dependency-name: next dependency-version: 16.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nextjs ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps-dev): bump prettier from 3.8.3 to 3.9.6 (#405) Bumps [prettier](https://github.com/prettier/prettier) from 3.8.3 to 3.9.6. - [Release notes](https://github.com/prettier/prettier/releases) - [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md) - [Commits](https://github.com/prettier/prettier/compare/3.8.3...3.9.6) --- updated-dependencies: - dependency-name: prettier dependency-version: 3.9.6 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * docs(changelog): Unreleased-Sektion fuer die Bumps nach v0.10.0 (#413) Die Dependency-PRs sind nach dem Release auf dev gelandet, teils auch auf main. Ohne Eintrag waeren sie beim naechsten Release unsichtbar -- inklusive Next 16.3.0, das CVE-2025-13465 mitbringt. Ausserdem im 0.10.0-Abschnitt nachgetragen, dass der Trivy-Scan bis #409 nie gelaufen ist. Der Fix steckt im Tag v0.10.0, fehlte aber in der Aufzaehlung -- und "Images werden bei jedem Publish gescannt" stand im Changelog, waehrend der Job im Action-Setup abbrach. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(gallery): per-album sort order, independent of Immich (#408) (#414) Album order was dictated entirely by Immich: getAlbum() sorted by the album's own asc/desc flag, so a Folio album always mirrored the archive. A curated series has a narrative order that has nothing to do with capture time, and changing the Immich album's sort to fit the website changes it for the archive too. Adds an optional per-album `sort` in gallery.yaml, editable in /admin, defaulting to today's behaviour so every existing config is unchanged: immich (default) | newest | oldest | filename | manual `manual` is a pinned *prefix*: `assetOrder` lists only the photos placed by hand, everything else follows in the album's Immich order. A full permutation of a 2,000-photo album would be ~80 KB of UUIDs in a file that is rewritten and copied to content/.backups/ on every admin save. It also makes drift fall out for free — photos removed in Immich never match, new ones land in the tail rather than being hidden. Sorting is applied after the cache read, not before the cache write, so the LRU keeps one canonical Immich-ordered copy per album. That avoids putting the mode in the cache key, lets a config change take effect without depending on invalidation, and keeps the stale-serving path correct. cache.get() returns the stored object by reference, so withSort() returns a shallow clone with a new array — sorting in place would reorder the shared entry, and under request coalescing every concurrent caller would be sorting the same array. Also fixes a prerequisite bug: /api/admin/albums/[albumId]/assets read album.assets from GET /albums/:id, which Immich 3.x no longer populates (lib/immich.ts:507). The hero picker's "This Album" tab returned nothing and threw outright when the key was absent. It now goes through the client's paginated metadata search, with ?types=all to opt videos in for the reorder editor. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): drop decorative emoji from the sort select labels (#415) An <option> cannot contain markup, so the SVG set in Icons is not reachable there — but a decorative emoji is not a substitute for it. Plain text instead; the album card badge already uses a real icon. The remaining emoji in the admin panel (asset picker tabs, section headings, layout picker options) predate this branch and are left for a separate cleanup. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): replace emoji icons with the shared SVG icon set (#416) The admin panel mixed two icon conventions: inline SVGs from `Icons.tsx` in most components, and decorative emoji in the asset picker and a few PageBuilder labels. Emoji render inconsistently across platforms, ignore the accent colour, and cannot inherit the `.svg-icon` sizing rules. - Icons.tsx: add `IconStar` (filled — it marks a state, not an action) and `IconImage`. - AssetPicker: the three tab labels and the favourite tile badge now use IconFolder / IconStar / IconImage. - PageBuilder: the "Standalone Albums" and "Subpages" headings use the icon set instead of an emoji. - PageBuilder: the layout picker drops its emoji for plain text. An <option> cannot contain markup, so an SVG is impossible there and a decorative glyph is not a substitute. - admin.css: align icon and label in the picker tabs, and swap the favourite badge's text-shadow for drop-shadow, which is what applies to an inline SVG. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): fold PageBuilder's local icons into the shared Icons module (#418) * refactor(admin): fold PageBuilder's local icons into the shared module PageBuilder.tsx carried its own `Icons` object duplicating most of the glyphs already exported by Icons.tsx, with hardcoded sizes and slightly divergent paths. Migrate all 32 call sites to the shared module and delete the local object. Five glyphs had no counterpart and are added to Icons.tsx as 1:1 ports of the local paths: IconX, IconPlus, IconHome, IconCopy, IconImage. The local ExternalLink and Check are dropped rather than ported — both had zero call sites. Two glyphs change shape slightly, which is the point of consolidating: the shared IconCamera includes the viewfinder bump the local copy omitted, and drag handles now use IconGripVertical. IconGripVertical uses the module's square 24x24 viewBox, so `.svg-drag` goes from 12x18 to 18x18 — the old non-square box would letterbox the glyph down to 12x12 and shrink the handle. * fix(admin): resolve icon-module integration after #416 Merging dev brought in #416, which added a second IconImage to Icons.tsx and two <Icons.Camera>/<Icons.Folder> section headers that reference the local Icons object this PR removes. Git merged both cleanly but the result did not type-check. - drop the duplicate IconImage (both copies were byte-identical) - point the two section headers at the imported IconCamera/IconFolder - refresh the SORT_LABELS comment: the icon set is imported now, not declared below --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> * fix(config): allow an empty gallery, guard against a double /api suffix (#421) An empty gallery is now a valid, rendered state instead of a throw: deriveGallery() no longer requires at least one album or subpage, so a deployment with no albums yet renders a bare homepage the owner can fill in via /admin. getConfig() also stops appending /api to an Immich URL that already ends in it, which previously produced .../api/api and broke every upstream request. Includes a restore of the per-album sort test cases, which the branch had lost by being cut before #408/#414. * feat(admin): favicon upload, served from the content volume (#422) Adds a bundled default favicon, an upload widget in admin Settings > General, and a route that serves the icon from the writable content/ volume with a fallback to the bundled default. Raster uploads (PNG/ICO/JPEG) are wrapped in an SVG container; the response carries its own CSP so an uploaded SVG cannot execute script on the origin. The GET route revalidates with an ETag instead of caching immutably, so a newly uploaded icon shows up immediately. Uploads are written via temp file + rename, and a Reset button restores the bundled default. * ci: flag unformatted files in a PR, without blocking it (#424) Prettier is configured as an error rule in eslint.config.mjs but has never run in CI, so part of the tree predates it. A final CI step now diffs against the PR base, runs prettier --list-different over the changed files, and emits a warning annotation per offender plus a job summary. Advisory by design: it never fails the job. Blocking would turn a PR red for merely touching a file that was already unformatted, and normalising the tree in one commit would wreck git blame and conflict with the PRs in flight. Requires fetch-depth: 0, since diffing against the base needs its history. * feat(install): first-run wizard gated by a one-time setup token (#419) Adds /install, a four-step first-run wizard: connect to Immich, optionally pick albums, name the site, finish. It verifies the credentials against the Immich server before writing anything, then writes gallery.yaml, settings.yaml and a content/install.json carrying the Immich credentials and a generated site secret. install.json exists because a running process cannot pick up new env vars — the wizard has to write configuration that takes effect without a restart. getInstallCredentials() merges it under the real environment, so env vars always win and rotation stays a matter of setting one. Both the page and the API routes are gated by a one-time setup token printed to the server log, so a deployment that is reachable before gallery.yaml exists cannot be configured by whoever finds it first. The token is stored in content/.setup-token (0600) rather than a module variable: Next.js bundles the page and each route handler separately, so a module-level token left the page and the API disagreeing inside one process and the wizard stuck on step 1. It is removed once the install completes. The admin password is stored as an scrypt hash using the scheme lib/auth.ts already applies to album passwords; a plaintext ADMIN_PASSWORD env var keeps working. * docs: document the setup wizard, fix the read-only content mount (#425) Quick Start now leads with the /install wizard, with the hand-written YAML route kept alongside it, and a First-Run Setup section covers the setup token, the files the wizard writes, and env-var precedence. Two corrections: both Docker examples mounted content/ as :ro, which silently breaks the wizard, the admin panel and the backup rotation alike — docs/admin-panel.md already said so and the README contradicted it. And nothing documented that content/install.json holds the Immich API key, so a backup of content/ is a backup of credentials. Also adds a Contributors section crediting the people whose work is in the project. * feat(admin): floating save bar pinned to the bottom of the viewport (#426) The save bar was the first, static element inside .admin-main. Since the document itself scrolls, it left the viewport as soon as you scrolled down — editing a subpage section or a settings block far below gave no visible dirty hint and no reachable save button. Replace it with a bottom-pinned floating bar shared by both editors. It only mounts while there is something to act on (unsaved changes, an in-flight save, or a result message), so it never covers content while idle. The success message clears after 5s, which hides the bar again. - new SaveBar component, replacing the duplicated markup in PageBuilder and SettingsEditor - adopt the previously unused .floating-save-bar CSS: slide-in keyframes (carrying translateX(-50%)), dirty border, wrap/gap, mobile variant and a prefers-reduced-motion opt-out; z-index 900 keeps it below modals - .admin-main gains bottom padding so the bar never covers page content - drop the now-unreachable idle hints: the ⌘S hint becomes a button title, the Live Sync note becomes a static line above the settings layout - header "Site" link now bypasses the cache (/?fresh=1), so the preview stays reachable when the bar is hidden Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(admin): themed listbox for the album sort control (#427) The per-album "Photo order" control was a native <select>. Because an <option> cannot contain markup, its choices could not use the admin panel's currentColor SVG set — the reason #415 had to fall back to plain text after dropping the emoji labels. Adds a Listbox component implementing the ARIA combobox/listbox pattern, so options can render a glyph beside their label: - DOM focus stays on the trigger button; the active option is announced through aria-activedescendant, keeping focus management to one element - Keyboard: arrows (clamped at the ends, like a native select), Home/End, Enter/Space to commit, Escape to cancel, Tab commits and moves on, and prefix type-ahead with a repeat-key cycle - Outside dismissal on pointerdown, so a press starting outside closes the popup before the click retargets The sort options now carry an icon each: calendar, arrow-down, arrow-up, an A→Z marker, and the drag glyph for manual — matching the badge the album card already shows. SORT_LABELS stays plain text because the badge feeds it to a title attribute. Closes #417 Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(git): ignore generated design handoff folders * fix(admin): stop the album sort dropdown clipping, and simplify the panel (#428) * fix(admin): render listbox popup in a portal so it escapes modal clipping The sort control's popup was position:absolute inside three clipping ancestors (.album-drawer overflow:hidden > .album-drawer-body overflow-y:auto > .modal-right-column overflow-y:auto), so it was cut off at the bottom of the Edit Album Details modal. z-index could not help: clipping happens before stacking. It also always hung below the trigger, with no flip. Portal the popup to document.body and position it from the trigger's viewport rect, flipping above when there is more room there and capping max-height to the space available so it scrolls internally rather than overflowing. It is dismissed on scroll and resize, since the anchor is only measured on open. The outside-pointerdown handler now also treats the popup as inside; without that the portalled list counts as outside, and a click on an option would close it before the selection commits. * refactor(admin): single-column album details panel The left column spent 1.2fr on a cover thumbnail and three stat rows, two of which (Status, Custom Hero) only restated the form fields opposite them, while the form itself was squeezed into 1.8fr behind a second nested scroller. Stack the drawer in one column instead: cover as a banner, then the form at full width, with the UUID moved into the footer. The body is now the only scroll container, which also removes one of the ancestors that was clipping the sort popup. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> * fix(admin): give the portalled listbox its theme back, lock the page behind modals (#429) Two defects in the album editor. The sort listbox popup painted transparent. Every --admin-* variable is scoped to .admin-layout, and since the popup moved into document.body it sits outside that subtree, so background/border/text all resolved to nothing. It now carries its own copy of the palette in both colour schemes, plus the font it no longer inherits. Scrolling inside a modal also moved the page behind it. No admin modal ever locked body scroll: the overlay covers the page but does not absorb wheel events, so a scroll starting on the backdrop — or continuing past the end of the modal's own scroller — reaches the document. overscroll-behavior cannot cover that case on its own, because it only applies to scroll containers and the backdrop is not one. useScrollLock freezes body while a modal is open and compensates for the width the scrollbar gives up, so nothing shifts underneath. Each lock restores the inline value it found, which makes nesting work without a counter — a picker opened from the drawer restores the drawer's hidden state instead of clearing it. Applied to both drawers and all four picker modals, which share the defect. overscroll-behavior: contain on the scrollers stops the chaining they can handle themselves. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com> * fix(security): allow unsafe-eval in CSP script-src during dev mode * feat(journal): add Journal Studio with split-screen editor, live preview and dedicated routes * fix(build): separate client parser from server journal-service and fix build type errors * fix(journal): Fotos rendern, Layout und Lightbox-Steuerung korrigieren Fünf unabhängige Fehler in der öffentlichen Journal- und Essay-Ansicht: * Foto-Blöcke wurden nie angezeigt. EssayView löst ein Foto über PhotoItem.id auf, und das sind verschlüsselte Tokens — die Blöcke aus dem Markdown tragen aber rohe Asset-UUIDs. Jede Zuordnung lief ins Leere, und nicht auflösbare Blöcke werden still verworfen. Die IDs werden jetzt serverseitig übersetzt; damit verschwinden nebenbei die rohen UUIDs aus dem Client-Payload, die dort laut Projektregel nie auftauchen dürfen. Nicht auflösbare Referenzen werden geloggt. * Überschriften standen weiter links als der Fließtext. Jeder Block hatte einzeln `max-width: 68ch`, und `ch` ist relativ zur Schrift des Elements — die Serif-Überschrift ergab eine breitere Spalte. Ersetzt durch eine gemeinsame, font-unabhängige `--essay-measure`. * Fullbleed-Fotos bluteten nur nach links aus: `.essay-figure` ist `width: 100%`, wodurch die Box überbestimmt ist und der negative rechte Margin verworfen wird. * Foto-Paare stellten beide Bilder gleich breit dar, wodurch ein Hochformat neben einem Querformat doppelt so hoch wurde. Jetzt eine Justified-Reihe: Breite proportional zum Seitenverhältnis, dadurch exakt gleiche Höhen ohne Beschnitt. * Die Lightbox hatte im Journal keine Tastatursteuerung und keine Scroll-Sperre — beides lag in PhotoGrid, also nur im Album-Raster. Verlagert in die Lightbox selbst, der doppelte Handler in PhotoGrid entfernt (sonst wäre pro Pfeildruck zwei Bilder weitergesprungen). Zusätzlich sind Proofing-Herzen und das EXIF-Panel im redaktionellen Modus abschaltbar und im Journal aus: Client-Proofing ist ein Übergabe-Workflow für Alben, keine Funktion einer Reportage. Auf der Übersicht wurde der Untertitel doppelt gerendert, weil extractExcerpt() auf ihn zurückfällt. * feat(admin): eigene URLs für alle Bereiche und überarbeiteter Journal Studio Das Panel war eine einzige Client-Komponente, die ihre Tabs über useState umschaltet: keine Route pro Bereich, kein Deep-Link, kein Zurück-Button, und nach jedem Reload landete man wieder auf "Pages". Auch der Journal-Editor hatte keine eigene URL. Jetzt sieben echte Routen (/admin, /admin/pages, /admin/journal, /admin/journal/<slug>, /admin/settings, /admin/settings/<section>, /admin/analytics). Die Shell mit Auth-Prüfung und Kopfzeile sitzt im Layout und umschließt children — so bleibt die Session-Prüfung über Routenwechsel montiert, statt bei jedem Tab-Wechsel neu zu laufen und den Spinner aufblitzen zu lassen. Unbekannte Settings-Sections fallen auf General zurück. Im selben Zug der Journal Studio, der die Routing-Änderung ohnehin berührt: * Alle Eingabefelder nutzten die Klasse `admin-input`, die in keinem CSS definiert war — sie fielen auf Browser-Defaults zurück. Jetzt gestylt, gescoped, damit der generische Name nicht ins übrige Panel leckt. * Der Split View ist per Divider verschiebbar (Maus, Tastatur, Doppelklick zum Zurücksetzen), Breite in localStorage. * Das Studio bricht aus der 1120px-Spalte aus, die Preview hat Platz. * Die Preview zeigte für jedes Foto fest 3:2 und log damit über das Layout der veröffentlichten Seite; die echten Verhältnisse werden jetzt an den Thumbnails gemessen. * Blöcke mit alten positionsbasierten Foto-Referenzen werden markiert — die lassen sich auf einer eigenständigen Journal-Seite nicht auflösen und verschwanden bisher stillschweigend. * Blocktyp-Chips als gemeinsame Komponente, monochrom und per Icon unterschieden statt in einer eigenen Blau/Lila/Orange-Palette, die sonst nirgends im Panel vorkommt. * Emojis raus, SVG-Icons rein. * fix(admin): Designsystem-Lücken im Panel schließen Eine systematische Suche nach Klassen, die im TSX benutzt, aber in keinem CSS definiert sind, hat vier Stellen mit demselben Muster gefunden: * `admin-btn-secondary` und `admin-btn-danger` existierten nicht. Sämtliche Löschen-Buttons sahen aus wie normale Buttons — keine Warnwirkung. Als `.admin-btn.admin-btn-danger` geschrieben, weil die Varianten mit den Größenklassen kombiniert werden, die weiter unten ihren eigenen Hintergrund setzen. * `page-progress-fill` fehlte: die Balken im Analytics-Panel waren leere Rinnen, der Wert unsichtbar. Ebenso `analytics-empty` und `admin-loading-container`. * `subpage-drawer-section`, `subpage-drawer-title-group` und `input-with-icon` im PageBuilder waren wirkungslos und teils mit Inline-Styles notdürftig kompensiert. * `grid-card-preview` fehlte, wodurch alle Layout-Vorschauen auf Höhe null kollabierten. Nur "Showcase" war sichtbar — und das aus Versehen, weil sein Tile `hero-tile` hieß und damit die `aspect-ratio` einer fremden PageBuilder-Klasse erbte. Umbenannt. Dazu die Theme-Vorschauen, die praktisch identisch aussahen: alle sieben zeigten dieselben drei quadratischen Kacheln, einziger Unterschied war die Hintergrundfarbe. Sie spiegeln jetzt die echten Preset-Daten aus lib/config/theme.ts — Schriftcharakter, Eckradius, Rasterdichte, Passepartout bzw. Schatten. Die Kopfzeile richtet sich an einer gemeinsamen Steuerhöhe aus. Der "Site"-Link war höher als die Buttons daneben: `.admin-btn` hatte keine explizite line-height, und <button> bekommt box-sizing: border-box vom Browser, <a> nicht. Die Statusanzeige setzte weder Schriftfamilie noch -größe und fiel auf den Browser-Default zurück — sie war nie Teil des Designsystems. Jetzt gleiche Höhe und Typografie, Pillenform als Zustandsanzeige, Trenner zur Aktionsgruppe. Das dauerhafte Pulsieren des grünen Punkts entfällt; Animation bleibt den Zuständen vorbehalten, die Aufmerksamkeit brauchen. Restliche Emojis durch SVG-Icons ersetzt. * feat(admin): add scroll-to-top toggle and SVG arrow The back-to-top button was always on and drew its arrow with the ↑ text character. Add a `scrollToTop` setting (General section in the admin panel, defaults to on so existing sites are unaffected) and replace the glyph with a stroked SVG that inherits currentColor across all presets. Scroll handling is now rAF-throttled, and prefers-reduced-motion turns off both the hover lift and the smooth scroll. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * security(journal): escape author HTML instead of filtering it CodeQL flags 26 high-severity alerts on the release PR; the bulk of them point at sanitizeHtml(), a denylist of three regexes whose output goes into dangerouslySetInnerHTML. I reproduced the bypasses before changing anything — all four pass the old filter: <img src=x onerror=alert(1)> unquoted handler, regex wants quotes <img src=x onerror='alert(1)'> single quotes, same reason <svg onload=alert(1)> not a <script> tag javasjavascript:cript:alert(1) one-pass replace, the rest recombines Plus an attribute breakout in the link renderer, which interpolated the URL into href="${url}" unescaped: [x](" onmouseover=alert(1) x=") -> <a href="" onmouseover=alert(1" ...> Replaced with escaping. Every `&<>"'` in author text becomes an entity before any markdown rule runs, so the only tags in the output are the ones renderInlineMarkdown builds itself and a URL cannot leave its attribute. Link schemes are now an allowlist (http, https, mailto, tel, relative, anchor); anything else renders as plain text. The serializer needed decodeHtmlEntities to match: without it a save would write `&lt;` into the Markdown file and the next parse would escape the `&` again, corrupting the text further on every round trip. A test covers parse -> serialize -> parse stability. Two existing tests asserted the old behaviour and were rewritten rather than deleted: one expected the script tag to be *removed* from the output, the other expected the substring "onerror" to be absent. Both now assert the property that matters — that no tag can form — because `onerror` surviving as inert text is fine. Exploitation required admin access either way: journal and essay text comes from the studio or from content/*.md. This removes the weakness, it does not close an open door. * fix(journal): contain file paths, fix frontmatter escaping, defuse two regexes Follow-up to the CodeQL findings on release PR #432. I went through all 23 alerts individually; this addresses the ones that are worth addressing and documents the ones that are not. Path containment (12 alerts, all false positives). Every path built from a slug goes through isValidSlug(), a strict `/^[a-zA-Z0-9_-]+$/` allowlist — verified against `../../etc/passwd`, `foo/../../bar`, `a/b`, `..` and friends, all rejected. CodeQL cannot see it because the check lives in another module. Added a containedPath() helper that resolves the path and refuses anything landing outside the content directory: a second lock on a door that was already locked, and a barrier the analysis can follow. Also removed the dead `slug.endsWith('.md')` branches — isValidSlug rejects dots, so they could never be taken. Frontmatter escaping (1 alert, a real bug). The serializer escaped `"` but not `\`, and the parser never unescaped anything. A title containing either character gained a backslash on every save/load cycle: Path C:\Users "quoted" -> Path C:\\Users \"quoted\" -> ... Escaping now covers the backslash first and the parser undoes both. A round trip test covers quotes, backslashes, colons and apostrophes. Two of three ReDoS regexes (2 alerts). The heading pattern had `\s+` next to `(.+)`, which overlap, so the engine tried every split of the whitespace run before failing; it is `[ \t]+` and `(\S.*)` now. The quote author pattern wrapped a lazy group around an optional group — the quadratic case — and is an index split on the first separator now. The third regex, the bold/italic pass, is deliberately left alone. Rewriting it with a negated class removes the backtracking but breaks nesting: `**bold *and italic* here**` renders as `*<em>bold </em>and italic<em> here</em>*`. The input is Markdown from an authenticated admin, never a visitor, so the worst case is an author slowing down their own page. The comment in the code says so. Not addressed: 5 js/insufficient-password-hash alerts. They ask for a slow KDF where the code uses SHA-256/HMAC — correct in general, but the admin password comes from an environment variable and is never stored, so a stronger KDF protects nothing that is not already in plaintext in the environment. 399 unit tests pass (18 new), build and tsc clean. * fix(journal): split the quote author by scanning, not by pattern Cleaning up after myself. #439 replaced the quote author regex `/^(.*?)(?:\s+--\s+(.+))?$/` — a lazy group around an optional one, the quadratic case — with `/\s+--\s+/`, and CodeQL promptly flagged the replacement for the same reason. One reported pattern traded for another. splitQuoteAuthor() scans for the first `--` that has whitespace on both sides. Linear, and it needs no reasoning about the regex engine at all. Behaviour is identical to the original regex, checked case by case against it: separator, no separator, several separators, tabs, wide gaps, `a--b` without spaces, leading and trailing separators, empty string. All nine are covered by tests, plus one asserting it stays fast on a 50k whitespace run. * security(admin): derive the session signing key with scrypt getSigningKey() ran the admin password through a single SHA-256 digest. It is key derivation rather than password storage, so it was never a stored-hash problem — but if the derived key ever leaked, one fast hash makes recovering the password by brute force cheap. CodeQL flags it as js/insufficient-password-hash and, for this particular alert, has a point. scrypt now. Two details that matter: The salt has to be stable. A random salt would produce a different key on every call and invalidate every session; it is derived from AUTH_SECRET, which is deployment-specific. Verified across separate processes: same inputs produce a verifying token, so a restart or redeploy does not log everyone out. The result is cached for the process lifetime. scrypt is deliberately slow and getSigningKey() runs on every admin request — deriving per call would add ~24ms to each one. The cache key is a digest of secret plus password, so a rotation misses the cache and derives again, and no extra plaintext copy of the password is kept around. Measured: first derivation 24ms, subsequent calls 0.12ms. Password change and secret change both invalidate an existing token, checked in separate processes. Note the one-time effect: existing admin sessions are invalidated by the change in derivation, so everyone logs in once more. * security(admin): key the signing-key cache on its inputs, not a digest #441 removed the SHA-256 digest of the admin password from the key derivation and introduced a new one three lines above it, as the cache key. Same rule, same file: CodeQL reported it immediately. The comment justifying it was wrong too. It claimed no second plaintext copy of the password was retained, while building the digest input allocates exactly that in order to hash it. The cache now holds the two input strings and compares them directly. They are the same objects the env and install caches already hold, so nothing extra is retained, and no fast hash of the password exists in memory for the life of the process. Re-verified after the change, in separate processes: a token from one process verifies in another with the same inputs, a changed password or secret rejects it, first derivation 24ms, cached calls 0.001ms. That leaves scrypt as the only place the password is hashed here. The two HMACs further down operate on the derived key and on token data, not on the password; the constant-time comparison in verifyAdminPassword is the previously dismissed one. --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
2026-08-14 16:55:07 +02:00
font-size: inherit;
font-weight: inherit;
color: inherit;
feat(admin): visual theme cards, album search, and status dashboard (#241) * feat(admin): implement visual theme cards, album search, and system status diagnostics * fix(admin): resolve type-checking build errors in SettingsEditor and status route --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-05-31 21:17:52 +02:00
}
/* Status Dropdown */
.status-dropdown-backdrop {
position: fixed;
inset: 0;
z-index: 99;
background: transparent;
}
.status-dropdown {
position: absolute;
top: 100%;
right: 0;
margin-top: 0.5rem;
width: 260px;
background: var(--admin-bg-raised);
border: 1px solid var(--admin-border);
border-radius: 12px;
box-shadow: 0 6px 20px rgba(0, 0, 0, 0.15);
z-index: 100;
overflow: hidden;
animation: slideDown 0.15s cubic-bezier(0.16, 1, 0.3, 1);
}
.status-dropdown-header {
display: flex;
align-items: center;
justify-content: space-between;
padding: 0.65rem 0.85rem;
border-bottom: 1px solid var(--admin-border);
background: var(--admin-bg-elevated);
}
.status-dropdown-header h4 {
margin: 0;
feat: add visual admin panel with page builder and settings editor - Add /admin route with password-protected visual page builder - Page Builder: manage hero images, standalone albums, subpages, and sections - Album Picker: browse all shared Immich albums with search and filtering - Settings Editor: theme, grid, footer, legal, SEO configuration - YAML service with atomic writes and automatic backups (content/.backups/) - HMAC-signed admin sessions (24h expiry, HttpOnly cookies) - API endpoints: /api/admin/{auth,gallery,settings,albums,reload} - Enable with ADMIN_PASSWORD env var; disabled by default - invalidateConfigCache() export for hot-reload after saves
2026-05-29 17:04:37 +02:00
font-size: 0.8rem;
feat(admin): visual theme cards, album search, and status dashboard (#241) * feat(admin): implement visual theme cards, album search, and system status diagnostics * fix(admin): resolve type-checking build errors in SettingsEditor and status route --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-05-31 21:17:52 +02:00
font-weight: 600;
text-transform: uppercase;
letter-spacing: 0.05em;
color: var(--admin-text-muted);
}
.status-refresh-btn {
background: none;
border: none;
color: var(--admin-text-muted);
feat: add visual admin panel with page builder and settings editor - Add /admin route with password-protected visual page builder - Page Builder: manage hero images, standalone albums, subpages, and sections - Album Picker: browse all shared Immich albums with search and filtering - Settings Editor: theme, grid, footer, legal, SEO configuration - YAML service with atomic writes and automatic backups (content/.backups/) - HMAC-signed admin sessions (24h expiry, HttpOnly cookies) - API endpoints: /api/admin/{auth,gallery,settings,albums,reload} - Enable with ADMIN_PASSWORD env var; disabled by default - invalidateConfigCache() export for hot-reload after saves
2026-05-29 17:04:37 +02:00
cursor: pointer;
feat(admin): visual theme cards, album search, and status dashboard (#241) * feat(admin): implement visual theme cards, album search, and system status diagnostics * fix(admin): resolve type-checking build errors in SettingsEditor and status route --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-05-31 21:17:52 +02:00
font-size: 0.95rem;
padding: 0 0.2rem;
line-height: 1;
transition: color 0.15s;
feat: add visual admin panel with page builder and settings editor - Add /admin route with password-protected visual page builder - Page Builder: manage hero images, standalone albums, subpages, and sections - Album Picker: browse all shared Immich albums with search and filtering - Settings Editor: theme, grid, footer, legal, SEO configuration - YAML service with atomic writes and automatic backups (content/.backups/) - HMAC-signed admin sessions (24h expiry, HttpOnly cookies) - API endpoints: /api/admin/{auth,gallery,settings,albums,reload} - Enable with ADMIN_PASSWORD env var; disabled by default - invalidateConfigCache() export for hot-reload after saves
2026-05-29 17:04:37 +02:00
}
feat(admin): visual theme cards, album search, and status dashboard (#241) * feat(admin): implement visual theme cards, album search, and system status diagnostics * fix(admin): resolve type-checking build errors in SettingsEditor and status route --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-05-31 21:17:52 +02:00
.status-refresh-btn:hover {
fix: admin panel light/dark theme support, improved contrast, and backup confirmation a) Admin panel now respects the site's light/dark theme toggle via CSS custom properties that respond to [data-theme='light'] on <html>. All hardcoded dark colors replaced with semantic CSS variables. b) Improved contrast in dark mode: secondary text changed from #666/#555 to #a0a0a0, muted text from #555 to #707070. All text is now clearly readable against dark backgrounds. c) Backup system was already implemented in yaml-service.ts (creates timestamped backups in content/.backups/ before each save, keeps last 10 versions). Now the UI shows a confirmation message that a backup was created after each successful save.
2026-05-29 17:20:56 +02:00
color: var(--admin-text);
feat: add visual admin panel with page builder and settings editor - Add /admin route with password-protected visual page builder - Page Builder: manage hero images, standalone albums, subpages, and sections - Album Picker: browse all shared Immich albums with search and filtering - Settings Editor: theme, grid, footer, legal, SEO configuration - YAML service with atomic writes and automatic backups (content/.backups/) - HMAC-signed admin sessions (24h expiry, HttpOnly cookies) - API endpoints: /api/admin/{auth,gallery,settings,albums,reload} - Enable with ADMIN_PASSWORD env var; disabled by default - invalidateConfigCache() export for hot-reload after saves
2026-05-29 17:04:37 +02:00
}
feat(admin): visual theme cards, album search, and status dashboard (#241) * feat(admin): implement visual theme cards, album search, and system status diagnostics * fix(admin): resolve type-checking build errors in SettingsEditor and status route --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-05-31 21:17:52 +02:00
.status-dropdown-body {
padding: 0.5rem 0.85rem;
display: flex;
flex-direction: column;
}
.status-item {
display: flex;
justify-content: space-between;
align-items: center;
padding: 0.45rem 0;
border-bottom: 1px dashed var(--admin-border);
font-size: 0.78rem;
}
.status-item:last-child {
border-bottom: none;
}
.status-label {
color: var(--admin-text-muted);
}
.status-val {
font-weight: 500;
color: var(--admin-text);
}
.status-val.ok {
color: var(--admin-success, #10b981);
}
.status-val.error {
color: var(--admin-error, #ef4444);
}
chore(release): v0.10.0 (#400) Photo Essay mode, client proofing, studio-modern preset, admin panel overhaul, watermark, cookieless analytics, subpage toggle, SEO title templates. Analytics API now admin-only, Trivy scan on publish. Album order mirrors the Immich timeline; map theme, admin status panel, lightbox counter and Docker health check fixed. See CHANGELOG.md for the full list and the health-check upgrade note.
2026-08-10 09:56:20 +02:00
.status-val.unknown {
color: var(--admin-text-secondary);
}
feat(admin): visual theme cards, album search, and status dashboard (#241) * feat(admin): implement visual theme cards, album search, and system status diagnostics * fix(admin): resolve type-checking build errors in SettingsEditor and status route --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-05-31 21:17:52 +02:00
/* ── Search Bar ────────────────────────────────────────────── */
.builder-search-container {
padding: 0.75rem 1.5rem;
background: var(--admin-bg-raised);
border-bottom: 1px solid var(--admin-border);
margin-bottom: 1rem;
}
.builder-search-wrapper {
position: relative;
display: flex;
align-items: center;
max-width: 480px;
}
.builder-search-icon {
position: absolute;
left: 10px;
font-size: 0.85rem;
color: var(--admin-text-muted);
pointer-events: none;
}
.builder-search-input {
width: 100%;
padding: 0.5rem 2rem 0.5rem 2rem;
background: var(--admin-bg-input);
border: 1px solid var(--admin-border);
border-radius: 8px;
color: var(--admin-text);
font-size: 0.82rem;
transition: all 0.15s;
}
.builder-search-input:focus {
outline: none;
border-color: var(--admin-accent);
box-shadow: 0 0 0 1px var(--admin-accent);
background: var(--admin-bg);
}
.builder-search-clear {
position: absolute;
right: 8px;
background: none;
border: none;
color: var(--admin-text-muted);
font-size: 1.1rem;
cursor: pointer;
padding: 0 4px;
}
.builder-search-clear:hover {
color: var(--admin-text);
}
/* Keyframes */
@keyframes pulse-green {
chore(release): v0.10.0 (#400) Photo Essay mode, client proofing, studio-modern preset, admin panel overhaul, watermark, cookieless analytics, subpage toggle, SEO title templates. Analytics API now admin-only, Trivy scan on publish. Album order mirrors the Immich timeline; map theme, admin status panel, lightbox counter and Docker health check fixed. See CHANGELOG.md for the full list and the health-check upgrade note.
2026-08-10 09:56:20 +02:00
0% {
box-shadow: 0 0 0 0 rgba(16, 185, 129, 0.4);
}
70% {
box-shadow: 0 0 0 6px rgba(16, 185, 129, 0);
}
100% {
box-shadow: 0 0 0 0 rgba(16, 185, 129, 0);
}
feat(admin): visual theme cards, album search, and status dashboard (#241) * feat(admin): implement visual theme cards, album search, and system status diagnostics * fix(admin): resolve type-checking build errors in SettingsEditor and status route --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-05-31 21:17:52 +02:00
}
@keyframes pulse-red {
chore(release): v0.10.0 (#400) Photo Essay mode, client proofing, studio-modern preset, admin panel overhaul, watermark, cookieless analytics, subpage toggle, SEO title templates. Analytics API now admin-only, Trivy scan on publish. Album order mirrors the Immich timeline; map theme, admin status panel, lightbox counter and Docker health check fixed. See CHANGELOG.md for the full list and the health-check upgrade note.
2026-08-10 09:56:20 +02:00
0% {
box-shadow: 0 0 0 0 rgba(239, 68, 68, 0.4);
}
70% {
box-shadow: 0 0 0 6px rgba(239, 68, 68, 0);
}
100% {
box-shadow: 0 0 0 0 rgba(239, 68, 68, 0);
}
feat: add visual admin panel with page builder and settings editor - Add /admin route with password-protected visual page builder - Page Builder: manage hero images, standalone albums, subpages, and sections - Album Picker: browse all shared Immich albums with search and filtering - Settings Editor: theme, grid, footer, legal, SEO configuration - YAML service with atomic writes and automatic backups (content/.backups/) - HMAC-signed admin sessions (24h expiry, HttpOnly cookies) - API endpoints: /api/admin/{auth,gallery,settings,albums,reload} - Enable with ADMIN_PASSWORD env var; disabled by default - invalidateConfigCache() export for hot-reload after saves
2026-05-29 17:04:37 +02:00
}
/* Color Field */
.color-field {
display: flex;
align-items: center;
gap: 0.5rem;
}
.color-field input[type='color'] {
width: 36px;
height: 36px;
padding: 0;
fix: admin panel light/dark theme support, improved contrast, and backup confirmation a) Admin panel now respects the site's light/dark theme toggle via CSS custom properties that respond to [data-theme='light'] on <html>. All hardcoded dark colors replaced with semantic CSS variables. b) Improved contrast in dark mode: secondary text changed from #666/#555 to #a0a0a0, muted text from #555 to #707070. All text is now clearly readable against dark backgrounds. c) Backup system was already implemented in yaml-service.ts (creates timestamped backups in content/.backups/ before each save, keeps last 10 versions). Now the UI shows a confirmation message that a backup was created after each successful save.
2026-05-29 17:20:56 +02:00
border: 1px solid var(--admin-border);
feat: add visual admin panel with page builder and settings editor - Add /admin route with password-protected visual page builder - Page Builder: manage hero images, standalone albums, subpages, and sections - Album Picker: browse all shared Immich albums with search and filtering - Settings Editor: theme, grid, footer, legal, SEO configuration - YAML service with atomic writes and automatic backups (content/.backups/) - HMAC-signed admin sessions (24h expiry, HttpOnly cookies) - API endpoints: /api/admin/{auth,gallery,settings,albums,reload} - Enable with ADMIN_PASSWORD env var; disabled by default - invalidateConfigCache() export for hot-reload after saves
2026-05-29 17:04:37 +02:00
border-radius: 6px;
background: none;
cursor: pointer;
}
.color-field input[type='text'] {
flex: 1;
padding: 0.6rem 0.75rem;
fix: admin panel light/dark theme support, improved contrast, and backup confirmation a) Admin panel now respects the site's light/dark theme toggle via CSS custom properties that respond to [data-theme='light'] on <html>. All hardcoded dark colors replaced with semantic CSS variables. b) Improved contrast in dark mode: secondary text changed from #666/#555 to #a0a0a0, muted text from #555 to #707070. All text is now clearly readable against dark backgrounds. c) Backup system was already implemented in yaml-service.ts (creates timestamped backups in content/.backups/ before each save, keeps last 10 versions). Now the UI shows a confirmation message that a backup was created after each successful save.
2026-05-29 17:20:56 +02:00
background: var(--admin-bg-input);
border: 1px solid var(--admin-border);
feat: add visual admin panel with page builder and settings editor - Add /admin route with password-protected visual page builder - Page Builder: manage hero images, standalone albums, subpages, and sections - Album Picker: browse all shared Immich albums with search and filtering - Settings Editor: theme, grid, footer, legal, SEO configuration - YAML service with atomic writes and automatic backups (content/.backups/) - HMAC-signed admin sessions (24h expiry, HttpOnly cookies) - API endpoints: /api/admin/{auth,gallery,settings,albums,reload} - Enable with ADMIN_PASSWORD env var; disabled by default - invalidateConfigCache() export for hot-reload after saves
2026-05-29 17:04:37 +02:00
border-radius: 6px;
fix: admin panel light/dark theme support, improved contrast, and backup confirmation a) Admin panel now respects the site's light/dark theme toggle via CSS custom properties that respond to [data-theme='light'] on <html>. All hardcoded dark colors replaced with semantic CSS variables. b) Improved contrast in dark mode: secondary text changed from #666/#555 to #a0a0a0, muted text from #555 to #707070. All text is now clearly readable against dark backgrounds. c) Backup system was already implemented in yaml-service.ts (creates timestamped backups in content/.backups/ before each save, keeps last 10 versions). Now the UI shows a confirmation message that a backup was created after each successful save.
2026-05-29 17:20:56 +02:00
color: var(--admin-text);
feat: add visual admin panel with page builder and settings editor - Add /admin route with password-protected visual page builder - Page Builder: manage hero images, standalone albums, subpages, and sections - Album Picker: browse all shared Immich albums with search and filtering - Settings Editor: theme, grid, footer, legal, SEO configuration - YAML service with atomic writes and automatic backups (content/.backups/) - HMAC-signed admin sessions (24h expiry, HttpOnly cookies) - API endpoints: /api/admin/{auth,gallery,settings,albums,reload} - Enable with ADMIN_PASSWORD env var; disabled by default - invalidateConfigCache() export for hot-reload after saves
2026-05-29 17:04:37 +02:00
font-size: 0.875rem;
font-family: monospace;
}
/* Radio Group */
.radio-group {
display: flex;
gap: 1rem;
}
.radio-group label {
display: flex;
align-items: center;
gap: 0.3rem;
font-size: 0.85rem;
fix: admin panel light/dark theme support, improved contrast, and backup confirmation a) Admin panel now respects the site's light/dark theme toggle via CSS custom properties that respond to [data-theme='light'] on <html>. All hardcoded dark colors replaced with semantic CSS variables. b) Improved contrast in dark mode: secondary text changed from #666/#555 to #a0a0a0, muted text from #555 to #707070. All text is now clearly readable against dark backgrounds. c) Backup system was already implemented in yaml-service.ts (creates timestamped backups in content/.backups/ before each save, keeps last 10 versions). Now the UI shows a confirmation message that a backup was created after each successful save.
2026-05-29 17:20:56 +02:00
color: var(--admin-text);
feat: add visual admin panel with page builder and settings editor - Add /admin route with password-protected visual page builder - Page Builder: manage hero images, standalone albums, subpages, and sections - Album Picker: browse all shared Immich albums with search and filtering - Settings Editor: theme, grid, footer, legal, SEO configuration - YAML service with atomic writes and automatic backups (content/.backups/) - HMAC-signed admin sessions (24h expiry, HttpOnly cookies) - API endpoints: /api/admin/{auth,gallery,settings,albums,reload} - Enable with ADMIN_PASSWORD env var; disabled by default - invalidateConfigCache() export for hot-reload after saves
2026-05-29 17:04:37 +02:00
cursor: pointer;
}
feat(admin): add asset picker with favorites, drag-and-drop reordering, preview links, and keyboard shortcuts - Asset Picker: Visual browser for hero images with Favorites tab (shown first) and All Photos tab. Includes infinite scroll and UUID fallback input for assets not easily found in the grid. - Drag & Drop: All lists (hero images, standalone albums, subpage albums, subpage tiles) are now reorderable via drag handles using @dnd-kit. - Preview Links: 'Preview Site' button in save bar, '↗ Site' in header, and per-subpage preview links with URL slug preview shown inline. - Keyboard Shortcuts: ⌘+S / Ctrl+S to save in both Pages and Settings tabs. - Unsaved Changes Guard: beforeunload warning prevents accidental data loss. - New API route /api/admin/assets for browsing Immich assets with pagination and favorites filter via search/metadata endpoint.
2026-05-29 17:59:25 +02:00
/* ── Asset Picker (Hero) ───────────────────────────────────── */
.asset-picker-modal {
width: 100%;
max-width: 720px;
fix: asset picker grid overflow - images no longer stack on scroll
2026-05-29 18:03:00 +02:00
height: 85vh;
feat(admin): add asset picker with favorites, drag-and-drop reordering, preview links, and keyboard shortcuts - Asset Picker: Visual browser for hero images with Favorites tab (shown first) and All Photos tab. Includes infinite scroll and UUID fallback input for assets not easily found in the grid. - Drag & Drop: All lists (hero images, standalone albums, subpage albums, subpage tiles) are now reorderable via drag handles using @dnd-kit. - Preview Links: 'Preview Site' button in save bar, '↗ Site' in header, and per-subpage preview links with URL slug preview shown inline. - Keyboard Shortcuts: ⌘+S / Ctrl+S to save in both Pages and Settings tabs. - Unsaved Changes Guard: beforeunload warning prevents accidental data loss. - New API route /api/admin/assets for browsing Immich assets with pagination and favorites filter via search/metadata endpoint.
2026-05-29 17:59:25 +02:00
background: var(--admin-bg-raised);
border: 1px solid var(--admin-border);
border-radius: 12px;
display: flex;
flex-direction: column;
overflow: hidden;
}
.asset-picker-tabs {
display: flex;
border-bottom: 1px solid var(--admin-border);
}
.asset-picker-tab {
flex: 1;
🛡️ Sentinel: [HIGH] Fix timingSafeEqual DoS Vulnerability (#423) * Fix timingSafeEqual DoS Vulnerability in Webhook Co-authored-by: ralksta <16941050+ralksta@users.noreply.github.com> * Fix memory exhaustion DoS in token decoding Co-authored-by: ralksta <16941050+ralksta@users.noreply.github.com> --------- Co-authored-by: google-labs-jules[bot] <161369871+google-labs-jules[bot]@users.noreply.github.com>
2026-08-14 11:10:42 +02:00
display: inline-flex;
align-items: center;
justify-content: center;
gap: 0.45rem;
feat(admin): add asset picker with favorites, drag-and-drop reordering, preview links, and keyboard shortcuts - Asset Picker: Visual browser for hero images with Favorites tab (shown first) and All Photos tab. Includes infinite scroll and UUID fallback input for assets not easily found in the grid. - Drag & Drop: All lists (hero images, standalone albums, subpage albums, subpage tiles) are now reorderable via drag handles using @dnd-kit. - Preview Links: 'Preview Site' button in save bar, '↗ Site' in header, and per-subpage preview links with URL slug preview shown inline. - Keyboard Shortcuts: ⌘+S / Ctrl+S to save in both Pages and Settings tabs. - Unsaved Changes Guard: beforeunload warning prevents accidental data loss. - New API route /api/admin/assets for browsing Immich assets with pagination and favorites filter via search/metadata endpoint.
2026-05-29 17:59:25 +02:00
padding: 0.7rem 1rem;
background: none;
border: none;
color: var(--admin-text-muted);
font-size: 0.85rem;
cursor: pointer;
transition: all 0.15s;
border-bottom: 2px solid transparent;
}
.asset-picker-tab:hover {
color: var(--admin-text-secondary);
background: var(--admin-bg-elevated);
}
.asset-picker-tab.active {
color: var(--admin-text);
border-bottom-color: var(--admin-accent);
}
.asset-picker-grid {
flex: 1;
fix: asset picker grid overflow - images no longer stack on scroll
2026-05-29 18:03:00 +02:00
min-height: 0;
feat(admin): add asset picker with favorites, drag-and-drop reordering, preview links, and keyboard shortcuts - Asset Picker: Visual browser for hero images with Favorites tab (shown first) and All Photos tab. Includes infinite scroll and UUID fallback input for assets not easily found in the grid. - Drag & Drop: All lists (hero images, standalone albums, subpage albums, subpage tiles) are now reorderable via drag handles using @dnd-kit. - Preview Links: 'Preview Site' button in save bar, '↗ Site' in header, and per-subpage preview links with URL slug preview shown inline. - Keyboard Shortcuts: ⌘+S / Ctrl+S to save in both Pages and Settings tabs. - Unsaved Changes Guard: beforeunload warning prevents accidental data loss. - New API route /api/admin/assets for browsing Immich assets with pagination and favorites filter via search/metadata endpoint.
2026-05-29 17:59:25 +02:00
overflow-y: auto;
release: v0.11.0 — journal fixes, admin URLs, design system cleanup (#432) * fix(screenshots): sharp-Typen fuer 0.34 und 0.35 gleichzeitig (#410) sharp 0.35 ist von `export =` auf ESM umgestellt: der Modul-Namespace ist nicht mehr aufrufbar, die Factory sitzt unter .default. Der Type-Check brach damit in scripts/screenshots.ts weg, sobald der Next-Bump (#402) sharp von 0.34.5 auf 0.35.3 mitzieht -- sharp ist hier keine deklarierte Dependency, sondern kommt ueber Next mit. Die Form wird jetzt aus dem installierten Paket abgeleitet statt festgeschrieben, zur Laufzeit wie im Typ. Geprueft mit beiden Versionen: tsc laeuft mit 0.34.5 und mit 0.35.3 fehlerfrei durch. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(deps): bump the nextjs group across 1 directory with 2 updates (#402) Bumps the nextjs group with 2 updates in the / directory: [next](https://github.com/vercel/next.js) and [eslint-config-next](https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next). Updates `next` from 16.2.12 to 16.3.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/compare/v16.2.12...v16.3.0) Updates `eslint-config-next` from 16.2.12 to 16.3.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/commits/v16.3.0/packages/eslint-config-next) --- updated-dependencies: - dependency-name: eslint-config-next dependency-version: 16.3.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: nextjs - dependency-name: next dependency-version: 16.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nextjs ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps-dev): bump prettier from 3.8.3 to 3.9.6 (#405) Bumps [prettier](https://github.com/prettier/prettier) from 3.8.3 to 3.9.6. - [Release notes](https://github.com/prettier/prettier/releases) - [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md) - [Commits](https://github.com/prettier/prettier/compare/3.8.3...3.9.6) --- updated-dependencies: - dependency-name: prettier dependency-version: 3.9.6 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * docs(changelog): Unreleased-Sektion fuer die Bumps nach v0.10.0 (#413) Die Dependency-PRs sind nach dem Release auf dev gelandet, teils auch auf main. Ohne Eintrag waeren sie beim naechsten Release unsichtbar -- inklusive Next 16.3.0, das CVE-2025-13465 mitbringt. Ausserdem im 0.10.0-Abschnitt nachgetragen, dass der Trivy-Scan bis #409 nie gelaufen ist. Der Fix steckt im Tag v0.10.0, fehlte aber in der Aufzaehlung -- und "Images werden bei jedem Publish gescannt" stand im Changelog, waehrend der Job im Action-Setup abbrach. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(gallery): per-album sort order, independent of Immich (#408) (#414) Album order was dictated entirely by Immich: getAlbum() sorted by the album's own asc/desc flag, so a Folio album always mirrored the archive. A curated series has a narrative order that has nothing to do with capture time, and changing the Immich album's sort to fit the website changes it for the archive too. Adds an optional per-album `sort` in gallery.yaml, editable in /admin, defaulting to today's behaviour so every existing config is unchanged: immich (default) | newest | oldest | filename | manual `manual` is a pinned *prefix*: `assetOrder` lists only the photos placed by hand, everything else follows in the album's Immich order. A full permutation of a 2,000-photo album would be ~80 KB of UUIDs in a file that is rewritten and copied to content/.backups/ on every admin save. It also makes drift fall out for free — photos removed in Immich never match, new ones land in the tail rather than being hidden. Sorting is applied after the cache read, not before the cache write, so the LRU keeps one canonical Immich-ordered copy per album. That avoids putting the mode in the cache key, lets a config change take effect without depending on invalidation, and keeps the stale-serving path correct. cache.get() returns the stored object by reference, so withSort() returns a shallow clone with a new array — sorting in place would reorder the shared entry, and under request coalescing every concurrent caller would be sorting the same array. Also fixes a prerequisite bug: /api/admin/albums/[albumId]/assets read album.assets from GET /albums/:id, which Immich 3.x no longer populates (lib/immich.ts:507). The hero picker's "This Album" tab returned nothing and threw outright when the key was absent. It now goes through the client's paginated metadata search, with ?types=all to opt videos in for the reorder editor. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): drop decorative emoji from the sort select labels (#415) An <option> cannot contain markup, so the SVG set in Icons is not reachable there — but a decorative emoji is not a substitute for it. Plain text instead; the album card badge already uses a real icon. The remaining emoji in the admin panel (asset picker tabs, section headings, layout picker options) predate this branch and are left for a separate cleanup. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): replace emoji icons with the shared SVG icon set (#416) The admin panel mixed two icon conventions: inline SVGs from `Icons.tsx` in most components, and decorative emoji in the asset picker and a few PageBuilder labels. Emoji render inconsistently across platforms, ignore the accent colour, and cannot inherit the `.svg-icon` sizing rules. - Icons.tsx: add `IconStar` (filled — it marks a state, not an action) and `IconImage`. - AssetPicker: the three tab labels and the favourite tile badge now use IconFolder / IconStar / IconImage. - PageBuilder: the "Standalone Albums" and "Subpages" headings use the icon set instead of an emoji. - PageBuilder: the layout picker drops its emoji for plain text. An <option> cannot contain markup, so an SVG is impossible there and a decorative glyph is not a substitute. - admin.css: align icon and label in the picker tabs, and swap the favourite badge's text-shadow for drop-shadow, which is what applies to an inline SVG. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): fold PageBuilder's local icons into the shared Icons module (#418) * refactor(admin): fold PageBuilder's local icons into the shared module PageBuilder.tsx carried its own `Icons` object duplicating most of the glyphs already exported by Icons.tsx, with hardcoded sizes and slightly divergent paths. Migrate all 32 call sites to the shared module and delete the local object. Five glyphs had no counterpart and are added to Icons.tsx as 1:1 ports of the local paths: IconX, IconPlus, IconHome, IconCopy, IconImage. The local ExternalLink and Check are dropped rather than ported — both had zero call sites. Two glyphs change shape slightly, which is the point of consolidating: the shared IconCamera includes the viewfinder bump the local copy omitted, and drag handles now use IconGripVertical. IconGripVertical uses the module's square 24x24 viewBox, so `.svg-drag` goes from 12x18 to 18x18 — the old non-square box would letterbox the glyph down to 12x12 and shrink the handle. * fix(admin): resolve icon-module integration after #416 Merging dev brought in #416, which added a second IconImage to Icons.tsx and two <Icons.Camera>/<Icons.Folder> section headers that reference the local Icons object this PR removes. Git merged both cleanly but the result did not type-check. - drop the duplicate IconImage (both copies were byte-identical) - point the two section headers at the imported IconCamera/IconFolder - refresh the SORT_LABELS comment: the icon set is imported now, not declared below --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> * fix(config): allow an empty gallery, guard against a double /api suffix (#421) An empty gallery is now a valid, rendered state instead of a throw: deriveGallery() no longer requires at least one album or subpage, so a deployment with no albums yet renders a bare homepage the owner can fill in via /admin. getConfig() also stops appending /api to an Immich URL that already ends in it, which previously produced .../api/api and broke every upstream request. Includes a restore of the per-album sort test cases, which the branch had lost by being cut before #408/#414. * feat(admin): favicon upload, served from the content volume (#422) Adds a bundled default favicon, an upload widget in admin Settings > General, and a route that serves the icon from the writable content/ volume with a fallback to the bundled default. Raster uploads (PNG/ICO/JPEG) are wrapped in an SVG container; the response carries its own CSP so an uploaded SVG cannot execute script on the origin. The GET route revalidates with an ETag instead of caching immutably, so a newly uploaded icon shows up immediately. Uploads are written via temp file + rename, and a Reset button restores the bundled default. * ci: flag unformatted files in a PR, without blocking it (#424) Prettier is configured as an error rule in eslint.config.mjs but has never run in CI, so part of the tree predates it. A final CI step now diffs against the PR base, runs prettier --list-different over the changed files, and emits a warning annotation per offender plus a job summary. Advisory by design: it never fails the job. Blocking would turn a PR red for merely touching a file that was already unformatted, and normalising the tree in one commit would wreck git blame and conflict with the PRs in flight. Requires fetch-depth: 0, since diffing against the base needs its history. * feat(install): first-run wizard gated by a one-time setup token (#419) Adds /install, a four-step first-run wizard: connect to Immich, optionally pick albums, name the site, finish. It verifies the credentials against the Immich server before writing anything, then writes gallery.yaml, settings.yaml and a content/install.json carrying the Immich credentials and a generated site secret. install.json exists because a running process cannot pick up new env vars — the wizard has to write configuration that takes effect without a restart. getInstallCredentials() merges it under the real environment, so env vars always win and rotation stays a matter of setting one. Both the page and the API routes are gated by a one-time setup token printed to the server log, so a deployment that is reachable before gallery.yaml exists cannot be configured by whoever finds it first. The token is stored in content/.setup-token (0600) rather than a module variable: Next.js bundles the page and each route handler separately, so a module-level token left the page and the API disagreeing inside one process and the wizard stuck on step 1. It is removed once the install completes. The admin password is stored as an scrypt hash using the scheme lib/auth.ts already applies to album passwords; a plaintext ADMIN_PASSWORD env var keeps working. * docs: document the setup wizard, fix the read-only content mount (#425) Quick Start now leads with the /install wizard, with the hand-written YAML route kept alongside it, and a First-Run Setup section covers the setup token, the files the wizard writes, and env-var precedence. Two corrections: both Docker examples mounted content/ as :ro, which silently breaks the wizard, the admin panel and the backup rotation alike — docs/admin-panel.md already said so and the README contradicted it. And nothing documented that content/install.json holds the Immich API key, so a backup of content/ is a backup of credentials. Also adds a Contributors section crediting the people whose work is in the project. * feat(admin): floating save bar pinned to the bottom of the viewport (#426) The save bar was the first, static element inside .admin-main. Since the document itself scrolls, it left the viewport as soon as you scrolled down — editing a subpage section or a settings block far below gave no visible dirty hint and no reachable save button. Replace it with a bottom-pinned floating bar shared by both editors. It only mounts while there is something to act on (unsaved changes, an in-flight save, or a result message), so it never covers content while idle. The success message clears after 5s, which hides the bar again. - new SaveBar component, replacing the duplicated markup in PageBuilder and SettingsEditor - adopt the previously unused .floating-save-bar CSS: slide-in keyframes (carrying translateX(-50%)), dirty border, wrap/gap, mobile variant and a prefers-reduced-motion opt-out; z-index 900 keeps it below modals - .admin-main gains bottom padding so the bar never covers page content - drop the now-unreachable idle hints: the ⌘S hint becomes a button title, the Live Sync note becomes a static line above the settings layout - header "Site" link now bypasses the cache (/?fresh=1), so the preview stays reachable when the bar is hidden Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(admin): themed listbox for the album sort control (#427) The per-album "Photo order" control was a native <select>. Because an <option> cannot contain markup, its choices could not use the admin panel's currentColor SVG set — the reason #415 had to fall back to plain text after dropping the emoji labels. Adds a Listbox component implementing the ARIA combobox/listbox pattern, so options can render a glyph beside their label: - DOM focus stays on the trigger button; the active option is announced through aria-activedescendant, keeping focus management to one element - Keyboard: arrows (clamped at the ends, like a native select), Home/End, Enter/Space to commit, Escape to cancel, Tab commits and moves on, and prefix type-ahead with a repeat-key cycle - Outside dismissal on pointerdown, so a press starting outside closes the popup before the click retargets The sort options now carry an icon each: calendar, arrow-down, arrow-up, an A→Z marker, and the drag glyph for manual — matching the badge the album card already shows. SORT_LABELS stays plain text because the badge feeds it to a title attribute. Closes #417 Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(git): ignore generated design handoff folders * fix(admin): stop the album sort dropdown clipping, and simplify the panel (#428) * fix(admin): render listbox popup in a portal so it escapes modal clipping The sort control's popup was position:absolute inside three clipping ancestors (.album-drawer overflow:hidden > .album-drawer-body overflow-y:auto > .modal-right-column overflow-y:auto), so it was cut off at the bottom of the Edit Album Details modal. z-index could not help: clipping happens before stacking. It also always hung below the trigger, with no flip. Portal the popup to document.body and position it from the trigger's viewport rect, flipping above when there is more room there and capping max-height to the space available so it scrolls internally rather than overflowing. It is dismissed on scroll and resize, since the anchor is only measured on open. The outside-pointerdown handler now also treats the popup as inside; without that the portalled list counts as outside, and a click on an option would close it before the selection commits. * refactor(admin): single-column album details panel The left column spent 1.2fr on a cover thumbnail and three stat rows, two of which (Status, Custom Hero) only restated the form fields opposite them, while the form itself was squeezed into 1.8fr behind a second nested scroller. Stack the drawer in one column instead: cover as a banner, then the form at full width, with the UUID moved into the footer. The body is now the only scroll container, which also removes one of the ancestors that was clipping the sort popup. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> * fix(admin): give the portalled listbox its theme back, lock the page behind modals (#429) Two defects in the album editor. The sort listbox popup painted transparent. Every --admin-* variable is scoped to .admin-layout, and since the popup moved into document.body it sits outside that subtree, so background/border/text all resolved to nothing. It now carries its own copy of the palette in both colour schemes, plus the font it no longer inherits. Scrolling inside a modal also moved the page behind it. No admin modal ever locked body scroll: the overlay covers the page but does not absorb wheel events, so a scroll starting on the backdrop — or continuing past the end of the modal's own scroller — reaches the document. overscroll-behavior cannot cover that case on its own, because it only applies to scroll containers and the backdrop is not one. useScrollLock freezes body while a modal is open and compensates for the width the scrollbar gives up, so nothing shifts underneath. Each lock restores the inline value it found, which makes nesting work without a counter — a picker opened from the drawer restores the drawer's hidden state instead of clearing it. Applied to both drawers and all four picker modals, which share the defect. overscroll-behavior: contain on the scrollers stops the chaining they can handle themselves. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com> * fix(security): allow unsafe-eval in CSP script-src during dev mode * feat(journal): add Journal Studio with split-screen editor, live preview and dedicated routes * fix(build): separate client parser from server journal-service and fix build type errors * fix(journal): Fotos rendern, Layout und Lightbox-Steuerung korrigieren Fünf unabhängige Fehler in der öffentlichen Journal- und Essay-Ansicht: * Foto-Blöcke wurden nie angezeigt. EssayView löst ein Foto über PhotoItem.id auf, und das sind verschlüsselte Tokens — die Blöcke aus dem Markdown tragen aber rohe Asset-UUIDs. Jede Zuordnung lief ins Leere, und nicht auflösbare Blöcke werden still verworfen. Die IDs werden jetzt serverseitig übersetzt; damit verschwinden nebenbei die rohen UUIDs aus dem Client-Payload, die dort laut Projektregel nie auftauchen dürfen. Nicht auflösbare Referenzen werden geloggt. * Überschriften standen weiter links als der Fließtext. Jeder Block hatte einzeln `max-width: 68ch`, und `ch` ist relativ zur Schrift des Elements — die Serif-Überschrift ergab eine breitere Spalte. Ersetzt durch eine gemeinsame, font-unabhängige `--essay-measure`. * Fullbleed-Fotos bluteten nur nach links aus: `.essay-figure` ist `width: 100%`, wodurch die Box überbestimmt ist und der negative rechte Margin verworfen wird. * Foto-Paare stellten beide Bilder gleich breit dar, wodurch ein Hochformat neben einem Querformat doppelt so hoch wurde. Jetzt eine Justified-Reihe: Breite proportional zum Seitenverhältnis, dadurch exakt gleiche Höhen ohne Beschnitt. * Die Lightbox hatte im Journal keine Tastatursteuerung und keine Scroll-Sperre — beides lag in PhotoGrid, also nur im Album-Raster. Verlagert in die Lightbox selbst, der doppelte Handler in PhotoGrid entfernt (sonst wäre pro Pfeildruck zwei Bilder weitergesprungen). Zusätzlich sind Proofing-Herzen und das EXIF-Panel im redaktionellen Modus abschaltbar und im Journal aus: Client-Proofing ist ein Übergabe-Workflow für Alben, keine Funktion einer Reportage. Auf der Übersicht wurde der Untertitel doppelt gerendert, weil extractExcerpt() auf ihn zurückfällt. * feat(admin): eigene URLs für alle Bereiche und überarbeiteter Journal Studio Das Panel war eine einzige Client-Komponente, die ihre Tabs über useState umschaltet: keine Route pro Bereich, kein Deep-Link, kein Zurück-Button, und nach jedem Reload landete man wieder auf "Pages". Auch der Journal-Editor hatte keine eigene URL. Jetzt sieben echte Routen (/admin, /admin/pages, /admin/journal, /admin/journal/<slug>, /admin/settings, /admin/settings/<section>, /admin/analytics). Die Shell mit Auth-Prüfung und Kopfzeile sitzt im Layout und umschließt children — so bleibt die Session-Prüfung über Routenwechsel montiert, statt bei jedem Tab-Wechsel neu zu laufen und den Spinner aufblitzen zu lassen. Unbekannte Settings-Sections fallen auf General zurück. Im selben Zug der Journal Studio, der die Routing-Änderung ohnehin berührt: * Alle Eingabefelder nutzten die Klasse `admin-input`, die in keinem CSS definiert war — sie fielen auf Browser-Defaults zurück. Jetzt gestylt, gescoped, damit der generische Name nicht ins übrige Panel leckt. * Der Split View ist per Divider verschiebbar (Maus, Tastatur, Doppelklick zum Zurücksetzen), Breite in localStorage. * Das Studio bricht aus der 1120px-Spalte aus, die Preview hat Platz. * Die Preview zeigte für jedes Foto fest 3:2 und log damit über das Layout der veröffentlichten Seite; die echten Verhältnisse werden jetzt an den Thumbnails gemessen. * Blöcke mit alten positionsbasierten Foto-Referenzen werden markiert — die lassen sich auf einer eigenständigen Journal-Seite nicht auflösen und verschwanden bisher stillschweigend. * Blocktyp-Chips als gemeinsame Komponente, monochrom und per Icon unterschieden statt in einer eigenen Blau/Lila/Orange-Palette, die sonst nirgends im Panel vorkommt. * Emojis raus, SVG-Icons rein. * fix(admin): Designsystem-Lücken im Panel schließen Eine systematische Suche nach Klassen, die im TSX benutzt, aber in keinem CSS definiert sind, hat vier Stellen mit demselben Muster gefunden: * `admin-btn-secondary` und `admin-btn-danger` existierten nicht. Sämtliche Löschen-Buttons sahen aus wie normale Buttons — keine Warnwirkung. Als `.admin-btn.admin-btn-danger` geschrieben, weil die Varianten mit den Größenklassen kombiniert werden, die weiter unten ihren eigenen Hintergrund setzen. * `page-progress-fill` fehlte: die Balken im Analytics-Panel waren leere Rinnen, der Wert unsichtbar. Ebenso `analytics-empty` und `admin-loading-container`. * `subpage-drawer-section`, `subpage-drawer-title-group` und `input-with-icon` im PageBuilder waren wirkungslos und teils mit Inline-Styles notdürftig kompensiert. * `grid-card-preview` fehlte, wodurch alle Layout-Vorschauen auf Höhe null kollabierten. Nur "Showcase" war sichtbar — und das aus Versehen, weil sein Tile `hero-tile` hieß und damit die `aspect-ratio` einer fremden PageBuilder-Klasse erbte. Umbenannt. Dazu die Theme-Vorschauen, die praktisch identisch aussahen: alle sieben zeigten dieselben drei quadratischen Kacheln, einziger Unterschied war die Hintergrundfarbe. Sie spiegeln jetzt die echten Preset-Daten aus lib/config/theme.ts — Schriftcharakter, Eckradius, Rasterdichte, Passepartout bzw. Schatten. Die Kopfzeile richtet sich an einer gemeinsamen Steuerhöhe aus. Der "Site"-Link war höher als die Buttons daneben: `.admin-btn` hatte keine explizite line-height, und <button> bekommt box-sizing: border-box vom Browser, <a> nicht. Die Statusanzeige setzte weder Schriftfamilie noch -größe und fiel auf den Browser-Default zurück — sie war nie Teil des Designsystems. Jetzt gleiche Höhe und Typografie, Pillenform als Zustandsanzeige, Trenner zur Aktionsgruppe. Das dauerhafte Pulsieren des grünen Punkts entfällt; Animation bleibt den Zuständen vorbehalten, die Aufmerksamkeit brauchen. Restliche Emojis durch SVG-Icons ersetzt. * feat(admin): add scroll-to-top toggle and SVG arrow The back-to-top button was always on and drew its arrow with the ↑ text character. Add a `scrollToTop` setting (General section in the admin panel, defaults to on so existing sites are unaffected) and replace the glyph with a stroked SVG that inherits currentColor across all presets. Scroll handling is now rAF-throttled, and prefers-reduced-motion turns off both the hover lift and the smooth scroll. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * security(journal): escape author HTML instead of filtering it CodeQL flags 26 high-severity alerts on the release PR; the bulk of them point at sanitizeHtml(), a denylist of three regexes whose output goes into dangerouslySetInnerHTML. I reproduced the bypasses before changing anything — all four pass the old filter: <img src=x onerror=alert(1)> unquoted handler, regex wants quotes <img src=x onerror='alert(1)'> single quotes, same reason <svg onload=alert(1)> not a <script> tag javasjavascript:cript:alert(1) one-pass replace, the rest recombines Plus an attribute breakout in the link renderer, which interpolated the URL into href="${url}" unescaped: [x](" onmouseover=alert(1) x=") -> <a href="" onmouseover=alert(1" ...> Replaced with escaping. Every `&<>"'` in author text becomes an entity before any markdown rule runs, so the only tags in the output are the ones renderInlineMarkdown builds itself and a URL cannot leave its attribute. Link schemes are now an allowlist (http, https, mailto, tel, relative, anchor); anything else renders as plain text. The serializer needed decodeHtmlEntities to match: without it a save would write `&lt;` into the Markdown file and the next parse would escape the `&` again, corrupting the text further on every round trip. A test covers parse -> serialize -> parse stability. Two existing tests asserted the old behaviour and were rewritten rather than deleted: one expected the script tag to be *removed* from the output, the other expected the substring "onerror" to be absent. Both now assert the property that matters — that no tag can form — because `onerror` surviving as inert text is fine. Exploitation required admin access either way: journal and essay text comes from the studio or from content/*.md. This removes the weakness, it does not close an open door. * fix(journal): contain file paths, fix frontmatter escaping, defuse two regexes Follow-up to the CodeQL findings on release PR #432. I went through all 23 alerts individually; this addresses the ones that are worth addressing and documents the ones that are not. Path containment (12 alerts, all false positives). Every path built from a slug goes through isValidSlug(), a strict `/^[a-zA-Z0-9_-]+$/` allowlist — verified against `../../etc/passwd`, `foo/../../bar`, `a/b`, `..` and friends, all rejected. CodeQL cannot see it because the check lives in another module. Added a containedPath() helper that resolves the path and refuses anything landing outside the content directory: a second lock on a door that was already locked, and a barrier the analysis can follow. Also removed the dead `slug.endsWith('.md')` branches — isValidSlug rejects dots, so they could never be taken. Frontmatter escaping (1 alert, a real bug). The serializer escaped `"` but not `\`, and the parser never unescaped anything. A title containing either character gained a backslash on every save/load cycle: Path C:\Users "quoted" -> Path C:\\Users \"quoted\" -> ... Escaping now covers the backslash first and the parser undoes both. A round trip test covers quotes, backslashes, colons and apostrophes. Two of three ReDoS regexes (2 alerts). The heading pattern had `\s+` next to `(.+)`, which overlap, so the engine tried every split of the whitespace run before failing; it is `[ \t]+` and `(\S.*)` now. The quote author pattern wrapped a lazy group around an optional group — the quadratic case — and is an index split on the first separator now. The third regex, the bold/italic pass, is deliberately left alone. Rewriting it with a negated class removes the backtracking but breaks nesting: `**bold *and italic* here**` renders as `*<em>bold </em>and italic<em> here</em>*`. The input is Markdown from an authenticated admin, never a visitor, so the worst case is an author slowing down their own page. The comment in the code says so. Not addressed: 5 js/insufficient-password-hash alerts. They ask for a slow KDF where the code uses SHA-256/HMAC — correct in general, but the admin password comes from an environment variable and is never stored, so a stronger KDF protects nothing that is not already in plaintext in the environment. 399 unit tests pass (18 new), build and tsc clean. * fix(journal): split the quote author by scanning, not by pattern Cleaning up after myself. #439 replaced the quote author regex `/^(.*?)(?:\s+--\s+(.+))?$/` — a lazy group around an optional one, the quadratic case — with `/\s+--\s+/`, and CodeQL promptly flagged the replacement for the same reason. One reported pattern traded for another. splitQuoteAuthor() scans for the first `--` that has whitespace on both sides. Linear, and it needs no reasoning about the regex engine at all. Behaviour is identical to the original regex, checked case by case against it: separator, no separator, several separators, tabs, wide gaps, `a--b` without spaces, leading and trailing separators, empty string. All nine are covered by tests, plus one asserting it stays fast on a 50k whitespace run. * security(admin): derive the session signing key with scrypt getSigningKey() ran the admin password through a single SHA-256 digest. It is key derivation rather than password storage, so it was never a stored-hash problem — but if the derived key ever leaked, one fast hash makes recovering the password by brute force cheap. CodeQL flags it as js/insufficient-password-hash and, for this particular alert, has a point. scrypt now. Two details that matter: The salt has to be stable. A random salt would produce a different key on every call and invalidate every session; it is derived from AUTH_SECRET, which is deployment-specific. Verified across separate processes: same inputs produce a verifying token, so a restart or redeploy does not log everyone out. The result is cached for the process lifetime. scrypt is deliberately slow and getSigningKey() runs on every admin request — deriving per call would add ~24ms to each one. The cache key is a digest of secret plus password, so a rotation misses the cache and derives again, and no extra plaintext copy of the password is kept around. Measured: first derivation 24ms, subsequent calls 0.12ms. Password change and secret change both invalidate an existing token, checked in separate processes. Note the one-time effect: existing admin sessions are invalidated by the change in derivation, so everyone logs in once more. * security(admin): key the signing-key cache on its inputs, not a digest #441 removed the SHA-256 digest of the admin password from the key derivation and introduced a new one three lines above it, as the cache key. Same rule, same file: CodeQL reported it immediately. The comment justifying it was wrong too. It claimed no second plaintext copy of the password was retained, while building the digest input allocates exactly that in order to hash it. The cache now holds the two input strings and compares them directly. They are the same objects the env and install caches already hold, so nothing extra is retained, and no fast hash of the password exists in memory for the life of the process. Re-verified after the change, in separate processes: a token from one process verifies in another with the same inputs, a changed password or secret rejects it, first derivation 24ms, cached calls 0.001ms. That leaves scrypt as the only place the password is hashed here. The two HMACs further down operate on the derived key and on token data, not on the password; the constant-time comparison in verifyAdminPassword is the previously dismissed one. --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
2026-08-14 16:55:07 +02:00
overscroll-behavior: contain;
feat(admin): add asset picker with favorites, drag-and-drop reordering, preview links, and keyboard shortcuts - Asset Picker: Visual browser for hero images with Favorites tab (shown first) and All Photos tab. Includes infinite scroll and UUID fallback input for assets not easily found in the grid. - Drag & Drop: All lists (hero images, standalone albums, subpage albums, subpage tiles) are now reorderable via drag handles using @dnd-kit. - Preview Links: 'Preview Site' button in save bar, '↗ Site' in header, and per-subpage preview links with URL slug preview shown inline. - Keyboard Shortcuts: ⌘+S / Ctrl+S to save in both Pages and Settings tabs. - Unsaved Changes Guard: beforeunload warning prevents accidental data loss. - New API route /api/admin/assets for browsing Immich assets with pagination and favorites filter via search/metadata endpoint.
2026-05-29 17:59:25 +02:00
padding: 0.75rem;
display: grid;
grid-template-columns: repeat(auto-fill, minmax(120px, 1fr));
fix: asset picker grid overflow - images no longer stack on scroll
2026-05-29 18:03:00 +02:00
grid-auto-rows: min-content;
feat(admin): add asset picker with favorites, drag-and-drop reordering, preview links, and keyboard shortcuts - Asset Picker: Visual browser for hero images with Favorites tab (shown first) and All Photos tab. Includes infinite scroll and UUID fallback input for assets not easily found in the grid. - Drag & Drop: All lists (hero images, standalone albums, subpage albums, subpage tiles) are now reorderable via drag handles using @dnd-kit. - Preview Links: 'Preview Site' button in save bar, '↗ Site' in header, and per-subpage preview links with URL slug preview shown inline. - Keyboard Shortcuts: ⌘+S / Ctrl+S to save in both Pages and Settings tabs. - Unsaved Changes Guard: beforeunload warning prevents accidental data loss. - New API route /api/admin/assets for browsing Immich assets with pagination and favorites filter via search/metadata endpoint.
2026-05-29 17:59:25 +02:00
gap: 0.5rem;
align-content: start;
}
.asset-picker-loading {
grid-column: 1 / -1;
display: flex;
align-items: center;
justify-content: center;
padding: 3rem;
}
.asset-picker-loading-more {
grid-column: 1 / -1;
display: flex;
align-items: center;
justify-content: center;
padding: 1rem;
}
.asset-picker-tile {
position: relative;
aspect-ratio: 1;
border-radius: 8px;
overflow: hidden;
cursor: pointer;
background: var(--admin-bg-elevated);
border: 2px solid transparent;
chore(release): v0.10.0 (#400) Photo Essay mode, client proofing, studio-modern preset, admin panel overhaul, watermark, cookieless analytics, subpage toggle, SEO title templates. Analytics API now admin-only, Trivy scan on publish. Album order mirrors the Immich timeline; map theme, admin status panel, lightbox counter and Docker health check fixed. See CHANGELOG.md for the full list and the health-check upgrade note.
2026-08-10 09:56:20 +02:00
transition:
border-color 0.15s,
transform 0.1s;
feat(admin): add asset picker with favorites, drag-and-drop reordering, preview links, and keyboard shortcuts - Asset Picker: Visual browser for hero images with Favorites tab (shown first) and All Photos tab. Includes infinite scroll and UUID fallback input for assets not easily found in the grid. - Drag & Drop: All lists (hero images, standalone albums, subpage albums, subpage tiles) are now reorderable via drag handles using @dnd-kit. - Preview Links: 'Preview Site' button in save bar, '↗ Site' in header, and per-subpage preview links with URL slug preview shown inline. - Keyboard Shortcuts: ⌘+S / Ctrl+S to save in both Pages and Settings tabs. - Unsaved Changes Guard: beforeunload warning prevents accidental data loss. - New API route /api/admin/assets for browsing Immich assets with pagination and favorites filter via search/metadata endpoint.
2026-05-29 17:59:25 +02:00
}
.asset-picker-tile:hover:not(.used) {
border-color: var(--admin-accent);
transform: scale(1.03);
}
.asset-picker-tile.used {
opacity: 0.4;
cursor: not-allowed;
}
.asset-picker-tile img {
width: 100%;
height: 100%;
object-fit: cover;
}
.asset-picker-used-badge {
position: absolute;
top: 4px;
right: 4px;
width: 22px;
height: 22px;
border-radius: 50%;
background: var(--admin-accent);
color: #000;
font-size: 0.7rem;
display: flex;
align-items: center;
justify-content: center;
font-weight: 700;
}
.asset-picker-fav-badge {
position: absolute;
top: 4px;
left: 4px;
🛡️ Sentinel: [HIGH] Fix timingSafeEqual DoS Vulnerability (#423) * Fix timingSafeEqual DoS Vulnerability in Webhook Co-authored-by: ralksta <16941050+ralksta@users.noreply.github.com> * Fix memory exhaustion DoS in token decoding Co-authored-by: ralksta <16941050+ralksta@users.noreply.github.com> --------- Co-authored-by: google-labs-jules[bot] <161369871+google-labs-jules[bot]@users.noreply.github.com>
2026-08-14 11:10:42 +02:00
display: flex;
font-size: 0.85rem;
color: var(--admin-accent);
/* drop-shadow, not text-shadow: the badge is an inline SVG, not a glyph. */
filter: drop-shadow(0 1px 3px rgba(0, 0, 0, 0.6));
feat(admin): add asset picker with favorites, drag-and-drop reordering, preview links, and keyboard shortcuts - Asset Picker: Visual browser for hero images with Favorites tab (shown first) and All Photos tab. Includes infinite scroll and UUID fallback input for assets not easily found in the grid. - Drag & Drop: All lists (hero images, standalone albums, subpage albums, subpage tiles) are now reorderable via drag handles using @dnd-kit. - Preview Links: 'Preview Site' button in save bar, '↗ Site' in header, and per-subpage preview links with URL slug preview shown inline. - Keyboard Shortcuts: ⌘+S / Ctrl+S to save in both Pages and Settings tabs. - Unsaved Changes Guard: beforeunload warning prevents accidental data loss. - New API route /api/admin/assets for browsing Immich assets with pagination and favorites filter via search/metadata endpoint.
2026-05-29 17:59:25 +02:00
}
.asset-picker-uuid-section {
padding: 0.75rem 1rem;
border-top: 1px solid var(--admin-border);
background: var(--admin-bg);
}
.asset-picker-uuid-form {
display: flex;
gap: 0.5rem;
align-items: center;
}
.asset-picker-uuid-input {
flex: 1;
padding: 0.5rem 0.75rem;
background: var(--admin-bg-input);
border: 1px solid var(--admin-border);
border-radius: 6px;
color: var(--admin-text);
font-size: 0.8rem;
font-family: monospace;
}
.asset-picker-uuid-input:focus {
outline: none;
border-color: var(--admin-border-focus);
}
.asset-picker-uuid-error {
font-size: 0.7rem;
color: var(--admin-error);
margin-top: 0.3rem;
display: block;
}
/* ── Drag Handles ──────────────────────────────────────────── */
.hero-tile-drag,
.album-tile-drag,
.subpage-tile-drag {
position: absolute;
z-index: 5;
width: 24px;
height: 24px;
display: flex;
align-items: center;
justify-content: center;
font-size: 0.85rem;
color: rgba(255, 255, 255, 0.8);
background: rgba(0, 0, 0, 0.5);
backdrop-filter: blur(4px);
border-radius: 4px;
cursor: grab;
opacity: 0;
transition: opacity 0.15s;
user-select: none;
touch-action: none;
}
.hero-tile-drag:active,
.album-tile-drag:active,
.subpage-tile-drag:active {
cursor: grabbing;
}
.hero-tile-drag {
top: 6px;
left: 6px;
}
.album-tile-drag {
top: 6px;
left: 6px;
}
.subpage-tile-drag {
top: 6px;
left: 6px;
}
.hero-tile:hover .hero-tile-drag,
.album-tile:hover .album-tile-drag,
.subpage-tile:hover .subpage-tile-drag {
opacity: 1;
}
/* ── Preview & Slug ───────────────────────────────────────────── */
.subpage-slug-preview {
font-size: 0.72rem;
color: var(--admin-text-muted);
font-family: monospace;
padding: 0.15rem 0.4rem;
background: var(--admin-bg);
border-radius: 3px;
white-space: nowrap;
}
.save-bar-right {
display: flex;
align-items: center;
gap: 0.5rem;
}
.admin-btn-preview {
font-size: 0.8rem;
padding: 0.4rem 0.8rem;
text-decoration: none;
}
/* ── Danger icon button ───────────────────────────────────────── */
.admin-btn-icon-danger:hover {
color: var(--admin-error) !important;
}
feat: add visual admin panel with page builder and settings editor - Add /admin route with password-protected visual page builder - Page Builder: manage hero images, standalone albums, subpages, and sections - Album Picker: browse all shared Immich albums with search and filtering - Settings Editor: theme, grid, footer, legal, SEO configuration - YAML service with atomic writes and automatic backups (content/.backups/) - HMAC-signed admin sessions (24h expiry, HttpOnly cookies) - API endpoints: /api/admin/{auth,gallery,settings,albums,reload} - Enable with ADMIN_PASSWORD env var; disabled by default - invalidateConfigCache() export for hot-reload after saves
2026-05-29 17:04:37 +02:00
/* ── Responsive ──────────────────────────────────────────────── */
@media (max-width: 768px) {
.admin-main {
release: v0.11.0 — journal fixes, admin URLs, design system cleanup (#432) * fix(screenshots): sharp-Typen fuer 0.34 und 0.35 gleichzeitig (#410) sharp 0.35 ist von `export =` auf ESM umgestellt: der Modul-Namespace ist nicht mehr aufrufbar, die Factory sitzt unter .default. Der Type-Check brach damit in scripts/screenshots.ts weg, sobald der Next-Bump (#402) sharp von 0.34.5 auf 0.35.3 mitzieht -- sharp ist hier keine deklarierte Dependency, sondern kommt ueber Next mit. Die Form wird jetzt aus dem installierten Paket abgeleitet statt festgeschrieben, zur Laufzeit wie im Typ. Geprueft mit beiden Versionen: tsc laeuft mit 0.34.5 und mit 0.35.3 fehlerfrei durch. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(deps): bump the nextjs group across 1 directory with 2 updates (#402) Bumps the nextjs group with 2 updates in the / directory: [next](https://github.com/vercel/next.js) and [eslint-config-next](https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next). Updates `next` from 16.2.12 to 16.3.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/compare/v16.2.12...v16.3.0) Updates `eslint-config-next` from 16.2.12 to 16.3.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/commits/v16.3.0/packages/eslint-config-next) --- updated-dependencies: - dependency-name: eslint-config-next dependency-version: 16.3.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: nextjs - dependency-name: next dependency-version: 16.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nextjs ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps-dev): bump prettier from 3.8.3 to 3.9.6 (#405) Bumps [prettier](https://github.com/prettier/prettier) from 3.8.3 to 3.9.6. - [Release notes](https://github.com/prettier/prettier/releases) - [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md) - [Commits](https://github.com/prettier/prettier/compare/3.8.3...3.9.6) --- updated-dependencies: - dependency-name: prettier dependency-version: 3.9.6 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * docs(changelog): Unreleased-Sektion fuer die Bumps nach v0.10.0 (#413) Die Dependency-PRs sind nach dem Release auf dev gelandet, teils auch auf main. Ohne Eintrag waeren sie beim naechsten Release unsichtbar -- inklusive Next 16.3.0, das CVE-2025-13465 mitbringt. Ausserdem im 0.10.0-Abschnitt nachgetragen, dass der Trivy-Scan bis #409 nie gelaufen ist. Der Fix steckt im Tag v0.10.0, fehlte aber in der Aufzaehlung -- und "Images werden bei jedem Publish gescannt" stand im Changelog, waehrend der Job im Action-Setup abbrach. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(gallery): per-album sort order, independent of Immich (#408) (#414) Album order was dictated entirely by Immich: getAlbum() sorted by the album's own asc/desc flag, so a Folio album always mirrored the archive. A curated series has a narrative order that has nothing to do with capture time, and changing the Immich album's sort to fit the website changes it for the archive too. Adds an optional per-album `sort` in gallery.yaml, editable in /admin, defaulting to today's behaviour so every existing config is unchanged: immich (default) | newest | oldest | filename | manual `manual` is a pinned *prefix*: `assetOrder` lists only the photos placed by hand, everything else follows in the album's Immich order. A full permutation of a 2,000-photo album would be ~80 KB of UUIDs in a file that is rewritten and copied to content/.backups/ on every admin save. It also makes drift fall out for free — photos removed in Immich never match, new ones land in the tail rather than being hidden. Sorting is applied after the cache read, not before the cache write, so the LRU keeps one canonical Immich-ordered copy per album. That avoids putting the mode in the cache key, lets a config change take effect without depending on invalidation, and keeps the stale-serving path correct. cache.get() returns the stored object by reference, so withSort() returns a shallow clone with a new array — sorting in place would reorder the shared entry, and under request coalescing every concurrent caller would be sorting the same array. Also fixes a prerequisite bug: /api/admin/albums/[albumId]/assets read album.assets from GET /albums/:id, which Immich 3.x no longer populates (lib/immich.ts:507). The hero picker's "This Album" tab returned nothing and threw outright when the key was absent. It now goes through the client's paginated metadata search, with ?types=all to opt videos in for the reorder editor. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): drop decorative emoji from the sort select labels (#415) An <option> cannot contain markup, so the SVG set in Icons is not reachable there — but a decorative emoji is not a substitute for it. Plain text instead; the album card badge already uses a real icon. The remaining emoji in the admin panel (asset picker tabs, section headings, layout picker options) predate this branch and are left for a separate cleanup. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): replace emoji icons with the shared SVG icon set (#416) The admin panel mixed two icon conventions: inline SVGs from `Icons.tsx` in most components, and decorative emoji in the asset picker and a few PageBuilder labels. Emoji render inconsistently across platforms, ignore the accent colour, and cannot inherit the `.svg-icon` sizing rules. - Icons.tsx: add `IconStar` (filled — it marks a state, not an action) and `IconImage`. - AssetPicker: the three tab labels and the favourite tile badge now use IconFolder / IconStar / IconImage. - PageBuilder: the "Standalone Albums" and "Subpages" headings use the icon set instead of an emoji. - PageBuilder: the layout picker drops its emoji for plain text. An <option> cannot contain markup, so an SVG is impossible there and a decorative glyph is not a substitute. - admin.css: align icon and label in the picker tabs, and swap the favourite badge's text-shadow for drop-shadow, which is what applies to an inline SVG. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): fold PageBuilder's local icons into the shared Icons module (#418) * refactor(admin): fold PageBuilder's local icons into the shared module PageBuilder.tsx carried its own `Icons` object duplicating most of the glyphs already exported by Icons.tsx, with hardcoded sizes and slightly divergent paths. Migrate all 32 call sites to the shared module and delete the local object. Five glyphs had no counterpart and are added to Icons.tsx as 1:1 ports of the local paths: IconX, IconPlus, IconHome, IconCopy, IconImage. The local ExternalLink and Check are dropped rather than ported — both had zero call sites. Two glyphs change shape slightly, which is the point of consolidating: the shared IconCamera includes the viewfinder bump the local copy omitted, and drag handles now use IconGripVertical. IconGripVertical uses the module's square 24x24 viewBox, so `.svg-drag` goes from 12x18 to 18x18 — the old non-square box would letterbox the glyph down to 12x12 and shrink the handle. * fix(admin): resolve icon-module integration after #416 Merging dev brought in #416, which added a second IconImage to Icons.tsx and two <Icons.Camera>/<Icons.Folder> section headers that reference the local Icons object this PR removes. Git merged both cleanly but the result did not type-check. - drop the duplicate IconImage (both copies were byte-identical) - point the two section headers at the imported IconCamera/IconFolder - refresh the SORT_LABELS comment: the icon set is imported now, not declared below --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> * fix(config): allow an empty gallery, guard against a double /api suffix (#421) An empty gallery is now a valid, rendered state instead of a throw: deriveGallery() no longer requires at least one album or subpage, so a deployment with no albums yet renders a bare homepage the owner can fill in via /admin. getConfig() also stops appending /api to an Immich URL that already ends in it, which previously produced .../api/api and broke every upstream request. Includes a restore of the per-album sort test cases, which the branch had lost by being cut before #408/#414. * feat(admin): favicon upload, served from the content volume (#422) Adds a bundled default favicon, an upload widget in admin Settings > General, and a route that serves the icon from the writable content/ volume with a fallback to the bundled default. Raster uploads (PNG/ICO/JPEG) are wrapped in an SVG container; the response carries its own CSP so an uploaded SVG cannot execute script on the origin. The GET route revalidates with an ETag instead of caching immutably, so a newly uploaded icon shows up immediately. Uploads are written via temp file + rename, and a Reset button restores the bundled default. * ci: flag unformatted files in a PR, without blocking it (#424) Prettier is configured as an error rule in eslint.config.mjs but has never run in CI, so part of the tree predates it. A final CI step now diffs against the PR base, runs prettier --list-different over the changed files, and emits a warning annotation per offender plus a job summary. Advisory by design: it never fails the job. Blocking would turn a PR red for merely touching a file that was already unformatted, and normalising the tree in one commit would wreck git blame and conflict with the PRs in flight. Requires fetch-depth: 0, since diffing against the base needs its history. * feat(install): first-run wizard gated by a one-time setup token (#419) Adds /install, a four-step first-run wizard: connect to Immich, optionally pick albums, name the site, finish. It verifies the credentials against the Immich server before writing anything, then writes gallery.yaml, settings.yaml and a content/install.json carrying the Immich credentials and a generated site secret. install.json exists because a running process cannot pick up new env vars — the wizard has to write configuration that takes effect without a restart. getInstallCredentials() merges it under the real environment, so env vars always win and rotation stays a matter of setting one. Both the page and the API routes are gated by a one-time setup token printed to the server log, so a deployment that is reachable before gallery.yaml exists cannot be configured by whoever finds it first. The token is stored in content/.setup-token (0600) rather than a module variable: Next.js bundles the page and each route handler separately, so a module-level token left the page and the API disagreeing inside one process and the wizard stuck on step 1. It is removed once the install completes. The admin password is stored as an scrypt hash using the scheme lib/auth.ts already applies to album passwords; a plaintext ADMIN_PASSWORD env var keeps working. * docs: document the setup wizard, fix the read-only content mount (#425) Quick Start now leads with the /install wizard, with the hand-written YAML route kept alongside it, and a First-Run Setup section covers the setup token, the files the wizard writes, and env-var precedence. Two corrections: both Docker examples mounted content/ as :ro, which silently breaks the wizard, the admin panel and the backup rotation alike — docs/admin-panel.md already said so and the README contradicted it. And nothing documented that content/install.json holds the Immich API key, so a backup of content/ is a backup of credentials. Also adds a Contributors section crediting the people whose work is in the project. * feat(admin): floating save bar pinned to the bottom of the viewport (#426) The save bar was the first, static element inside .admin-main. Since the document itself scrolls, it left the viewport as soon as you scrolled down — editing a subpage section or a settings block far below gave no visible dirty hint and no reachable save button. Replace it with a bottom-pinned floating bar shared by both editors. It only mounts while there is something to act on (unsaved changes, an in-flight save, or a result message), so it never covers content while idle. The success message clears after 5s, which hides the bar again. - new SaveBar component, replacing the duplicated markup in PageBuilder and SettingsEditor - adopt the previously unused .floating-save-bar CSS: slide-in keyframes (carrying translateX(-50%)), dirty border, wrap/gap, mobile variant and a prefers-reduced-motion opt-out; z-index 900 keeps it below modals - .admin-main gains bottom padding so the bar never covers page content - drop the now-unreachable idle hints: the ⌘S hint becomes a button title, the Live Sync note becomes a static line above the settings layout - header "Site" link now bypasses the cache (/?fresh=1), so the preview stays reachable when the bar is hidden Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(admin): themed listbox for the album sort control (#427) The per-album "Photo order" control was a native <select>. Because an <option> cannot contain markup, its choices could not use the admin panel's currentColor SVG set — the reason #415 had to fall back to plain text after dropping the emoji labels. Adds a Listbox component implementing the ARIA combobox/listbox pattern, so options can render a glyph beside their label: - DOM focus stays on the trigger button; the active option is announced through aria-activedescendant, keeping focus management to one element - Keyboard: arrows (clamped at the ends, like a native select), Home/End, Enter/Space to commit, Escape to cancel, Tab commits and moves on, and prefix type-ahead with a repeat-key cycle - Outside dismissal on pointerdown, so a press starting outside closes the popup before the click retargets The sort options now carry an icon each: calendar, arrow-down, arrow-up, an A→Z marker, and the drag glyph for manual — matching the badge the album card already shows. SORT_LABELS stays plain text because the badge feeds it to a title attribute. Closes #417 Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(git): ignore generated design handoff folders * fix(admin): stop the album sort dropdown clipping, and simplify the panel (#428) * fix(admin): render listbox popup in a portal so it escapes modal clipping The sort control's popup was position:absolute inside three clipping ancestors (.album-drawer overflow:hidden > .album-drawer-body overflow-y:auto > .modal-right-column overflow-y:auto), so it was cut off at the bottom of the Edit Album Details modal. z-index could not help: clipping happens before stacking. It also always hung below the trigger, with no flip. Portal the popup to document.body and position it from the trigger's viewport rect, flipping above when there is more room there and capping max-height to the space available so it scrolls internally rather than overflowing. It is dismissed on scroll and resize, since the anchor is only measured on open. The outside-pointerdown handler now also treats the popup as inside; without that the portalled list counts as outside, and a click on an option would close it before the selection commits. * refactor(admin): single-column album details panel The left column spent 1.2fr on a cover thumbnail and three stat rows, two of which (Status, Custom Hero) only restated the form fields opposite them, while the form itself was squeezed into 1.8fr behind a second nested scroller. Stack the drawer in one column instead: cover as a banner, then the form at full width, with the UUID moved into the footer. The body is now the only scroll container, which also removes one of the ancestors that was clipping the sort popup. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> * fix(admin): give the portalled listbox its theme back, lock the page behind modals (#429) Two defects in the album editor. The sort listbox popup painted transparent. Every --admin-* variable is scoped to .admin-layout, and since the popup moved into document.body it sits outside that subtree, so background/border/text all resolved to nothing. It now carries its own copy of the palette in both colour schemes, plus the font it no longer inherits. Scrolling inside a modal also moved the page behind it. No admin modal ever locked body scroll: the overlay covers the page but does not absorb wheel events, so a scroll starting on the backdrop — or continuing past the end of the modal's own scroller — reaches the document. overscroll-behavior cannot cover that case on its own, because it only applies to scroll containers and the backdrop is not one. useScrollLock freezes body while a modal is open and compensates for the width the scrollbar gives up, so nothing shifts underneath. Each lock restores the inline value it found, which makes nesting work without a counter — a picker opened from the drawer restores the drawer's hidden state instead of clearing it. Applied to both drawers and all four picker modals, which share the defect. overscroll-behavior: contain on the scrollers stops the chaining they can handle themselves. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com> * fix(security): allow unsafe-eval in CSP script-src during dev mode * feat(journal): add Journal Studio with split-screen editor, live preview and dedicated routes * fix(build): separate client parser from server journal-service and fix build type errors * fix(journal): Fotos rendern, Layout und Lightbox-Steuerung korrigieren Fünf unabhängige Fehler in der öffentlichen Journal- und Essay-Ansicht: * Foto-Blöcke wurden nie angezeigt. EssayView löst ein Foto über PhotoItem.id auf, und das sind verschlüsselte Tokens — die Blöcke aus dem Markdown tragen aber rohe Asset-UUIDs. Jede Zuordnung lief ins Leere, und nicht auflösbare Blöcke werden still verworfen. Die IDs werden jetzt serverseitig übersetzt; damit verschwinden nebenbei die rohen UUIDs aus dem Client-Payload, die dort laut Projektregel nie auftauchen dürfen. Nicht auflösbare Referenzen werden geloggt. * Überschriften standen weiter links als der Fließtext. Jeder Block hatte einzeln `max-width: 68ch`, und `ch` ist relativ zur Schrift des Elements — die Serif-Überschrift ergab eine breitere Spalte. Ersetzt durch eine gemeinsame, font-unabhängige `--essay-measure`. * Fullbleed-Fotos bluteten nur nach links aus: `.essay-figure` ist `width: 100%`, wodurch die Box überbestimmt ist und der negative rechte Margin verworfen wird. * Foto-Paare stellten beide Bilder gleich breit dar, wodurch ein Hochformat neben einem Querformat doppelt so hoch wurde. Jetzt eine Justified-Reihe: Breite proportional zum Seitenverhältnis, dadurch exakt gleiche Höhen ohne Beschnitt. * Die Lightbox hatte im Journal keine Tastatursteuerung und keine Scroll-Sperre — beides lag in PhotoGrid, also nur im Album-Raster. Verlagert in die Lightbox selbst, der doppelte Handler in PhotoGrid entfernt (sonst wäre pro Pfeildruck zwei Bilder weitergesprungen). Zusätzlich sind Proofing-Herzen und das EXIF-Panel im redaktionellen Modus abschaltbar und im Journal aus: Client-Proofing ist ein Übergabe-Workflow für Alben, keine Funktion einer Reportage. Auf der Übersicht wurde der Untertitel doppelt gerendert, weil extractExcerpt() auf ihn zurückfällt. * feat(admin): eigene URLs für alle Bereiche und überarbeiteter Journal Studio Das Panel war eine einzige Client-Komponente, die ihre Tabs über useState umschaltet: keine Route pro Bereich, kein Deep-Link, kein Zurück-Button, und nach jedem Reload landete man wieder auf "Pages". Auch der Journal-Editor hatte keine eigene URL. Jetzt sieben echte Routen (/admin, /admin/pages, /admin/journal, /admin/journal/<slug>, /admin/settings, /admin/settings/<section>, /admin/analytics). Die Shell mit Auth-Prüfung und Kopfzeile sitzt im Layout und umschließt children — so bleibt die Session-Prüfung über Routenwechsel montiert, statt bei jedem Tab-Wechsel neu zu laufen und den Spinner aufblitzen zu lassen. Unbekannte Settings-Sections fallen auf General zurück. Im selben Zug der Journal Studio, der die Routing-Änderung ohnehin berührt: * Alle Eingabefelder nutzten die Klasse `admin-input`, die in keinem CSS definiert war — sie fielen auf Browser-Defaults zurück. Jetzt gestylt, gescoped, damit der generische Name nicht ins übrige Panel leckt. * Der Split View ist per Divider verschiebbar (Maus, Tastatur, Doppelklick zum Zurücksetzen), Breite in localStorage. * Das Studio bricht aus der 1120px-Spalte aus, die Preview hat Platz. * Die Preview zeigte für jedes Foto fest 3:2 und log damit über das Layout der veröffentlichten Seite; die echten Verhältnisse werden jetzt an den Thumbnails gemessen. * Blöcke mit alten positionsbasierten Foto-Referenzen werden markiert — die lassen sich auf einer eigenständigen Journal-Seite nicht auflösen und verschwanden bisher stillschweigend. * Blocktyp-Chips als gemeinsame Komponente, monochrom und per Icon unterschieden statt in einer eigenen Blau/Lila/Orange-Palette, die sonst nirgends im Panel vorkommt. * Emojis raus, SVG-Icons rein. * fix(admin): Designsystem-Lücken im Panel schließen Eine systematische Suche nach Klassen, die im TSX benutzt, aber in keinem CSS definiert sind, hat vier Stellen mit demselben Muster gefunden: * `admin-btn-secondary` und `admin-btn-danger` existierten nicht. Sämtliche Löschen-Buttons sahen aus wie normale Buttons — keine Warnwirkung. Als `.admin-btn.admin-btn-danger` geschrieben, weil die Varianten mit den Größenklassen kombiniert werden, die weiter unten ihren eigenen Hintergrund setzen. * `page-progress-fill` fehlte: die Balken im Analytics-Panel waren leere Rinnen, der Wert unsichtbar. Ebenso `analytics-empty` und `admin-loading-container`. * `subpage-drawer-section`, `subpage-drawer-title-group` und `input-with-icon` im PageBuilder waren wirkungslos und teils mit Inline-Styles notdürftig kompensiert. * `grid-card-preview` fehlte, wodurch alle Layout-Vorschauen auf Höhe null kollabierten. Nur "Showcase" war sichtbar — und das aus Versehen, weil sein Tile `hero-tile` hieß und damit die `aspect-ratio` einer fremden PageBuilder-Klasse erbte. Umbenannt. Dazu die Theme-Vorschauen, die praktisch identisch aussahen: alle sieben zeigten dieselben drei quadratischen Kacheln, einziger Unterschied war die Hintergrundfarbe. Sie spiegeln jetzt die echten Preset-Daten aus lib/config/theme.ts — Schriftcharakter, Eckradius, Rasterdichte, Passepartout bzw. Schatten. Die Kopfzeile richtet sich an einer gemeinsamen Steuerhöhe aus. Der "Site"-Link war höher als die Buttons daneben: `.admin-btn` hatte keine explizite line-height, und <button> bekommt box-sizing: border-box vom Browser, <a> nicht. Die Statusanzeige setzte weder Schriftfamilie noch -größe und fiel auf den Browser-Default zurück — sie war nie Teil des Designsystems. Jetzt gleiche Höhe und Typografie, Pillenform als Zustandsanzeige, Trenner zur Aktionsgruppe. Das dauerhafte Pulsieren des grünen Punkts entfällt; Animation bleibt den Zuständen vorbehalten, die Aufmerksamkeit brauchen. Restliche Emojis durch SVG-Icons ersetzt. * feat(admin): add scroll-to-top toggle and SVG arrow The back-to-top button was always on and drew its arrow with the ↑ text character. Add a `scrollToTop` setting (General section in the admin panel, defaults to on so existing sites are unaffected) and replace the glyph with a stroked SVG that inherits currentColor across all presets. Scroll handling is now rAF-throttled, and prefers-reduced-motion turns off both the hover lift and the smooth scroll. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * security(journal): escape author HTML instead of filtering it CodeQL flags 26 high-severity alerts on the release PR; the bulk of them point at sanitizeHtml(), a denylist of three regexes whose output goes into dangerouslySetInnerHTML. I reproduced the bypasses before changing anything — all four pass the old filter: <img src=x onerror=alert(1)> unquoted handler, regex wants quotes <img src=x onerror='alert(1)'> single quotes, same reason <svg onload=alert(1)> not a <script> tag javasjavascript:cript:alert(1) one-pass replace, the rest recombines Plus an attribute breakout in the link renderer, which interpolated the URL into href="${url}" unescaped: [x](" onmouseover=alert(1) x=") -> <a href="" onmouseover=alert(1" ...> Replaced with escaping. Every `&<>"'` in author text becomes an entity before any markdown rule runs, so the only tags in the output are the ones renderInlineMarkdown builds itself and a URL cannot leave its attribute. Link schemes are now an allowlist (http, https, mailto, tel, relative, anchor); anything else renders as plain text. The serializer needed decodeHtmlEntities to match: without it a save would write `&lt;` into the Markdown file and the next parse would escape the `&` again, corrupting the text further on every round trip. A test covers parse -> serialize -> parse stability. Two existing tests asserted the old behaviour and were rewritten rather than deleted: one expected the script tag to be *removed* from the output, the other expected the substring "onerror" to be absent. Both now assert the property that matters — that no tag can form — because `onerror` surviving as inert text is fine. Exploitation required admin access either way: journal and essay text comes from the studio or from content/*.md. This removes the weakness, it does not close an open door. * fix(journal): contain file paths, fix frontmatter escaping, defuse two regexes Follow-up to the CodeQL findings on release PR #432. I went through all 23 alerts individually; this addresses the ones that are worth addressing and documents the ones that are not. Path containment (12 alerts, all false positives). Every path built from a slug goes through isValidSlug(), a strict `/^[a-zA-Z0-9_-]+$/` allowlist — verified against `../../etc/passwd`, `foo/../../bar`, `a/b`, `..` and friends, all rejected. CodeQL cannot see it because the check lives in another module. Added a containedPath() helper that resolves the path and refuses anything landing outside the content directory: a second lock on a door that was already locked, and a barrier the analysis can follow. Also removed the dead `slug.endsWith('.md')` branches — isValidSlug rejects dots, so they could never be taken. Frontmatter escaping (1 alert, a real bug). The serializer escaped `"` but not `\`, and the parser never unescaped anything. A title containing either character gained a backslash on every save/load cycle: Path C:\Users "quoted" -> Path C:\\Users \"quoted\" -> ... Escaping now covers the backslash first and the parser undoes both. A round trip test covers quotes, backslashes, colons and apostrophes. Two of three ReDoS regexes (2 alerts). The heading pattern had `\s+` next to `(.+)`, which overlap, so the engine tried every split of the whitespace run before failing; it is `[ \t]+` and `(\S.*)` now. The quote author pattern wrapped a lazy group around an optional group — the quadratic case — and is an index split on the first separator now. The third regex, the bold/italic pass, is deliberately left alone. Rewriting it with a negated class removes the backtracking but breaks nesting: `**bold *and italic* here**` renders as `*<em>bold </em>and italic<em> here</em>*`. The input is Markdown from an authenticated admin, never a visitor, so the worst case is an author slowing down their own page. The comment in the code says so. Not addressed: 5 js/insufficient-password-hash alerts. They ask for a slow KDF where the code uses SHA-256/HMAC — correct in general, but the admin password comes from an environment variable and is never stored, so a stronger KDF protects nothing that is not already in plaintext in the environment. 399 unit tests pass (18 new), build and tsc clean. * fix(journal): split the quote author by scanning, not by pattern Cleaning up after myself. #439 replaced the quote author regex `/^(.*?)(?:\s+--\s+(.+))?$/` — a lazy group around an optional one, the quadratic case — with `/\s+--\s+/`, and CodeQL promptly flagged the replacement for the same reason. One reported pattern traded for another. splitQuoteAuthor() scans for the first `--` that has whitespace on both sides. Linear, and it needs no reasoning about the regex engine at all. Behaviour is identical to the original regex, checked case by case against it: separator, no separator, several separators, tabs, wide gaps, `a--b` without spaces, leading and trailing separators, empty string. All nine are covered by tests, plus one asserting it stays fast on a 50k whitespace run. * security(admin): derive the session signing key with scrypt getSigningKey() ran the admin password through a single SHA-256 digest. It is key derivation rather than password storage, so it was never a stored-hash problem — but if the derived key ever leaked, one fast hash makes recovering the password by brute force cheap. CodeQL flags it as js/insufficient-password-hash and, for this particular alert, has a point. scrypt now. Two details that matter: The salt has to be stable. A random salt would produce a different key on every call and invalidate every session; it is derived from AUTH_SECRET, which is deployment-specific. Verified across separate processes: same inputs produce a verifying token, so a restart or redeploy does not log everyone out. The result is cached for the process lifetime. scrypt is deliberately slow and getSigningKey() runs on every admin request — deriving per call would add ~24ms to each one. The cache key is a digest of secret plus password, so a rotation misses the cache and derives again, and no extra plaintext copy of the password is kept around. Measured: first derivation 24ms, subsequent calls 0.12ms. Password change and secret change both invalidate an existing token, checked in separate processes. Note the one-time effect: existing admin sessions are invalidated by the change in derivation, so everyone logs in once more. * security(admin): key the signing-key cache on its inputs, not a digest #441 removed the SHA-256 digest of the admin password from the key derivation and introduced a new one three lines above it, as the cache key. Same rule, same file: CodeQL reported it immediately. The comment justifying it was wrong too. It claimed no second plaintext copy of the password was retained, while building the digest input allocates exactly that in order to hash it. The cache now holds the two input strings and compares them directly. They are the same objects the env and install caches already hold, so nothing extra is retained, and no fast hash of the password exists in memory for the life of the process. Re-verified after the change, in separate processes: a token from one process verifies in another with the same inputs, a changed password or secret rejects it, first derivation 24ms, cached calls 0.001ms. That leaves scrypt as the only place the password is hashed here. The two HMACs further down operate on the derived key and on token data, not on the password; the constant-time comparison in verifyAdminPassword is the previously dismissed one. --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
2026-08-14 16:55:07 +02:00
padding: 1rem 1rem 6rem;
}
.floating-save-bar {
bottom: 1rem;
width: calc(100% - 2rem);
padding: 0.625rem 0.875rem;
gap: 0.5rem;
feat: add visual admin panel with page builder and settings editor - Add /admin route with password-protected visual page builder - Page Builder: manage hero images, standalone albums, subpages, and sections - Album Picker: browse all shared Immich albums with search and filtering - Settings Editor: theme, grid, footer, legal, SEO configuration - YAML service with atomic writes and automatic backups (content/.backups/) - HMAC-signed admin sessions (24h expiry, HttpOnly cookies) - API endpoints: /api/admin/{auth,gallery,settings,albums,reload} - Enable with ADMIN_PASSWORD env var; disabled by default - invalidateConfigCache() export for hot-reload after saves
2026-05-29 17:04:37 +02:00
}
.admin-header {
padding: 0.5rem 1rem;
}
.admin-header h1 {
display: none;
}
.settings-layout {
grid-template-columns: 1fr;
gap: 1rem;
}
.settings-nav {
flex-direction: row;
overflow-x: auto;
gap: 0;
}
.settings-nav-item {
white-space: nowrap;
}
.admin-field-row {
grid-template-columns: 1fr;
}
}
feat: redesign admin pagebuilder with slide-over drawers and svg icons (#242) Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-05-31 21:27:13 +02:00
/* ── Premium Slide-over Drawer & Badges Redesign ──────────────── */
/* Inline SVG Icon Global Styling */
.svg-icon {
display: inline-block;
vertical-align: middle;
flex-shrink: 0;
width: 1em;
height: 1em;
stroke-width: 2px;
chore(release): v0.10.0 (#400) Photo Essay mode, client proofing, studio-modern preset, admin panel overhaul, watermark, cookieless analytics, subpage toggle, SEO title templates. Analytics API now admin-only, Trivy scan on publish. Album order mirrors the Immich timeline; map theme, admin status panel, lightbox counter and Docker health check fixed. See CHANGELOG.md for the full list and the health-check upgrade note.
2026-08-10 09:56:20 +02:00
transition:
transform 0.2s ease,
color 0.15s ease;
feat: redesign admin pagebuilder with slide-over drawers and svg icons (#242) Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-05-31 21:27:13 +02:00
}
🛡️ Sentinel: [HIGH] Fix timingSafeEqual DoS Vulnerability (#423) * Fix timingSafeEqual DoS Vulnerability in Webhook Co-authored-by: ralksta <16941050+ralksta@users.noreply.github.com> * Fix memory exhaustion DoS in token decoding Co-authored-by: ralksta <16941050+ralksta@users.noreply.github.com> --------- Co-authored-by: google-labs-jules[bot] <161369871+google-labs-jules[bot]@users.noreply.github.com>
2026-08-14 11:10:42 +02:00
/* Drag handles use IconGripVertical's square 24x24 viewBox, so keep the box
square too — a 12x18 box would letterbox the glyph down to 12x12. */
feat: redesign admin pagebuilder with slide-over drawers and svg icons (#242) Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-05-31 21:27:13 +02:00
.svg-drag {
🛡️ Sentinel: [HIGH] Fix timingSafeEqual DoS Vulnerability (#423) * Fix timingSafeEqual DoS Vulnerability in Webhook Co-authored-by: ralksta <16941050+ralksta@users.noreply.github.com> * Fix memory exhaustion DoS in token decoding Co-authored-by: ralksta <16941050+ralksta@users.noreply.github.com> --------- Co-authored-by: google-labs-jules[bot] <161369871+google-labs-jules[bot]@users.noreply.github.com>
2026-08-14 11:10:42 +02:00
width: 18px;
feat: redesign admin pagebuilder with slide-over drawers and svg icons (#242) Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-05-31 21:27:13 +02:00
height: 18px;
}
h2 .svg-icon,
h3 .svg-icon {
margin-right: 0.5rem;
font-size: 1.15em;
color: var(--admin-accent);
}
/* Album Card Simplification & Grid Spacing */
.album-list {
display: grid;
grid-template-columns: repeat(auto-fill, minmax(180px, 1fr));
gap: 1.25rem;
margin: 0.5rem 0 1.25rem;
}
.album-tile {
background: var(--admin-bg-raised);
border: 1px solid var(--admin-border);
border-radius: 12px;
overflow: hidden;
position: relative;
transition: all 0.25s cubic-bezier(0.16, 1, 0.3, 1);
box-shadow: 0 1px 3px rgba(0, 0, 0, 0.1);
}
.album-tile:hover {
transform: translateY(-2px);
border-color: var(--admin-border-hover);
box-shadow: 0 8px 24px rgba(0, 0, 0, 0.25);
}
[data-theme='light'] .album-tile:hover {
box-shadow: 0 8px 24px rgba(0, 0, 0, 0.08);
}
.album-tile-cover {
aspect-ratio: 16 / 11;
border-bottom: 1px solid var(--admin-border);
position: relative;
background: var(--admin-bg-elevated);
overflow: hidden;
}
.album-tile-placeholder {
color: var(--admin-text-muted);
font-size: 1.75rem;
}
.album-tile-overlay {
display: flex;
gap: 0.5rem;
}
.album-tile-btn {
background: rgba(17, 17, 17, 0.85);
backdrop-filter: blur(8px);
border: 1px solid var(--admin-border);
color: var(--admin-text);
width: 32px;
height: 32px;
border-radius: 8px;
transition: all 0.15s ease;
}
.album-tile-btn:hover {
background: var(--admin-accent);
color: #000;
border-color: var(--admin-accent);
}
.album-tile-btn-danger:hover {
background: var(--admin-error) !important;
color: #fff !important;
border-color: var(--admin-error) !important;
}
.album-tile-info {
padding: 0.75rem;
display: flex;
flex-direction: column;
gap: 0.25rem;
}
.album-tile-title-row {
display: flex;
align-items: center;
justify-content: space-between;
gap: 0.5rem;
}
.album-tile-name {
font-size: 0.85rem;
font-weight: 600;
color: var(--admin-text);
white-space: nowrap;
overflow: hidden;
text-overflow: ellipsis;
flex: 1;
}
.album-tile-name.custom-title {
color: var(--admin-accent);
font-style: italic;
}
/* Badges for status indications */
.album-tile-badges {
display: flex;
gap: 0.25rem;
flex-shrink: 0;
}
.album-tile-badges .badge {
display: inline-flex;
align-items: center;
justify-content: center;
width: 18px;
height: 18px;
border-radius: 4px;
font-size: 0.7rem;
background: var(--admin-bg-elevated);
border: 1px solid var(--admin-border);
color: var(--admin-text-secondary);
}
.album-tile-badges .badge-password {
color: var(--admin-accent);
border-color: rgba(245, 158, 11, 0.3);
background: rgba(245, 158, 11, 0.05);
}
.album-tile-badges .badge-hero {
color: var(--admin-success);
border-color: rgba(74, 222, 128, 0.3);
background: rgba(74, 222, 128, 0.05);
}
🛡️ Sentinel: [HIGH] Fix timingSafeEqual DoS Vulnerability (#423) * Fix timingSafeEqual DoS Vulnerability in Webhook Co-authored-by: ralksta <16941050+ralksta@users.noreply.github.com> * Fix memory exhaustion DoS in token decoding Co-authored-by: ralksta <16941050+ralksta@users.noreply.github.com> --------- Co-authored-by: google-labs-jules[bot] <161369871+google-labs-jules[bot]@users.noreply.github.com>
2026-08-14 11:10:42 +02:00
/* Carries a mode name ("filename", "oldest"), so it cannot use the fixed
icon-sized box the other badges share. */
.album-tile-badges .badge-sort {
width: auto;
min-width: 18px;
padding: 0 5px;
font-size: 0.62rem;
letter-spacing: 0.03em;
text-transform: uppercase;
}
feat: redesign album drawer into a gorgeous centered two-column modal (#243) Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-05-31 21:30:00 +02:00
/* ── Breitwand-Kiste Centered Modal styling ── */
feat: redesign admin pagebuilder with slide-over drawers and svg icons (#242) Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-05-31 21:27:13 +02:00
.album-drawer-overlay {
position: fixed;
inset: 0;
z-index: 1000;
background: var(--admin-overlay);
feat: redesign album drawer into a gorgeous centered two-column modal (#243) Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-05-31 21:30:00 +02:00
backdrop-filter: blur(12px);
feat: redesign admin pagebuilder with slide-over drawers and svg icons (#242) Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-05-31 21:27:13 +02:00
display: flex;
feat: redesign album drawer into a gorgeous centered two-column modal (#243) Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-05-31 21:30:00 +02:00
align-items: center;
justify-content: center;
padding: 1.5rem;
feat: redesign admin pagebuilder with slide-over drawers and svg icons (#242) Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-05-31 21:27:13 +02:00
opacity: 0;
pointer-events: none;
feat: redesign album drawer into a gorgeous centered two-column modal (#243) Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-05-31 21:30:00 +02:00
transition: opacity 0.25s cubic-bezier(0.16, 1, 0.3, 1);
feat: redesign admin pagebuilder with slide-over drawers and svg icons (#242) Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-05-31 21:27:13 +02:00
}
.album-drawer-overlay.open {
opacity: 1;
pointer-events: auto;
}
.album-drawer {
width: 100%;
release: v0.11.0 — journal fixes, admin URLs, design system cleanup (#432) * fix(screenshots): sharp-Typen fuer 0.34 und 0.35 gleichzeitig (#410) sharp 0.35 ist von `export =` auf ESM umgestellt: der Modul-Namespace ist nicht mehr aufrufbar, die Factory sitzt unter .default. Der Type-Check brach damit in scripts/screenshots.ts weg, sobald der Next-Bump (#402) sharp von 0.34.5 auf 0.35.3 mitzieht -- sharp ist hier keine deklarierte Dependency, sondern kommt ueber Next mit. Die Form wird jetzt aus dem installierten Paket abgeleitet statt festgeschrieben, zur Laufzeit wie im Typ. Geprueft mit beiden Versionen: tsc laeuft mit 0.34.5 und mit 0.35.3 fehlerfrei durch. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(deps): bump the nextjs group across 1 directory with 2 updates (#402) Bumps the nextjs group with 2 updates in the / directory: [next](https://github.com/vercel/next.js) and [eslint-config-next](https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next). Updates `next` from 16.2.12 to 16.3.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/compare/v16.2.12...v16.3.0) Updates `eslint-config-next` from 16.2.12 to 16.3.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/commits/v16.3.0/packages/eslint-config-next) --- updated-dependencies: - dependency-name: eslint-config-next dependency-version: 16.3.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: nextjs - dependency-name: next dependency-version: 16.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nextjs ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps-dev): bump prettier from 3.8.3 to 3.9.6 (#405) Bumps [prettier](https://github.com/prettier/prettier) from 3.8.3 to 3.9.6. - [Release notes](https://github.com/prettier/prettier/releases) - [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md) - [Commits](https://github.com/prettier/prettier/compare/3.8.3...3.9.6) --- updated-dependencies: - dependency-name: prettier dependency-version: 3.9.6 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * docs(changelog): Unreleased-Sektion fuer die Bumps nach v0.10.0 (#413) Die Dependency-PRs sind nach dem Release auf dev gelandet, teils auch auf main. Ohne Eintrag waeren sie beim naechsten Release unsichtbar -- inklusive Next 16.3.0, das CVE-2025-13465 mitbringt. Ausserdem im 0.10.0-Abschnitt nachgetragen, dass der Trivy-Scan bis #409 nie gelaufen ist. Der Fix steckt im Tag v0.10.0, fehlte aber in der Aufzaehlung -- und "Images werden bei jedem Publish gescannt" stand im Changelog, waehrend der Job im Action-Setup abbrach. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(gallery): per-album sort order, independent of Immich (#408) (#414) Album order was dictated entirely by Immich: getAlbum() sorted by the album's own asc/desc flag, so a Folio album always mirrored the archive. A curated series has a narrative order that has nothing to do with capture time, and changing the Immich album's sort to fit the website changes it for the archive too. Adds an optional per-album `sort` in gallery.yaml, editable in /admin, defaulting to today's behaviour so every existing config is unchanged: immich (default) | newest | oldest | filename | manual `manual` is a pinned *prefix*: `assetOrder` lists only the photos placed by hand, everything else follows in the album's Immich order. A full permutation of a 2,000-photo album would be ~80 KB of UUIDs in a file that is rewritten and copied to content/.backups/ on every admin save. It also makes drift fall out for free — photos removed in Immich never match, new ones land in the tail rather than being hidden. Sorting is applied after the cache read, not before the cache write, so the LRU keeps one canonical Immich-ordered copy per album. That avoids putting the mode in the cache key, lets a config change take effect without depending on invalidation, and keeps the stale-serving path correct. cache.get() returns the stored object by reference, so withSort() returns a shallow clone with a new array — sorting in place would reorder the shared entry, and under request coalescing every concurrent caller would be sorting the same array. Also fixes a prerequisite bug: /api/admin/albums/[albumId]/assets read album.assets from GET /albums/:id, which Immich 3.x no longer populates (lib/immich.ts:507). The hero picker's "This Album" tab returned nothing and threw outright when the key was absent. It now goes through the client's paginated metadata search, with ?types=all to opt videos in for the reorder editor. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): drop decorative emoji from the sort select labels (#415) An <option> cannot contain markup, so the SVG set in Icons is not reachable there — but a decorative emoji is not a substitute for it. Plain text instead; the album card badge already uses a real icon. The remaining emoji in the admin panel (asset picker tabs, section headings, layout picker options) predate this branch and are left for a separate cleanup. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): replace emoji icons with the shared SVG icon set (#416) The admin panel mixed two icon conventions: inline SVGs from `Icons.tsx` in most components, and decorative emoji in the asset picker and a few PageBuilder labels. Emoji render inconsistently across platforms, ignore the accent colour, and cannot inherit the `.svg-icon` sizing rules. - Icons.tsx: add `IconStar` (filled — it marks a state, not an action) and `IconImage`. - AssetPicker: the three tab labels and the favourite tile badge now use IconFolder / IconStar / IconImage. - PageBuilder: the "Standalone Albums" and "Subpages" headings use the icon set instead of an emoji. - PageBuilder: the layout picker drops its emoji for plain text. An <option> cannot contain markup, so an SVG is impossible there and a decorative glyph is not a substitute. - admin.css: align icon and label in the picker tabs, and swap the favourite badge's text-shadow for drop-shadow, which is what applies to an inline SVG. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): fold PageBuilder's local icons into the shared Icons module (#418) * refactor(admin): fold PageBuilder's local icons into the shared module PageBuilder.tsx carried its own `Icons` object duplicating most of the glyphs already exported by Icons.tsx, with hardcoded sizes and slightly divergent paths. Migrate all 32 call sites to the shared module and delete the local object. Five glyphs had no counterpart and are added to Icons.tsx as 1:1 ports of the local paths: IconX, IconPlus, IconHome, IconCopy, IconImage. The local ExternalLink and Check are dropped rather than ported — both had zero call sites. Two glyphs change shape slightly, which is the point of consolidating: the shared IconCamera includes the viewfinder bump the local copy omitted, and drag handles now use IconGripVertical. IconGripVertical uses the module's square 24x24 viewBox, so `.svg-drag` goes from 12x18 to 18x18 — the old non-square box would letterbox the glyph down to 12x12 and shrink the handle. * fix(admin): resolve icon-module integration after #416 Merging dev brought in #416, which added a second IconImage to Icons.tsx and two <Icons.Camera>/<Icons.Folder> section headers that reference the local Icons object this PR removes. Git merged both cleanly but the result did not type-check. - drop the duplicate IconImage (both copies were byte-identical) - point the two section headers at the imported IconCamera/IconFolder - refresh the SORT_LABELS comment: the icon set is imported now, not declared below --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> * fix(config): allow an empty gallery, guard against a double /api suffix (#421) An empty gallery is now a valid, rendered state instead of a throw: deriveGallery() no longer requires at least one album or subpage, so a deployment with no albums yet renders a bare homepage the owner can fill in via /admin. getConfig() also stops appending /api to an Immich URL that already ends in it, which previously produced .../api/api and broke every upstream request. Includes a restore of the per-album sort test cases, which the branch had lost by being cut before #408/#414. * feat(admin): favicon upload, served from the content volume (#422) Adds a bundled default favicon, an upload widget in admin Settings > General, and a route that serves the icon from the writable content/ volume with a fallback to the bundled default. Raster uploads (PNG/ICO/JPEG) are wrapped in an SVG container; the response carries its own CSP so an uploaded SVG cannot execute script on the origin. The GET route revalidates with an ETag instead of caching immutably, so a newly uploaded icon shows up immediately. Uploads are written via temp file + rename, and a Reset button restores the bundled default. * ci: flag unformatted files in a PR, without blocking it (#424) Prettier is configured as an error rule in eslint.config.mjs but has never run in CI, so part of the tree predates it. A final CI step now diffs against the PR base, runs prettier --list-different over the changed files, and emits a warning annotation per offender plus a job summary. Advisory by design: it never fails the job. Blocking would turn a PR red for merely touching a file that was already unformatted, and normalising the tree in one commit would wreck git blame and conflict with the PRs in flight. Requires fetch-depth: 0, since diffing against the base needs its history. * feat(install): first-run wizard gated by a one-time setup token (#419) Adds /install, a four-step first-run wizard: connect to Immich, optionally pick albums, name the site, finish. It verifies the credentials against the Immich server before writing anything, then writes gallery.yaml, settings.yaml and a content/install.json carrying the Immich credentials and a generated site secret. install.json exists because a running process cannot pick up new env vars — the wizard has to write configuration that takes effect without a restart. getInstallCredentials() merges it under the real environment, so env vars always win and rotation stays a matter of setting one. Both the page and the API routes are gated by a one-time setup token printed to the server log, so a deployment that is reachable before gallery.yaml exists cannot be configured by whoever finds it first. The token is stored in content/.setup-token (0600) rather than a module variable: Next.js bundles the page and each route handler separately, so a module-level token left the page and the API disagreeing inside one process and the wizard stuck on step 1. It is removed once the install completes. The admin password is stored as an scrypt hash using the scheme lib/auth.ts already applies to album passwords; a plaintext ADMIN_PASSWORD env var keeps working. * docs: document the setup wizard, fix the read-only content mount (#425) Quick Start now leads with the /install wizard, with the hand-written YAML route kept alongside it, and a First-Run Setup section covers the setup token, the files the wizard writes, and env-var precedence. Two corrections: both Docker examples mounted content/ as :ro, which silently breaks the wizard, the admin panel and the backup rotation alike — docs/admin-panel.md already said so and the README contradicted it. And nothing documented that content/install.json holds the Immich API key, so a backup of content/ is a backup of credentials. Also adds a Contributors section crediting the people whose work is in the project. * feat(admin): floating save bar pinned to the bottom of the viewport (#426) The save bar was the first, static element inside .admin-main. Since the document itself scrolls, it left the viewport as soon as you scrolled down — editing a subpage section or a settings block far below gave no visible dirty hint and no reachable save button. Replace it with a bottom-pinned floating bar shared by both editors. It only mounts while there is something to act on (unsaved changes, an in-flight save, or a result message), so it never covers content while idle. The success message clears after 5s, which hides the bar again. - new SaveBar component, replacing the duplicated markup in PageBuilder and SettingsEditor - adopt the previously unused .floating-save-bar CSS: slide-in keyframes (carrying translateX(-50%)), dirty border, wrap/gap, mobile variant and a prefers-reduced-motion opt-out; z-index 900 keeps it below modals - .admin-main gains bottom padding so the bar never covers page content - drop the now-unreachable idle hints: the ⌘S hint becomes a button title, the Live Sync note becomes a static line above the settings layout - header "Site" link now bypasses the cache (/?fresh=1), so the preview stays reachable when the bar is hidden Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(admin): themed listbox for the album sort control (#427) The per-album "Photo order" control was a native <select>. Because an <option> cannot contain markup, its choices could not use the admin panel's currentColor SVG set — the reason #415 had to fall back to plain text after dropping the emoji labels. Adds a Listbox component implementing the ARIA combobox/listbox pattern, so options can render a glyph beside their label: - DOM focus stays on the trigger button; the active option is announced through aria-activedescendant, keeping focus management to one element - Keyboard: arrows (clamped at the ends, like a native select), Home/End, Enter/Space to commit, Escape to cancel, Tab commits and moves on, and prefix type-ahead with a repeat-key cycle - Outside dismissal on pointerdown, so a press starting outside closes the popup before the click retargets The sort options now carry an icon each: calendar, arrow-down, arrow-up, an A→Z marker, and the drag glyph for manual — matching the badge the album card already shows. SORT_LABELS stays plain text because the badge feeds it to a title attribute. Closes #417 Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(git): ignore generated design handoff folders * fix(admin): stop the album sort dropdown clipping, and simplify the panel (#428) * fix(admin): render listbox popup in a portal so it escapes modal clipping The sort control's popup was position:absolute inside three clipping ancestors (.album-drawer overflow:hidden > .album-drawer-body overflow-y:auto > .modal-right-column overflow-y:auto), so it was cut off at the bottom of the Edit Album Details modal. z-index could not help: clipping happens before stacking. It also always hung below the trigger, with no flip. Portal the popup to document.body and position it from the trigger's viewport rect, flipping above when there is more room there and capping max-height to the space available so it scrolls internally rather than overflowing. It is dismissed on scroll and resize, since the anchor is only measured on open. The outside-pointerdown handler now also treats the popup as inside; without that the portalled list counts as outside, and a click on an option would close it before the selection commits. * refactor(admin): single-column album details panel The left column spent 1.2fr on a cover thumbnail and three stat rows, two of which (Status, Custom Hero) only restated the form fields opposite them, while the form itself was squeezed into 1.8fr behind a second nested scroller. Stack the drawer in one column instead: cover as a banner, then the form at full width, with the UUID moved into the footer. The body is now the only scroll container, which also removes one of the ancestors that was clipping the sort popup. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> * fix(admin): give the portalled listbox its theme back, lock the page behind modals (#429) Two defects in the album editor. The sort listbox popup painted transparent. Every --admin-* variable is scoped to .admin-layout, and since the popup moved into document.body it sits outside that subtree, so background/border/text all resolved to nothing. It now carries its own copy of the palette in both colour schemes, plus the font it no longer inherits. Scrolling inside a modal also moved the page behind it. No admin modal ever locked body scroll: the overlay covers the page but does not absorb wheel events, so a scroll starting on the backdrop — or continuing past the end of the modal's own scroller — reaches the document. overscroll-behavior cannot cover that case on its own, because it only applies to scroll containers and the backdrop is not one. useScrollLock freezes body while a modal is open and compensates for the width the scrollbar gives up, so nothing shifts underneath. Each lock restores the inline value it found, which makes nesting work without a counter — a picker opened from the drawer restores the drawer's hidden state instead of clearing it. Applied to both drawers and all four picker modals, which share the defect. overscroll-behavior: contain on the scrollers stops the chaining they can handle themselves. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com> * fix(security): allow unsafe-eval in CSP script-src during dev mode * feat(journal): add Journal Studio with split-screen editor, live preview and dedicated routes * fix(build): separate client parser from server journal-service and fix build type errors * fix(journal): Fotos rendern, Layout und Lightbox-Steuerung korrigieren Fünf unabhängige Fehler in der öffentlichen Journal- und Essay-Ansicht: * Foto-Blöcke wurden nie angezeigt. EssayView löst ein Foto über PhotoItem.id auf, und das sind verschlüsselte Tokens — die Blöcke aus dem Markdown tragen aber rohe Asset-UUIDs. Jede Zuordnung lief ins Leere, und nicht auflösbare Blöcke werden still verworfen. Die IDs werden jetzt serverseitig übersetzt; damit verschwinden nebenbei die rohen UUIDs aus dem Client-Payload, die dort laut Projektregel nie auftauchen dürfen. Nicht auflösbare Referenzen werden geloggt. * Überschriften standen weiter links als der Fließtext. Jeder Block hatte einzeln `max-width: 68ch`, und `ch` ist relativ zur Schrift des Elements — die Serif-Überschrift ergab eine breitere Spalte. Ersetzt durch eine gemeinsame, font-unabhängige `--essay-measure`. * Fullbleed-Fotos bluteten nur nach links aus: `.essay-figure` ist `width: 100%`, wodurch die Box überbestimmt ist und der negative rechte Margin verworfen wird. * Foto-Paare stellten beide Bilder gleich breit dar, wodurch ein Hochformat neben einem Querformat doppelt so hoch wurde. Jetzt eine Justified-Reihe: Breite proportional zum Seitenverhältnis, dadurch exakt gleiche Höhen ohne Beschnitt. * Die Lightbox hatte im Journal keine Tastatursteuerung und keine Scroll-Sperre — beides lag in PhotoGrid, also nur im Album-Raster. Verlagert in die Lightbox selbst, der doppelte Handler in PhotoGrid entfernt (sonst wäre pro Pfeildruck zwei Bilder weitergesprungen). Zusätzlich sind Proofing-Herzen und das EXIF-Panel im redaktionellen Modus abschaltbar und im Journal aus: Client-Proofing ist ein Übergabe-Workflow für Alben, keine Funktion einer Reportage. Auf der Übersicht wurde der Untertitel doppelt gerendert, weil extractExcerpt() auf ihn zurückfällt. * feat(admin): eigene URLs für alle Bereiche und überarbeiteter Journal Studio Das Panel war eine einzige Client-Komponente, die ihre Tabs über useState umschaltet: keine Route pro Bereich, kein Deep-Link, kein Zurück-Button, und nach jedem Reload landete man wieder auf "Pages". Auch der Journal-Editor hatte keine eigene URL. Jetzt sieben echte Routen (/admin, /admin/pages, /admin/journal, /admin/journal/<slug>, /admin/settings, /admin/settings/<section>, /admin/analytics). Die Shell mit Auth-Prüfung und Kopfzeile sitzt im Layout und umschließt children — so bleibt die Session-Prüfung über Routenwechsel montiert, statt bei jedem Tab-Wechsel neu zu laufen und den Spinner aufblitzen zu lassen. Unbekannte Settings-Sections fallen auf General zurück. Im selben Zug der Journal Studio, der die Routing-Änderung ohnehin berührt: * Alle Eingabefelder nutzten die Klasse `admin-input`, die in keinem CSS definiert war — sie fielen auf Browser-Defaults zurück. Jetzt gestylt, gescoped, damit der generische Name nicht ins übrige Panel leckt. * Der Split View ist per Divider verschiebbar (Maus, Tastatur, Doppelklick zum Zurücksetzen), Breite in localStorage. * Das Studio bricht aus der 1120px-Spalte aus, die Preview hat Platz. * Die Preview zeigte für jedes Foto fest 3:2 und log damit über das Layout der veröffentlichten Seite; die echten Verhältnisse werden jetzt an den Thumbnails gemessen. * Blöcke mit alten positionsbasierten Foto-Referenzen werden markiert — die lassen sich auf einer eigenständigen Journal-Seite nicht auflösen und verschwanden bisher stillschweigend. * Blocktyp-Chips als gemeinsame Komponente, monochrom und per Icon unterschieden statt in einer eigenen Blau/Lila/Orange-Palette, die sonst nirgends im Panel vorkommt. * Emojis raus, SVG-Icons rein. * fix(admin): Designsystem-Lücken im Panel schließen Eine systematische Suche nach Klassen, die im TSX benutzt, aber in keinem CSS definiert sind, hat vier Stellen mit demselben Muster gefunden: * `admin-btn-secondary` und `admin-btn-danger` existierten nicht. Sämtliche Löschen-Buttons sahen aus wie normale Buttons — keine Warnwirkung. Als `.admin-btn.admin-btn-danger` geschrieben, weil die Varianten mit den Größenklassen kombiniert werden, die weiter unten ihren eigenen Hintergrund setzen. * `page-progress-fill` fehlte: die Balken im Analytics-Panel waren leere Rinnen, der Wert unsichtbar. Ebenso `analytics-empty` und `admin-loading-container`. * `subpage-drawer-section`, `subpage-drawer-title-group` und `input-with-icon` im PageBuilder waren wirkungslos und teils mit Inline-Styles notdürftig kompensiert. * `grid-card-preview` fehlte, wodurch alle Layout-Vorschauen auf Höhe null kollabierten. Nur "Showcase" war sichtbar — und das aus Versehen, weil sein Tile `hero-tile` hieß und damit die `aspect-ratio` einer fremden PageBuilder-Klasse erbte. Umbenannt. Dazu die Theme-Vorschauen, die praktisch identisch aussahen: alle sieben zeigten dieselben drei quadratischen Kacheln, einziger Unterschied war die Hintergrundfarbe. Sie spiegeln jetzt die echten Preset-Daten aus lib/config/theme.ts — Schriftcharakter, Eckradius, Rasterdichte, Passepartout bzw. Schatten. Die Kopfzeile richtet sich an einer gemeinsamen Steuerhöhe aus. Der "Site"-Link war höher als die Buttons daneben: `.admin-btn` hatte keine explizite line-height, und <button> bekommt box-sizing: border-box vom Browser, <a> nicht. Die Statusanzeige setzte weder Schriftfamilie noch -größe und fiel auf den Browser-Default zurück — sie war nie Teil des Designsystems. Jetzt gleiche Höhe und Typografie, Pillenform als Zustandsanzeige, Trenner zur Aktionsgruppe. Das dauerhafte Pulsieren des grünen Punkts entfällt; Animation bleibt den Zuständen vorbehalten, die Aufmerksamkeit brauchen. Restliche Emojis durch SVG-Icons ersetzt. * feat(admin): add scroll-to-top toggle and SVG arrow The back-to-top button was always on and drew its arrow with the ↑ text character. Add a `scrollToTop` setting (General section in the admin panel, defaults to on so existing sites are unaffected) and replace the glyph with a stroked SVG that inherits currentColor across all presets. Scroll handling is now rAF-throttled, and prefers-reduced-motion turns off both the hover lift and the smooth scroll. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * security(journal): escape author HTML instead of filtering it CodeQL flags 26 high-severity alerts on the release PR; the bulk of them point at sanitizeHtml(), a denylist of three regexes whose output goes into dangerouslySetInnerHTML. I reproduced the bypasses before changing anything — all four pass the old filter: <img src=x onerror=alert(1)> unquoted handler, regex wants quotes <img src=x onerror='alert(1)'> single quotes, same reason <svg onload=alert(1)> not a <script> tag javasjavascript:cript:alert(1) one-pass replace, the rest recombines Plus an attribute breakout in the link renderer, which interpolated the URL into href="${url}" unescaped: [x](" onmouseover=alert(1) x=") -> <a href="" onmouseover=alert(1" ...> Replaced with escaping. Every `&<>"'` in author text becomes an entity before any markdown rule runs, so the only tags in the output are the ones renderInlineMarkdown builds itself and a URL cannot leave its attribute. Link schemes are now an allowlist (http, https, mailto, tel, relative, anchor); anything else renders as plain text. The serializer needed decodeHtmlEntities to match: without it a save would write `&lt;` into the Markdown file and the next parse would escape the `&` again, corrupting the text further on every round trip. A test covers parse -> serialize -> parse stability. Two existing tests asserted the old behaviour and were rewritten rather than deleted: one expected the script tag to be *removed* from the output, the other expected the substring "onerror" to be absent. Both now assert the property that matters — that no tag can form — because `onerror` surviving as inert text is fine. Exploitation required admin access either way: journal and essay text comes from the studio or from content/*.md. This removes the weakness, it does not close an open door. * fix(journal): contain file paths, fix frontmatter escaping, defuse two regexes Follow-up to the CodeQL findings on release PR #432. I went through all 23 alerts individually; this addresses the ones that are worth addressing and documents the ones that are not. Path containment (12 alerts, all false positives). Every path built from a slug goes through isValidSlug(), a strict `/^[a-zA-Z0-9_-]+$/` allowlist — verified against `../../etc/passwd`, `foo/../../bar`, `a/b`, `..` and friends, all rejected. CodeQL cannot see it because the check lives in another module. Added a containedPath() helper that resolves the path and refuses anything landing outside the content directory: a second lock on a door that was already locked, and a barrier the analysis can follow. Also removed the dead `slug.endsWith('.md')` branches — isValidSlug rejects dots, so they could never be taken. Frontmatter escaping (1 alert, a real bug). The serializer escaped `"` but not `\`, and the parser never unescaped anything. A title containing either character gained a backslash on every save/load cycle: Path C:\Users "quoted" -> Path C:\\Users \"quoted\" -> ... Escaping now covers the backslash first and the parser undoes both. A round trip test covers quotes, backslashes, colons and apostrophes. Two of three ReDoS regexes (2 alerts). The heading pattern had `\s+` next to `(.+)`, which overlap, so the engine tried every split of the whitespace run before failing; it is `[ \t]+` and `(\S.*)` now. The quote author pattern wrapped a lazy group around an optional group — the quadratic case — and is an index split on the first separator now. The third regex, the bold/italic pass, is deliberately left alone. Rewriting it with a negated class removes the backtracking but breaks nesting: `**bold *and italic* here**` renders as `*<em>bold </em>and italic<em> here</em>*`. The input is Markdown from an authenticated admin, never a visitor, so the worst case is an author slowing down their own page. The comment in the code says so. Not addressed: 5 js/insufficient-password-hash alerts. They ask for a slow KDF where the code uses SHA-256/HMAC — correct in general, but the admin password comes from an environment variable and is never stored, so a stronger KDF protects nothing that is not already in plaintext in the environment. 399 unit tests pass (18 new), build and tsc clean. * fix(journal): split the quote author by scanning, not by pattern Cleaning up after myself. #439 replaced the quote author regex `/^(.*?)(?:\s+--\s+(.+))?$/` — a lazy group around an optional one, the quadratic case — with `/\s+--\s+/`, and CodeQL promptly flagged the replacement for the same reason. One reported pattern traded for another. splitQuoteAuthor() scans for the first `--` that has whitespace on both sides. Linear, and it needs no reasoning about the regex engine at all. Behaviour is identical to the original regex, checked case by case against it: separator, no separator, several separators, tabs, wide gaps, `a--b` without spaces, leading and trailing separators, empty string. All nine are covered by tests, plus one asserting it stays fast on a 50k whitespace run. * security(admin): derive the session signing key with scrypt getSigningKey() ran the admin password through a single SHA-256 digest. It is key derivation rather than password storage, so it was never a stored-hash problem — but if the derived key ever leaked, one fast hash makes recovering the password by brute force cheap. CodeQL flags it as js/insufficient-password-hash and, for this particular alert, has a point. scrypt now. Two details that matter: The salt has to be stable. A random salt would produce a different key on every call and invalidate every session; it is derived from AUTH_SECRET, which is deployment-specific. Verified across separate processes: same inputs produce a verifying token, so a restart or redeploy does not log everyone out. The result is cached for the process lifetime. scrypt is deliberately slow and getSigningKey() runs on every admin request — deriving per call would add ~24ms to each one. The cache key is a digest of secret plus password, so a rotation misses the cache and derives again, and no extra plaintext copy of the password is kept around. Measured: first derivation 24ms, subsequent calls 0.12ms. Password change and secret change both invalidate an existing token, checked in separate processes. Note the one-time effect: existing admin sessions are invalidated by the change in derivation, so everyone logs in once more. * security(admin): key the signing-key cache on its inputs, not a digest #441 removed the SHA-256 digest of the admin password from the key derivation and introduced a new one three lines above it, as the cache key. Same rule, same file: CodeQL reported it immediately. The comment justifying it was wrong too. It claimed no second plaintext copy of the password was retained, while building the digest input allocates exactly that in order to hash it. The cache now holds the two input strings and compares them directly. They are the same objects the env and install caches already hold, so nothing extra is retained, and no fast hash of the password exists in memory for the life of the process. Re-verified after the change, in separate processes: a token from one process verifies in another with the same inputs, a changed password or secret rejects it, first derivation 24ms, cached calls 0.001ms. That leaves scrypt as the only place the password is hashed here. The two HMACs further down operate on the derived key and on token data, not on the password; the constant-time comparison in verifyAdminPassword is the previously dismissed one. --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
2026-08-14 16:55:07 +02:00
max-width: 620px;
feat: redesign album drawer into a gorgeous centered two-column modal (#243) Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-05-31 21:30:00 +02:00
max-height: 90vh;
feat: redesign admin pagebuilder with slide-over drawers and svg icons (#242) Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-05-31 21:27:13 +02:00
background: var(--admin-bg-raised);
feat: redesign album drawer into a gorgeous centered two-column modal (#243) Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-05-31 21:30:00 +02:00
border: 1px solid var(--admin-border);
border-radius: 16px;
box-shadow: 0 20px 50px rgba(0, 0, 0, 0.4);
feat: redesign admin pagebuilder with slide-over drawers and svg icons (#242) Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-05-31 21:27:13 +02:00
display: flex;
flex-direction: column;
feat: redesign album drawer into a gorgeous centered two-column modal (#243) Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-05-31 21:30:00 +02:00
overflow: hidden;
transform: scale(0.95) translateY(10px);
transition: transform 0.25s cubic-bezier(0.16, 1, 0.3, 1);
feat: redesign admin pagebuilder with slide-over drawers and svg icons (#242) Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-05-31 21:27:13 +02:00
}
.album-drawer-overlay.open .album-drawer {
feat: redesign album drawer into a gorgeous centered two-column modal (#243) Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-05-31 21:30:00 +02:00
transform: scale(1) translateY(0);
feat: redesign admin pagebuilder with slide-over drawers and svg icons (#242) Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-05-31 21:27:13 +02:00
}
.album-drawer-header {
padding: 1.25rem 1.5rem;
border-bottom: 1px solid var(--admin-border);
display: flex;
align-items: center;
justify-content: space-between;
background: var(--admin-bg-elevated);
}
.album-drawer-header h3 {
feat: redesign album drawer into a gorgeous centered two-column modal (#243) Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-05-31 21:30:00 +02:00
font-size: 1.15rem;
feat: redesign admin pagebuilder with slide-over drawers and svg icons (#242) Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-05-31 21:27:13 +02:00
font-weight: 700;
margin: 0;
display: flex;
align-items: center;
gap: 0.5rem;
}
release: v0.11.0 — journal fixes, admin URLs, design system cleanup (#432) * fix(screenshots): sharp-Typen fuer 0.34 und 0.35 gleichzeitig (#410) sharp 0.35 ist von `export =` auf ESM umgestellt: der Modul-Namespace ist nicht mehr aufrufbar, die Factory sitzt unter .default. Der Type-Check brach damit in scripts/screenshots.ts weg, sobald der Next-Bump (#402) sharp von 0.34.5 auf 0.35.3 mitzieht -- sharp ist hier keine deklarierte Dependency, sondern kommt ueber Next mit. Die Form wird jetzt aus dem installierten Paket abgeleitet statt festgeschrieben, zur Laufzeit wie im Typ. Geprueft mit beiden Versionen: tsc laeuft mit 0.34.5 und mit 0.35.3 fehlerfrei durch. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(deps): bump the nextjs group across 1 directory with 2 updates (#402) Bumps the nextjs group with 2 updates in the / directory: [next](https://github.com/vercel/next.js) and [eslint-config-next](https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next). Updates `next` from 16.2.12 to 16.3.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/compare/v16.2.12...v16.3.0) Updates `eslint-config-next` from 16.2.12 to 16.3.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/commits/v16.3.0/packages/eslint-config-next) --- updated-dependencies: - dependency-name: eslint-config-next dependency-version: 16.3.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: nextjs - dependency-name: next dependency-version: 16.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nextjs ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps-dev): bump prettier from 3.8.3 to 3.9.6 (#405) Bumps [prettier](https://github.com/prettier/prettier) from 3.8.3 to 3.9.6. - [Release notes](https://github.com/prettier/prettier/releases) - [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md) - [Commits](https://github.com/prettier/prettier/compare/3.8.3...3.9.6) --- updated-dependencies: - dependency-name: prettier dependency-version: 3.9.6 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * docs(changelog): Unreleased-Sektion fuer die Bumps nach v0.10.0 (#413) Die Dependency-PRs sind nach dem Release auf dev gelandet, teils auch auf main. Ohne Eintrag waeren sie beim naechsten Release unsichtbar -- inklusive Next 16.3.0, das CVE-2025-13465 mitbringt. Ausserdem im 0.10.0-Abschnitt nachgetragen, dass der Trivy-Scan bis #409 nie gelaufen ist. Der Fix steckt im Tag v0.10.0, fehlte aber in der Aufzaehlung -- und "Images werden bei jedem Publish gescannt" stand im Changelog, waehrend der Job im Action-Setup abbrach. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(gallery): per-album sort order, independent of Immich (#408) (#414) Album order was dictated entirely by Immich: getAlbum() sorted by the album's own asc/desc flag, so a Folio album always mirrored the archive. A curated series has a narrative order that has nothing to do with capture time, and changing the Immich album's sort to fit the website changes it for the archive too. Adds an optional per-album `sort` in gallery.yaml, editable in /admin, defaulting to today's behaviour so every existing config is unchanged: immich (default) | newest | oldest | filename | manual `manual` is a pinned *prefix*: `assetOrder` lists only the photos placed by hand, everything else follows in the album's Immich order. A full permutation of a 2,000-photo album would be ~80 KB of UUIDs in a file that is rewritten and copied to content/.backups/ on every admin save. It also makes drift fall out for free — photos removed in Immich never match, new ones land in the tail rather than being hidden. Sorting is applied after the cache read, not before the cache write, so the LRU keeps one canonical Immich-ordered copy per album. That avoids putting the mode in the cache key, lets a config change take effect without depending on invalidation, and keeps the stale-serving path correct. cache.get() returns the stored object by reference, so withSort() returns a shallow clone with a new array — sorting in place would reorder the shared entry, and under request coalescing every concurrent caller would be sorting the same array. Also fixes a prerequisite bug: /api/admin/albums/[albumId]/assets read album.assets from GET /albums/:id, which Immich 3.x no longer populates (lib/immich.ts:507). The hero picker's "This Album" tab returned nothing and threw outright when the key was absent. It now goes through the client's paginated metadata search, with ?types=all to opt videos in for the reorder editor. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): drop decorative emoji from the sort select labels (#415) An <option> cannot contain markup, so the SVG set in Icons is not reachable there — but a decorative emoji is not a substitute for it. Plain text instead; the album card badge already uses a real icon. The remaining emoji in the admin panel (asset picker tabs, section headings, layout picker options) predate this branch and are left for a separate cleanup. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): replace emoji icons with the shared SVG icon set (#416) The admin panel mixed two icon conventions: inline SVGs from `Icons.tsx` in most components, and decorative emoji in the asset picker and a few PageBuilder labels. Emoji render inconsistently across platforms, ignore the accent colour, and cannot inherit the `.svg-icon` sizing rules. - Icons.tsx: add `IconStar` (filled — it marks a state, not an action) and `IconImage`. - AssetPicker: the three tab labels and the favourite tile badge now use IconFolder / IconStar / IconImage. - PageBuilder: the "Standalone Albums" and "Subpages" headings use the icon set instead of an emoji. - PageBuilder: the layout picker drops its emoji for plain text. An <option> cannot contain markup, so an SVG is impossible there and a decorative glyph is not a substitute. - admin.css: align icon and label in the picker tabs, and swap the favourite badge's text-shadow for drop-shadow, which is what applies to an inline SVG. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): fold PageBuilder's local icons into the shared Icons module (#418) * refactor(admin): fold PageBuilder's local icons into the shared module PageBuilder.tsx carried its own `Icons` object duplicating most of the glyphs already exported by Icons.tsx, with hardcoded sizes and slightly divergent paths. Migrate all 32 call sites to the shared module and delete the local object. Five glyphs had no counterpart and are added to Icons.tsx as 1:1 ports of the local paths: IconX, IconPlus, IconHome, IconCopy, IconImage. The local ExternalLink and Check are dropped rather than ported — both had zero call sites. Two glyphs change shape slightly, which is the point of consolidating: the shared IconCamera includes the viewfinder bump the local copy omitted, and drag handles now use IconGripVertical. IconGripVertical uses the module's square 24x24 viewBox, so `.svg-drag` goes from 12x18 to 18x18 — the old non-square box would letterbox the glyph down to 12x12 and shrink the handle. * fix(admin): resolve icon-module integration after #416 Merging dev brought in #416, which added a second IconImage to Icons.tsx and two <Icons.Camera>/<Icons.Folder> section headers that reference the local Icons object this PR removes. Git merged both cleanly but the result did not type-check. - drop the duplicate IconImage (both copies were byte-identical) - point the two section headers at the imported IconCamera/IconFolder - refresh the SORT_LABELS comment: the icon set is imported now, not declared below --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> * fix(config): allow an empty gallery, guard against a double /api suffix (#421) An empty gallery is now a valid, rendered state instead of a throw: deriveGallery() no longer requires at least one album or subpage, so a deployment with no albums yet renders a bare homepage the owner can fill in via /admin. getConfig() also stops appending /api to an Immich URL that already ends in it, which previously produced .../api/api and broke every upstream request. Includes a restore of the per-album sort test cases, which the branch had lost by being cut before #408/#414. * feat(admin): favicon upload, served from the content volume (#422) Adds a bundled default favicon, an upload widget in admin Settings > General, and a route that serves the icon from the writable content/ volume with a fallback to the bundled default. Raster uploads (PNG/ICO/JPEG) are wrapped in an SVG container; the response carries its own CSP so an uploaded SVG cannot execute script on the origin. The GET route revalidates with an ETag instead of caching immutably, so a newly uploaded icon shows up immediately. Uploads are written via temp file + rename, and a Reset button restores the bundled default. * ci: flag unformatted files in a PR, without blocking it (#424) Prettier is configured as an error rule in eslint.config.mjs but has never run in CI, so part of the tree predates it. A final CI step now diffs against the PR base, runs prettier --list-different over the changed files, and emits a warning annotation per offender plus a job summary. Advisory by design: it never fails the job. Blocking would turn a PR red for merely touching a file that was already unformatted, and normalising the tree in one commit would wreck git blame and conflict with the PRs in flight. Requires fetch-depth: 0, since diffing against the base needs its history. * feat(install): first-run wizard gated by a one-time setup token (#419) Adds /install, a four-step first-run wizard: connect to Immich, optionally pick albums, name the site, finish. It verifies the credentials against the Immich server before writing anything, then writes gallery.yaml, settings.yaml and a content/install.json carrying the Immich credentials and a generated site secret. install.json exists because a running process cannot pick up new env vars — the wizard has to write configuration that takes effect without a restart. getInstallCredentials() merges it under the real environment, so env vars always win and rotation stays a matter of setting one. Both the page and the API routes are gated by a one-time setup token printed to the server log, so a deployment that is reachable before gallery.yaml exists cannot be configured by whoever finds it first. The token is stored in content/.setup-token (0600) rather than a module variable: Next.js bundles the page and each route handler separately, so a module-level token left the page and the API disagreeing inside one process and the wizard stuck on step 1. It is removed once the install completes. The admin password is stored as an scrypt hash using the scheme lib/auth.ts already applies to album passwords; a plaintext ADMIN_PASSWORD env var keeps working. * docs: document the setup wizard, fix the read-only content mount (#425) Quick Start now leads with the /install wizard, with the hand-written YAML route kept alongside it, and a First-Run Setup section covers the setup token, the files the wizard writes, and env-var precedence. Two corrections: both Docker examples mounted content/ as :ro, which silently breaks the wizard, the admin panel and the backup rotation alike — docs/admin-panel.md already said so and the README contradicted it. And nothing documented that content/install.json holds the Immich API key, so a backup of content/ is a backup of credentials. Also adds a Contributors section crediting the people whose work is in the project. * feat(admin): floating save bar pinned to the bottom of the viewport (#426) The save bar was the first, static element inside .admin-main. Since the document itself scrolls, it left the viewport as soon as you scrolled down — editing a subpage section or a settings block far below gave no visible dirty hint and no reachable save button. Replace it with a bottom-pinned floating bar shared by both editors. It only mounts while there is something to act on (unsaved changes, an in-flight save, or a result message), so it never covers content while idle. The success message clears after 5s, which hides the bar again. - new SaveBar component, replacing the duplicated markup in PageBuilder and SettingsEditor - adopt the previously unused .floating-save-bar CSS: slide-in keyframes (carrying translateX(-50%)), dirty border, wrap/gap, mobile variant and a prefers-reduced-motion opt-out; z-index 900 keeps it below modals - .admin-main gains bottom padding so the bar never covers page content - drop the now-unreachable idle hints: the ⌘S hint becomes a button title, the Live Sync note becomes a static line above the settings layout - header "Site" link now bypasses the cache (/?fresh=1), so the preview stays reachable when the bar is hidden Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(admin): themed listbox for the album sort control (#427) The per-album "Photo order" control was a native <select>. Because an <option> cannot contain markup, its choices could not use the admin panel's currentColor SVG set — the reason #415 had to fall back to plain text after dropping the emoji labels. Adds a Listbox component implementing the ARIA combobox/listbox pattern, so options can render a glyph beside their label: - DOM focus stays on the trigger button; the active option is announced through aria-activedescendant, keeping focus management to one element - Keyboard: arrows (clamped at the ends, like a native select), Home/End, Enter/Space to commit, Escape to cancel, Tab commits and moves on, and prefix type-ahead with a repeat-key cycle - Outside dismissal on pointerdown, so a press starting outside closes the popup before the click retargets The sort options now carry an icon each: calendar, arrow-down, arrow-up, an A→Z marker, and the drag glyph for manual — matching the badge the album card already shows. SORT_LABELS stays plain text because the badge feeds it to a title attribute. Closes #417 Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(git): ignore generated design handoff folders * fix(admin): stop the album sort dropdown clipping, and simplify the panel (#428) * fix(admin): render listbox popup in a portal so it escapes modal clipping The sort control's popup was position:absolute inside three clipping ancestors (.album-drawer overflow:hidden > .album-drawer-body overflow-y:auto > .modal-right-column overflow-y:auto), so it was cut off at the bottom of the Edit Album Details modal. z-index could not help: clipping happens before stacking. It also always hung below the trigger, with no flip. Portal the popup to document.body and position it from the trigger's viewport rect, flipping above when there is more room there and capping max-height to the space available so it scrolls internally rather than overflowing. It is dismissed on scroll and resize, since the anchor is only measured on open. The outside-pointerdown handler now also treats the popup as inside; without that the portalled list counts as outside, and a click on an option would close it before the selection commits. * refactor(admin): single-column album details panel The left column spent 1.2fr on a cover thumbnail and three stat rows, two of which (Status, Custom Hero) only restated the form fields opposite them, while the form itself was squeezed into 1.8fr behind a second nested scroller. Stack the drawer in one column instead: cover as a banner, then the form at full width, with the UUID moved into the footer. The body is now the only scroll container, which also removes one of the ancestors that was clipping the sort popup. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> * fix(admin): give the portalled listbox its theme back, lock the page behind modals (#429) Two defects in the album editor. The sort listbox popup painted transparent. Every --admin-* variable is scoped to .admin-layout, and since the popup moved into document.body it sits outside that subtree, so background/border/text all resolved to nothing. It now carries its own copy of the palette in both colour schemes, plus the font it no longer inherits. Scrolling inside a modal also moved the page behind it. No admin modal ever locked body scroll: the overlay covers the page but does not absorb wheel events, so a scroll starting on the backdrop — or continuing past the end of the modal's own scroller — reaches the document. overscroll-behavior cannot cover that case on its own, because it only applies to scroll containers and the backdrop is not one. useScrollLock freezes body while a modal is open and compensates for the width the scrollbar gives up, so nothing shifts underneath. Each lock restores the inline value it found, which makes nesting work without a counter — a picker opened from the drawer restores the drawer's hidden state instead of clearing it. Applied to both drawers and all four picker modals, which share the defect. overscroll-behavior: contain on the scrollers stops the chaining they can handle themselves. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com> * fix(security): allow unsafe-eval in CSP script-src during dev mode * feat(journal): add Journal Studio with split-screen editor, live preview and dedicated routes * fix(build): separate client parser from server journal-service and fix build type errors * fix(journal): Fotos rendern, Layout und Lightbox-Steuerung korrigieren Fünf unabhängige Fehler in der öffentlichen Journal- und Essay-Ansicht: * Foto-Blöcke wurden nie angezeigt. EssayView löst ein Foto über PhotoItem.id auf, und das sind verschlüsselte Tokens — die Blöcke aus dem Markdown tragen aber rohe Asset-UUIDs. Jede Zuordnung lief ins Leere, und nicht auflösbare Blöcke werden still verworfen. Die IDs werden jetzt serverseitig übersetzt; damit verschwinden nebenbei die rohen UUIDs aus dem Client-Payload, die dort laut Projektregel nie auftauchen dürfen. Nicht auflösbare Referenzen werden geloggt. * Überschriften standen weiter links als der Fließtext. Jeder Block hatte einzeln `max-width: 68ch`, und `ch` ist relativ zur Schrift des Elements — die Serif-Überschrift ergab eine breitere Spalte. Ersetzt durch eine gemeinsame, font-unabhängige `--essay-measure`. * Fullbleed-Fotos bluteten nur nach links aus: `.essay-figure` ist `width: 100%`, wodurch die Box überbestimmt ist und der negative rechte Margin verworfen wird. * Foto-Paare stellten beide Bilder gleich breit dar, wodurch ein Hochformat neben einem Querformat doppelt so hoch wurde. Jetzt eine Justified-Reihe: Breite proportional zum Seitenverhältnis, dadurch exakt gleiche Höhen ohne Beschnitt. * Die Lightbox hatte im Journal keine Tastatursteuerung und keine Scroll-Sperre — beides lag in PhotoGrid, also nur im Album-Raster. Verlagert in die Lightbox selbst, der doppelte Handler in PhotoGrid entfernt (sonst wäre pro Pfeildruck zwei Bilder weitergesprungen). Zusätzlich sind Proofing-Herzen und das EXIF-Panel im redaktionellen Modus abschaltbar und im Journal aus: Client-Proofing ist ein Übergabe-Workflow für Alben, keine Funktion einer Reportage. Auf der Übersicht wurde der Untertitel doppelt gerendert, weil extractExcerpt() auf ihn zurückfällt. * feat(admin): eigene URLs für alle Bereiche und überarbeiteter Journal Studio Das Panel war eine einzige Client-Komponente, die ihre Tabs über useState umschaltet: keine Route pro Bereich, kein Deep-Link, kein Zurück-Button, und nach jedem Reload landete man wieder auf "Pages". Auch der Journal-Editor hatte keine eigene URL. Jetzt sieben echte Routen (/admin, /admin/pages, /admin/journal, /admin/journal/<slug>, /admin/settings, /admin/settings/<section>, /admin/analytics). Die Shell mit Auth-Prüfung und Kopfzeile sitzt im Layout und umschließt children — so bleibt die Session-Prüfung über Routenwechsel montiert, statt bei jedem Tab-Wechsel neu zu laufen und den Spinner aufblitzen zu lassen. Unbekannte Settings-Sections fallen auf General zurück. Im selben Zug der Journal Studio, der die Routing-Änderung ohnehin berührt: * Alle Eingabefelder nutzten die Klasse `admin-input`, die in keinem CSS definiert war — sie fielen auf Browser-Defaults zurück. Jetzt gestylt, gescoped, damit der generische Name nicht ins übrige Panel leckt. * Der Split View ist per Divider verschiebbar (Maus, Tastatur, Doppelklick zum Zurücksetzen), Breite in localStorage. * Das Studio bricht aus der 1120px-Spalte aus, die Preview hat Platz. * Die Preview zeigte für jedes Foto fest 3:2 und log damit über das Layout der veröffentlichten Seite; die echten Verhältnisse werden jetzt an den Thumbnails gemessen. * Blöcke mit alten positionsbasierten Foto-Referenzen werden markiert — die lassen sich auf einer eigenständigen Journal-Seite nicht auflösen und verschwanden bisher stillschweigend. * Blocktyp-Chips als gemeinsame Komponente, monochrom und per Icon unterschieden statt in einer eigenen Blau/Lila/Orange-Palette, die sonst nirgends im Panel vorkommt. * Emojis raus, SVG-Icons rein. * fix(admin): Designsystem-Lücken im Panel schließen Eine systematische Suche nach Klassen, die im TSX benutzt, aber in keinem CSS definiert sind, hat vier Stellen mit demselben Muster gefunden: * `admin-btn-secondary` und `admin-btn-danger` existierten nicht. Sämtliche Löschen-Buttons sahen aus wie normale Buttons — keine Warnwirkung. Als `.admin-btn.admin-btn-danger` geschrieben, weil die Varianten mit den Größenklassen kombiniert werden, die weiter unten ihren eigenen Hintergrund setzen. * `page-progress-fill` fehlte: die Balken im Analytics-Panel waren leere Rinnen, der Wert unsichtbar. Ebenso `analytics-empty` und `admin-loading-container`. * `subpage-drawer-section`, `subpage-drawer-title-group` und `input-with-icon` im PageBuilder waren wirkungslos und teils mit Inline-Styles notdürftig kompensiert. * `grid-card-preview` fehlte, wodurch alle Layout-Vorschauen auf Höhe null kollabierten. Nur "Showcase" war sichtbar — und das aus Versehen, weil sein Tile `hero-tile` hieß und damit die `aspect-ratio` einer fremden PageBuilder-Klasse erbte. Umbenannt. Dazu die Theme-Vorschauen, die praktisch identisch aussahen: alle sieben zeigten dieselben drei quadratischen Kacheln, einziger Unterschied war die Hintergrundfarbe. Sie spiegeln jetzt die echten Preset-Daten aus lib/config/theme.ts — Schriftcharakter, Eckradius, Rasterdichte, Passepartout bzw. Schatten. Die Kopfzeile richtet sich an einer gemeinsamen Steuerhöhe aus. Der "Site"-Link war höher als die Buttons daneben: `.admin-btn` hatte keine explizite line-height, und <button> bekommt box-sizing: border-box vom Browser, <a> nicht. Die Statusanzeige setzte weder Schriftfamilie noch -größe und fiel auf den Browser-Default zurück — sie war nie Teil des Designsystems. Jetzt gleiche Höhe und Typografie, Pillenform als Zustandsanzeige, Trenner zur Aktionsgruppe. Das dauerhafte Pulsieren des grünen Punkts entfällt; Animation bleibt den Zuständen vorbehalten, die Aufmerksamkeit brauchen. Restliche Emojis durch SVG-Icons ersetzt. * feat(admin): add scroll-to-top toggle and SVG arrow The back-to-top button was always on and drew its arrow with the ↑ text character. Add a `scrollToTop` setting (General section in the admin panel, defaults to on so existing sites are unaffected) and replace the glyph with a stroked SVG that inherits currentColor across all presets. Scroll handling is now rAF-throttled, and prefers-reduced-motion turns off both the hover lift and the smooth scroll. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * security(journal): escape author HTML instead of filtering it CodeQL flags 26 high-severity alerts on the release PR; the bulk of them point at sanitizeHtml(), a denylist of three regexes whose output goes into dangerouslySetInnerHTML. I reproduced the bypasses before changing anything — all four pass the old filter: <img src=x onerror=alert(1)> unquoted handler, regex wants quotes <img src=x onerror='alert(1)'> single quotes, same reason <svg onload=alert(1)> not a <script> tag javasjavascript:cript:alert(1) one-pass replace, the rest recombines Plus an attribute breakout in the link renderer, which interpolated the URL into href="${url}" unescaped: [x](" onmouseover=alert(1) x=") -> <a href="" onmouseover=alert(1" ...> Replaced with escaping. Every `&<>"'` in author text becomes an entity before any markdown rule runs, so the only tags in the output are the ones renderInlineMarkdown builds itself and a URL cannot leave its attribute. Link schemes are now an allowlist (http, https, mailto, tel, relative, anchor); anything else renders as plain text. The serializer needed decodeHtmlEntities to match: without it a save would write `&lt;` into the Markdown file and the next parse would escape the `&` again, corrupting the text further on every round trip. A test covers parse -> serialize -> parse stability. Two existing tests asserted the old behaviour and were rewritten rather than deleted: one expected the script tag to be *removed* from the output, the other expected the substring "onerror" to be absent. Both now assert the property that matters — that no tag can form — because `onerror` surviving as inert text is fine. Exploitation required admin access either way: journal and essay text comes from the studio or from content/*.md. This removes the weakness, it does not close an open door. * fix(journal): contain file paths, fix frontmatter escaping, defuse two regexes Follow-up to the CodeQL findings on release PR #432. I went through all 23 alerts individually; this addresses the ones that are worth addressing and documents the ones that are not. Path containment (12 alerts, all false positives). Every path built from a slug goes through isValidSlug(), a strict `/^[a-zA-Z0-9_-]+$/` allowlist — verified against `../../etc/passwd`, `foo/../../bar`, `a/b`, `..` and friends, all rejected. CodeQL cannot see it because the check lives in another module. Added a containedPath() helper that resolves the path and refuses anything landing outside the content directory: a second lock on a door that was already locked, and a barrier the analysis can follow. Also removed the dead `slug.endsWith('.md')` branches — isValidSlug rejects dots, so they could never be taken. Frontmatter escaping (1 alert, a real bug). The serializer escaped `"` but not `\`, and the parser never unescaped anything. A title containing either character gained a backslash on every save/load cycle: Path C:\Users "quoted" -> Path C:\\Users \"quoted\" -> ... Escaping now covers the backslash first and the parser undoes both. A round trip test covers quotes, backslashes, colons and apostrophes. Two of three ReDoS regexes (2 alerts). The heading pattern had `\s+` next to `(.+)`, which overlap, so the engine tried every split of the whitespace run before failing; it is `[ \t]+` and `(\S.*)` now. The quote author pattern wrapped a lazy group around an optional group — the quadratic case — and is an index split on the first separator now. The third regex, the bold/italic pass, is deliberately left alone. Rewriting it with a negated class removes the backtracking but breaks nesting: `**bold *and italic* here**` renders as `*<em>bold </em>and italic<em> here</em>*`. The input is Markdown from an authenticated admin, never a visitor, so the worst case is an author slowing down their own page. The comment in the code says so. Not addressed: 5 js/insufficient-password-hash alerts. They ask for a slow KDF where the code uses SHA-256/HMAC — correct in general, but the admin password comes from an environment variable and is never stored, so a stronger KDF protects nothing that is not already in plaintext in the environment. 399 unit tests pass (18 new), build and tsc clean. * fix(journal): split the quote author by scanning, not by pattern Cleaning up after myself. #439 replaced the quote author regex `/^(.*?)(?:\s+--\s+(.+))?$/` — a lazy group around an optional one, the quadratic case — with `/\s+--\s+/`, and CodeQL promptly flagged the replacement for the same reason. One reported pattern traded for another. splitQuoteAuthor() scans for the first `--` that has whitespace on both sides. Linear, and it needs no reasoning about the regex engine at all. Behaviour is identical to the original regex, checked case by case against it: separator, no separator, several separators, tabs, wide gaps, `a--b` without spaces, leading and trailing separators, empty string. All nine are covered by tests, plus one asserting it stays fast on a 50k whitespace run. * security(admin): derive the session signing key with scrypt getSigningKey() ran the admin password through a single SHA-256 digest. It is key derivation rather than password storage, so it was never a stored-hash problem — but if the derived key ever leaked, one fast hash makes recovering the password by brute force cheap. CodeQL flags it as js/insufficient-password-hash and, for this particular alert, has a point. scrypt now. Two details that matter: The salt has to be stable. A random salt would produce a different key on every call and invalidate every session; it is derived from AUTH_SECRET, which is deployment-specific. Verified across separate processes: same inputs produce a verifying token, so a restart or redeploy does not log everyone out. The result is cached for the process lifetime. scrypt is deliberately slow and getSigningKey() runs on every admin request — deriving per call would add ~24ms to each one. The cache key is a digest of secret plus password, so a rotation misses the cache and derives again, and no extra plaintext copy of the password is kept around. Measured: first derivation 24ms, subsequent calls 0.12ms. Password change and secret change both invalidate an existing token, checked in separate processes. Note the one-time effect: existing admin sessions are invalidated by the change in derivation, so everyone logs in once more. * security(admin): key the signing-key cache on its inputs, not a digest #441 removed the SHA-256 digest of the admin password from the key derivation and introduced a new one three lines above it, as the cache key. Same rule, same file: CodeQL reported it immediately. The comment justifying it was wrong too. It claimed no second plaintext copy of the password was retained, while building the digest input allocates exactly that in order to hash it. The cache now holds the two input strings and compares them directly. They are the same objects the env and install caches already hold, so nothing extra is retained, and no fast hash of the password exists in memory for the life of the process. Re-verified after the change, in separate processes: a token from one process verifies in another with the same inputs, a changed password or secret rejects it, first derivation 24ms, cached calls 0.001ms. That leaves scrypt as the only place the password is hashed here. The two HMACs further down operate on the derived key and on token data, not on the password; the constant-time comparison in verifyAdminPassword is the previously dismissed one. --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
2026-08-14 16:55:07 +02:00
/* Single-column body — and the drawer's only scroll container. Nesting a second
scroller here is what used to clip the sort listbox popup. */
feat: redesign admin pagebuilder with slide-over drawers and svg icons (#242) Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-05-31 21:27:13 +02:00
.album-drawer-body {
flex: 1;
feat: redesign album drawer into a gorgeous centered two-column modal (#243) Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-05-31 21:30:00 +02:00
min-height: 0;
release: v0.11.0 — journal fixes, admin URLs, design system cleanup (#432) * fix(screenshots): sharp-Typen fuer 0.34 und 0.35 gleichzeitig (#410) sharp 0.35 ist von `export =` auf ESM umgestellt: der Modul-Namespace ist nicht mehr aufrufbar, die Factory sitzt unter .default. Der Type-Check brach damit in scripts/screenshots.ts weg, sobald der Next-Bump (#402) sharp von 0.34.5 auf 0.35.3 mitzieht -- sharp ist hier keine deklarierte Dependency, sondern kommt ueber Next mit. Die Form wird jetzt aus dem installierten Paket abgeleitet statt festgeschrieben, zur Laufzeit wie im Typ. Geprueft mit beiden Versionen: tsc laeuft mit 0.34.5 und mit 0.35.3 fehlerfrei durch. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(deps): bump the nextjs group across 1 directory with 2 updates (#402) Bumps the nextjs group with 2 updates in the / directory: [next](https://github.com/vercel/next.js) and [eslint-config-next](https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next). Updates `next` from 16.2.12 to 16.3.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/compare/v16.2.12...v16.3.0) Updates `eslint-config-next` from 16.2.12 to 16.3.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/commits/v16.3.0/packages/eslint-config-next) --- updated-dependencies: - dependency-name: eslint-config-next dependency-version: 16.3.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: nextjs - dependency-name: next dependency-version: 16.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nextjs ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps-dev): bump prettier from 3.8.3 to 3.9.6 (#405) Bumps [prettier](https://github.com/prettier/prettier) from 3.8.3 to 3.9.6. - [Release notes](https://github.com/prettier/prettier/releases) - [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md) - [Commits](https://github.com/prettier/prettier/compare/3.8.3...3.9.6) --- updated-dependencies: - dependency-name: prettier dependency-version: 3.9.6 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * docs(changelog): Unreleased-Sektion fuer die Bumps nach v0.10.0 (#413) Die Dependency-PRs sind nach dem Release auf dev gelandet, teils auch auf main. Ohne Eintrag waeren sie beim naechsten Release unsichtbar -- inklusive Next 16.3.0, das CVE-2025-13465 mitbringt. Ausserdem im 0.10.0-Abschnitt nachgetragen, dass der Trivy-Scan bis #409 nie gelaufen ist. Der Fix steckt im Tag v0.10.0, fehlte aber in der Aufzaehlung -- und "Images werden bei jedem Publish gescannt" stand im Changelog, waehrend der Job im Action-Setup abbrach. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(gallery): per-album sort order, independent of Immich (#408) (#414) Album order was dictated entirely by Immich: getAlbum() sorted by the album's own asc/desc flag, so a Folio album always mirrored the archive. A curated series has a narrative order that has nothing to do with capture time, and changing the Immich album's sort to fit the website changes it for the archive too. Adds an optional per-album `sort` in gallery.yaml, editable in /admin, defaulting to today's behaviour so every existing config is unchanged: immich (default) | newest | oldest | filename | manual `manual` is a pinned *prefix*: `assetOrder` lists only the photos placed by hand, everything else follows in the album's Immich order. A full permutation of a 2,000-photo album would be ~80 KB of UUIDs in a file that is rewritten and copied to content/.backups/ on every admin save. It also makes drift fall out for free — photos removed in Immich never match, new ones land in the tail rather than being hidden. Sorting is applied after the cache read, not before the cache write, so the LRU keeps one canonical Immich-ordered copy per album. That avoids putting the mode in the cache key, lets a config change take effect without depending on invalidation, and keeps the stale-serving path correct. cache.get() returns the stored object by reference, so withSort() returns a shallow clone with a new array — sorting in place would reorder the shared entry, and under request coalescing every concurrent caller would be sorting the same array. Also fixes a prerequisite bug: /api/admin/albums/[albumId]/assets read album.assets from GET /albums/:id, which Immich 3.x no longer populates (lib/immich.ts:507). The hero picker's "This Album" tab returned nothing and threw outright when the key was absent. It now goes through the client's paginated metadata search, with ?types=all to opt videos in for the reorder editor. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): drop decorative emoji from the sort select labels (#415) An <option> cannot contain markup, so the SVG set in Icons is not reachable there — but a decorative emoji is not a substitute for it. Plain text instead; the album card badge already uses a real icon. The remaining emoji in the admin panel (asset picker tabs, section headings, layout picker options) predate this branch and are left for a separate cleanup. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): replace emoji icons with the shared SVG icon set (#416) The admin panel mixed two icon conventions: inline SVGs from `Icons.tsx` in most components, and decorative emoji in the asset picker and a few PageBuilder labels. Emoji render inconsistently across platforms, ignore the accent colour, and cannot inherit the `.svg-icon` sizing rules. - Icons.tsx: add `IconStar` (filled — it marks a state, not an action) and `IconImage`. - AssetPicker: the three tab labels and the favourite tile badge now use IconFolder / IconStar / IconImage. - PageBuilder: the "Standalone Albums" and "Subpages" headings use the icon set instead of an emoji. - PageBuilder: the layout picker drops its emoji for plain text. An <option> cannot contain markup, so an SVG is impossible there and a decorative glyph is not a substitute. - admin.css: align icon and label in the picker tabs, and swap the favourite badge's text-shadow for drop-shadow, which is what applies to an inline SVG. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): fold PageBuilder's local icons into the shared Icons module (#418) * refactor(admin): fold PageBuilder's local icons into the shared module PageBuilder.tsx carried its own `Icons` object duplicating most of the glyphs already exported by Icons.tsx, with hardcoded sizes and slightly divergent paths. Migrate all 32 call sites to the shared module and delete the local object. Five glyphs had no counterpart and are added to Icons.tsx as 1:1 ports of the local paths: IconX, IconPlus, IconHome, IconCopy, IconImage. The local ExternalLink and Check are dropped rather than ported — both had zero call sites. Two glyphs change shape slightly, which is the point of consolidating: the shared IconCamera includes the viewfinder bump the local copy omitted, and drag handles now use IconGripVertical. IconGripVertical uses the module's square 24x24 viewBox, so `.svg-drag` goes from 12x18 to 18x18 — the old non-square box would letterbox the glyph down to 12x12 and shrink the handle. * fix(admin): resolve icon-module integration after #416 Merging dev brought in #416, which added a second IconImage to Icons.tsx and two <Icons.Camera>/<Icons.Folder> section headers that reference the local Icons object this PR removes. Git merged both cleanly but the result did not type-check. - drop the duplicate IconImage (both copies were byte-identical) - point the two section headers at the imported IconCamera/IconFolder - refresh the SORT_LABELS comment: the icon set is imported now, not declared below --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> * fix(config): allow an empty gallery, guard against a double /api suffix (#421) An empty gallery is now a valid, rendered state instead of a throw: deriveGallery() no longer requires at least one album or subpage, so a deployment with no albums yet renders a bare homepage the owner can fill in via /admin. getConfig() also stops appending /api to an Immich URL that already ends in it, which previously produced .../api/api and broke every upstream request. Includes a restore of the per-album sort test cases, which the branch had lost by being cut before #408/#414. * feat(admin): favicon upload, served from the content volume (#422) Adds a bundled default favicon, an upload widget in admin Settings > General, and a route that serves the icon from the writable content/ volume with a fallback to the bundled default. Raster uploads (PNG/ICO/JPEG) are wrapped in an SVG container; the response carries its own CSP so an uploaded SVG cannot execute script on the origin. The GET route revalidates with an ETag instead of caching immutably, so a newly uploaded icon shows up immediately. Uploads are written via temp file + rename, and a Reset button restores the bundled default. * ci: flag unformatted files in a PR, without blocking it (#424) Prettier is configured as an error rule in eslint.config.mjs but has never run in CI, so part of the tree predates it. A final CI step now diffs against the PR base, runs prettier --list-different over the changed files, and emits a warning annotation per offender plus a job summary. Advisory by design: it never fails the job. Blocking would turn a PR red for merely touching a file that was already unformatted, and normalising the tree in one commit would wreck git blame and conflict with the PRs in flight. Requires fetch-depth: 0, since diffing against the base needs its history. * feat(install): first-run wizard gated by a one-time setup token (#419) Adds /install, a four-step first-run wizard: connect to Immich, optionally pick albums, name the site, finish. It verifies the credentials against the Immich server before writing anything, then writes gallery.yaml, settings.yaml and a content/install.json carrying the Immich credentials and a generated site secret. install.json exists because a running process cannot pick up new env vars — the wizard has to write configuration that takes effect without a restart. getInstallCredentials() merges it under the real environment, so env vars always win and rotation stays a matter of setting one. Both the page and the API routes are gated by a one-time setup token printed to the server log, so a deployment that is reachable before gallery.yaml exists cannot be configured by whoever finds it first. The token is stored in content/.setup-token (0600) rather than a module variable: Next.js bundles the page and each route handler separately, so a module-level token left the page and the API disagreeing inside one process and the wizard stuck on step 1. It is removed once the install completes. The admin password is stored as an scrypt hash using the scheme lib/auth.ts already applies to album passwords; a plaintext ADMIN_PASSWORD env var keeps working. * docs: document the setup wizard, fix the read-only content mount (#425) Quick Start now leads with the /install wizard, with the hand-written YAML route kept alongside it, and a First-Run Setup section covers the setup token, the files the wizard writes, and env-var precedence. Two corrections: both Docker examples mounted content/ as :ro, which silently breaks the wizard, the admin panel and the backup rotation alike — docs/admin-panel.md already said so and the README contradicted it. And nothing documented that content/install.json holds the Immich API key, so a backup of content/ is a backup of credentials. Also adds a Contributors section crediting the people whose work is in the project. * feat(admin): floating save bar pinned to the bottom of the viewport (#426) The save bar was the first, static element inside .admin-main. Since the document itself scrolls, it left the viewport as soon as you scrolled down — editing a subpage section or a settings block far below gave no visible dirty hint and no reachable save button. Replace it with a bottom-pinned floating bar shared by both editors. It only mounts while there is something to act on (unsaved changes, an in-flight save, or a result message), so it never covers content while idle. The success message clears after 5s, which hides the bar again. - new SaveBar component, replacing the duplicated markup in PageBuilder and SettingsEditor - adopt the previously unused .floating-save-bar CSS: slide-in keyframes (carrying translateX(-50%)), dirty border, wrap/gap, mobile variant and a prefers-reduced-motion opt-out; z-index 900 keeps it below modals - .admin-main gains bottom padding so the bar never covers page content - drop the now-unreachable idle hints: the ⌘S hint becomes a button title, the Live Sync note becomes a static line above the settings layout - header "Site" link now bypasses the cache (/?fresh=1), so the preview stays reachable when the bar is hidden Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(admin): themed listbox for the album sort control (#427) The per-album "Photo order" control was a native <select>. Because an <option> cannot contain markup, its choices could not use the admin panel's currentColor SVG set — the reason #415 had to fall back to plain text after dropping the emoji labels. Adds a Listbox component implementing the ARIA combobox/listbox pattern, so options can render a glyph beside their label: - DOM focus stays on the trigger button; the active option is announced through aria-activedescendant, keeping focus management to one element - Keyboard: arrows (clamped at the ends, like a native select), Home/End, Enter/Space to commit, Escape to cancel, Tab commits and moves on, and prefix type-ahead with a repeat-key cycle - Outside dismissal on pointerdown, so a press starting outside closes the popup before the click retargets The sort options now carry an icon each: calendar, arrow-down, arrow-up, an A→Z marker, and the drag glyph for manual — matching the badge the album card already shows. SORT_LABELS stays plain text because the badge feeds it to a title attribute. Closes #417 Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(git): ignore generated design handoff folders * fix(admin): stop the album sort dropdown clipping, and simplify the panel (#428) * fix(admin): render listbox popup in a portal so it escapes modal clipping The sort control's popup was position:absolute inside three clipping ancestors (.album-drawer overflow:hidden > .album-drawer-body overflow-y:auto > .modal-right-column overflow-y:auto), so it was cut off at the bottom of the Edit Album Details modal. z-index could not help: clipping happens before stacking. It also always hung below the trigger, with no flip. Portal the popup to document.body and position it from the trigger's viewport rect, flipping above when there is more room there and capping max-height to the space available so it scrolls internally rather than overflowing. It is dismissed on scroll and resize, since the anchor is only measured on open. The outside-pointerdown handler now also treats the popup as inside; without that the portalled list counts as outside, and a click on an option would close it before the selection commits. * refactor(admin): single-column album details panel The left column spent 1.2fr on a cover thumbnail and three stat rows, two of which (Status, Custom Hero) only restated the form fields opposite them, while the form itself was squeezed into 1.8fr behind a second nested scroller. Stack the drawer in one column instead: cover as a banner, then the form at full width, with the UUID moved into the footer. The body is now the only scroll container, which also removes one of the ancestors that was clipping the sort popup. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> * fix(admin): give the portalled listbox its theme back, lock the page behind modals (#429) Two defects in the album editor. The sort listbox popup painted transparent. Every --admin-* variable is scoped to .admin-layout, and since the popup moved into document.body it sits outside that subtree, so background/border/text all resolved to nothing. It now carries its own copy of the palette in both colour schemes, plus the font it no longer inherits. Scrolling inside a modal also moved the page behind it. No admin modal ever locked body scroll: the overlay covers the page but does not absorb wheel events, so a scroll starting on the backdrop — or continuing past the end of the modal's own scroller — reaches the document. overscroll-behavior cannot cover that case on its own, because it only applies to scroll containers and the backdrop is not one. useScrollLock freezes body while a modal is open and compensates for the width the scrollbar gives up, so nothing shifts underneath. Each lock restores the inline value it found, which makes nesting work without a counter — a picker opened from the drawer restores the drawer's hidden state instead of clearing it. Applied to both drawers and all four picker modals, which share the defect. overscroll-behavior: contain on the scrollers stops the chaining they can handle themselves. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com> * fix(security): allow unsafe-eval in CSP script-src during dev mode * feat(journal): add Journal Studio with split-screen editor, live preview and dedicated routes * fix(build): separate client parser from server journal-service and fix build type errors * fix(journal): Fotos rendern, Layout und Lightbox-Steuerung korrigieren Fünf unabhängige Fehler in der öffentlichen Journal- und Essay-Ansicht: * Foto-Blöcke wurden nie angezeigt. EssayView löst ein Foto über PhotoItem.id auf, und das sind verschlüsselte Tokens — die Blöcke aus dem Markdown tragen aber rohe Asset-UUIDs. Jede Zuordnung lief ins Leere, und nicht auflösbare Blöcke werden still verworfen. Die IDs werden jetzt serverseitig übersetzt; damit verschwinden nebenbei die rohen UUIDs aus dem Client-Payload, die dort laut Projektregel nie auftauchen dürfen. Nicht auflösbare Referenzen werden geloggt. * Überschriften standen weiter links als der Fließtext. Jeder Block hatte einzeln `max-width: 68ch`, und `ch` ist relativ zur Schrift des Elements — die Serif-Überschrift ergab eine breitere Spalte. Ersetzt durch eine gemeinsame, font-unabhängige `--essay-measure`. * Fullbleed-Fotos bluteten nur nach links aus: `.essay-figure` ist `width: 100%`, wodurch die Box überbestimmt ist und der negative rechte Margin verworfen wird. * Foto-Paare stellten beide Bilder gleich breit dar, wodurch ein Hochformat neben einem Querformat doppelt so hoch wurde. Jetzt eine Justified-Reihe: Breite proportional zum Seitenverhältnis, dadurch exakt gleiche Höhen ohne Beschnitt. * Die Lightbox hatte im Journal keine Tastatursteuerung und keine Scroll-Sperre — beides lag in PhotoGrid, also nur im Album-Raster. Verlagert in die Lightbox selbst, der doppelte Handler in PhotoGrid entfernt (sonst wäre pro Pfeildruck zwei Bilder weitergesprungen). Zusätzlich sind Proofing-Herzen und das EXIF-Panel im redaktionellen Modus abschaltbar und im Journal aus: Client-Proofing ist ein Übergabe-Workflow für Alben, keine Funktion einer Reportage. Auf der Übersicht wurde der Untertitel doppelt gerendert, weil extractExcerpt() auf ihn zurückfällt. * feat(admin): eigene URLs für alle Bereiche und überarbeiteter Journal Studio Das Panel war eine einzige Client-Komponente, die ihre Tabs über useState umschaltet: keine Route pro Bereich, kein Deep-Link, kein Zurück-Button, und nach jedem Reload landete man wieder auf "Pages". Auch der Journal-Editor hatte keine eigene URL. Jetzt sieben echte Routen (/admin, /admin/pages, /admin/journal, /admin/journal/<slug>, /admin/settings, /admin/settings/<section>, /admin/analytics). Die Shell mit Auth-Prüfung und Kopfzeile sitzt im Layout und umschließt children — so bleibt die Session-Prüfung über Routenwechsel montiert, statt bei jedem Tab-Wechsel neu zu laufen und den Spinner aufblitzen zu lassen. Unbekannte Settings-Sections fallen auf General zurück. Im selben Zug der Journal Studio, der die Routing-Änderung ohnehin berührt: * Alle Eingabefelder nutzten die Klasse `admin-input`, die in keinem CSS definiert war — sie fielen auf Browser-Defaults zurück. Jetzt gestylt, gescoped, damit der generische Name nicht ins übrige Panel leckt. * Der Split View ist per Divider verschiebbar (Maus, Tastatur, Doppelklick zum Zurücksetzen), Breite in localStorage. * Das Studio bricht aus der 1120px-Spalte aus, die Preview hat Platz. * Die Preview zeigte für jedes Foto fest 3:2 und log damit über das Layout der veröffentlichten Seite; die echten Verhältnisse werden jetzt an den Thumbnails gemessen. * Blöcke mit alten positionsbasierten Foto-Referenzen werden markiert — die lassen sich auf einer eigenständigen Journal-Seite nicht auflösen und verschwanden bisher stillschweigend. * Blocktyp-Chips als gemeinsame Komponente, monochrom und per Icon unterschieden statt in einer eigenen Blau/Lila/Orange-Palette, die sonst nirgends im Panel vorkommt. * Emojis raus, SVG-Icons rein. * fix(admin): Designsystem-Lücken im Panel schließen Eine systematische Suche nach Klassen, die im TSX benutzt, aber in keinem CSS definiert sind, hat vier Stellen mit demselben Muster gefunden: * `admin-btn-secondary` und `admin-btn-danger` existierten nicht. Sämtliche Löschen-Buttons sahen aus wie normale Buttons — keine Warnwirkung. Als `.admin-btn.admin-btn-danger` geschrieben, weil die Varianten mit den Größenklassen kombiniert werden, die weiter unten ihren eigenen Hintergrund setzen. * `page-progress-fill` fehlte: die Balken im Analytics-Panel waren leere Rinnen, der Wert unsichtbar. Ebenso `analytics-empty` und `admin-loading-container`. * `subpage-drawer-section`, `subpage-drawer-title-group` und `input-with-icon` im PageBuilder waren wirkungslos und teils mit Inline-Styles notdürftig kompensiert. * `grid-card-preview` fehlte, wodurch alle Layout-Vorschauen auf Höhe null kollabierten. Nur "Showcase" war sichtbar — und das aus Versehen, weil sein Tile `hero-tile` hieß und damit die `aspect-ratio` einer fremden PageBuilder-Klasse erbte. Umbenannt. Dazu die Theme-Vorschauen, die praktisch identisch aussahen: alle sieben zeigten dieselben drei quadratischen Kacheln, einziger Unterschied war die Hintergrundfarbe. Sie spiegeln jetzt die echten Preset-Daten aus lib/config/theme.ts — Schriftcharakter, Eckradius, Rasterdichte, Passepartout bzw. Schatten. Die Kopfzeile richtet sich an einer gemeinsamen Steuerhöhe aus. Der "Site"-Link war höher als die Buttons daneben: `.admin-btn` hatte keine explizite line-height, und <button> bekommt box-sizing: border-box vom Browser, <a> nicht. Die Statusanzeige setzte weder Schriftfamilie noch -größe und fiel auf den Browser-Default zurück — sie war nie Teil des Designsystems. Jetzt gleiche Höhe und Typografie, Pillenform als Zustandsanzeige, Trenner zur Aktionsgruppe. Das dauerhafte Pulsieren des grünen Punkts entfällt; Animation bleibt den Zuständen vorbehalten, die Aufmerksamkeit brauchen. Restliche Emojis durch SVG-Icons ersetzt. * feat(admin): add scroll-to-top toggle and SVG arrow The back-to-top button was always on and drew its arrow with the ↑ text character. Add a `scrollToTop` setting (General section in the admin panel, defaults to on so existing sites are unaffected) and replace the glyph with a stroked SVG that inherits currentColor across all presets. Scroll handling is now rAF-throttled, and prefers-reduced-motion turns off both the hover lift and the smooth scroll. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * security(journal): escape author HTML instead of filtering it CodeQL flags 26 high-severity alerts on the release PR; the bulk of them point at sanitizeHtml(), a denylist of three regexes whose output goes into dangerouslySetInnerHTML. I reproduced the bypasses before changing anything — all four pass the old filter: <img src=x onerror=alert(1)> unquoted handler, regex wants quotes <img src=x onerror='alert(1)'> single quotes, same reason <svg onload=alert(1)> not a <script> tag javasjavascript:cript:alert(1) one-pass replace, the rest recombines Plus an attribute breakout in the link renderer, which interpolated the URL into href="${url}" unescaped: [x](" onmouseover=alert(1) x=") -> <a href="" onmouseover=alert(1" ...> Replaced with escaping. Every `&<>"'` in author text becomes an entity before any markdown rule runs, so the only tags in the output are the ones renderInlineMarkdown builds itself and a URL cannot leave its attribute. Link schemes are now an allowlist (http, https, mailto, tel, relative, anchor); anything else renders as plain text. The serializer needed decodeHtmlEntities to match: without it a save would write `&lt;` into the Markdown file and the next parse would escape the `&` again, corrupting the text further on every round trip. A test covers parse -> serialize -> parse stability. Two existing tests asserted the old behaviour and were rewritten rather than deleted: one expected the script tag to be *removed* from the output, the other expected the substring "onerror" to be absent. Both now assert the property that matters — that no tag can form — because `onerror` surviving as inert text is fine. Exploitation required admin access either way: journal and essay text comes from the studio or from content/*.md. This removes the weakness, it does not close an open door. * fix(journal): contain file paths, fix frontmatter escaping, defuse two regexes Follow-up to the CodeQL findings on release PR #432. I went through all 23 alerts individually; this addresses the ones that are worth addressing and documents the ones that are not. Path containment (12 alerts, all false positives). Every path built from a slug goes through isValidSlug(), a strict `/^[a-zA-Z0-9_-]+$/` allowlist — verified against `../../etc/passwd`, `foo/../../bar`, `a/b`, `..` and friends, all rejected. CodeQL cannot see it because the check lives in another module. Added a containedPath() helper that resolves the path and refuses anything landing outside the content directory: a second lock on a door that was already locked, and a barrier the analysis can follow. Also removed the dead `slug.endsWith('.md')` branches — isValidSlug rejects dots, so they could never be taken. Frontmatter escaping (1 alert, a real bug). The serializer escaped `"` but not `\`, and the parser never unescaped anything. A title containing either character gained a backslash on every save/load cycle: Path C:\Users "quoted" -> Path C:\\Users \"quoted\" -> ... Escaping now covers the backslash first and the parser undoes both. A round trip test covers quotes, backslashes, colons and apostrophes. Two of three ReDoS regexes (2 alerts). The heading pattern had `\s+` next to `(.+)`, which overlap, so the engine tried every split of the whitespace run before failing; it is `[ \t]+` and `(\S.*)` now. The quote author pattern wrapped a lazy group around an optional group — the quadratic case — and is an index split on the first separator now. The third regex, the bold/italic pass, is deliberately left alone. Rewriting it with a negated class removes the backtracking but breaks nesting: `**bold *and italic* here**` renders as `*<em>bold </em>and italic<em> here</em>*`. The input is Markdown from an authenticated admin, never a visitor, so the worst case is an author slowing down their own page. The comment in the code says so. Not addressed: 5 js/insufficient-password-hash alerts. They ask for a slow KDF where the code uses SHA-256/HMAC — correct in general, but the admin password comes from an environment variable and is never stored, so a stronger KDF protects nothing that is not already in plaintext in the environment. 399 unit tests pass (18 new), build and tsc clean. * fix(journal): split the quote author by scanning, not by pattern Cleaning up after myself. #439 replaced the quote author regex `/^(.*?)(?:\s+--\s+(.+))?$/` — a lazy group around an optional one, the quadratic case — with `/\s+--\s+/`, and CodeQL promptly flagged the replacement for the same reason. One reported pattern traded for another. splitQuoteAuthor() scans for the first `--` that has whitespace on both sides. Linear, and it needs no reasoning about the regex engine at all. Behaviour is identical to the original regex, checked case by case against it: separator, no separator, several separators, tabs, wide gaps, `a--b` without spaces, leading and trailing separators, empty string. All nine are covered by tests, plus one asserting it stays fast on a 50k whitespace run. * security(admin): derive the session signing key with scrypt getSigningKey() ran the admin password through a single SHA-256 digest. It is key derivation rather than password storage, so it was never a stored-hash problem — but if the derived key ever leaked, one fast hash makes recovering the password by brute force cheap. CodeQL flags it as js/insufficient-password-hash and, for this particular alert, has a point. scrypt now. Two details that matter: The salt has to be stable. A random salt would produce a different key on every call and invalidate every session; it is derived from AUTH_SECRET, which is deployment-specific. Verified across separate processes: same inputs produce a verifying token, so a restart or redeploy does not log everyone out. The result is cached for the process lifetime. scrypt is deliberately slow and getSigningKey() runs on every admin request — deriving per call would add ~24ms to each one. The cache key is a digest of secret plus password, so a rotation misses the cache and derives again, and no extra plaintext copy of the password is kept around. Measured: first derivation 24ms, subsequent calls 0.12ms. Password change and secret change both invalidate an existing token, checked in separate processes. Note the one-time effect: existing admin sessions are invalidated by the change in derivation, so everyone logs in once more. * security(admin): key the signing-key cache on its inputs, not a digest #441 removed the SHA-256 digest of the admin password from the key derivation and introduced a new one three lines above it, as the cache key. Same rule, same file: CodeQL reported it immediately. The comment justifying it was wrong too. It claimed no second plaintext copy of the password was retained, while building the digest input allocates exactly that in order to hash it. The cache now holds the two input strings and compares them directly. They are the same objects the env and install caches already hold, so nothing extra is retained, and no fast hash of the password exists in memory for the life of the process. Re-verified after the change, in separate processes: a token from one process verifies in another with the same inputs, a changed password or secret rejects it, first derivation 24ms, cached calls 0.001ms. That leaves scrypt as the only place the password is hashed here. The two HMACs further down operate on the derived key and on token data, not on the password; the constant-time comparison in verifyAdminPassword is the previously dismissed one. --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
2026-08-14 16:55:07 +02:00
overflow-y: auto;
/* Stop the scroll handing off to the page once the form hits its end. */
overscroll-behavior: contain;
feat: redesign album drawer into a gorgeous centered two-column modal (#243) Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-05-31 21:30:00 +02:00
padding: 1.75rem;
display: flex;
flex-direction: column;
gap: 1.25rem;
}
@media (max-width: 768px) {
release: v0.11.0 — journal fixes, admin URLs, design system cleanup (#432) * fix(screenshots): sharp-Typen fuer 0.34 und 0.35 gleichzeitig (#410) sharp 0.35 ist von `export =` auf ESM umgestellt: der Modul-Namespace ist nicht mehr aufrufbar, die Factory sitzt unter .default. Der Type-Check brach damit in scripts/screenshots.ts weg, sobald der Next-Bump (#402) sharp von 0.34.5 auf 0.35.3 mitzieht -- sharp ist hier keine deklarierte Dependency, sondern kommt ueber Next mit. Die Form wird jetzt aus dem installierten Paket abgeleitet statt festgeschrieben, zur Laufzeit wie im Typ. Geprueft mit beiden Versionen: tsc laeuft mit 0.34.5 und mit 0.35.3 fehlerfrei durch. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(deps): bump the nextjs group across 1 directory with 2 updates (#402) Bumps the nextjs group with 2 updates in the / directory: [next](https://github.com/vercel/next.js) and [eslint-config-next](https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next). Updates `next` from 16.2.12 to 16.3.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/compare/v16.2.12...v16.3.0) Updates `eslint-config-next` from 16.2.12 to 16.3.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/commits/v16.3.0/packages/eslint-config-next) --- updated-dependencies: - dependency-name: eslint-config-next dependency-version: 16.3.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: nextjs - dependency-name: next dependency-version: 16.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nextjs ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps-dev): bump prettier from 3.8.3 to 3.9.6 (#405) Bumps [prettier](https://github.com/prettier/prettier) from 3.8.3 to 3.9.6. - [Release notes](https://github.com/prettier/prettier/releases) - [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md) - [Commits](https://github.com/prettier/prettier/compare/3.8.3...3.9.6) --- updated-dependencies: - dependency-name: prettier dependency-version: 3.9.6 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * docs(changelog): Unreleased-Sektion fuer die Bumps nach v0.10.0 (#413) Die Dependency-PRs sind nach dem Release auf dev gelandet, teils auch auf main. Ohne Eintrag waeren sie beim naechsten Release unsichtbar -- inklusive Next 16.3.0, das CVE-2025-13465 mitbringt. Ausserdem im 0.10.0-Abschnitt nachgetragen, dass der Trivy-Scan bis #409 nie gelaufen ist. Der Fix steckt im Tag v0.10.0, fehlte aber in der Aufzaehlung -- und "Images werden bei jedem Publish gescannt" stand im Changelog, waehrend der Job im Action-Setup abbrach. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(gallery): per-album sort order, independent of Immich (#408) (#414) Album order was dictated entirely by Immich: getAlbum() sorted by the album's own asc/desc flag, so a Folio album always mirrored the archive. A curated series has a narrative order that has nothing to do with capture time, and changing the Immich album's sort to fit the website changes it for the archive too. Adds an optional per-album `sort` in gallery.yaml, editable in /admin, defaulting to today's behaviour so every existing config is unchanged: immich (default) | newest | oldest | filename | manual `manual` is a pinned *prefix*: `assetOrder` lists only the photos placed by hand, everything else follows in the album's Immich order. A full permutation of a 2,000-photo album would be ~80 KB of UUIDs in a file that is rewritten and copied to content/.backups/ on every admin save. It also makes drift fall out for free — photos removed in Immich never match, new ones land in the tail rather than being hidden. Sorting is applied after the cache read, not before the cache write, so the LRU keeps one canonical Immich-ordered copy per album. That avoids putting the mode in the cache key, lets a config change take effect without depending on invalidation, and keeps the stale-serving path correct. cache.get() returns the stored object by reference, so withSort() returns a shallow clone with a new array — sorting in place would reorder the shared entry, and under request coalescing every concurrent caller would be sorting the same array. Also fixes a prerequisite bug: /api/admin/albums/[albumId]/assets read album.assets from GET /albums/:id, which Immich 3.x no longer populates (lib/immich.ts:507). The hero picker's "This Album" tab returned nothing and threw outright when the key was absent. It now goes through the client's paginated metadata search, with ?types=all to opt videos in for the reorder editor. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): drop decorative emoji from the sort select labels (#415) An <option> cannot contain markup, so the SVG set in Icons is not reachable there — but a decorative emoji is not a substitute for it. Plain text instead; the album card badge already uses a real icon. The remaining emoji in the admin panel (asset picker tabs, section headings, layout picker options) predate this branch and are left for a separate cleanup. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): replace emoji icons with the shared SVG icon set (#416) The admin panel mixed two icon conventions: inline SVGs from `Icons.tsx` in most components, and decorative emoji in the asset picker and a few PageBuilder labels. Emoji render inconsistently across platforms, ignore the accent colour, and cannot inherit the `.svg-icon` sizing rules. - Icons.tsx: add `IconStar` (filled — it marks a state, not an action) and `IconImage`. - AssetPicker: the three tab labels and the favourite tile badge now use IconFolder / IconStar / IconImage. - PageBuilder: the "Standalone Albums" and "Subpages" headings use the icon set instead of an emoji. - PageBuilder: the layout picker drops its emoji for plain text. An <option> cannot contain markup, so an SVG is impossible there and a decorative glyph is not a substitute. - admin.css: align icon and label in the picker tabs, and swap the favourite badge's text-shadow for drop-shadow, which is what applies to an inline SVG. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): fold PageBuilder's local icons into the shared Icons module (#418) * refactor(admin): fold PageBuilder's local icons into the shared module PageBuilder.tsx carried its own `Icons` object duplicating most of the glyphs already exported by Icons.tsx, with hardcoded sizes and slightly divergent paths. Migrate all 32 call sites to the shared module and delete the local object. Five glyphs had no counterpart and are added to Icons.tsx as 1:1 ports of the local paths: IconX, IconPlus, IconHome, IconCopy, IconImage. The local ExternalLink and Check are dropped rather than ported — both had zero call sites. Two glyphs change shape slightly, which is the point of consolidating: the shared IconCamera includes the viewfinder bump the local copy omitted, and drag handles now use IconGripVertical. IconGripVertical uses the module's square 24x24 viewBox, so `.svg-drag` goes from 12x18 to 18x18 — the old non-square box would letterbox the glyph down to 12x12 and shrink the handle. * fix(admin): resolve icon-module integration after #416 Merging dev brought in #416, which added a second IconImage to Icons.tsx and two <Icons.Camera>/<Icons.Folder> section headers that reference the local Icons object this PR removes. Git merged both cleanly but the result did not type-check. - drop the duplicate IconImage (both copies were byte-identical) - point the two section headers at the imported IconCamera/IconFolder - refresh the SORT_LABELS comment: the icon set is imported now, not declared below --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> * fix(config): allow an empty gallery, guard against a double /api suffix (#421) An empty gallery is now a valid, rendered state instead of a throw: deriveGallery() no longer requires at least one album or subpage, so a deployment with no albums yet renders a bare homepage the owner can fill in via /admin. getConfig() also stops appending /api to an Immich URL that already ends in it, which previously produced .../api/api and broke every upstream request. Includes a restore of the per-album sort test cases, which the branch had lost by being cut before #408/#414. * feat(admin): favicon upload, served from the content volume (#422) Adds a bundled default favicon, an upload widget in admin Settings > General, and a route that serves the icon from the writable content/ volume with a fallback to the bundled default. Raster uploads (PNG/ICO/JPEG) are wrapped in an SVG container; the response carries its own CSP so an uploaded SVG cannot execute script on the origin. The GET route revalidates with an ETag instead of caching immutably, so a newly uploaded icon shows up immediately. Uploads are written via temp file + rename, and a Reset button restores the bundled default. * ci: flag unformatted files in a PR, without blocking it (#424) Prettier is configured as an error rule in eslint.config.mjs but has never run in CI, so part of the tree predates it. A final CI step now diffs against the PR base, runs prettier --list-different over the changed files, and emits a warning annotation per offender plus a job summary. Advisory by design: it never fails the job. Blocking would turn a PR red for merely touching a file that was already unformatted, and normalising the tree in one commit would wreck git blame and conflict with the PRs in flight. Requires fetch-depth: 0, since diffing against the base needs its history. * feat(install): first-run wizard gated by a one-time setup token (#419) Adds /install, a four-step first-run wizard: connect to Immich, optionally pick albums, name the site, finish. It verifies the credentials against the Immich server before writing anything, then writes gallery.yaml, settings.yaml and a content/install.json carrying the Immich credentials and a generated site secret. install.json exists because a running process cannot pick up new env vars — the wizard has to write configuration that takes effect without a restart. getInstallCredentials() merges it under the real environment, so env vars always win and rotation stays a matter of setting one. Both the page and the API routes are gated by a one-time setup token printed to the server log, so a deployment that is reachable before gallery.yaml exists cannot be configured by whoever finds it first. The token is stored in content/.setup-token (0600) rather than a module variable: Next.js bundles the page and each route handler separately, so a module-level token left the page and the API disagreeing inside one process and the wizard stuck on step 1. It is removed once the install completes. The admin password is stored as an scrypt hash using the scheme lib/auth.ts already applies to album passwords; a plaintext ADMIN_PASSWORD env var keeps working. * docs: document the setup wizard, fix the read-only content mount (#425) Quick Start now leads with the /install wizard, with the hand-written YAML route kept alongside it, and a First-Run Setup section covers the setup token, the files the wizard writes, and env-var precedence. Two corrections: both Docker examples mounted content/ as :ro, which silently breaks the wizard, the admin panel and the backup rotation alike — docs/admin-panel.md already said so and the README contradicted it. And nothing documented that content/install.json holds the Immich API key, so a backup of content/ is a backup of credentials. Also adds a Contributors section crediting the people whose work is in the project. * feat(admin): floating save bar pinned to the bottom of the viewport (#426) The save bar was the first, static element inside .admin-main. Since the document itself scrolls, it left the viewport as soon as you scrolled down — editing a subpage section or a settings block far below gave no visible dirty hint and no reachable save button. Replace it with a bottom-pinned floating bar shared by both editors. It only mounts while there is something to act on (unsaved changes, an in-flight save, or a result message), so it never covers content while idle. The success message clears after 5s, which hides the bar again. - new SaveBar component, replacing the duplicated markup in PageBuilder and SettingsEditor - adopt the previously unused .floating-save-bar CSS: slide-in keyframes (carrying translateX(-50%)), dirty border, wrap/gap, mobile variant and a prefers-reduced-motion opt-out; z-index 900 keeps it below modals - .admin-main gains bottom padding so the bar never covers page content - drop the now-unreachable idle hints: the ⌘S hint becomes a button title, the Live Sync note becomes a static line above the settings layout - header "Site" link now bypasses the cache (/?fresh=1), so the preview stays reachable when the bar is hidden Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(admin): themed listbox for the album sort control (#427) The per-album "Photo order" control was a native <select>. Because an <option> cannot contain markup, its choices could not use the admin panel's currentColor SVG set — the reason #415 had to fall back to plain text after dropping the emoji labels. Adds a Listbox component implementing the ARIA combobox/listbox pattern, so options can render a glyph beside their label: - DOM focus stays on the trigger button; the active option is announced through aria-activedescendant, keeping focus management to one element - Keyboard: arrows (clamped at the ends, like a native select), Home/End, Enter/Space to commit, Escape to cancel, Tab commits and moves on, and prefix type-ahead with a repeat-key cycle - Outside dismissal on pointerdown, so a press starting outside closes the popup before the click retargets The sort options now carry an icon each: calendar, arrow-down, arrow-up, an A→Z marker, and the drag glyph for manual — matching the badge the album card already shows. SORT_LABELS stays plain text because the badge feeds it to a title attribute. Closes #417 Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(git): ignore generated design handoff folders * fix(admin): stop the album sort dropdown clipping, and simplify the panel (#428) * fix(admin): render listbox popup in a portal so it escapes modal clipping The sort control's popup was position:absolute inside three clipping ancestors (.album-drawer overflow:hidden > .album-drawer-body overflow-y:auto > .modal-right-column overflow-y:auto), so it was cut off at the bottom of the Edit Album Details modal. z-index could not help: clipping happens before stacking. It also always hung below the trigger, with no flip. Portal the popup to document.body and position it from the trigger's viewport rect, flipping above when there is more room there and capping max-height to the space available so it scrolls internally rather than overflowing. It is dismissed on scroll and resize, since the anchor is only measured on open. The outside-pointerdown handler now also treats the popup as inside; without that the portalled list counts as outside, and a click on an option would close it before the selection commits. * refactor(admin): single-column album details panel The left column spent 1.2fr on a cover thumbnail and three stat rows, two of which (Status, Custom Hero) only restated the form fields opposite them, while the form itself was squeezed into 1.8fr behind a second nested scroller. Stack the drawer in one column instead: cover as a banner, then the form at full width, with the UUID moved into the footer. The body is now the only scroll container, which also removes one of the ancestors that was clipping the sort popup. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> * fix(admin): give the portalled listbox its theme back, lock the page behind modals (#429) Two defects in the album editor. The sort listbox popup painted transparent. Every --admin-* variable is scoped to .admin-layout, and since the popup moved into document.body it sits outside that subtree, so background/border/text all resolved to nothing. It now carries its own copy of the palette in both colour schemes, plus the font it no longer inherits. Scrolling inside a modal also moved the page behind it. No admin modal ever locked body scroll: the overlay covers the page but does not absorb wheel events, so a scroll starting on the backdrop — or continuing past the end of the modal's own scroller — reaches the document. overscroll-behavior cannot cover that case on its own, because it only applies to scroll containers and the backdrop is not one. useScrollLock freezes body while a modal is open and compensates for the width the scrollbar gives up, so nothing shifts underneath. Each lock restores the inline value it found, which makes nesting work without a counter — a picker opened from the drawer restores the drawer's hidden state instead of clearing it. Applied to both drawers and all four picker modals, which share the defect. overscroll-behavior: contain on the scrollers stops the chaining they can handle themselves. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com> * fix(security): allow unsafe-eval in CSP script-src during dev mode * feat(journal): add Journal Studio with split-screen editor, live preview and dedicated routes * fix(build): separate client parser from server journal-service and fix build type errors * fix(journal): Fotos rendern, Layout und Lightbox-Steuerung korrigieren Fünf unabhängige Fehler in der öffentlichen Journal- und Essay-Ansicht: * Foto-Blöcke wurden nie angezeigt. EssayView löst ein Foto über PhotoItem.id auf, und das sind verschlüsselte Tokens — die Blöcke aus dem Markdown tragen aber rohe Asset-UUIDs. Jede Zuordnung lief ins Leere, und nicht auflösbare Blöcke werden still verworfen. Die IDs werden jetzt serverseitig übersetzt; damit verschwinden nebenbei die rohen UUIDs aus dem Client-Payload, die dort laut Projektregel nie auftauchen dürfen. Nicht auflösbare Referenzen werden geloggt. * Überschriften standen weiter links als der Fließtext. Jeder Block hatte einzeln `max-width: 68ch`, und `ch` ist relativ zur Schrift des Elements — die Serif-Überschrift ergab eine breitere Spalte. Ersetzt durch eine gemeinsame, font-unabhängige `--essay-measure`. * Fullbleed-Fotos bluteten nur nach links aus: `.essay-figure` ist `width: 100%`, wodurch die Box überbestimmt ist und der negative rechte Margin verworfen wird. * Foto-Paare stellten beide Bilder gleich breit dar, wodurch ein Hochformat neben einem Querformat doppelt so hoch wurde. Jetzt eine Justified-Reihe: Breite proportional zum Seitenverhältnis, dadurch exakt gleiche Höhen ohne Beschnitt. * Die Lightbox hatte im Journal keine Tastatursteuerung und keine Scroll-Sperre — beides lag in PhotoGrid, also nur im Album-Raster. Verlagert in die Lightbox selbst, der doppelte Handler in PhotoGrid entfernt (sonst wäre pro Pfeildruck zwei Bilder weitergesprungen). Zusätzlich sind Proofing-Herzen und das EXIF-Panel im redaktionellen Modus abschaltbar und im Journal aus: Client-Proofing ist ein Übergabe-Workflow für Alben, keine Funktion einer Reportage. Auf der Übersicht wurde der Untertitel doppelt gerendert, weil extractExcerpt() auf ihn zurückfällt. * feat(admin): eigene URLs für alle Bereiche und überarbeiteter Journal Studio Das Panel war eine einzige Client-Komponente, die ihre Tabs über useState umschaltet: keine Route pro Bereich, kein Deep-Link, kein Zurück-Button, und nach jedem Reload landete man wieder auf "Pages". Auch der Journal-Editor hatte keine eigene URL. Jetzt sieben echte Routen (/admin, /admin/pages, /admin/journal, /admin/journal/<slug>, /admin/settings, /admin/settings/<section>, /admin/analytics). Die Shell mit Auth-Prüfung und Kopfzeile sitzt im Layout und umschließt children — so bleibt die Session-Prüfung über Routenwechsel montiert, statt bei jedem Tab-Wechsel neu zu laufen und den Spinner aufblitzen zu lassen. Unbekannte Settings-Sections fallen auf General zurück. Im selben Zug der Journal Studio, der die Routing-Änderung ohnehin berührt: * Alle Eingabefelder nutzten die Klasse `admin-input`, die in keinem CSS definiert war — sie fielen auf Browser-Defaults zurück. Jetzt gestylt, gescoped, damit der generische Name nicht ins übrige Panel leckt. * Der Split View ist per Divider verschiebbar (Maus, Tastatur, Doppelklick zum Zurücksetzen), Breite in localStorage. * Das Studio bricht aus der 1120px-Spalte aus, die Preview hat Platz. * Die Preview zeigte für jedes Foto fest 3:2 und log damit über das Layout der veröffentlichten Seite; die echten Verhältnisse werden jetzt an den Thumbnails gemessen. * Blöcke mit alten positionsbasierten Foto-Referenzen werden markiert — die lassen sich auf einer eigenständigen Journal-Seite nicht auflösen und verschwanden bisher stillschweigend. * Blocktyp-Chips als gemeinsame Komponente, monochrom und per Icon unterschieden statt in einer eigenen Blau/Lila/Orange-Palette, die sonst nirgends im Panel vorkommt. * Emojis raus, SVG-Icons rein. * fix(admin): Designsystem-Lücken im Panel schließen Eine systematische Suche nach Klassen, die im TSX benutzt, aber in keinem CSS definiert sind, hat vier Stellen mit demselben Muster gefunden: * `admin-btn-secondary` und `admin-btn-danger` existierten nicht. Sämtliche Löschen-Buttons sahen aus wie normale Buttons — keine Warnwirkung. Als `.admin-btn.admin-btn-danger` geschrieben, weil die Varianten mit den Größenklassen kombiniert werden, die weiter unten ihren eigenen Hintergrund setzen. * `page-progress-fill` fehlte: die Balken im Analytics-Panel waren leere Rinnen, der Wert unsichtbar. Ebenso `analytics-empty` und `admin-loading-container`. * `subpage-drawer-section`, `subpage-drawer-title-group` und `input-with-icon` im PageBuilder waren wirkungslos und teils mit Inline-Styles notdürftig kompensiert. * `grid-card-preview` fehlte, wodurch alle Layout-Vorschauen auf Höhe null kollabierten. Nur "Showcase" war sichtbar — und das aus Versehen, weil sein Tile `hero-tile` hieß und damit die `aspect-ratio` einer fremden PageBuilder-Klasse erbte. Umbenannt. Dazu die Theme-Vorschauen, die praktisch identisch aussahen: alle sieben zeigten dieselben drei quadratischen Kacheln, einziger Unterschied war die Hintergrundfarbe. Sie spiegeln jetzt die echten Preset-Daten aus lib/config/theme.ts — Schriftcharakter, Eckradius, Rasterdichte, Passepartout bzw. Schatten. Die Kopfzeile richtet sich an einer gemeinsamen Steuerhöhe aus. Der "Site"-Link war höher als die Buttons daneben: `.admin-btn` hatte keine explizite line-height, und <button> bekommt box-sizing: border-box vom Browser, <a> nicht. Die Statusanzeige setzte weder Schriftfamilie noch -größe und fiel auf den Browser-Default zurück — sie war nie Teil des Designsystems. Jetzt gleiche Höhe und Typografie, Pillenform als Zustandsanzeige, Trenner zur Aktionsgruppe. Das dauerhafte Pulsieren des grünen Punkts entfällt; Animation bleibt den Zuständen vorbehalten, die Aufmerksamkeit brauchen. Restliche Emojis durch SVG-Icons ersetzt. * feat(admin): add scroll-to-top toggle and SVG arrow The back-to-top button was always on and drew its arrow with the ↑ text character. Add a `scrollToTop` setting (General section in the admin panel, defaults to on so existing sites are unaffected) and replace the glyph with a stroked SVG that inherits currentColor across all presets. Scroll handling is now rAF-throttled, and prefers-reduced-motion turns off both the hover lift and the smooth scroll. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * security(journal): escape author HTML instead of filtering it CodeQL flags 26 high-severity alerts on the release PR; the bulk of them point at sanitizeHtml(), a denylist of three regexes whose output goes into dangerouslySetInnerHTML. I reproduced the bypasses before changing anything — all four pass the old filter: <img src=x onerror=alert(1)> unquoted handler, regex wants quotes <img src=x onerror='alert(1)'> single quotes, same reason <svg onload=alert(1)> not a <script> tag javasjavascript:cript:alert(1) one-pass replace, the rest recombines Plus an attribute breakout in the link renderer, which interpolated the URL into href="${url}" unescaped: [x](" onmouseover=alert(1) x=") -> <a href="" onmouseover=alert(1" ...> Replaced with escaping. Every `&<>"'` in author text becomes an entity before any markdown rule runs, so the only tags in the output are the ones renderInlineMarkdown builds itself and a URL cannot leave its attribute. Link schemes are now an allowlist (http, https, mailto, tel, relative, anchor); anything else renders as plain text. The serializer needed decodeHtmlEntities to match: without it a save would write `&lt;` into the Markdown file and the next parse would escape the `&` again, corrupting the text further on every round trip. A test covers parse -> serialize -> parse stability. Two existing tests asserted the old behaviour and were rewritten rather than deleted: one expected the script tag to be *removed* from the output, the other expected the substring "onerror" to be absent. Both now assert the property that matters — that no tag can form — because `onerror` surviving as inert text is fine. Exploitation required admin access either way: journal and essay text comes from the studio or from content/*.md. This removes the weakness, it does not close an open door. * fix(journal): contain file paths, fix frontmatter escaping, defuse two regexes Follow-up to the CodeQL findings on release PR #432. I went through all 23 alerts individually; this addresses the ones that are worth addressing and documents the ones that are not. Path containment (12 alerts, all false positives). Every path built from a slug goes through isValidSlug(), a strict `/^[a-zA-Z0-9_-]+$/` allowlist — verified against `../../etc/passwd`, `foo/../../bar`, `a/b`, `..` and friends, all rejected. CodeQL cannot see it because the check lives in another module. Added a containedPath() helper that resolves the path and refuses anything landing outside the content directory: a second lock on a door that was already locked, and a barrier the analysis can follow. Also removed the dead `slug.endsWith('.md')` branches — isValidSlug rejects dots, so they could never be taken. Frontmatter escaping (1 alert, a real bug). The serializer escaped `"` but not `\`, and the parser never unescaped anything. A title containing either character gained a backslash on every save/load cycle: Path C:\Users "quoted" -> Path C:\\Users \"quoted\" -> ... Escaping now covers the backslash first and the parser undoes both. A round trip test covers quotes, backslashes, colons and apostrophes. Two of three ReDoS regexes (2 alerts). The heading pattern had `\s+` next to `(.+)`, which overlap, so the engine tried every split of the whitespace run before failing; it is `[ \t]+` and `(\S.*)` now. The quote author pattern wrapped a lazy group around an optional group — the quadratic case — and is an index split on the first separator now. The third regex, the bold/italic pass, is deliberately left alone. Rewriting it with a negated class removes the backtracking but breaks nesting: `**bold *and italic* here**` renders as `*<em>bold </em>and italic<em> here</em>*`. The input is Markdown from an authenticated admin, never a visitor, so the worst case is an author slowing down their own page. The comment in the code says so. Not addressed: 5 js/insufficient-password-hash alerts. They ask for a slow KDF where the code uses SHA-256/HMAC — correct in general, but the admin password comes from an environment variable and is never stored, so a stronger KDF protects nothing that is not already in plaintext in the environment. 399 unit tests pass (18 new), build and tsc clean. * fix(journal): split the quote author by scanning, not by pattern Cleaning up after myself. #439 replaced the quote author regex `/^(.*?)(?:\s+--\s+(.+))?$/` — a lazy group around an optional one, the quadratic case — with `/\s+--\s+/`, and CodeQL promptly flagged the replacement for the same reason. One reported pattern traded for another. splitQuoteAuthor() scans for the first `--` that has whitespace on both sides. Linear, and it needs no reasoning about the regex engine at all. Behaviour is identical to the original regex, checked case by case against it: separator, no separator, several separators, tabs, wide gaps, `a--b` without spaces, leading and trailing separators, empty string. All nine are covered by tests, plus one asserting it stays fast on a 50k whitespace run. * security(admin): derive the session signing key with scrypt getSigningKey() ran the admin password through a single SHA-256 digest. It is key derivation rather than password storage, so it was never a stored-hash problem — but if the derived key ever leaked, one fast hash makes recovering the password by brute force cheap. CodeQL flags it as js/insufficient-password-hash and, for this particular alert, has a point. scrypt now. Two details that matter: The salt has to be stable. A random salt would produce a different key on every call and invalidate every session; it is derived from AUTH_SECRET, which is deployment-specific. Verified across separate processes: same inputs produce a verifying token, so a restart or redeploy does not log everyone out. The result is cached for the process lifetime. scrypt is deliberately slow and getSigningKey() runs on every admin request — deriving per call would add ~24ms to each one. The cache key is a digest of secret plus password, so a rotation misses the cache and derives again, and no extra plaintext copy of the password is kept around. Measured: first derivation 24ms, subsequent calls 0.12ms. Password change and secret change both invalidate an existing token, checked in separate processes. Note the one-time effect: existing admin sessions are invalidated by the change in derivation, so everyone logs in once more. * security(admin): key the signing-key cache on its inputs, not a digest #441 removed the SHA-256 digest of the admin password from the key derivation and introduced a new one three lines above it, as the cache key. Same rule, same file: CodeQL reported it immediately. The comment justifying it was wrong too. It claimed no second plaintext copy of the password was retained, while building the digest input allocates exactly that in order to hash it. The cache now holds the two input strings and compares them directly. They are the same objects the env and install caches already hold, so nothing extra is retained, and no fast hash of the password exists in memory for the life of the process. Re-verified after the change, in separate processes: a token from one process verifies in another with the same inputs, a changed password or secret rejects it, first derivation 24ms, cached calls 0.001ms. That leaves scrypt as the only place the password is hashed here. The two HMACs further down operate on the derived key and on token data, not on the password; the constant-time comparison in verifyAdminPassword is the previously dismissed one. --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
2026-08-14 16:55:07 +02:00
.album-drawer {
max-height: 95vh;
}
.album-drawer-body {
feat: redesign album drawer into a gorgeous centered two-column modal (#243) Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-05-31 21:30:00 +02:00
padding: 1.25rem;
}
}
feat: redesign admin pagebuilder with slide-over drawers and svg icons (#242) Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-05-31 21:27:13 +02:00
.album-drawer-body::-webkit-scrollbar {
width: 6px;
}
.album-drawer-body::-webkit-scrollbar-track {
background: transparent;
}
.album-drawer-body::-webkit-scrollbar-thumb {
background: var(--admin-border);
border-radius: 3px;
}
.album-drawer-body::-webkit-scrollbar-thumb:hover {
background: var(--admin-border-hover);
}
.album-drawer-footer {
feat: redesign album drawer into a gorgeous centered two-column modal (#243) Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-05-31 21:30:00 +02:00
padding: 1rem 1.5rem;
feat: redesign admin pagebuilder with slide-over drawers and svg icons (#242) Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-05-31 21:27:13 +02:00
border-top: 1px solid var(--admin-border);
background: var(--admin-bg-elevated);
display: flex;
release: v0.11.0 — journal fixes, admin URLs, design system cleanup (#432) * fix(screenshots): sharp-Typen fuer 0.34 und 0.35 gleichzeitig (#410) sharp 0.35 ist von `export =` auf ESM umgestellt: der Modul-Namespace ist nicht mehr aufrufbar, die Factory sitzt unter .default. Der Type-Check brach damit in scripts/screenshots.ts weg, sobald der Next-Bump (#402) sharp von 0.34.5 auf 0.35.3 mitzieht -- sharp ist hier keine deklarierte Dependency, sondern kommt ueber Next mit. Die Form wird jetzt aus dem installierten Paket abgeleitet statt festgeschrieben, zur Laufzeit wie im Typ. Geprueft mit beiden Versionen: tsc laeuft mit 0.34.5 und mit 0.35.3 fehlerfrei durch. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(deps): bump the nextjs group across 1 directory with 2 updates (#402) Bumps the nextjs group with 2 updates in the / directory: [next](https://github.com/vercel/next.js) and [eslint-config-next](https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next). Updates `next` from 16.2.12 to 16.3.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/compare/v16.2.12...v16.3.0) Updates `eslint-config-next` from 16.2.12 to 16.3.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/commits/v16.3.0/packages/eslint-config-next) --- updated-dependencies: - dependency-name: eslint-config-next dependency-version: 16.3.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: nextjs - dependency-name: next dependency-version: 16.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nextjs ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps-dev): bump prettier from 3.8.3 to 3.9.6 (#405) Bumps [prettier](https://github.com/prettier/prettier) from 3.8.3 to 3.9.6. - [Release notes](https://github.com/prettier/prettier/releases) - [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md) - [Commits](https://github.com/prettier/prettier/compare/3.8.3...3.9.6) --- updated-dependencies: - dependency-name: prettier dependency-version: 3.9.6 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * docs(changelog): Unreleased-Sektion fuer die Bumps nach v0.10.0 (#413) Die Dependency-PRs sind nach dem Release auf dev gelandet, teils auch auf main. Ohne Eintrag waeren sie beim naechsten Release unsichtbar -- inklusive Next 16.3.0, das CVE-2025-13465 mitbringt. Ausserdem im 0.10.0-Abschnitt nachgetragen, dass der Trivy-Scan bis #409 nie gelaufen ist. Der Fix steckt im Tag v0.10.0, fehlte aber in der Aufzaehlung -- und "Images werden bei jedem Publish gescannt" stand im Changelog, waehrend der Job im Action-Setup abbrach. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(gallery): per-album sort order, independent of Immich (#408) (#414) Album order was dictated entirely by Immich: getAlbum() sorted by the album's own asc/desc flag, so a Folio album always mirrored the archive. A curated series has a narrative order that has nothing to do with capture time, and changing the Immich album's sort to fit the website changes it for the archive too. Adds an optional per-album `sort` in gallery.yaml, editable in /admin, defaulting to today's behaviour so every existing config is unchanged: immich (default) | newest | oldest | filename | manual `manual` is a pinned *prefix*: `assetOrder` lists only the photos placed by hand, everything else follows in the album's Immich order. A full permutation of a 2,000-photo album would be ~80 KB of UUIDs in a file that is rewritten and copied to content/.backups/ on every admin save. It also makes drift fall out for free — photos removed in Immich never match, new ones land in the tail rather than being hidden. Sorting is applied after the cache read, not before the cache write, so the LRU keeps one canonical Immich-ordered copy per album. That avoids putting the mode in the cache key, lets a config change take effect without depending on invalidation, and keeps the stale-serving path correct. cache.get() returns the stored object by reference, so withSort() returns a shallow clone with a new array — sorting in place would reorder the shared entry, and under request coalescing every concurrent caller would be sorting the same array. Also fixes a prerequisite bug: /api/admin/albums/[albumId]/assets read album.assets from GET /albums/:id, which Immich 3.x no longer populates (lib/immich.ts:507). The hero picker's "This Album" tab returned nothing and threw outright when the key was absent. It now goes through the client's paginated metadata search, with ?types=all to opt videos in for the reorder editor. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): drop decorative emoji from the sort select labels (#415) An <option> cannot contain markup, so the SVG set in Icons is not reachable there — but a decorative emoji is not a substitute for it. Plain text instead; the album card badge already uses a real icon. The remaining emoji in the admin panel (asset picker tabs, section headings, layout picker options) predate this branch and are left for a separate cleanup. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): replace emoji icons with the shared SVG icon set (#416) The admin panel mixed two icon conventions: inline SVGs from `Icons.tsx` in most components, and decorative emoji in the asset picker and a few PageBuilder labels. Emoji render inconsistently across platforms, ignore the accent colour, and cannot inherit the `.svg-icon` sizing rules. - Icons.tsx: add `IconStar` (filled — it marks a state, not an action) and `IconImage`. - AssetPicker: the three tab labels and the favourite tile badge now use IconFolder / IconStar / IconImage. - PageBuilder: the "Standalone Albums" and "Subpages" headings use the icon set instead of an emoji. - PageBuilder: the layout picker drops its emoji for plain text. An <option> cannot contain markup, so an SVG is impossible there and a decorative glyph is not a substitute. - admin.css: align icon and label in the picker tabs, and swap the favourite badge's text-shadow for drop-shadow, which is what applies to an inline SVG. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): fold PageBuilder's local icons into the shared Icons module (#418) * refactor(admin): fold PageBuilder's local icons into the shared module PageBuilder.tsx carried its own `Icons` object duplicating most of the glyphs already exported by Icons.tsx, with hardcoded sizes and slightly divergent paths. Migrate all 32 call sites to the shared module and delete the local object. Five glyphs had no counterpart and are added to Icons.tsx as 1:1 ports of the local paths: IconX, IconPlus, IconHome, IconCopy, IconImage. The local ExternalLink and Check are dropped rather than ported — both had zero call sites. Two glyphs change shape slightly, which is the point of consolidating: the shared IconCamera includes the viewfinder bump the local copy omitted, and drag handles now use IconGripVertical. IconGripVertical uses the module's square 24x24 viewBox, so `.svg-drag` goes from 12x18 to 18x18 — the old non-square box would letterbox the glyph down to 12x12 and shrink the handle. * fix(admin): resolve icon-module integration after #416 Merging dev brought in #416, which added a second IconImage to Icons.tsx and two <Icons.Camera>/<Icons.Folder> section headers that reference the local Icons object this PR removes. Git merged both cleanly but the result did not type-check. - drop the duplicate IconImage (both copies were byte-identical) - point the two section headers at the imported IconCamera/IconFolder - refresh the SORT_LABELS comment: the icon set is imported now, not declared below --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> * fix(config): allow an empty gallery, guard against a double /api suffix (#421) An empty gallery is now a valid, rendered state instead of a throw: deriveGallery() no longer requires at least one album or subpage, so a deployment with no albums yet renders a bare homepage the owner can fill in via /admin. getConfig() also stops appending /api to an Immich URL that already ends in it, which previously produced .../api/api and broke every upstream request. Includes a restore of the per-album sort test cases, which the branch had lost by being cut before #408/#414. * feat(admin): favicon upload, served from the content volume (#422) Adds a bundled default favicon, an upload widget in admin Settings > General, and a route that serves the icon from the writable content/ volume with a fallback to the bundled default. Raster uploads (PNG/ICO/JPEG) are wrapped in an SVG container; the response carries its own CSP so an uploaded SVG cannot execute script on the origin. The GET route revalidates with an ETag instead of caching immutably, so a newly uploaded icon shows up immediately. Uploads are written via temp file + rename, and a Reset button restores the bundled default. * ci: flag unformatted files in a PR, without blocking it (#424) Prettier is configured as an error rule in eslint.config.mjs but has never run in CI, so part of the tree predates it. A final CI step now diffs against the PR base, runs prettier --list-different over the changed files, and emits a warning annotation per offender plus a job summary. Advisory by design: it never fails the job. Blocking would turn a PR red for merely touching a file that was already unformatted, and normalising the tree in one commit would wreck git blame and conflict with the PRs in flight. Requires fetch-depth: 0, since diffing against the base needs its history. * feat(install): first-run wizard gated by a one-time setup token (#419) Adds /install, a four-step first-run wizard: connect to Immich, optionally pick albums, name the site, finish. It verifies the credentials against the Immich server before writing anything, then writes gallery.yaml, settings.yaml and a content/install.json carrying the Immich credentials and a generated site secret. install.json exists because a running process cannot pick up new env vars — the wizard has to write configuration that takes effect without a restart. getInstallCredentials() merges it under the real environment, so env vars always win and rotation stays a matter of setting one. Both the page and the API routes are gated by a one-time setup token printed to the server log, so a deployment that is reachable before gallery.yaml exists cannot be configured by whoever finds it first. The token is stored in content/.setup-token (0600) rather than a module variable: Next.js bundles the page and each route handler separately, so a module-level token left the page and the API disagreeing inside one process and the wizard stuck on step 1. It is removed once the install completes. The admin password is stored as an scrypt hash using the scheme lib/auth.ts already applies to album passwords; a plaintext ADMIN_PASSWORD env var keeps working. * docs: document the setup wizard, fix the read-only content mount (#425) Quick Start now leads with the /install wizard, with the hand-written YAML route kept alongside it, and a First-Run Setup section covers the setup token, the files the wizard writes, and env-var precedence. Two corrections: both Docker examples mounted content/ as :ro, which silently breaks the wizard, the admin panel and the backup rotation alike — docs/admin-panel.md already said so and the README contradicted it. And nothing documented that content/install.json holds the Immich API key, so a backup of content/ is a backup of credentials. Also adds a Contributors section crediting the people whose work is in the project. * feat(admin): floating save bar pinned to the bottom of the viewport (#426) The save bar was the first, static element inside .admin-main. Since the document itself scrolls, it left the viewport as soon as you scrolled down — editing a subpage section or a settings block far below gave no visible dirty hint and no reachable save button. Replace it with a bottom-pinned floating bar shared by both editors. It only mounts while there is something to act on (unsaved changes, an in-flight save, or a result message), so it never covers content while idle. The success message clears after 5s, which hides the bar again. - new SaveBar component, replacing the duplicated markup in PageBuilder and SettingsEditor - adopt the previously unused .floating-save-bar CSS: slide-in keyframes (carrying translateX(-50%)), dirty border, wrap/gap, mobile variant and a prefers-reduced-motion opt-out; z-index 900 keeps it below modals - .admin-main gains bottom padding so the bar never covers page content - drop the now-unreachable idle hints: the ⌘S hint becomes a button title, the Live Sync note becomes a static line above the settings layout - header "Site" link now bypasses the cache (/?fresh=1), so the preview stays reachable when the bar is hidden Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(admin): themed listbox for the album sort control (#427) The per-album "Photo order" control was a native <select>. Because an <option> cannot contain markup, its choices could not use the admin panel's currentColor SVG set — the reason #415 had to fall back to plain text after dropping the emoji labels. Adds a Listbox component implementing the ARIA combobox/listbox pattern, so options can render a glyph beside their label: - DOM focus stays on the trigger button; the active option is announced through aria-activedescendant, keeping focus management to one element - Keyboard: arrows (clamped at the ends, like a native select), Home/End, Enter/Space to commit, Escape to cancel, Tab commits and moves on, and prefix type-ahead with a repeat-key cycle - Outside dismissal on pointerdown, so a press starting outside closes the popup before the click retargets The sort options now carry an icon each: calendar, arrow-down, arrow-up, an A→Z marker, and the drag glyph for manual — matching the badge the album card already shows. SORT_LABELS stays plain text because the badge feeds it to a title attribute. Closes #417 Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(git): ignore generated design handoff folders * fix(admin): stop the album sort dropdown clipping, and simplify the panel (#428) * fix(admin): render listbox popup in a portal so it escapes modal clipping The sort control's popup was position:absolute inside three clipping ancestors (.album-drawer overflow:hidden > .album-drawer-body overflow-y:auto > .modal-right-column overflow-y:auto), so it was cut off at the bottom of the Edit Album Details modal. z-index could not help: clipping happens before stacking. It also always hung below the trigger, with no flip. Portal the popup to document.body and position it from the trigger's viewport rect, flipping above when there is more room there and capping max-height to the space available so it scrolls internally rather than overflowing. It is dismissed on scroll and resize, since the anchor is only measured on open. The outside-pointerdown handler now also treats the popup as inside; without that the portalled list counts as outside, and a click on an option would close it before the selection commits. * refactor(admin): single-column album details panel The left column spent 1.2fr on a cover thumbnail and three stat rows, two of which (Status, Custom Hero) only restated the form fields opposite them, while the form itself was squeezed into 1.8fr behind a second nested scroller. Stack the drawer in one column instead: cover as a banner, then the form at full width, with the UUID moved into the footer. The body is now the only scroll container, which also removes one of the ancestors that was clipping the sort popup. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> * fix(admin): give the portalled listbox its theme back, lock the page behind modals (#429) Two defects in the album editor. The sort listbox popup painted transparent. Every --admin-* variable is scoped to .admin-layout, and since the popup moved into document.body it sits outside that subtree, so background/border/text all resolved to nothing. It now carries its own copy of the palette in both colour schemes, plus the font it no longer inherits. Scrolling inside a modal also moved the page behind it. No admin modal ever locked body scroll: the overlay covers the page but does not absorb wheel events, so a scroll starting on the backdrop — or continuing past the end of the modal's own scroller — reaches the document. overscroll-behavior cannot cover that case on its own, because it only applies to scroll containers and the backdrop is not one. useScrollLock freezes body while a modal is open and compensates for the width the scrollbar gives up, so nothing shifts underneath. Each lock restores the inline value it found, which makes nesting work without a counter — a picker opened from the drawer restores the drawer's hidden state instead of clearing it. Applied to both drawers and all four picker modals, which share the defect. overscroll-behavior: contain on the scrollers stops the chaining they can handle themselves. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com> * fix(security): allow unsafe-eval in CSP script-src during dev mode * feat(journal): add Journal Studio with split-screen editor, live preview and dedicated routes * fix(build): separate client parser from server journal-service and fix build type errors * fix(journal): Fotos rendern, Layout und Lightbox-Steuerung korrigieren Fünf unabhängige Fehler in der öffentlichen Journal- und Essay-Ansicht: * Foto-Blöcke wurden nie angezeigt. EssayView löst ein Foto über PhotoItem.id auf, und das sind verschlüsselte Tokens — die Blöcke aus dem Markdown tragen aber rohe Asset-UUIDs. Jede Zuordnung lief ins Leere, und nicht auflösbare Blöcke werden still verworfen. Die IDs werden jetzt serverseitig übersetzt; damit verschwinden nebenbei die rohen UUIDs aus dem Client-Payload, die dort laut Projektregel nie auftauchen dürfen. Nicht auflösbare Referenzen werden geloggt. * Überschriften standen weiter links als der Fließtext. Jeder Block hatte einzeln `max-width: 68ch`, und `ch` ist relativ zur Schrift des Elements — die Serif-Überschrift ergab eine breitere Spalte. Ersetzt durch eine gemeinsame, font-unabhängige `--essay-measure`. * Fullbleed-Fotos bluteten nur nach links aus: `.essay-figure` ist `width: 100%`, wodurch die Box überbestimmt ist und der negative rechte Margin verworfen wird. * Foto-Paare stellten beide Bilder gleich breit dar, wodurch ein Hochformat neben einem Querformat doppelt so hoch wurde. Jetzt eine Justified-Reihe: Breite proportional zum Seitenverhältnis, dadurch exakt gleiche Höhen ohne Beschnitt. * Die Lightbox hatte im Journal keine Tastatursteuerung und keine Scroll-Sperre — beides lag in PhotoGrid, also nur im Album-Raster. Verlagert in die Lightbox selbst, der doppelte Handler in PhotoGrid entfernt (sonst wäre pro Pfeildruck zwei Bilder weitergesprungen). Zusätzlich sind Proofing-Herzen und das EXIF-Panel im redaktionellen Modus abschaltbar und im Journal aus: Client-Proofing ist ein Übergabe-Workflow für Alben, keine Funktion einer Reportage. Auf der Übersicht wurde der Untertitel doppelt gerendert, weil extractExcerpt() auf ihn zurückfällt. * feat(admin): eigene URLs für alle Bereiche und überarbeiteter Journal Studio Das Panel war eine einzige Client-Komponente, die ihre Tabs über useState umschaltet: keine Route pro Bereich, kein Deep-Link, kein Zurück-Button, und nach jedem Reload landete man wieder auf "Pages". Auch der Journal-Editor hatte keine eigene URL. Jetzt sieben echte Routen (/admin, /admin/pages, /admin/journal, /admin/journal/<slug>, /admin/settings, /admin/settings/<section>, /admin/analytics). Die Shell mit Auth-Prüfung und Kopfzeile sitzt im Layout und umschließt children — so bleibt die Session-Prüfung über Routenwechsel montiert, statt bei jedem Tab-Wechsel neu zu laufen und den Spinner aufblitzen zu lassen. Unbekannte Settings-Sections fallen auf General zurück. Im selben Zug der Journal Studio, der die Routing-Änderung ohnehin berührt: * Alle Eingabefelder nutzten die Klasse `admin-input`, die in keinem CSS definiert war — sie fielen auf Browser-Defaults zurück. Jetzt gestylt, gescoped, damit der generische Name nicht ins übrige Panel leckt. * Der Split View ist per Divider verschiebbar (Maus, Tastatur, Doppelklick zum Zurücksetzen), Breite in localStorage. * Das Studio bricht aus der 1120px-Spalte aus, die Preview hat Platz. * Die Preview zeigte für jedes Foto fest 3:2 und log damit über das Layout der veröffentlichten Seite; die echten Verhältnisse werden jetzt an den Thumbnails gemessen. * Blöcke mit alten positionsbasierten Foto-Referenzen werden markiert — die lassen sich auf einer eigenständigen Journal-Seite nicht auflösen und verschwanden bisher stillschweigend. * Blocktyp-Chips als gemeinsame Komponente, monochrom und per Icon unterschieden statt in einer eigenen Blau/Lila/Orange-Palette, die sonst nirgends im Panel vorkommt. * Emojis raus, SVG-Icons rein. * fix(admin): Designsystem-Lücken im Panel schließen Eine systematische Suche nach Klassen, die im TSX benutzt, aber in keinem CSS definiert sind, hat vier Stellen mit demselben Muster gefunden: * `admin-btn-secondary` und `admin-btn-danger` existierten nicht. Sämtliche Löschen-Buttons sahen aus wie normale Buttons — keine Warnwirkung. Als `.admin-btn.admin-btn-danger` geschrieben, weil die Varianten mit den Größenklassen kombiniert werden, die weiter unten ihren eigenen Hintergrund setzen. * `page-progress-fill` fehlte: die Balken im Analytics-Panel waren leere Rinnen, der Wert unsichtbar. Ebenso `analytics-empty` und `admin-loading-container`. * `subpage-drawer-section`, `subpage-drawer-title-group` und `input-with-icon` im PageBuilder waren wirkungslos und teils mit Inline-Styles notdürftig kompensiert. * `grid-card-preview` fehlte, wodurch alle Layout-Vorschauen auf Höhe null kollabierten. Nur "Showcase" war sichtbar — und das aus Versehen, weil sein Tile `hero-tile` hieß und damit die `aspect-ratio` einer fremden PageBuilder-Klasse erbte. Umbenannt. Dazu die Theme-Vorschauen, die praktisch identisch aussahen: alle sieben zeigten dieselben drei quadratischen Kacheln, einziger Unterschied war die Hintergrundfarbe. Sie spiegeln jetzt die echten Preset-Daten aus lib/config/theme.ts — Schriftcharakter, Eckradius, Rasterdichte, Passepartout bzw. Schatten. Die Kopfzeile richtet sich an einer gemeinsamen Steuerhöhe aus. Der "Site"-Link war höher als die Buttons daneben: `.admin-btn` hatte keine explizite line-height, und <button> bekommt box-sizing: border-box vom Browser, <a> nicht. Die Statusanzeige setzte weder Schriftfamilie noch -größe und fiel auf den Browser-Default zurück — sie war nie Teil des Designsystems. Jetzt gleiche Höhe und Typografie, Pillenform als Zustandsanzeige, Trenner zur Aktionsgruppe. Das dauerhafte Pulsieren des grünen Punkts entfällt; Animation bleibt den Zuständen vorbehalten, die Aufmerksamkeit brauchen. Restliche Emojis durch SVG-Icons ersetzt. * feat(admin): add scroll-to-top toggle and SVG arrow The back-to-top button was always on and drew its arrow with the ↑ text character. Add a `scrollToTop` setting (General section in the admin panel, defaults to on so existing sites are unaffected) and replace the glyph with a stroked SVG that inherits currentColor across all presets. Scroll handling is now rAF-throttled, and prefers-reduced-motion turns off both the hover lift and the smooth scroll. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * security(journal): escape author HTML instead of filtering it CodeQL flags 26 high-severity alerts on the release PR; the bulk of them point at sanitizeHtml(), a denylist of three regexes whose output goes into dangerouslySetInnerHTML. I reproduced the bypasses before changing anything — all four pass the old filter: <img src=x onerror=alert(1)> unquoted handler, regex wants quotes <img src=x onerror='alert(1)'> single quotes, same reason <svg onload=alert(1)> not a <script> tag javasjavascript:cript:alert(1) one-pass replace, the rest recombines Plus an attribute breakout in the link renderer, which interpolated the URL into href="${url}" unescaped: [x](" onmouseover=alert(1) x=") -> <a href="" onmouseover=alert(1" ...> Replaced with escaping. Every `&<>"'` in author text becomes an entity before any markdown rule runs, so the only tags in the output are the ones renderInlineMarkdown builds itself and a URL cannot leave its attribute. Link schemes are now an allowlist (http, https, mailto, tel, relative, anchor); anything else renders as plain text. The serializer needed decodeHtmlEntities to match: without it a save would write `&lt;` into the Markdown file and the next parse would escape the `&` again, corrupting the text further on every round trip. A test covers parse -> serialize -> parse stability. Two existing tests asserted the old behaviour and were rewritten rather than deleted: one expected the script tag to be *removed* from the output, the other expected the substring "onerror" to be absent. Both now assert the property that matters — that no tag can form — because `onerror` surviving as inert text is fine. Exploitation required admin access either way: journal and essay text comes from the studio or from content/*.md. This removes the weakness, it does not close an open door. * fix(journal): contain file paths, fix frontmatter escaping, defuse two regexes Follow-up to the CodeQL findings on release PR #432. I went through all 23 alerts individually; this addresses the ones that are worth addressing and documents the ones that are not. Path containment (12 alerts, all false positives). Every path built from a slug goes through isValidSlug(), a strict `/^[a-zA-Z0-9_-]+$/` allowlist — verified against `../../etc/passwd`, `foo/../../bar`, `a/b`, `..` and friends, all rejected. CodeQL cannot see it because the check lives in another module. Added a containedPath() helper that resolves the path and refuses anything landing outside the content directory: a second lock on a door that was already locked, and a barrier the analysis can follow. Also removed the dead `slug.endsWith('.md')` branches — isValidSlug rejects dots, so they could never be taken. Frontmatter escaping (1 alert, a real bug). The serializer escaped `"` but not `\`, and the parser never unescaped anything. A title containing either character gained a backslash on every save/load cycle: Path C:\Users "quoted" -> Path C:\\Users \"quoted\" -> ... Escaping now covers the backslash first and the parser undoes both. A round trip test covers quotes, backslashes, colons and apostrophes. Two of three ReDoS regexes (2 alerts). The heading pattern had `\s+` next to `(.+)`, which overlap, so the engine tried every split of the whitespace run before failing; it is `[ \t]+` and `(\S.*)` now. The quote author pattern wrapped a lazy group around an optional group — the quadratic case — and is an index split on the first separator now. The third regex, the bold/italic pass, is deliberately left alone. Rewriting it with a negated class removes the backtracking but breaks nesting: `**bold *and italic* here**` renders as `*<em>bold </em>and italic<em> here</em>*`. The input is Markdown from an authenticated admin, never a visitor, so the worst case is an author slowing down their own page. The comment in the code says so. Not addressed: 5 js/insufficient-password-hash alerts. They ask for a slow KDF where the code uses SHA-256/HMAC — correct in general, but the admin password comes from an environment variable and is never stored, so a stronger KDF protects nothing that is not already in plaintext in the environment. 399 unit tests pass (18 new), build and tsc clean. * fix(journal): split the quote author by scanning, not by pattern Cleaning up after myself. #439 replaced the quote author regex `/^(.*?)(?:\s+--\s+(.+))?$/` — a lazy group around an optional one, the quadratic case — with `/\s+--\s+/`, and CodeQL promptly flagged the replacement for the same reason. One reported pattern traded for another. splitQuoteAuthor() scans for the first `--` that has whitespace on both sides. Linear, and it needs no reasoning about the regex engine at all. Behaviour is identical to the original regex, checked case by case against it: separator, no separator, several separators, tabs, wide gaps, `a--b` without spaces, leading and trailing separators, empty string. All nine are covered by tests, plus one asserting it stays fast on a 50k whitespace run. * security(admin): derive the session signing key with scrypt getSigningKey() ran the admin password through a single SHA-256 digest. It is key derivation rather than password storage, so it was never a stored-hash problem — but if the derived key ever leaked, one fast hash makes recovering the password by brute force cheap. CodeQL flags it as js/insufficient-password-hash and, for this particular alert, has a point. scrypt now. Two details that matter: The salt has to be stable. A random salt would produce a different key on every call and invalidate every session; it is derived from AUTH_SECRET, which is deployment-specific. Verified across separate processes: same inputs produce a verifying token, so a restart or redeploy does not log everyone out. The result is cached for the process lifetime. scrypt is deliberately slow and getSigningKey() runs on every admin request — deriving per call would add ~24ms to each one. The cache key is a digest of secret plus password, so a rotation misses the cache and derives again, and no extra plaintext copy of the password is kept around. Measured: first derivation 24ms, subsequent calls 0.12ms. Password change and secret change both invalidate an existing token, checked in separate processes. Note the one-time effect: existing admin sessions are invalidated by the change in derivation, so everyone logs in once more. * security(admin): key the signing-key cache on its inputs, not a digest #441 removed the SHA-256 digest of the admin password from the key derivation and introduced a new one three lines above it, as the cache key. Same rule, same file: CodeQL reported it immediately. The comment justifying it was wrong too. It claimed no second plaintext copy of the password was retained, while building the digest input allocates exactly that in order to hash it. The cache now holds the two input strings and compares them directly. They are the same objects the env and install caches already hold, so nothing extra is retained, and no fast hash of the password exists in memory for the life of the process. Re-verified after the change, in separate processes: a token from one process verifies in another with the same inputs, a changed password or secret rejects it, first derivation 24ms, cached calls 0.001ms. That leaves scrypt as the only place the password is hashed here. The two HMACs further down operate on the derived key and on token data, not on the password; the constant-time comparison in verifyAdminPassword is the previously dismissed one. --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
2026-08-14 16:55:07 +02:00
align-items: center;
feat: redesign album drawer into a gorgeous centered two-column modal (#243) Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-05-31 21:30:00 +02:00
justify-content: space-between;
release: v0.11.0 — journal fixes, admin URLs, design system cleanup (#432) * fix(screenshots): sharp-Typen fuer 0.34 und 0.35 gleichzeitig (#410) sharp 0.35 ist von `export =` auf ESM umgestellt: der Modul-Namespace ist nicht mehr aufrufbar, die Factory sitzt unter .default. Der Type-Check brach damit in scripts/screenshots.ts weg, sobald der Next-Bump (#402) sharp von 0.34.5 auf 0.35.3 mitzieht -- sharp ist hier keine deklarierte Dependency, sondern kommt ueber Next mit. Die Form wird jetzt aus dem installierten Paket abgeleitet statt festgeschrieben, zur Laufzeit wie im Typ. Geprueft mit beiden Versionen: tsc laeuft mit 0.34.5 und mit 0.35.3 fehlerfrei durch. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(deps): bump the nextjs group across 1 directory with 2 updates (#402) Bumps the nextjs group with 2 updates in the / directory: [next](https://github.com/vercel/next.js) and [eslint-config-next](https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next). Updates `next` from 16.2.12 to 16.3.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/compare/v16.2.12...v16.3.0) Updates `eslint-config-next` from 16.2.12 to 16.3.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/commits/v16.3.0/packages/eslint-config-next) --- updated-dependencies: - dependency-name: eslint-config-next dependency-version: 16.3.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: nextjs - dependency-name: next dependency-version: 16.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nextjs ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps-dev): bump prettier from 3.8.3 to 3.9.6 (#405) Bumps [prettier](https://github.com/prettier/prettier) from 3.8.3 to 3.9.6. - [Release notes](https://github.com/prettier/prettier/releases) - [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md) - [Commits](https://github.com/prettier/prettier/compare/3.8.3...3.9.6) --- updated-dependencies: - dependency-name: prettier dependency-version: 3.9.6 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * docs(changelog): Unreleased-Sektion fuer die Bumps nach v0.10.0 (#413) Die Dependency-PRs sind nach dem Release auf dev gelandet, teils auch auf main. Ohne Eintrag waeren sie beim naechsten Release unsichtbar -- inklusive Next 16.3.0, das CVE-2025-13465 mitbringt. Ausserdem im 0.10.0-Abschnitt nachgetragen, dass der Trivy-Scan bis #409 nie gelaufen ist. Der Fix steckt im Tag v0.10.0, fehlte aber in der Aufzaehlung -- und "Images werden bei jedem Publish gescannt" stand im Changelog, waehrend der Job im Action-Setup abbrach. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(gallery): per-album sort order, independent of Immich (#408) (#414) Album order was dictated entirely by Immich: getAlbum() sorted by the album's own asc/desc flag, so a Folio album always mirrored the archive. A curated series has a narrative order that has nothing to do with capture time, and changing the Immich album's sort to fit the website changes it for the archive too. Adds an optional per-album `sort` in gallery.yaml, editable in /admin, defaulting to today's behaviour so every existing config is unchanged: immich (default) | newest | oldest | filename | manual `manual` is a pinned *prefix*: `assetOrder` lists only the photos placed by hand, everything else follows in the album's Immich order. A full permutation of a 2,000-photo album would be ~80 KB of UUIDs in a file that is rewritten and copied to content/.backups/ on every admin save. It also makes drift fall out for free — photos removed in Immich never match, new ones land in the tail rather than being hidden. Sorting is applied after the cache read, not before the cache write, so the LRU keeps one canonical Immich-ordered copy per album. That avoids putting the mode in the cache key, lets a config change take effect without depending on invalidation, and keeps the stale-serving path correct. cache.get() returns the stored object by reference, so withSort() returns a shallow clone with a new array — sorting in place would reorder the shared entry, and under request coalescing every concurrent caller would be sorting the same array. Also fixes a prerequisite bug: /api/admin/albums/[albumId]/assets read album.assets from GET /albums/:id, which Immich 3.x no longer populates (lib/immich.ts:507). The hero picker's "This Album" tab returned nothing and threw outright when the key was absent. It now goes through the client's paginated metadata search, with ?types=all to opt videos in for the reorder editor. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): drop decorative emoji from the sort select labels (#415) An <option> cannot contain markup, so the SVG set in Icons is not reachable there — but a decorative emoji is not a substitute for it. Plain text instead; the album card badge already uses a real icon. The remaining emoji in the admin panel (asset picker tabs, section headings, layout picker options) predate this branch and are left for a separate cleanup. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): replace emoji icons with the shared SVG icon set (#416) The admin panel mixed two icon conventions: inline SVGs from `Icons.tsx` in most components, and decorative emoji in the asset picker and a few PageBuilder labels. Emoji render inconsistently across platforms, ignore the accent colour, and cannot inherit the `.svg-icon` sizing rules. - Icons.tsx: add `IconStar` (filled — it marks a state, not an action) and `IconImage`. - AssetPicker: the three tab labels and the favourite tile badge now use IconFolder / IconStar / IconImage. - PageBuilder: the "Standalone Albums" and "Subpages" headings use the icon set instead of an emoji. - PageBuilder: the layout picker drops its emoji for plain text. An <option> cannot contain markup, so an SVG is impossible there and a decorative glyph is not a substitute. - admin.css: align icon and label in the picker tabs, and swap the favourite badge's text-shadow for drop-shadow, which is what applies to an inline SVG. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): fold PageBuilder's local icons into the shared Icons module (#418) * refactor(admin): fold PageBuilder's local icons into the shared module PageBuilder.tsx carried its own `Icons` object duplicating most of the glyphs already exported by Icons.tsx, with hardcoded sizes and slightly divergent paths. Migrate all 32 call sites to the shared module and delete the local object. Five glyphs had no counterpart and are added to Icons.tsx as 1:1 ports of the local paths: IconX, IconPlus, IconHome, IconCopy, IconImage. The local ExternalLink and Check are dropped rather than ported — both had zero call sites. Two glyphs change shape slightly, which is the point of consolidating: the shared IconCamera includes the viewfinder bump the local copy omitted, and drag handles now use IconGripVertical. IconGripVertical uses the module's square 24x24 viewBox, so `.svg-drag` goes from 12x18 to 18x18 — the old non-square box would letterbox the glyph down to 12x12 and shrink the handle. * fix(admin): resolve icon-module integration after #416 Merging dev brought in #416, which added a second IconImage to Icons.tsx and two <Icons.Camera>/<Icons.Folder> section headers that reference the local Icons object this PR removes. Git merged both cleanly but the result did not type-check. - drop the duplicate IconImage (both copies were byte-identical) - point the two section headers at the imported IconCamera/IconFolder - refresh the SORT_LABELS comment: the icon set is imported now, not declared below --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> * fix(config): allow an empty gallery, guard against a double /api suffix (#421) An empty gallery is now a valid, rendered state instead of a throw: deriveGallery() no longer requires at least one album or subpage, so a deployment with no albums yet renders a bare homepage the owner can fill in via /admin. getConfig() also stops appending /api to an Immich URL that already ends in it, which previously produced .../api/api and broke every upstream request. Includes a restore of the per-album sort test cases, which the branch had lost by being cut before #408/#414. * feat(admin): favicon upload, served from the content volume (#422) Adds a bundled default favicon, an upload widget in admin Settings > General, and a route that serves the icon from the writable content/ volume with a fallback to the bundled default. Raster uploads (PNG/ICO/JPEG) are wrapped in an SVG container; the response carries its own CSP so an uploaded SVG cannot execute script on the origin. The GET route revalidates with an ETag instead of caching immutably, so a newly uploaded icon shows up immediately. Uploads are written via temp file + rename, and a Reset button restores the bundled default. * ci: flag unformatted files in a PR, without blocking it (#424) Prettier is configured as an error rule in eslint.config.mjs but has never run in CI, so part of the tree predates it. A final CI step now diffs against the PR base, runs prettier --list-different over the changed files, and emits a warning annotation per offender plus a job summary. Advisory by design: it never fails the job. Blocking would turn a PR red for merely touching a file that was already unformatted, and normalising the tree in one commit would wreck git blame and conflict with the PRs in flight. Requires fetch-depth: 0, since diffing against the base needs its history. * feat(install): first-run wizard gated by a one-time setup token (#419) Adds /install, a four-step first-run wizard: connect to Immich, optionally pick albums, name the site, finish. It verifies the credentials against the Immich server before writing anything, then writes gallery.yaml, settings.yaml and a content/install.json carrying the Immich credentials and a generated site secret. install.json exists because a running process cannot pick up new env vars — the wizard has to write configuration that takes effect without a restart. getInstallCredentials() merges it under the real environment, so env vars always win and rotation stays a matter of setting one. Both the page and the API routes are gated by a one-time setup token printed to the server log, so a deployment that is reachable before gallery.yaml exists cannot be configured by whoever finds it first. The token is stored in content/.setup-token (0600) rather than a module variable: Next.js bundles the page and each route handler separately, so a module-level token left the page and the API disagreeing inside one process and the wizard stuck on step 1. It is removed once the install completes. The admin password is stored as an scrypt hash using the scheme lib/auth.ts already applies to album passwords; a plaintext ADMIN_PASSWORD env var keeps working. * docs: document the setup wizard, fix the read-only content mount (#425) Quick Start now leads with the /install wizard, with the hand-written YAML route kept alongside it, and a First-Run Setup section covers the setup token, the files the wizard writes, and env-var precedence. Two corrections: both Docker examples mounted content/ as :ro, which silently breaks the wizard, the admin panel and the backup rotation alike — docs/admin-panel.md already said so and the README contradicted it. And nothing documented that content/install.json holds the Immich API key, so a backup of content/ is a backup of credentials. Also adds a Contributors section crediting the people whose work is in the project. * feat(admin): floating save bar pinned to the bottom of the viewport (#426) The save bar was the first, static element inside .admin-main. Since the document itself scrolls, it left the viewport as soon as you scrolled down — editing a subpage section or a settings block far below gave no visible dirty hint and no reachable save button. Replace it with a bottom-pinned floating bar shared by both editors. It only mounts while there is something to act on (unsaved changes, an in-flight save, or a result message), so it never covers content while idle. The success message clears after 5s, which hides the bar again. - new SaveBar component, replacing the duplicated markup in PageBuilder and SettingsEditor - adopt the previously unused .floating-save-bar CSS: slide-in keyframes (carrying translateX(-50%)), dirty border, wrap/gap, mobile variant and a prefers-reduced-motion opt-out; z-index 900 keeps it below modals - .admin-main gains bottom padding so the bar never covers page content - drop the now-unreachable idle hints: the ⌘S hint becomes a button title, the Live Sync note becomes a static line above the settings layout - header "Site" link now bypasses the cache (/?fresh=1), so the preview stays reachable when the bar is hidden Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(admin): themed listbox for the album sort control (#427) The per-album "Photo order" control was a native <select>. Because an <option> cannot contain markup, its choices could not use the admin panel's currentColor SVG set — the reason #415 had to fall back to plain text after dropping the emoji labels. Adds a Listbox component implementing the ARIA combobox/listbox pattern, so options can render a glyph beside their label: - DOM focus stays on the trigger button; the active option is announced through aria-activedescendant, keeping focus management to one element - Keyboard: arrows (clamped at the ends, like a native select), Home/End, Enter/Space to commit, Escape to cancel, Tab commits and moves on, and prefix type-ahead with a repeat-key cycle - Outside dismissal on pointerdown, so a press starting outside closes the popup before the click retargets The sort options now carry an icon each: calendar, arrow-down, arrow-up, an A→Z marker, and the drag glyph for manual — matching the badge the album card already shows. SORT_LABELS stays plain text because the badge feeds it to a title attribute. Closes #417 Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(git): ignore generated design handoff folders * fix(admin): stop the album sort dropdown clipping, and simplify the panel (#428) * fix(admin): render listbox popup in a portal so it escapes modal clipping The sort control's popup was position:absolute inside three clipping ancestors (.album-drawer overflow:hidden > .album-drawer-body overflow-y:auto > .modal-right-column overflow-y:auto), so it was cut off at the bottom of the Edit Album Details modal. z-index could not help: clipping happens before stacking. It also always hung below the trigger, with no flip. Portal the popup to document.body and position it from the trigger's viewport rect, flipping above when there is more room there and capping max-height to the space available so it scrolls internally rather than overflowing. It is dismissed on scroll and resize, since the anchor is only measured on open. The outside-pointerdown handler now also treats the popup as inside; without that the portalled list counts as outside, and a click on an option would close it before the selection commits. * refactor(admin): single-column album details panel The left column spent 1.2fr on a cover thumbnail and three stat rows, two of which (Status, Custom Hero) only restated the form fields opposite them, while the form itself was squeezed into 1.8fr behind a second nested scroller. Stack the drawer in one column instead: cover as a banner, then the form at full width, with the UUID moved into the footer. The body is now the only scroll container, which also removes one of the ancestors that was clipping the sort popup. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> * fix(admin): give the portalled listbox its theme back, lock the page behind modals (#429) Two defects in the album editor. The sort listbox popup painted transparent. Every --admin-* variable is scoped to .admin-layout, and since the popup moved into document.body it sits outside that subtree, so background/border/text all resolved to nothing. It now carries its own copy of the palette in both colour schemes, plus the font it no longer inherits. Scrolling inside a modal also moved the page behind it. No admin modal ever locked body scroll: the overlay covers the page but does not absorb wheel events, so a scroll starting on the backdrop — or continuing past the end of the modal's own scroller — reaches the document. overscroll-behavior cannot cover that case on its own, because it only applies to scroll containers and the backdrop is not one. useScrollLock freezes body while a modal is open and compensates for the width the scrollbar gives up, so nothing shifts underneath. Each lock restores the inline value it found, which makes nesting work without a counter — a picker opened from the drawer restores the drawer's hidden state instead of clearing it. Applied to both drawers and all four picker modals, which share the defect. overscroll-behavior: contain on the scrollers stops the chaining they can handle themselves. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com> * fix(security): allow unsafe-eval in CSP script-src during dev mode * feat(journal): add Journal Studio with split-screen editor, live preview and dedicated routes * fix(build): separate client parser from server journal-service and fix build type errors * fix(journal): Fotos rendern, Layout und Lightbox-Steuerung korrigieren Fünf unabhängige Fehler in der öffentlichen Journal- und Essay-Ansicht: * Foto-Blöcke wurden nie angezeigt. EssayView löst ein Foto über PhotoItem.id auf, und das sind verschlüsselte Tokens — die Blöcke aus dem Markdown tragen aber rohe Asset-UUIDs. Jede Zuordnung lief ins Leere, und nicht auflösbare Blöcke werden still verworfen. Die IDs werden jetzt serverseitig übersetzt; damit verschwinden nebenbei die rohen UUIDs aus dem Client-Payload, die dort laut Projektregel nie auftauchen dürfen. Nicht auflösbare Referenzen werden geloggt. * Überschriften standen weiter links als der Fließtext. Jeder Block hatte einzeln `max-width: 68ch`, und `ch` ist relativ zur Schrift des Elements — die Serif-Überschrift ergab eine breitere Spalte. Ersetzt durch eine gemeinsame, font-unabhängige `--essay-measure`. * Fullbleed-Fotos bluteten nur nach links aus: `.essay-figure` ist `width: 100%`, wodurch die Box überbestimmt ist und der negative rechte Margin verworfen wird. * Foto-Paare stellten beide Bilder gleich breit dar, wodurch ein Hochformat neben einem Querformat doppelt so hoch wurde. Jetzt eine Justified-Reihe: Breite proportional zum Seitenverhältnis, dadurch exakt gleiche Höhen ohne Beschnitt. * Die Lightbox hatte im Journal keine Tastatursteuerung und keine Scroll-Sperre — beides lag in PhotoGrid, also nur im Album-Raster. Verlagert in die Lightbox selbst, der doppelte Handler in PhotoGrid entfernt (sonst wäre pro Pfeildruck zwei Bilder weitergesprungen). Zusätzlich sind Proofing-Herzen und das EXIF-Panel im redaktionellen Modus abschaltbar und im Journal aus: Client-Proofing ist ein Übergabe-Workflow für Alben, keine Funktion einer Reportage. Auf der Übersicht wurde der Untertitel doppelt gerendert, weil extractExcerpt() auf ihn zurückfällt. * feat(admin): eigene URLs für alle Bereiche und überarbeiteter Journal Studio Das Panel war eine einzige Client-Komponente, die ihre Tabs über useState umschaltet: keine Route pro Bereich, kein Deep-Link, kein Zurück-Button, und nach jedem Reload landete man wieder auf "Pages". Auch der Journal-Editor hatte keine eigene URL. Jetzt sieben echte Routen (/admin, /admin/pages, /admin/journal, /admin/journal/<slug>, /admin/settings, /admin/settings/<section>, /admin/analytics). Die Shell mit Auth-Prüfung und Kopfzeile sitzt im Layout und umschließt children — so bleibt die Session-Prüfung über Routenwechsel montiert, statt bei jedem Tab-Wechsel neu zu laufen und den Spinner aufblitzen zu lassen. Unbekannte Settings-Sections fallen auf General zurück. Im selben Zug der Journal Studio, der die Routing-Änderung ohnehin berührt: * Alle Eingabefelder nutzten die Klasse `admin-input`, die in keinem CSS definiert war — sie fielen auf Browser-Defaults zurück. Jetzt gestylt, gescoped, damit der generische Name nicht ins übrige Panel leckt. * Der Split View ist per Divider verschiebbar (Maus, Tastatur, Doppelklick zum Zurücksetzen), Breite in localStorage. * Das Studio bricht aus der 1120px-Spalte aus, die Preview hat Platz. * Die Preview zeigte für jedes Foto fest 3:2 und log damit über das Layout der veröffentlichten Seite; die echten Verhältnisse werden jetzt an den Thumbnails gemessen. * Blöcke mit alten positionsbasierten Foto-Referenzen werden markiert — die lassen sich auf einer eigenständigen Journal-Seite nicht auflösen und verschwanden bisher stillschweigend. * Blocktyp-Chips als gemeinsame Komponente, monochrom und per Icon unterschieden statt in einer eigenen Blau/Lila/Orange-Palette, die sonst nirgends im Panel vorkommt. * Emojis raus, SVG-Icons rein. * fix(admin): Designsystem-Lücken im Panel schließen Eine systematische Suche nach Klassen, die im TSX benutzt, aber in keinem CSS definiert sind, hat vier Stellen mit demselben Muster gefunden: * `admin-btn-secondary` und `admin-btn-danger` existierten nicht. Sämtliche Löschen-Buttons sahen aus wie normale Buttons — keine Warnwirkung. Als `.admin-btn.admin-btn-danger` geschrieben, weil die Varianten mit den Größenklassen kombiniert werden, die weiter unten ihren eigenen Hintergrund setzen. * `page-progress-fill` fehlte: die Balken im Analytics-Panel waren leere Rinnen, der Wert unsichtbar. Ebenso `analytics-empty` und `admin-loading-container`. * `subpage-drawer-section`, `subpage-drawer-title-group` und `input-with-icon` im PageBuilder waren wirkungslos und teils mit Inline-Styles notdürftig kompensiert. * `grid-card-preview` fehlte, wodurch alle Layout-Vorschauen auf Höhe null kollabierten. Nur "Showcase" war sichtbar — und das aus Versehen, weil sein Tile `hero-tile` hieß und damit die `aspect-ratio` einer fremden PageBuilder-Klasse erbte. Umbenannt. Dazu die Theme-Vorschauen, die praktisch identisch aussahen: alle sieben zeigten dieselben drei quadratischen Kacheln, einziger Unterschied war die Hintergrundfarbe. Sie spiegeln jetzt die echten Preset-Daten aus lib/config/theme.ts — Schriftcharakter, Eckradius, Rasterdichte, Passepartout bzw. Schatten. Die Kopfzeile richtet sich an einer gemeinsamen Steuerhöhe aus. Der "Site"-Link war höher als die Buttons daneben: `.admin-btn` hatte keine explizite line-height, und <button> bekommt box-sizing: border-box vom Browser, <a> nicht. Die Statusanzeige setzte weder Schriftfamilie noch -größe und fiel auf den Browser-Default zurück — sie war nie Teil des Designsystems. Jetzt gleiche Höhe und Typografie, Pillenform als Zustandsanzeige, Trenner zur Aktionsgruppe. Das dauerhafte Pulsieren des grünen Punkts entfällt; Animation bleibt den Zuständen vorbehalten, die Aufmerksamkeit brauchen. Restliche Emojis durch SVG-Icons ersetzt. * feat(admin): add scroll-to-top toggle and SVG arrow The back-to-top button was always on and drew its arrow with the ↑ text character. Add a `scrollToTop` setting (General section in the admin panel, defaults to on so existing sites are unaffected) and replace the glyph with a stroked SVG that inherits currentColor across all presets. Scroll handling is now rAF-throttled, and prefers-reduced-motion turns off both the hover lift and the smooth scroll. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * security(journal): escape author HTML instead of filtering it CodeQL flags 26 high-severity alerts on the release PR; the bulk of them point at sanitizeHtml(), a denylist of three regexes whose output goes into dangerouslySetInnerHTML. I reproduced the bypasses before changing anything — all four pass the old filter: <img src=x onerror=alert(1)> unquoted handler, regex wants quotes <img src=x onerror='alert(1)'> single quotes, same reason <svg onload=alert(1)> not a <script> tag javasjavascript:cript:alert(1) one-pass replace, the rest recombines Plus an attribute breakout in the link renderer, which interpolated the URL into href="${url}" unescaped: [x](" onmouseover=alert(1) x=") -> <a href="" onmouseover=alert(1" ...> Replaced with escaping. Every `&<>"'` in author text becomes an entity before any markdown rule runs, so the only tags in the output are the ones renderInlineMarkdown builds itself and a URL cannot leave its attribute. Link schemes are now an allowlist (http, https, mailto, tel, relative, anchor); anything else renders as plain text. The serializer needed decodeHtmlEntities to match: without it a save would write `&lt;` into the Markdown file and the next parse would escape the `&` again, corrupting the text further on every round trip. A test covers parse -> serialize -> parse stability. Two existing tests asserted the old behaviour and were rewritten rather than deleted: one expected the script tag to be *removed* from the output, the other expected the substring "onerror" to be absent. Both now assert the property that matters — that no tag can form — because `onerror` surviving as inert text is fine. Exploitation required admin access either way: journal and essay text comes from the studio or from content/*.md. This removes the weakness, it does not close an open door. * fix(journal): contain file paths, fix frontmatter escaping, defuse two regexes Follow-up to the CodeQL findings on release PR #432. I went through all 23 alerts individually; this addresses the ones that are worth addressing and documents the ones that are not. Path containment (12 alerts, all false positives). Every path built from a slug goes through isValidSlug(), a strict `/^[a-zA-Z0-9_-]+$/` allowlist — verified against `../../etc/passwd`, `foo/../../bar`, `a/b`, `..` and friends, all rejected. CodeQL cannot see it because the check lives in another module. Added a containedPath() helper that resolves the path and refuses anything landing outside the content directory: a second lock on a door that was already locked, and a barrier the analysis can follow. Also removed the dead `slug.endsWith('.md')` branches — isValidSlug rejects dots, so they could never be taken. Frontmatter escaping (1 alert, a real bug). The serializer escaped `"` but not `\`, and the parser never unescaped anything. A title containing either character gained a backslash on every save/load cycle: Path C:\Users "quoted" -> Path C:\\Users \"quoted\" -> ... Escaping now covers the backslash first and the parser undoes both. A round trip test covers quotes, backslashes, colons and apostrophes. Two of three ReDoS regexes (2 alerts). The heading pattern had `\s+` next to `(.+)`, which overlap, so the engine tried every split of the whitespace run before failing; it is `[ \t]+` and `(\S.*)` now. The quote author pattern wrapped a lazy group around an optional group — the quadratic case — and is an index split on the first separator now. The third regex, the bold/italic pass, is deliberately left alone. Rewriting it with a negated class removes the backtracking but breaks nesting: `**bold *and italic* here**` renders as `*<em>bold </em>and italic<em> here</em>*`. The input is Markdown from an authenticated admin, never a visitor, so the worst case is an author slowing down their own page. The comment in the code says so. Not addressed: 5 js/insufficient-password-hash alerts. They ask for a slow KDF where the code uses SHA-256/HMAC — correct in general, but the admin password comes from an environment variable and is never stored, so a stronger KDF protects nothing that is not already in plaintext in the environment. 399 unit tests pass (18 new), build and tsc clean. * fix(journal): split the quote author by scanning, not by pattern Cleaning up after myself. #439 replaced the quote author regex `/^(.*?)(?:\s+--\s+(.+))?$/` — a lazy group around an optional one, the quadratic case — with `/\s+--\s+/`, and CodeQL promptly flagged the replacement for the same reason. One reported pattern traded for another. splitQuoteAuthor() scans for the first `--` that has whitespace on both sides. Linear, and it needs no reasoning about the regex engine at all. Behaviour is identical to the original regex, checked case by case against it: separator, no separator, several separators, tabs, wide gaps, `a--b` without spaces, leading and trailing separators, empty string. All nine are covered by tests, plus one asserting it stays fast on a 50k whitespace run. * security(admin): derive the session signing key with scrypt getSigningKey() ran the admin password through a single SHA-256 digest. It is key derivation rather than password storage, so it was never a stored-hash problem — but if the derived key ever leaked, one fast hash makes recovering the password by brute force cheap. CodeQL flags it as js/insufficient-password-hash and, for this particular alert, has a point. scrypt now. Two details that matter: The salt has to be stable. A random salt would produce a different key on every call and invalidate every session; it is derived from AUTH_SECRET, which is deployment-specific. Verified across separate processes: same inputs produce a verifying token, so a restart or redeploy does not log everyone out. The result is cached for the process lifetime. scrypt is deliberately slow and getSigningKey() runs on every admin request — deriving per call would add ~24ms to each one. The cache key is a digest of secret plus password, so a rotation misses the cache and derives again, and no extra plaintext copy of the password is kept around. Measured: first derivation 24ms, subsequent calls 0.12ms. Password change and secret change both invalidate an existing token, checked in separate processes. Note the one-time effect: existing admin sessions are invalidated by the change in derivation, so everyone logs in once more. * security(admin): key the signing-key cache on its inputs, not a digest #441 removed the SHA-256 digest of the admin password from the key derivation and introduced a new one three lines above it, as the cache key. Same rule, same file: CodeQL reported it immediately. The comment justifying it was wrong too. It claimed no second plaintext copy of the password was retained, while building the digest input allocates exactly that in order to hash it. The cache now holds the two input strings and compares them directly. They are the same objects the env and install caches already hold, so nothing extra is retained, and no fast hash of the password exists in memory for the life of the process. Re-verified after the change, in separate processes: a token from one process verifies in another with the same inputs, a changed password or secret rejects it, first derivation 24ms, cached calls 0.001ms. That leaves scrypt as the only place the password is hashed here. The two HMACs further down operate on the derived key and on token data, not on the password; the constant-time comparison in verifyAdminPassword is the previously dismissed one. --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
2026-08-14 16:55:07 +02:00
flex-wrap: wrap;
feat: redesign admin pagebuilder with slide-over drawers and svg icons (#242) Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-05-31 21:27:13 +02:00
gap: 0.75rem;
}
release: v0.11.0 — journal fixes, admin URLs, design system cleanup (#432) * fix(screenshots): sharp-Typen fuer 0.34 und 0.35 gleichzeitig (#410) sharp 0.35 ist von `export =` auf ESM umgestellt: der Modul-Namespace ist nicht mehr aufrufbar, die Factory sitzt unter .default. Der Type-Check brach damit in scripts/screenshots.ts weg, sobald der Next-Bump (#402) sharp von 0.34.5 auf 0.35.3 mitzieht -- sharp ist hier keine deklarierte Dependency, sondern kommt ueber Next mit. Die Form wird jetzt aus dem installierten Paket abgeleitet statt festgeschrieben, zur Laufzeit wie im Typ. Geprueft mit beiden Versionen: tsc laeuft mit 0.34.5 und mit 0.35.3 fehlerfrei durch. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(deps): bump the nextjs group across 1 directory with 2 updates (#402) Bumps the nextjs group with 2 updates in the / directory: [next](https://github.com/vercel/next.js) and [eslint-config-next](https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next). Updates `next` from 16.2.12 to 16.3.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/compare/v16.2.12...v16.3.0) Updates `eslint-config-next` from 16.2.12 to 16.3.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/commits/v16.3.0/packages/eslint-config-next) --- updated-dependencies: - dependency-name: eslint-config-next dependency-version: 16.3.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: nextjs - dependency-name: next dependency-version: 16.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nextjs ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps-dev): bump prettier from 3.8.3 to 3.9.6 (#405) Bumps [prettier](https://github.com/prettier/prettier) from 3.8.3 to 3.9.6. - [Release notes](https://github.com/prettier/prettier/releases) - [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md) - [Commits](https://github.com/prettier/prettier/compare/3.8.3...3.9.6) --- updated-dependencies: - dependency-name: prettier dependency-version: 3.9.6 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * docs(changelog): Unreleased-Sektion fuer die Bumps nach v0.10.0 (#413) Die Dependency-PRs sind nach dem Release auf dev gelandet, teils auch auf main. Ohne Eintrag waeren sie beim naechsten Release unsichtbar -- inklusive Next 16.3.0, das CVE-2025-13465 mitbringt. Ausserdem im 0.10.0-Abschnitt nachgetragen, dass der Trivy-Scan bis #409 nie gelaufen ist. Der Fix steckt im Tag v0.10.0, fehlte aber in der Aufzaehlung -- und "Images werden bei jedem Publish gescannt" stand im Changelog, waehrend der Job im Action-Setup abbrach. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(gallery): per-album sort order, independent of Immich (#408) (#414) Album order was dictated entirely by Immich: getAlbum() sorted by the album's own asc/desc flag, so a Folio album always mirrored the archive. A curated series has a narrative order that has nothing to do with capture time, and changing the Immich album's sort to fit the website changes it for the archive too. Adds an optional per-album `sort` in gallery.yaml, editable in /admin, defaulting to today's behaviour so every existing config is unchanged: immich (default) | newest | oldest | filename | manual `manual` is a pinned *prefix*: `assetOrder` lists only the photos placed by hand, everything else follows in the album's Immich order. A full permutation of a 2,000-photo album would be ~80 KB of UUIDs in a file that is rewritten and copied to content/.backups/ on every admin save. It also makes drift fall out for free — photos removed in Immich never match, new ones land in the tail rather than being hidden. Sorting is applied after the cache read, not before the cache write, so the LRU keeps one canonical Immich-ordered copy per album. That avoids putting the mode in the cache key, lets a config change take effect without depending on invalidation, and keeps the stale-serving path correct. cache.get() returns the stored object by reference, so withSort() returns a shallow clone with a new array — sorting in place would reorder the shared entry, and under request coalescing every concurrent caller would be sorting the same array. Also fixes a prerequisite bug: /api/admin/albums/[albumId]/assets read album.assets from GET /albums/:id, which Immich 3.x no longer populates (lib/immich.ts:507). The hero picker's "This Album" tab returned nothing and threw outright when the key was absent. It now goes through the client's paginated metadata search, with ?types=all to opt videos in for the reorder editor. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): drop decorative emoji from the sort select labels (#415) An <option> cannot contain markup, so the SVG set in Icons is not reachable there — but a decorative emoji is not a substitute for it. Plain text instead; the album card badge already uses a real icon. The remaining emoji in the admin panel (asset picker tabs, section headings, layout picker options) predate this branch and are left for a separate cleanup. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): replace emoji icons with the shared SVG icon set (#416) The admin panel mixed two icon conventions: inline SVGs from `Icons.tsx` in most components, and decorative emoji in the asset picker and a few PageBuilder labels. Emoji render inconsistently across platforms, ignore the accent colour, and cannot inherit the `.svg-icon` sizing rules. - Icons.tsx: add `IconStar` (filled — it marks a state, not an action) and `IconImage`. - AssetPicker: the three tab labels and the favourite tile badge now use IconFolder / IconStar / IconImage. - PageBuilder: the "Standalone Albums" and "Subpages" headings use the icon set instead of an emoji. - PageBuilder: the layout picker drops its emoji for plain text. An <option> cannot contain markup, so an SVG is impossible there and a decorative glyph is not a substitute. - admin.css: align icon and label in the picker tabs, and swap the favourite badge's text-shadow for drop-shadow, which is what applies to an inline SVG. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): fold PageBuilder's local icons into the shared Icons module (#418) * refactor(admin): fold PageBuilder's local icons into the shared module PageBuilder.tsx carried its own `Icons` object duplicating most of the glyphs already exported by Icons.tsx, with hardcoded sizes and slightly divergent paths. Migrate all 32 call sites to the shared module and delete the local object. Five glyphs had no counterpart and are added to Icons.tsx as 1:1 ports of the local paths: IconX, IconPlus, IconHome, IconCopy, IconImage. The local ExternalLink and Check are dropped rather than ported — both had zero call sites. Two glyphs change shape slightly, which is the point of consolidating: the shared IconCamera includes the viewfinder bump the local copy omitted, and drag handles now use IconGripVertical. IconGripVertical uses the module's square 24x24 viewBox, so `.svg-drag` goes from 12x18 to 18x18 — the old non-square box would letterbox the glyph down to 12x12 and shrink the handle. * fix(admin): resolve icon-module integration after #416 Merging dev brought in #416, which added a second IconImage to Icons.tsx and two <Icons.Camera>/<Icons.Folder> section headers that reference the local Icons object this PR removes. Git merged both cleanly but the result did not type-check. - drop the duplicate IconImage (both copies were byte-identical) - point the two section headers at the imported IconCamera/IconFolder - refresh the SORT_LABELS comment: the icon set is imported now, not declared below --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> * fix(config): allow an empty gallery, guard against a double /api suffix (#421) An empty gallery is now a valid, rendered state instead of a throw: deriveGallery() no longer requires at least one album or subpage, so a deployment with no albums yet renders a bare homepage the owner can fill in via /admin. getConfig() also stops appending /api to an Immich URL that already ends in it, which previously produced .../api/api and broke every upstream request. Includes a restore of the per-album sort test cases, which the branch had lost by being cut before #408/#414. * feat(admin): favicon upload, served from the content volume (#422) Adds a bundled default favicon, an upload widget in admin Settings > General, and a route that serves the icon from the writable content/ volume with a fallback to the bundled default. Raster uploads (PNG/ICO/JPEG) are wrapped in an SVG container; the response carries its own CSP so an uploaded SVG cannot execute script on the origin. The GET route revalidates with an ETag instead of caching immutably, so a newly uploaded icon shows up immediately. Uploads are written via temp file + rename, and a Reset button restores the bundled default. * ci: flag unformatted files in a PR, without blocking it (#424) Prettier is configured as an error rule in eslint.config.mjs but has never run in CI, so part of the tree predates it. A final CI step now diffs against the PR base, runs prettier --list-different over the changed files, and emits a warning annotation per offender plus a job summary. Advisory by design: it never fails the job. Blocking would turn a PR red for merely touching a file that was already unformatted, and normalising the tree in one commit would wreck git blame and conflict with the PRs in flight. Requires fetch-depth: 0, since diffing against the base needs its history. * feat(install): first-run wizard gated by a one-time setup token (#419) Adds /install, a four-step first-run wizard: connect to Immich, optionally pick albums, name the site, finish. It verifies the credentials against the Immich server before writing anything, then writes gallery.yaml, settings.yaml and a content/install.json carrying the Immich credentials and a generated site secret. install.json exists because a running process cannot pick up new env vars — the wizard has to write configuration that takes effect without a restart. getInstallCredentials() merges it under the real environment, so env vars always win and rotation stays a matter of setting one. Both the page and the API routes are gated by a one-time setup token printed to the server log, so a deployment that is reachable before gallery.yaml exists cannot be configured by whoever finds it first. The token is stored in content/.setup-token (0600) rather than a module variable: Next.js bundles the page and each route handler separately, so a module-level token left the page and the API disagreeing inside one process and the wizard stuck on step 1. It is removed once the install completes. The admin password is stored as an scrypt hash using the scheme lib/auth.ts already applies to album passwords; a plaintext ADMIN_PASSWORD env var keeps working. * docs: document the setup wizard, fix the read-only content mount (#425) Quick Start now leads with the /install wizard, with the hand-written YAML route kept alongside it, and a First-Run Setup section covers the setup token, the files the wizard writes, and env-var precedence. Two corrections: both Docker examples mounted content/ as :ro, which silently breaks the wizard, the admin panel and the backup rotation alike — docs/admin-panel.md already said so and the README contradicted it. And nothing documented that content/install.json holds the Immich API key, so a backup of content/ is a backup of credentials. Also adds a Contributors section crediting the people whose work is in the project. * feat(admin): floating save bar pinned to the bottom of the viewport (#426) The save bar was the first, static element inside .admin-main. Since the document itself scrolls, it left the viewport as soon as you scrolled down — editing a subpage section or a settings block far below gave no visible dirty hint and no reachable save button. Replace it with a bottom-pinned floating bar shared by both editors. It only mounts while there is something to act on (unsaved changes, an in-flight save, or a result message), so it never covers content while idle. The success message clears after 5s, which hides the bar again. - new SaveBar component, replacing the duplicated markup in PageBuilder and SettingsEditor - adopt the previously unused .floating-save-bar CSS: slide-in keyframes (carrying translateX(-50%)), dirty border, wrap/gap, mobile variant and a prefers-reduced-motion opt-out; z-index 900 keeps it below modals - .admin-main gains bottom padding so the bar never covers page content - drop the now-unreachable idle hints: the ⌘S hint becomes a button title, the Live Sync note becomes a static line above the settings layout - header "Site" link now bypasses the cache (/?fresh=1), so the preview stays reachable when the bar is hidden Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(admin): themed listbox for the album sort control (#427) The per-album "Photo order" control was a native <select>. Because an <option> cannot contain markup, its choices could not use the admin panel's currentColor SVG set — the reason #415 had to fall back to plain text after dropping the emoji labels. Adds a Listbox component implementing the ARIA combobox/listbox pattern, so options can render a glyph beside their label: - DOM focus stays on the trigger button; the active option is announced through aria-activedescendant, keeping focus management to one element - Keyboard: arrows (clamped at the ends, like a native select), Home/End, Enter/Space to commit, Escape to cancel, Tab commits and moves on, and prefix type-ahead with a repeat-key cycle - Outside dismissal on pointerdown, so a press starting outside closes the popup before the click retargets The sort options now carry an icon each: calendar, arrow-down, arrow-up, an A→Z marker, and the drag glyph for manual — matching the badge the album card already shows. SORT_LABELS stays plain text because the badge feeds it to a title attribute. Closes #417 Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(git): ignore generated design handoff folders * fix(admin): stop the album sort dropdown clipping, and simplify the panel (#428) * fix(admin): render listbox popup in a portal so it escapes modal clipping The sort control's popup was position:absolute inside three clipping ancestors (.album-drawer overflow:hidden > .album-drawer-body overflow-y:auto > .modal-right-column overflow-y:auto), so it was cut off at the bottom of the Edit Album Details modal. z-index could not help: clipping happens before stacking. It also always hung below the trigger, with no flip. Portal the popup to document.body and position it from the trigger's viewport rect, flipping above when there is more room there and capping max-height to the space available so it scrolls internally rather than overflowing. It is dismissed on scroll and resize, since the anchor is only measured on open. The outside-pointerdown handler now also treats the popup as inside; without that the portalled list counts as outside, and a click on an option would close it before the selection commits. * refactor(admin): single-column album details panel The left column spent 1.2fr on a cover thumbnail and three stat rows, two of which (Status, Custom Hero) only restated the form fields opposite them, while the form itself was squeezed into 1.8fr behind a second nested scroller. Stack the drawer in one column instead: cover as a banner, then the form at full width, with the UUID moved into the footer. The body is now the only scroll container, which also removes one of the ancestors that was clipping the sort popup. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> * fix(admin): give the portalled listbox its theme back, lock the page behind modals (#429) Two defects in the album editor. The sort listbox popup painted transparent. Every --admin-* variable is scoped to .admin-layout, and since the popup moved into document.body it sits outside that subtree, so background/border/text all resolved to nothing. It now carries its own copy of the palette in both colour schemes, plus the font it no longer inherits. Scrolling inside a modal also moved the page behind it. No admin modal ever locked body scroll: the overlay covers the page but does not absorb wheel events, so a scroll starting on the backdrop — or continuing past the end of the modal's own scroller — reaches the document. overscroll-behavior cannot cover that case on its own, because it only applies to scroll containers and the backdrop is not one. useScrollLock freezes body while a modal is open and compensates for the width the scrollbar gives up, so nothing shifts underneath. Each lock restores the inline value it found, which makes nesting work without a counter — a picker opened from the drawer restores the drawer's hidden state instead of clearing it. Applied to both drawers and all four picker modals, which share the defect. overscroll-behavior: contain on the scrollers stops the chaining they can handle themselves. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com> * fix(security): allow unsafe-eval in CSP script-src during dev mode * feat(journal): add Journal Studio with split-screen editor, live preview and dedicated routes * fix(build): separate client parser from server journal-service and fix build type errors * fix(journal): Fotos rendern, Layout und Lightbox-Steuerung korrigieren Fünf unabhängige Fehler in der öffentlichen Journal- und Essay-Ansicht: * Foto-Blöcke wurden nie angezeigt. EssayView löst ein Foto über PhotoItem.id auf, und das sind verschlüsselte Tokens — die Blöcke aus dem Markdown tragen aber rohe Asset-UUIDs. Jede Zuordnung lief ins Leere, und nicht auflösbare Blöcke werden still verworfen. Die IDs werden jetzt serverseitig übersetzt; damit verschwinden nebenbei die rohen UUIDs aus dem Client-Payload, die dort laut Projektregel nie auftauchen dürfen. Nicht auflösbare Referenzen werden geloggt. * Überschriften standen weiter links als der Fließtext. Jeder Block hatte einzeln `max-width: 68ch`, und `ch` ist relativ zur Schrift des Elements — die Serif-Überschrift ergab eine breitere Spalte. Ersetzt durch eine gemeinsame, font-unabhängige `--essay-measure`. * Fullbleed-Fotos bluteten nur nach links aus: `.essay-figure` ist `width: 100%`, wodurch die Box überbestimmt ist und der negative rechte Margin verworfen wird. * Foto-Paare stellten beide Bilder gleich breit dar, wodurch ein Hochformat neben einem Querformat doppelt so hoch wurde. Jetzt eine Justified-Reihe: Breite proportional zum Seitenverhältnis, dadurch exakt gleiche Höhen ohne Beschnitt. * Die Lightbox hatte im Journal keine Tastatursteuerung und keine Scroll-Sperre — beides lag in PhotoGrid, also nur im Album-Raster. Verlagert in die Lightbox selbst, der doppelte Handler in PhotoGrid entfernt (sonst wäre pro Pfeildruck zwei Bilder weitergesprungen). Zusätzlich sind Proofing-Herzen und das EXIF-Panel im redaktionellen Modus abschaltbar und im Journal aus: Client-Proofing ist ein Übergabe-Workflow für Alben, keine Funktion einer Reportage. Auf der Übersicht wurde der Untertitel doppelt gerendert, weil extractExcerpt() auf ihn zurückfällt. * feat(admin): eigene URLs für alle Bereiche und überarbeiteter Journal Studio Das Panel war eine einzige Client-Komponente, die ihre Tabs über useState umschaltet: keine Route pro Bereich, kein Deep-Link, kein Zurück-Button, und nach jedem Reload landete man wieder auf "Pages". Auch der Journal-Editor hatte keine eigene URL. Jetzt sieben echte Routen (/admin, /admin/pages, /admin/journal, /admin/journal/<slug>, /admin/settings, /admin/settings/<section>, /admin/analytics). Die Shell mit Auth-Prüfung und Kopfzeile sitzt im Layout und umschließt children — so bleibt die Session-Prüfung über Routenwechsel montiert, statt bei jedem Tab-Wechsel neu zu laufen und den Spinner aufblitzen zu lassen. Unbekannte Settings-Sections fallen auf General zurück. Im selben Zug der Journal Studio, der die Routing-Änderung ohnehin berührt: * Alle Eingabefelder nutzten die Klasse `admin-input`, die in keinem CSS definiert war — sie fielen auf Browser-Defaults zurück. Jetzt gestylt, gescoped, damit der generische Name nicht ins übrige Panel leckt. * Der Split View ist per Divider verschiebbar (Maus, Tastatur, Doppelklick zum Zurücksetzen), Breite in localStorage. * Das Studio bricht aus der 1120px-Spalte aus, die Preview hat Platz. * Die Preview zeigte für jedes Foto fest 3:2 und log damit über das Layout der veröffentlichten Seite; die echten Verhältnisse werden jetzt an den Thumbnails gemessen. * Blöcke mit alten positionsbasierten Foto-Referenzen werden markiert — die lassen sich auf einer eigenständigen Journal-Seite nicht auflösen und verschwanden bisher stillschweigend. * Blocktyp-Chips als gemeinsame Komponente, monochrom und per Icon unterschieden statt in einer eigenen Blau/Lila/Orange-Palette, die sonst nirgends im Panel vorkommt. * Emojis raus, SVG-Icons rein. * fix(admin): Designsystem-Lücken im Panel schließen Eine systematische Suche nach Klassen, die im TSX benutzt, aber in keinem CSS definiert sind, hat vier Stellen mit demselben Muster gefunden: * `admin-btn-secondary` und `admin-btn-danger` existierten nicht. Sämtliche Löschen-Buttons sahen aus wie normale Buttons — keine Warnwirkung. Als `.admin-btn.admin-btn-danger` geschrieben, weil die Varianten mit den Größenklassen kombiniert werden, die weiter unten ihren eigenen Hintergrund setzen. * `page-progress-fill` fehlte: die Balken im Analytics-Panel waren leere Rinnen, der Wert unsichtbar. Ebenso `analytics-empty` und `admin-loading-container`. * `subpage-drawer-section`, `subpage-drawer-title-group` und `input-with-icon` im PageBuilder waren wirkungslos und teils mit Inline-Styles notdürftig kompensiert. * `grid-card-preview` fehlte, wodurch alle Layout-Vorschauen auf Höhe null kollabierten. Nur "Showcase" war sichtbar — und das aus Versehen, weil sein Tile `hero-tile` hieß und damit die `aspect-ratio` einer fremden PageBuilder-Klasse erbte. Umbenannt. Dazu die Theme-Vorschauen, die praktisch identisch aussahen: alle sieben zeigten dieselben drei quadratischen Kacheln, einziger Unterschied war die Hintergrundfarbe. Sie spiegeln jetzt die echten Preset-Daten aus lib/config/theme.ts — Schriftcharakter, Eckradius, Rasterdichte, Passepartout bzw. Schatten. Die Kopfzeile richtet sich an einer gemeinsamen Steuerhöhe aus. Der "Site"-Link war höher als die Buttons daneben: `.admin-btn` hatte keine explizite line-height, und <button> bekommt box-sizing: border-box vom Browser, <a> nicht. Die Statusanzeige setzte weder Schriftfamilie noch -größe und fiel auf den Browser-Default zurück — sie war nie Teil des Designsystems. Jetzt gleiche Höhe und Typografie, Pillenform als Zustandsanzeige, Trenner zur Aktionsgruppe. Das dauerhafte Pulsieren des grünen Punkts entfällt; Animation bleibt den Zuständen vorbehalten, die Aufmerksamkeit brauchen. Restliche Emojis durch SVG-Icons ersetzt. * feat(admin): add scroll-to-top toggle and SVG arrow The back-to-top button was always on and drew its arrow with the ↑ text character. Add a `scrollToTop` setting (General section in the admin panel, defaults to on so existing sites are unaffected) and replace the glyph with a stroked SVG that inherits currentColor across all presets. Scroll handling is now rAF-throttled, and prefers-reduced-motion turns off both the hover lift and the smooth scroll. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * security(journal): escape author HTML instead of filtering it CodeQL flags 26 high-severity alerts on the release PR; the bulk of them point at sanitizeHtml(), a denylist of three regexes whose output goes into dangerouslySetInnerHTML. I reproduced the bypasses before changing anything — all four pass the old filter: <img src=x onerror=alert(1)> unquoted handler, regex wants quotes <img src=x onerror='alert(1)'> single quotes, same reason <svg onload=alert(1)> not a <script> tag javasjavascript:cript:alert(1) one-pass replace, the rest recombines Plus an attribute breakout in the link renderer, which interpolated the URL into href="${url}" unescaped: [x](" onmouseover=alert(1) x=") -> <a href="" onmouseover=alert(1" ...> Replaced with escaping. Every `&<>"'` in author text becomes an entity before any markdown rule runs, so the only tags in the output are the ones renderInlineMarkdown builds itself and a URL cannot leave its attribute. Link schemes are now an allowlist (http, https, mailto, tel, relative, anchor); anything else renders as plain text. The serializer needed decodeHtmlEntities to match: without it a save would write `&lt;` into the Markdown file and the next parse would escape the `&` again, corrupting the text further on every round trip. A test covers parse -> serialize -> parse stability. Two existing tests asserted the old behaviour and were rewritten rather than deleted: one expected the script tag to be *removed* from the output, the other expected the substring "onerror" to be absent. Both now assert the property that matters — that no tag can form — because `onerror` surviving as inert text is fine. Exploitation required admin access either way: journal and essay text comes from the studio or from content/*.md. This removes the weakness, it does not close an open door. * fix(journal): contain file paths, fix frontmatter escaping, defuse two regexes Follow-up to the CodeQL findings on release PR #432. I went through all 23 alerts individually; this addresses the ones that are worth addressing and documents the ones that are not. Path containment (12 alerts, all false positives). Every path built from a slug goes through isValidSlug(), a strict `/^[a-zA-Z0-9_-]+$/` allowlist — verified against `../../etc/passwd`, `foo/../../bar`, `a/b`, `..` and friends, all rejected. CodeQL cannot see it because the check lives in another module. Added a containedPath() helper that resolves the path and refuses anything landing outside the content directory: a second lock on a door that was already locked, and a barrier the analysis can follow. Also removed the dead `slug.endsWith('.md')` branches — isValidSlug rejects dots, so they could never be taken. Frontmatter escaping (1 alert, a real bug). The serializer escaped `"` but not `\`, and the parser never unescaped anything. A title containing either character gained a backslash on every save/load cycle: Path C:\Users "quoted" -> Path C:\\Users \"quoted\" -> ... Escaping now covers the backslash first and the parser undoes both. A round trip test covers quotes, backslashes, colons and apostrophes. Two of three ReDoS regexes (2 alerts). The heading pattern had `\s+` next to `(.+)`, which overlap, so the engine tried every split of the whitespace run before failing; it is `[ \t]+` and `(\S.*)` now. The quote author pattern wrapped a lazy group around an optional group — the quadratic case — and is an index split on the first separator now. The third regex, the bold/italic pass, is deliberately left alone. Rewriting it with a negated class removes the backtracking but breaks nesting: `**bold *and italic* here**` renders as `*<em>bold </em>and italic<em> here</em>*`. The input is Markdown from an authenticated admin, never a visitor, so the worst case is an author slowing down their own page. The comment in the code says so. Not addressed: 5 js/insufficient-password-hash alerts. They ask for a slow KDF where the code uses SHA-256/HMAC — correct in general, but the admin password comes from an environment variable and is never stored, so a stronger KDF protects nothing that is not already in plaintext in the environment. 399 unit tests pass (18 new), build and tsc clean. * fix(journal): split the quote author by scanning, not by pattern Cleaning up after myself. #439 replaced the quote author regex `/^(.*?)(?:\s+--\s+(.+))?$/` — a lazy group around an optional one, the quadratic case — with `/\s+--\s+/`, and CodeQL promptly flagged the replacement for the same reason. One reported pattern traded for another. splitQuoteAuthor() scans for the first `--` that has whitespace on both sides. Linear, and it needs no reasoning about the regex engine at all. Behaviour is identical to the original regex, checked case by case against it: separator, no separator, several separators, tabs, wide gaps, `a--b` without spaces, leading and trailing separators, empty string. All nine are covered by tests, plus one asserting it stays fast on a 50k whitespace run. * security(admin): derive the session signing key with scrypt getSigningKey() ran the admin password through a single SHA-256 digest. It is key derivation rather than password storage, so it was never a stored-hash problem — but if the derived key ever leaked, one fast hash makes recovering the password by brute force cheap. CodeQL flags it as js/insufficient-password-hash and, for this particular alert, has a point. scrypt now. Two details that matter: The salt has to be stable. A random salt would produce a different key on every call and invalidate every session; it is derived from AUTH_SECRET, which is deployment-specific. Verified across separate processes: same inputs produce a verifying token, so a restart or redeploy does not log everyone out. The result is cached for the process lifetime. scrypt is deliberately slow and getSigningKey() runs on every admin request — deriving per call would add ~24ms to each one. The cache key is a digest of secret plus password, so a rotation misses the cache and derives again, and no extra plaintext copy of the password is kept around. Measured: first derivation 24ms, subsequent calls 0.12ms. Password change and secret change both invalidate an existing token, checked in separate processes. Note the one-time effect: existing admin sessions are invalidated by the change in derivation, so everyone logs in once more. * security(admin): key the signing-key cache on its inputs, not a digest #441 removed the SHA-256 digest of the admin password from the key derivation and introduced a new one three lines above it, as the cache key. Same rule, same file: CodeQL reported it immediately. The comment justifying it was wrong too. It claimed no second plaintext copy of the password was retained, while building the digest input allocates exactly that in order to hash it. The cache now holds the two input strings and compares them directly. They are the same objects the env and install caches already hold, so nothing extra is retained, and no fast hash of the password exists in memory for the life of the process. Re-verified after the change, in separate processes: a token from one process verifies in another with the same inputs, a changed password or secret rejects it, first derivation 24ms, cached calls 0.001ms. That leaves scrypt as the only place the password is hashed here. The two HMACs further down operate on the derived key and on token data, not on the password; the constant-time comparison in verifyAdminPassword is the previously dismissed one. --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
2026-08-14 16:55:07 +02:00
/* Narrow screens cannot fit both buttons plus the UUID on one line; drop the
UUID onto its own row rather than squeezing the actions. */
@media (max-width: 560px) {
.album-drawer-footer .uuid-copy-box {
order: 1;
flex-basis: 100%;
}
}
/* Cover banner across the top of the drawer. flex-shrink must be off: the img
inside is height:100%, so the box has no min-content height and the scrolling
flex column would otherwise crush it to a couple of pixels. */
feat: redesign album drawer into a gorgeous centered two-column modal (#243) Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-05-31 21:30:00 +02:00
.modal-cover-container {
width: 100%;
release: v0.11.0 — journal fixes, admin URLs, design system cleanup (#432) * fix(screenshots): sharp-Typen fuer 0.34 und 0.35 gleichzeitig (#410) sharp 0.35 ist von `export =` auf ESM umgestellt: der Modul-Namespace ist nicht mehr aufrufbar, die Factory sitzt unter .default. Der Type-Check brach damit in scripts/screenshots.ts weg, sobald der Next-Bump (#402) sharp von 0.34.5 auf 0.35.3 mitzieht -- sharp ist hier keine deklarierte Dependency, sondern kommt ueber Next mit. Die Form wird jetzt aus dem installierten Paket abgeleitet statt festgeschrieben, zur Laufzeit wie im Typ. Geprueft mit beiden Versionen: tsc laeuft mit 0.34.5 und mit 0.35.3 fehlerfrei durch. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(deps): bump the nextjs group across 1 directory with 2 updates (#402) Bumps the nextjs group with 2 updates in the / directory: [next](https://github.com/vercel/next.js) and [eslint-config-next](https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next). Updates `next` from 16.2.12 to 16.3.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/compare/v16.2.12...v16.3.0) Updates `eslint-config-next` from 16.2.12 to 16.3.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/commits/v16.3.0/packages/eslint-config-next) --- updated-dependencies: - dependency-name: eslint-config-next dependency-version: 16.3.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: nextjs - dependency-name: next dependency-version: 16.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nextjs ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps-dev): bump prettier from 3.8.3 to 3.9.6 (#405) Bumps [prettier](https://github.com/prettier/prettier) from 3.8.3 to 3.9.6. - [Release notes](https://github.com/prettier/prettier/releases) - [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md) - [Commits](https://github.com/prettier/prettier/compare/3.8.3...3.9.6) --- updated-dependencies: - dependency-name: prettier dependency-version: 3.9.6 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * docs(changelog): Unreleased-Sektion fuer die Bumps nach v0.10.0 (#413) Die Dependency-PRs sind nach dem Release auf dev gelandet, teils auch auf main. Ohne Eintrag waeren sie beim naechsten Release unsichtbar -- inklusive Next 16.3.0, das CVE-2025-13465 mitbringt. Ausserdem im 0.10.0-Abschnitt nachgetragen, dass der Trivy-Scan bis #409 nie gelaufen ist. Der Fix steckt im Tag v0.10.0, fehlte aber in der Aufzaehlung -- und "Images werden bei jedem Publish gescannt" stand im Changelog, waehrend der Job im Action-Setup abbrach. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(gallery): per-album sort order, independent of Immich (#408) (#414) Album order was dictated entirely by Immich: getAlbum() sorted by the album's own asc/desc flag, so a Folio album always mirrored the archive. A curated series has a narrative order that has nothing to do with capture time, and changing the Immich album's sort to fit the website changes it for the archive too. Adds an optional per-album `sort` in gallery.yaml, editable in /admin, defaulting to today's behaviour so every existing config is unchanged: immich (default) | newest | oldest | filename | manual `manual` is a pinned *prefix*: `assetOrder` lists only the photos placed by hand, everything else follows in the album's Immich order. A full permutation of a 2,000-photo album would be ~80 KB of UUIDs in a file that is rewritten and copied to content/.backups/ on every admin save. It also makes drift fall out for free — photos removed in Immich never match, new ones land in the tail rather than being hidden. Sorting is applied after the cache read, not before the cache write, so the LRU keeps one canonical Immich-ordered copy per album. That avoids putting the mode in the cache key, lets a config change take effect without depending on invalidation, and keeps the stale-serving path correct. cache.get() returns the stored object by reference, so withSort() returns a shallow clone with a new array — sorting in place would reorder the shared entry, and under request coalescing every concurrent caller would be sorting the same array. Also fixes a prerequisite bug: /api/admin/albums/[albumId]/assets read album.assets from GET /albums/:id, which Immich 3.x no longer populates (lib/immich.ts:507). The hero picker's "This Album" tab returned nothing and threw outright when the key was absent. It now goes through the client's paginated metadata search, with ?types=all to opt videos in for the reorder editor. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): drop decorative emoji from the sort select labels (#415) An <option> cannot contain markup, so the SVG set in Icons is not reachable there — but a decorative emoji is not a substitute for it. Plain text instead; the album card badge already uses a real icon. The remaining emoji in the admin panel (asset picker tabs, section headings, layout picker options) predate this branch and are left for a separate cleanup. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): replace emoji icons with the shared SVG icon set (#416) The admin panel mixed two icon conventions: inline SVGs from `Icons.tsx` in most components, and decorative emoji in the asset picker and a few PageBuilder labels. Emoji render inconsistently across platforms, ignore the accent colour, and cannot inherit the `.svg-icon` sizing rules. - Icons.tsx: add `IconStar` (filled — it marks a state, not an action) and `IconImage`. - AssetPicker: the three tab labels and the favourite tile badge now use IconFolder / IconStar / IconImage. - PageBuilder: the "Standalone Albums" and "Subpages" headings use the icon set instead of an emoji. - PageBuilder: the layout picker drops its emoji for plain text. An <option> cannot contain markup, so an SVG is impossible there and a decorative glyph is not a substitute. - admin.css: align icon and label in the picker tabs, and swap the favourite badge's text-shadow for drop-shadow, which is what applies to an inline SVG. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): fold PageBuilder's local icons into the shared Icons module (#418) * refactor(admin): fold PageBuilder's local icons into the shared module PageBuilder.tsx carried its own `Icons` object duplicating most of the glyphs already exported by Icons.tsx, with hardcoded sizes and slightly divergent paths. Migrate all 32 call sites to the shared module and delete the local object. Five glyphs had no counterpart and are added to Icons.tsx as 1:1 ports of the local paths: IconX, IconPlus, IconHome, IconCopy, IconImage. The local ExternalLink and Check are dropped rather than ported — both had zero call sites. Two glyphs change shape slightly, which is the point of consolidating: the shared IconCamera includes the viewfinder bump the local copy omitted, and drag handles now use IconGripVertical. IconGripVertical uses the module's square 24x24 viewBox, so `.svg-drag` goes from 12x18 to 18x18 — the old non-square box would letterbox the glyph down to 12x12 and shrink the handle. * fix(admin): resolve icon-module integration after #416 Merging dev brought in #416, which added a second IconImage to Icons.tsx and two <Icons.Camera>/<Icons.Folder> section headers that reference the local Icons object this PR removes. Git merged both cleanly but the result did not type-check. - drop the duplicate IconImage (both copies were byte-identical) - point the two section headers at the imported IconCamera/IconFolder - refresh the SORT_LABELS comment: the icon set is imported now, not declared below --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> * fix(config): allow an empty gallery, guard against a double /api suffix (#421) An empty gallery is now a valid, rendered state instead of a throw: deriveGallery() no longer requires at least one album or subpage, so a deployment with no albums yet renders a bare homepage the owner can fill in via /admin. getConfig() also stops appending /api to an Immich URL that already ends in it, which previously produced .../api/api and broke every upstream request. Includes a restore of the per-album sort test cases, which the branch had lost by being cut before #408/#414. * feat(admin): favicon upload, served from the content volume (#422) Adds a bundled default favicon, an upload widget in admin Settings > General, and a route that serves the icon from the writable content/ volume with a fallback to the bundled default. Raster uploads (PNG/ICO/JPEG) are wrapped in an SVG container; the response carries its own CSP so an uploaded SVG cannot execute script on the origin. The GET route revalidates with an ETag instead of caching immutably, so a newly uploaded icon shows up immediately. Uploads are written via temp file + rename, and a Reset button restores the bundled default. * ci: flag unformatted files in a PR, without blocking it (#424) Prettier is configured as an error rule in eslint.config.mjs but has never run in CI, so part of the tree predates it. A final CI step now diffs against the PR base, runs prettier --list-different over the changed files, and emits a warning annotation per offender plus a job summary. Advisory by design: it never fails the job. Blocking would turn a PR red for merely touching a file that was already unformatted, and normalising the tree in one commit would wreck git blame and conflict with the PRs in flight. Requires fetch-depth: 0, since diffing against the base needs its history. * feat(install): first-run wizard gated by a one-time setup token (#419) Adds /install, a four-step first-run wizard: connect to Immich, optionally pick albums, name the site, finish. It verifies the credentials against the Immich server before writing anything, then writes gallery.yaml, settings.yaml and a content/install.json carrying the Immich credentials and a generated site secret. install.json exists because a running process cannot pick up new env vars — the wizard has to write configuration that takes effect without a restart. getInstallCredentials() merges it under the real environment, so env vars always win and rotation stays a matter of setting one. Both the page and the API routes are gated by a one-time setup token printed to the server log, so a deployment that is reachable before gallery.yaml exists cannot be configured by whoever finds it first. The token is stored in content/.setup-token (0600) rather than a module variable: Next.js bundles the page and each route handler separately, so a module-level token left the page and the API disagreeing inside one process and the wizard stuck on step 1. It is removed once the install completes. The admin password is stored as an scrypt hash using the scheme lib/auth.ts already applies to album passwords; a plaintext ADMIN_PASSWORD env var keeps working. * docs: document the setup wizard, fix the read-only content mount (#425) Quick Start now leads with the /install wizard, with the hand-written YAML route kept alongside it, and a First-Run Setup section covers the setup token, the files the wizard writes, and env-var precedence. Two corrections: both Docker examples mounted content/ as :ro, which silently breaks the wizard, the admin panel and the backup rotation alike — docs/admin-panel.md already said so and the README contradicted it. And nothing documented that content/install.json holds the Immich API key, so a backup of content/ is a backup of credentials. Also adds a Contributors section crediting the people whose work is in the project. * feat(admin): floating save bar pinned to the bottom of the viewport (#426) The save bar was the first, static element inside .admin-main. Since the document itself scrolls, it left the viewport as soon as you scrolled down — editing a subpage section or a settings block far below gave no visible dirty hint and no reachable save button. Replace it with a bottom-pinned floating bar shared by both editors. It only mounts while there is something to act on (unsaved changes, an in-flight save, or a result message), so it never covers content while idle. The success message clears after 5s, which hides the bar again. - new SaveBar component, replacing the duplicated markup in PageBuilder and SettingsEditor - adopt the previously unused .floating-save-bar CSS: slide-in keyframes (carrying translateX(-50%)), dirty border, wrap/gap, mobile variant and a prefers-reduced-motion opt-out; z-index 900 keeps it below modals - .admin-main gains bottom padding so the bar never covers page content - drop the now-unreachable idle hints: the ⌘S hint becomes a button title, the Live Sync note becomes a static line above the settings layout - header "Site" link now bypasses the cache (/?fresh=1), so the preview stays reachable when the bar is hidden Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(admin): themed listbox for the album sort control (#427) The per-album "Photo order" control was a native <select>. Because an <option> cannot contain markup, its choices could not use the admin panel's currentColor SVG set — the reason #415 had to fall back to plain text after dropping the emoji labels. Adds a Listbox component implementing the ARIA combobox/listbox pattern, so options can render a glyph beside their label: - DOM focus stays on the trigger button; the active option is announced through aria-activedescendant, keeping focus management to one element - Keyboard: arrows (clamped at the ends, like a native select), Home/End, Enter/Space to commit, Escape to cancel, Tab commits and moves on, and prefix type-ahead with a repeat-key cycle - Outside dismissal on pointerdown, so a press starting outside closes the popup before the click retargets The sort options now carry an icon each: calendar, arrow-down, arrow-up, an A→Z marker, and the drag glyph for manual — matching the badge the album card already shows. SORT_LABELS stays plain text because the badge feeds it to a title attribute. Closes #417 Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(git): ignore generated design handoff folders * fix(admin): stop the album sort dropdown clipping, and simplify the panel (#428) * fix(admin): render listbox popup in a portal so it escapes modal clipping The sort control's popup was position:absolute inside three clipping ancestors (.album-drawer overflow:hidden > .album-drawer-body overflow-y:auto > .modal-right-column overflow-y:auto), so it was cut off at the bottom of the Edit Album Details modal. z-index could not help: clipping happens before stacking. It also always hung below the trigger, with no flip. Portal the popup to document.body and position it from the trigger's viewport rect, flipping above when there is more room there and capping max-height to the space available so it scrolls internally rather than overflowing. It is dismissed on scroll and resize, since the anchor is only measured on open. The outside-pointerdown handler now also treats the popup as inside; without that the portalled list counts as outside, and a click on an option would close it before the selection commits. * refactor(admin): single-column album details panel The left column spent 1.2fr on a cover thumbnail and three stat rows, two of which (Status, Custom Hero) only restated the form fields opposite them, while the form itself was squeezed into 1.8fr behind a second nested scroller. Stack the drawer in one column instead: cover as a banner, then the form at full width, with the UUID moved into the footer. The body is now the only scroll container, which also removes one of the ancestors that was clipping the sort popup. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> * fix(admin): give the portalled listbox its theme back, lock the page behind modals (#429) Two defects in the album editor. The sort listbox popup painted transparent. Every --admin-* variable is scoped to .admin-layout, and since the popup moved into document.body it sits outside that subtree, so background/border/text all resolved to nothing. It now carries its own copy of the palette in both colour schemes, plus the font it no longer inherits. Scrolling inside a modal also moved the page behind it. No admin modal ever locked body scroll: the overlay covers the page but does not absorb wheel events, so a scroll starting on the backdrop — or continuing past the end of the modal's own scroller — reaches the document. overscroll-behavior cannot cover that case on its own, because it only applies to scroll containers and the backdrop is not one. useScrollLock freezes body while a modal is open and compensates for the width the scrollbar gives up, so nothing shifts underneath. Each lock restores the inline value it found, which makes nesting work without a counter — a picker opened from the drawer restores the drawer's hidden state instead of clearing it. Applied to both drawers and all four picker modals, which share the defect. overscroll-behavior: contain on the scrollers stops the chaining they can handle themselves. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com> * fix(security): allow unsafe-eval in CSP script-src during dev mode * feat(journal): add Journal Studio with split-screen editor, live preview and dedicated routes * fix(build): separate client parser from server journal-service and fix build type errors * fix(journal): Fotos rendern, Layout und Lightbox-Steuerung korrigieren Fünf unabhängige Fehler in der öffentlichen Journal- und Essay-Ansicht: * Foto-Blöcke wurden nie angezeigt. EssayView löst ein Foto über PhotoItem.id auf, und das sind verschlüsselte Tokens — die Blöcke aus dem Markdown tragen aber rohe Asset-UUIDs. Jede Zuordnung lief ins Leere, und nicht auflösbare Blöcke werden still verworfen. Die IDs werden jetzt serverseitig übersetzt; damit verschwinden nebenbei die rohen UUIDs aus dem Client-Payload, die dort laut Projektregel nie auftauchen dürfen. Nicht auflösbare Referenzen werden geloggt. * Überschriften standen weiter links als der Fließtext. Jeder Block hatte einzeln `max-width: 68ch`, und `ch` ist relativ zur Schrift des Elements — die Serif-Überschrift ergab eine breitere Spalte. Ersetzt durch eine gemeinsame, font-unabhängige `--essay-measure`. * Fullbleed-Fotos bluteten nur nach links aus: `.essay-figure` ist `width: 100%`, wodurch die Box überbestimmt ist und der negative rechte Margin verworfen wird. * Foto-Paare stellten beide Bilder gleich breit dar, wodurch ein Hochformat neben einem Querformat doppelt so hoch wurde. Jetzt eine Justified-Reihe: Breite proportional zum Seitenverhältnis, dadurch exakt gleiche Höhen ohne Beschnitt. * Die Lightbox hatte im Journal keine Tastatursteuerung und keine Scroll-Sperre — beides lag in PhotoGrid, also nur im Album-Raster. Verlagert in die Lightbox selbst, der doppelte Handler in PhotoGrid entfernt (sonst wäre pro Pfeildruck zwei Bilder weitergesprungen). Zusätzlich sind Proofing-Herzen und das EXIF-Panel im redaktionellen Modus abschaltbar und im Journal aus: Client-Proofing ist ein Übergabe-Workflow für Alben, keine Funktion einer Reportage. Auf der Übersicht wurde der Untertitel doppelt gerendert, weil extractExcerpt() auf ihn zurückfällt. * feat(admin): eigene URLs für alle Bereiche und überarbeiteter Journal Studio Das Panel war eine einzige Client-Komponente, die ihre Tabs über useState umschaltet: keine Route pro Bereich, kein Deep-Link, kein Zurück-Button, und nach jedem Reload landete man wieder auf "Pages". Auch der Journal-Editor hatte keine eigene URL. Jetzt sieben echte Routen (/admin, /admin/pages, /admin/journal, /admin/journal/<slug>, /admin/settings, /admin/settings/<section>, /admin/analytics). Die Shell mit Auth-Prüfung und Kopfzeile sitzt im Layout und umschließt children — so bleibt die Session-Prüfung über Routenwechsel montiert, statt bei jedem Tab-Wechsel neu zu laufen und den Spinner aufblitzen zu lassen. Unbekannte Settings-Sections fallen auf General zurück. Im selben Zug der Journal Studio, der die Routing-Änderung ohnehin berührt: * Alle Eingabefelder nutzten die Klasse `admin-input`, die in keinem CSS definiert war — sie fielen auf Browser-Defaults zurück. Jetzt gestylt, gescoped, damit der generische Name nicht ins übrige Panel leckt. * Der Split View ist per Divider verschiebbar (Maus, Tastatur, Doppelklick zum Zurücksetzen), Breite in localStorage. * Das Studio bricht aus der 1120px-Spalte aus, die Preview hat Platz. * Die Preview zeigte für jedes Foto fest 3:2 und log damit über das Layout der veröffentlichten Seite; die echten Verhältnisse werden jetzt an den Thumbnails gemessen. * Blöcke mit alten positionsbasierten Foto-Referenzen werden markiert — die lassen sich auf einer eigenständigen Journal-Seite nicht auflösen und verschwanden bisher stillschweigend. * Blocktyp-Chips als gemeinsame Komponente, monochrom und per Icon unterschieden statt in einer eigenen Blau/Lila/Orange-Palette, die sonst nirgends im Panel vorkommt. * Emojis raus, SVG-Icons rein. * fix(admin): Designsystem-Lücken im Panel schließen Eine systematische Suche nach Klassen, die im TSX benutzt, aber in keinem CSS definiert sind, hat vier Stellen mit demselben Muster gefunden: * `admin-btn-secondary` und `admin-btn-danger` existierten nicht. Sämtliche Löschen-Buttons sahen aus wie normale Buttons — keine Warnwirkung. Als `.admin-btn.admin-btn-danger` geschrieben, weil die Varianten mit den Größenklassen kombiniert werden, die weiter unten ihren eigenen Hintergrund setzen. * `page-progress-fill` fehlte: die Balken im Analytics-Panel waren leere Rinnen, der Wert unsichtbar. Ebenso `analytics-empty` und `admin-loading-container`. * `subpage-drawer-section`, `subpage-drawer-title-group` und `input-with-icon` im PageBuilder waren wirkungslos und teils mit Inline-Styles notdürftig kompensiert. * `grid-card-preview` fehlte, wodurch alle Layout-Vorschauen auf Höhe null kollabierten. Nur "Showcase" war sichtbar — und das aus Versehen, weil sein Tile `hero-tile` hieß und damit die `aspect-ratio` einer fremden PageBuilder-Klasse erbte. Umbenannt. Dazu die Theme-Vorschauen, die praktisch identisch aussahen: alle sieben zeigten dieselben drei quadratischen Kacheln, einziger Unterschied war die Hintergrundfarbe. Sie spiegeln jetzt die echten Preset-Daten aus lib/config/theme.ts — Schriftcharakter, Eckradius, Rasterdichte, Passepartout bzw. Schatten. Die Kopfzeile richtet sich an einer gemeinsamen Steuerhöhe aus. Der "Site"-Link war höher als die Buttons daneben: `.admin-btn` hatte keine explizite line-height, und <button> bekommt box-sizing: border-box vom Browser, <a> nicht. Die Statusanzeige setzte weder Schriftfamilie noch -größe und fiel auf den Browser-Default zurück — sie war nie Teil des Designsystems. Jetzt gleiche Höhe und Typografie, Pillenform als Zustandsanzeige, Trenner zur Aktionsgruppe. Das dauerhafte Pulsieren des grünen Punkts entfällt; Animation bleibt den Zuständen vorbehalten, die Aufmerksamkeit brauchen. Restliche Emojis durch SVG-Icons ersetzt. * feat(admin): add scroll-to-top toggle and SVG arrow The back-to-top button was always on and drew its arrow with the ↑ text character. Add a `scrollToTop` setting (General section in the admin panel, defaults to on so existing sites are unaffected) and replace the glyph with a stroked SVG that inherits currentColor across all presets. Scroll handling is now rAF-throttled, and prefers-reduced-motion turns off both the hover lift and the smooth scroll. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * security(journal): escape author HTML instead of filtering it CodeQL flags 26 high-severity alerts on the release PR; the bulk of them point at sanitizeHtml(), a denylist of three regexes whose output goes into dangerouslySetInnerHTML. I reproduced the bypasses before changing anything — all four pass the old filter: <img src=x onerror=alert(1)> unquoted handler, regex wants quotes <img src=x onerror='alert(1)'> single quotes, same reason <svg onload=alert(1)> not a <script> tag javasjavascript:cript:alert(1) one-pass replace, the rest recombines Plus an attribute breakout in the link renderer, which interpolated the URL into href="${url}" unescaped: [x](" onmouseover=alert(1) x=") -> <a href="" onmouseover=alert(1" ...> Replaced with escaping. Every `&<>"'` in author text becomes an entity before any markdown rule runs, so the only tags in the output are the ones renderInlineMarkdown builds itself and a URL cannot leave its attribute. Link schemes are now an allowlist (http, https, mailto, tel, relative, anchor); anything else renders as plain text. The serializer needed decodeHtmlEntities to match: without it a save would write `&lt;` into the Markdown file and the next parse would escape the `&` again, corrupting the text further on every round trip. A test covers parse -> serialize -> parse stability. Two existing tests asserted the old behaviour and were rewritten rather than deleted: one expected the script tag to be *removed* from the output, the other expected the substring "onerror" to be absent. Both now assert the property that matters — that no tag can form — because `onerror` surviving as inert text is fine. Exploitation required admin access either way: journal and essay text comes from the studio or from content/*.md. This removes the weakness, it does not close an open door. * fix(journal): contain file paths, fix frontmatter escaping, defuse two regexes Follow-up to the CodeQL findings on release PR #432. I went through all 23 alerts individually; this addresses the ones that are worth addressing and documents the ones that are not. Path containment (12 alerts, all false positives). Every path built from a slug goes through isValidSlug(), a strict `/^[a-zA-Z0-9_-]+$/` allowlist — verified against `../../etc/passwd`, `foo/../../bar`, `a/b`, `..` and friends, all rejected. CodeQL cannot see it because the check lives in another module. Added a containedPath() helper that resolves the path and refuses anything landing outside the content directory: a second lock on a door that was already locked, and a barrier the analysis can follow. Also removed the dead `slug.endsWith('.md')` branches — isValidSlug rejects dots, so they could never be taken. Frontmatter escaping (1 alert, a real bug). The serializer escaped `"` but not `\`, and the parser never unescaped anything. A title containing either character gained a backslash on every save/load cycle: Path C:\Users "quoted" -> Path C:\\Users \"quoted\" -> ... Escaping now covers the backslash first and the parser undoes both. A round trip test covers quotes, backslashes, colons and apostrophes. Two of three ReDoS regexes (2 alerts). The heading pattern had `\s+` next to `(.+)`, which overlap, so the engine tried every split of the whitespace run before failing; it is `[ \t]+` and `(\S.*)` now. The quote author pattern wrapped a lazy group around an optional group — the quadratic case — and is an index split on the first separator now. The third regex, the bold/italic pass, is deliberately left alone. Rewriting it with a negated class removes the backtracking but breaks nesting: `**bold *and italic* here**` renders as `*<em>bold </em>and italic<em> here</em>*`. The input is Markdown from an authenticated admin, never a visitor, so the worst case is an author slowing down their own page. The comment in the code says so. Not addressed: 5 js/insufficient-password-hash alerts. They ask for a slow KDF where the code uses SHA-256/HMAC — correct in general, but the admin password comes from an environment variable and is never stored, so a stronger KDF protects nothing that is not already in plaintext in the environment. 399 unit tests pass (18 new), build and tsc clean. * fix(journal): split the quote author by scanning, not by pattern Cleaning up after myself. #439 replaced the quote author regex `/^(.*?)(?:\s+--\s+(.+))?$/` — a lazy group around an optional one, the quadratic case — with `/\s+--\s+/`, and CodeQL promptly flagged the replacement for the same reason. One reported pattern traded for another. splitQuoteAuthor() scans for the first `--` that has whitespace on both sides. Linear, and it needs no reasoning about the regex engine at all. Behaviour is identical to the original regex, checked case by case against it: separator, no separator, several separators, tabs, wide gaps, `a--b` without spaces, leading and trailing separators, empty string. All nine are covered by tests, plus one asserting it stays fast on a 50k whitespace run. * security(admin): derive the session signing key with scrypt getSigningKey() ran the admin password through a single SHA-256 digest. It is key derivation rather than password storage, so it was never a stored-hash problem — but if the derived key ever leaked, one fast hash makes recovering the password by brute force cheap. CodeQL flags it as js/insufficient-password-hash and, for this particular alert, has a point. scrypt now. Two details that matter: The salt has to be stable. A random salt would produce a different key on every call and invalidate every session; it is derived from AUTH_SECRET, which is deployment-specific. Verified across separate processes: same inputs produce a verifying token, so a restart or redeploy does not log everyone out. The result is cached for the process lifetime. scrypt is deliberately slow and getSigningKey() runs on every admin request — deriving per call would add ~24ms to each one. The cache key is a digest of secret plus password, so a rotation misses the cache and derives again, and no extra plaintext copy of the password is kept around. Measured: first derivation 24ms, subsequent calls 0.12ms. Password change and secret change both invalidate an existing token, checked in separate processes. Note the one-time effect: existing admin sessions are invalidated by the change in derivation, so everyone logs in once more. * security(admin): key the signing-key cache on its inputs, not a digest #441 removed the SHA-256 digest of the admin password from the key derivation and introduced a new one three lines above it, as the cache key. Same rule, same file: CodeQL reported it immediately. The comment justifying it was wrong too. It claimed no second plaintext copy of the password was retained, while building the digest input allocates exactly that in order to hash it. The cache now holds the two input strings and compares them directly. They are the same objects the env and install caches already hold, so nothing extra is retained, and no fast hash of the password exists in memory for the life of the process. Re-verified after the change, in separate processes: a token from one process verifies in another with the same inputs, a changed password or secret rejects it, first derivation 24ms, cached calls 0.001ms. That leaves scrypt as the only place the password is hashed here. The two HMACs further down operate on the derived key and on token data, not on the password; the constant-time comparison in verifyAdminPassword is the previously dismissed one. --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
2026-08-14 16:55:07 +02:00
flex: none;
aspect-ratio: 21 / 9;
max-height: 180px;
feat: redesign admin pagebuilder with slide-over drawers and svg icons (#242) Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-05-31 21:27:13 +02:00
border-radius: 10px;
overflow: hidden;
border: 1px solid var(--admin-border);
feat: redesign album drawer into a gorgeous centered two-column modal (#243) Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-05-31 21:30:00 +02:00
background: var(--admin-bg);
box-shadow: 0 4px 12px rgba(0, 0, 0, 0.2);
feat: redesign admin pagebuilder with slide-over drawers and svg icons (#242) Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-05-31 21:27:13 +02:00
}
feat: redesign album drawer into a gorgeous centered two-column modal (#243) Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-05-31 21:30:00 +02:00
.modal-cover-container img {
feat: redesign admin pagebuilder with slide-over drawers and svg icons (#242) Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-05-31 21:27:13 +02:00
width: 100%;
height: 100%;
object-fit: cover;
feat: redesign album drawer into a gorgeous centered two-column modal (#243) Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-05-31 21:30:00 +02:00
display: block;
feat: redesign admin pagebuilder with slide-over drawers and svg icons (#242) Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-05-31 21:27:13 +02:00
}
feat: redesign album drawer into a gorgeous centered two-column modal (#243) Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-05-31 21:30:00 +02:00
.modal-cover-placeholder {
feat: redesign admin pagebuilder with slide-over drawers and svg icons (#242) Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-05-31 21:27:13 +02:00
width: 100%;
height: 100%;
display: flex;
align-items: center;
justify-content: center;
color: var(--admin-text-muted);
feat: redesign album drawer into a gorgeous centered two-column modal (#243) Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-05-31 21:30:00 +02:00
font-size: 2.5rem;
feat: redesign admin pagebuilder with slide-over drawers and svg icons (#242) Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-05-31 21:27:13 +02:00
}
release: v0.11.0 — journal fixes, admin URLs, design system cleanup (#432) * fix(screenshots): sharp-Typen fuer 0.34 und 0.35 gleichzeitig (#410) sharp 0.35 ist von `export =` auf ESM umgestellt: der Modul-Namespace ist nicht mehr aufrufbar, die Factory sitzt unter .default. Der Type-Check brach damit in scripts/screenshots.ts weg, sobald der Next-Bump (#402) sharp von 0.34.5 auf 0.35.3 mitzieht -- sharp ist hier keine deklarierte Dependency, sondern kommt ueber Next mit. Die Form wird jetzt aus dem installierten Paket abgeleitet statt festgeschrieben, zur Laufzeit wie im Typ. Geprueft mit beiden Versionen: tsc laeuft mit 0.34.5 und mit 0.35.3 fehlerfrei durch. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(deps): bump the nextjs group across 1 directory with 2 updates (#402) Bumps the nextjs group with 2 updates in the / directory: [next](https://github.com/vercel/next.js) and [eslint-config-next](https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next). Updates `next` from 16.2.12 to 16.3.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/compare/v16.2.12...v16.3.0) Updates `eslint-config-next` from 16.2.12 to 16.3.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/commits/v16.3.0/packages/eslint-config-next) --- updated-dependencies: - dependency-name: eslint-config-next dependency-version: 16.3.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: nextjs - dependency-name: next dependency-version: 16.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nextjs ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps-dev): bump prettier from 3.8.3 to 3.9.6 (#405) Bumps [prettier](https://github.com/prettier/prettier) from 3.8.3 to 3.9.6. - [Release notes](https://github.com/prettier/prettier/releases) - [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md) - [Commits](https://github.com/prettier/prettier/compare/3.8.3...3.9.6) --- updated-dependencies: - dependency-name: prettier dependency-version: 3.9.6 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * docs(changelog): Unreleased-Sektion fuer die Bumps nach v0.10.0 (#413) Die Dependency-PRs sind nach dem Release auf dev gelandet, teils auch auf main. Ohne Eintrag waeren sie beim naechsten Release unsichtbar -- inklusive Next 16.3.0, das CVE-2025-13465 mitbringt. Ausserdem im 0.10.0-Abschnitt nachgetragen, dass der Trivy-Scan bis #409 nie gelaufen ist. Der Fix steckt im Tag v0.10.0, fehlte aber in der Aufzaehlung -- und "Images werden bei jedem Publish gescannt" stand im Changelog, waehrend der Job im Action-Setup abbrach. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(gallery): per-album sort order, independent of Immich (#408) (#414) Album order was dictated entirely by Immich: getAlbum() sorted by the album's own asc/desc flag, so a Folio album always mirrored the archive. A curated series has a narrative order that has nothing to do with capture time, and changing the Immich album's sort to fit the website changes it for the archive too. Adds an optional per-album `sort` in gallery.yaml, editable in /admin, defaulting to today's behaviour so every existing config is unchanged: immich (default) | newest | oldest | filename | manual `manual` is a pinned *prefix*: `assetOrder` lists only the photos placed by hand, everything else follows in the album's Immich order. A full permutation of a 2,000-photo album would be ~80 KB of UUIDs in a file that is rewritten and copied to content/.backups/ on every admin save. It also makes drift fall out for free — photos removed in Immich never match, new ones land in the tail rather than being hidden. Sorting is applied after the cache read, not before the cache write, so the LRU keeps one canonical Immich-ordered copy per album. That avoids putting the mode in the cache key, lets a config change take effect without depending on invalidation, and keeps the stale-serving path correct. cache.get() returns the stored object by reference, so withSort() returns a shallow clone with a new array — sorting in place would reorder the shared entry, and under request coalescing every concurrent caller would be sorting the same array. Also fixes a prerequisite bug: /api/admin/albums/[albumId]/assets read album.assets from GET /albums/:id, which Immich 3.x no longer populates (lib/immich.ts:507). The hero picker's "This Album" tab returned nothing and threw outright when the key was absent. It now goes through the client's paginated metadata search, with ?types=all to opt videos in for the reorder editor. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): drop decorative emoji from the sort select labels (#415) An <option> cannot contain markup, so the SVG set in Icons is not reachable there — but a decorative emoji is not a substitute for it. Plain text instead; the album card badge already uses a real icon. The remaining emoji in the admin panel (asset picker tabs, section headings, layout picker options) predate this branch and are left for a separate cleanup. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): replace emoji icons with the shared SVG icon set (#416) The admin panel mixed two icon conventions: inline SVGs from `Icons.tsx` in most components, and decorative emoji in the asset picker and a few PageBuilder labels. Emoji render inconsistently across platforms, ignore the accent colour, and cannot inherit the `.svg-icon` sizing rules. - Icons.tsx: add `IconStar` (filled — it marks a state, not an action) and `IconImage`. - AssetPicker: the three tab labels and the favourite tile badge now use IconFolder / IconStar / IconImage. - PageBuilder: the "Standalone Albums" and "Subpages" headings use the icon set instead of an emoji. - PageBuilder: the layout picker drops its emoji for plain text. An <option> cannot contain markup, so an SVG is impossible there and a decorative glyph is not a substitute. - admin.css: align icon and label in the picker tabs, and swap the favourite badge's text-shadow for drop-shadow, which is what applies to an inline SVG. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): fold PageBuilder's local icons into the shared Icons module (#418) * refactor(admin): fold PageBuilder's local icons into the shared module PageBuilder.tsx carried its own `Icons` object duplicating most of the glyphs already exported by Icons.tsx, with hardcoded sizes and slightly divergent paths. Migrate all 32 call sites to the shared module and delete the local object. Five glyphs had no counterpart and are added to Icons.tsx as 1:1 ports of the local paths: IconX, IconPlus, IconHome, IconCopy, IconImage. The local ExternalLink and Check are dropped rather than ported — both had zero call sites. Two glyphs change shape slightly, which is the point of consolidating: the shared IconCamera includes the viewfinder bump the local copy omitted, and drag handles now use IconGripVertical. IconGripVertical uses the module's square 24x24 viewBox, so `.svg-drag` goes from 12x18 to 18x18 — the old non-square box would letterbox the glyph down to 12x12 and shrink the handle. * fix(admin): resolve icon-module integration after #416 Merging dev brought in #416, which added a second IconImage to Icons.tsx and two <Icons.Camera>/<Icons.Folder> section headers that reference the local Icons object this PR removes. Git merged both cleanly but the result did not type-check. - drop the duplicate IconImage (both copies were byte-identical) - point the two section headers at the imported IconCamera/IconFolder - refresh the SORT_LABELS comment: the icon set is imported now, not declared below --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> * fix(config): allow an empty gallery, guard against a double /api suffix (#421) An empty gallery is now a valid, rendered state instead of a throw: deriveGallery() no longer requires at least one album or subpage, so a deployment with no albums yet renders a bare homepage the owner can fill in via /admin. getConfig() also stops appending /api to an Immich URL that already ends in it, which previously produced .../api/api and broke every upstream request. Includes a restore of the per-album sort test cases, which the branch had lost by being cut before #408/#414. * feat(admin): favicon upload, served from the content volume (#422) Adds a bundled default favicon, an upload widget in admin Settings > General, and a route that serves the icon from the writable content/ volume with a fallback to the bundled default. Raster uploads (PNG/ICO/JPEG) are wrapped in an SVG container; the response carries its own CSP so an uploaded SVG cannot execute script on the origin. The GET route revalidates with an ETag instead of caching immutably, so a newly uploaded icon shows up immediately. Uploads are written via temp file + rename, and a Reset button restores the bundled default. * ci: flag unformatted files in a PR, without blocking it (#424) Prettier is configured as an error rule in eslint.config.mjs but has never run in CI, so part of the tree predates it. A final CI step now diffs against the PR base, runs prettier --list-different over the changed files, and emits a warning annotation per offender plus a job summary. Advisory by design: it never fails the job. Blocking would turn a PR red for merely touching a file that was already unformatted, and normalising the tree in one commit would wreck git blame and conflict with the PRs in flight. Requires fetch-depth: 0, since diffing against the base needs its history. * feat(install): first-run wizard gated by a one-time setup token (#419) Adds /install, a four-step first-run wizard: connect to Immich, optionally pick albums, name the site, finish. It verifies the credentials against the Immich server before writing anything, then writes gallery.yaml, settings.yaml and a content/install.json carrying the Immich credentials and a generated site secret. install.json exists because a running process cannot pick up new env vars — the wizard has to write configuration that takes effect without a restart. getInstallCredentials() merges it under the real environment, so env vars always win and rotation stays a matter of setting one. Both the page and the API routes are gated by a one-time setup token printed to the server log, so a deployment that is reachable before gallery.yaml exists cannot be configured by whoever finds it first. The token is stored in content/.setup-token (0600) rather than a module variable: Next.js bundles the page and each route handler separately, so a module-level token left the page and the API disagreeing inside one process and the wizard stuck on step 1. It is removed once the install completes. The admin password is stored as an scrypt hash using the scheme lib/auth.ts already applies to album passwords; a plaintext ADMIN_PASSWORD env var keeps working. * docs: document the setup wizard, fix the read-only content mount (#425) Quick Start now leads with the /install wizard, with the hand-written YAML route kept alongside it, and a First-Run Setup section covers the setup token, the files the wizard writes, and env-var precedence. Two corrections: both Docker examples mounted content/ as :ro, which silently breaks the wizard, the admin panel and the backup rotation alike — docs/admin-panel.md already said so and the README contradicted it. And nothing documented that content/install.json holds the Immich API key, so a backup of content/ is a backup of credentials. Also adds a Contributors section crediting the people whose work is in the project. * feat(admin): floating save bar pinned to the bottom of the viewport (#426) The save bar was the first, static element inside .admin-main. Since the document itself scrolls, it left the viewport as soon as you scrolled down — editing a subpage section or a settings block far below gave no visible dirty hint and no reachable save button. Replace it with a bottom-pinned floating bar shared by both editors. It only mounts while there is something to act on (unsaved changes, an in-flight save, or a result message), so it never covers content while idle. The success message clears after 5s, which hides the bar again. - new SaveBar component, replacing the duplicated markup in PageBuilder and SettingsEditor - adopt the previously unused .floating-save-bar CSS: slide-in keyframes (carrying translateX(-50%)), dirty border, wrap/gap, mobile variant and a prefers-reduced-motion opt-out; z-index 900 keeps it below modals - .admin-main gains bottom padding so the bar never covers page content - drop the now-unreachable idle hints: the ⌘S hint becomes a button title, the Live Sync note becomes a static line above the settings layout - header "Site" link now bypasses the cache (/?fresh=1), so the preview stays reachable when the bar is hidden Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(admin): themed listbox for the album sort control (#427) The per-album "Photo order" control was a native <select>. Because an <option> cannot contain markup, its choices could not use the admin panel's currentColor SVG set — the reason #415 had to fall back to plain text after dropping the emoji labels. Adds a Listbox component implementing the ARIA combobox/listbox pattern, so options can render a glyph beside their label: - DOM focus stays on the trigger button; the active option is announced through aria-activedescendant, keeping focus management to one element - Keyboard: arrows (clamped at the ends, like a native select), Home/End, Enter/Space to commit, Escape to cancel, Tab commits and moves on, and prefix type-ahead with a repeat-key cycle - Outside dismissal on pointerdown, so a press starting outside closes the popup before the click retargets The sort options now carry an icon each: calendar, arrow-down, arrow-up, an A→Z marker, and the drag glyph for manual — matching the badge the album card already shows. SORT_LABELS stays plain text because the badge feeds it to a title attribute. Closes #417 Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(git): ignore generated design handoff folders * fix(admin): stop the album sort dropdown clipping, and simplify the panel (#428) * fix(admin): render listbox popup in a portal so it escapes modal clipping The sort control's popup was position:absolute inside three clipping ancestors (.album-drawer overflow:hidden > .album-drawer-body overflow-y:auto > .modal-right-column overflow-y:auto), so it was cut off at the bottom of the Edit Album Details modal. z-index could not help: clipping happens before stacking. It also always hung below the trigger, with no flip. Portal the popup to document.body and position it from the trigger's viewport rect, flipping above when there is more room there and capping max-height to the space available so it scrolls internally rather than overflowing. It is dismissed on scroll and resize, since the anchor is only measured on open. The outside-pointerdown handler now also treats the popup as inside; without that the portalled list counts as outside, and a click on an option would close it before the selection commits. * refactor(admin): single-column album details panel The left column spent 1.2fr on a cover thumbnail and three stat rows, two of which (Status, Custom Hero) only restated the form fields opposite them, while the form itself was squeezed into 1.8fr behind a second nested scroller. Stack the drawer in one column instead: cover as a banner, then the form at full width, with the UUID moved into the footer. The body is now the only scroll container, which also removes one of the ancestors that was clipping the sort popup. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> * fix(admin): give the portalled listbox its theme back, lock the page behind modals (#429) Two defects in the album editor. The sort listbox popup painted transparent. Every --admin-* variable is scoped to .admin-layout, and since the popup moved into document.body it sits outside that subtree, so background/border/text all resolved to nothing. It now carries its own copy of the palette in both colour schemes, plus the font it no longer inherits. Scrolling inside a modal also moved the page behind it. No admin modal ever locked body scroll: the overlay covers the page but does not absorb wheel events, so a scroll starting on the backdrop — or continuing past the end of the modal's own scroller — reaches the document. overscroll-behavior cannot cover that case on its own, because it only applies to scroll containers and the backdrop is not one. useScrollLock freezes body while a modal is open and compensates for the width the scrollbar gives up, so nothing shifts underneath. Each lock restores the inline value it found, which makes nesting work without a counter — a picker opened from the drawer restores the drawer's hidden state instead of clearing it. Applied to both drawers and all four picker modals, which share the defect. overscroll-behavior: contain on the scrollers stops the chaining they can handle themselves. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com> * fix(security): allow unsafe-eval in CSP script-src during dev mode * feat(journal): add Journal Studio with split-screen editor, live preview and dedicated routes * fix(build): separate client parser from server journal-service and fix build type errors * fix(journal): Fotos rendern, Layout und Lightbox-Steuerung korrigieren Fünf unabhängige Fehler in der öffentlichen Journal- und Essay-Ansicht: * Foto-Blöcke wurden nie angezeigt. EssayView löst ein Foto über PhotoItem.id auf, und das sind verschlüsselte Tokens — die Blöcke aus dem Markdown tragen aber rohe Asset-UUIDs. Jede Zuordnung lief ins Leere, und nicht auflösbare Blöcke werden still verworfen. Die IDs werden jetzt serverseitig übersetzt; damit verschwinden nebenbei die rohen UUIDs aus dem Client-Payload, die dort laut Projektregel nie auftauchen dürfen. Nicht auflösbare Referenzen werden geloggt. * Überschriften standen weiter links als der Fließtext. Jeder Block hatte einzeln `max-width: 68ch`, und `ch` ist relativ zur Schrift des Elements — die Serif-Überschrift ergab eine breitere Spalte. Ersetzt durch eine gemeinsame, font-unabhängige `--essay-measure`. * Fullbleed-Fotos bluteten nur nach links aus: `.essay-figure` ist `width: 100%`, wodurch die Box überbestimmt ist und der negative rechte Margin verworfen wird. * Foto-Paare stellten beide Bilder gleich breit dar, wodurch ein Hochformat neben einem Querformat doppelt so hoch wurde. Jetzt eine Justified-Reihe: Breite proportional zum Seitenverhältnis, dadurch exakt gleiche Höhen ohne Beschnitt. * Die Lightbox hatte im Journal keine Tastatursteuerung und keine Scroll-Sperre — beides lag in PhotoGrid, also nur im Album-Raster. Verlagert in die Lightbox selbst, der doppelte Handler in PhotoGrid entfernt (sonst wäre pro Pfeildruck zwei Bilder weitergesprungen). Zusätzlich sind Proofing-Herzen und das EXIF-Panel im redaktionellen Modus abschaltbar und im Journal aus: Client-Proofing ist ein Übergabe-Workflow für Alben, keine Funktion einer Reportage. Auf der Übersicht wurde der Untertitel doppelt gerendert, weil extractExcerpt() auf ihn zurückfällt. * feat(admin): eigene URLs für alle Bereiche und überarbeiteter Journal Studio Das Panel war eine einzige Client-Komponente, die ihre Tabs über useState umschaltet: keine Route pro Bereich, kein Deep-Link, kein Zurück-Button, und nach jedem Reload landete man wieder auf "Pages". Auch der Journal-Editor hatte keine eigene URL. Jetzt sieben echte Routen (/admin, /admin/pages, /admin/journal, /admin/journal/<slug>, /admin/settings, /admin/settings/<section>, /admin/analytics). Die Shell mit Auth-Prüfung und Kopfzeile sitzt im Layout und umschließt children — so bleibt die Session-Prüfung über Routenwechsel montiert, statt bei jedem Tab-Wechsel neu zu laufen und den Spinner aufblitzen zu lassen. Unbekannte Settings-Sections fallen auf General zurück. Im selben Zug der Journal Studio, der die Routing-Änderung ohnehin berührt: * Alle Eingabefelder nutzten die Klasse `admin-input`, die in keinem CSS definiert war — sie fielen auf Browser-Defaults zurück. Jetzt gestylt, gescoped, damit der generische Name nicht ins übrige Panel leckt. * Der Split View ist per Divider verschiebbar (Maus, Tastatur, Doppelklick zum Zurücksetzen), Breite in localStorage. * Das Studio bricht aus der 1120px-Spalte aus, die Preview hat Platz. * Die Preview zeigte für jedes Foto fest 3:2 und log damit über das Layout der veröffentlichten Seite; die echten Verhältnisse werden jetzt an den Thumbnails gemessen. * Blöcke mit alten positionsbasierten Foto-Referenzen werden markiert — die lassen sich auf einer eigenständigen Journal-Seite nicht auflösen und verschwanden bisher stillschweigend. * Blocktyp-Chips als gemeinsame Komponente, monochrom und per Icon unterschieden statt in einer eigenen Blau/Lila/Orange-Palette, die sonst nirgends im Panel vorkommt. * Emojis raus, SVG-Icons rein. * fix(admin): Designsystem-Lücken im Panel schließen Eine systematische Suche nach Klassen, die im TSX benutzt, aber in keinem CSS definiert sind, hat vier Stellen mit demselben Muster gefunden: * `admin-btn-secondary` und `admin-btn-danger` existierten nicht. Sämtliche Löschen-Buttons sahen aus wie normale Buttons — keine Warnwirkung. Als `.admin-btn.admin-btn-danger` geschrieben, weil die Varianten mit den Größenklassen kombiniert werden, die weiter unten ihren eigenen Hintergrund setzen. * `page-progress-fill` fehlte: die Balken im Analytics-Panel waren leere Rinnen, der Wert unsichtbar. Ebenso `analytics-empty` und `admin-loading-container`. * `subpage-drawer-section`, `subpage-drawer-title-group` und `input-with-icon` im PageBuilder waren wirkungslos und teils mit Inline-Styles notdürftig kompensiert. * `grid-card-preview` fehlte, wodurch alle Layout-Vorschauen auf Höhe null kollabierten. Nur "Showcase" war sichtbar — und das aus Versehen, weil sein Tile `hero-tile` hieß und damit die `aspect-ratio` einer fremden PageBuilder-Klasse erbte. Umbenannt. Dazu die Theme-Vorschauen, die praktisch identisch aussahen: alle sieben zeigten dieselben drei quadratischen Kacheln, einziger Unterschied war die Hintergrundfarbe. Sie spiegeln jetzt die echten Preset-Daten aus lib/config/theme.ts — Schriftcharakter, Eckradius, Rasterdichte, Passepartout bzw. Schatten. Die Kopfzeile richtet sich an einer gemeinsamen Steuerhöhe aus. Der "Site"-Link war höher als die Buttons daneben: `.admin-btn` hatte keine explizite line-height, und <button> bekommt box-sizing: border-box vom Browser, <a> nicht. Die Statusanzeige setzte weder Schriftfamilie noch -größe und fiel auf den Browser-Default zurück — sie war nie Teil des Designsystems. Jetzt gleiche Höhe und Typografie, Pillenform als Zustandsanzeige, Trenner zur Aktionsgruppe. Das dauerhafte Pulsieren des grünen Punkts entfällt; Animation bleibt den Zuständen vorbehalten, die Aufmerksamkeit brauchen. Restliche Emojis durch SVG-Icons ersetzt. * feat(admin): add scroll-to-top toggle and SVG arrow The back-to-top button was always on and drew its arrow with the ↑ text character. Add a `scrollToTop` setting (General section in the admin panel, defaults to on so existing sites are unaffected) and replace the glyph with a stroked SVG that inherits currentColor across all presets. Scroll handling is now rAF-throttled, and prefers-reduced-motion turns off both the hover lift and the smooth scroll. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * security(journal): escape author HTML instead of filtering it CodeQL flags 26 high-severity alerts on the release PR; the bulk of them point at sanitizeHtml(), a denylist of three regexes whose output goes into dangerouslySetInnerHTML. I reproduced the bypasses before changing anything — all four pass the old filter: <img src=x onerror=alert(1)> unquoted handler, regex wants quotes <img src=x onerror='alert(1)'> single quotes, same reason <svg onload=alert(1)> not a <script> tag javasjavascript:cript:alert(1) one-pass replace, the rest recombines Plus an attribute breakout in the link renderer, which interpolated the URL into href="${url}" unescaped: [x](" onmouseover=alert(1) x=") -> <a href="" onmouseover=alert(1" ...> Replaced with escaping. Every `&<>"'` in author text becomes an entity before any markdown rule runs, so the only tags in the output are the ones renderInlineMarkdown builds itself and a URL cannot leave its attribute. Link schemes are now an allowlist (http, https, mailto, tel, relative, anchor); anything else renders as plain text. The serializer needed decodeHtmlEntities to match: without it a save would write `&lt;` into the Markdown file and the next parse would escape the `&` again, corrupting the text further on every round trip. A test covers parse -> serialize -> parse stability. Two existing tests asserted the old behaviour and were rewritten rather than deleted: one expected the script tag to be *removed* from the output, the other expected the substring "onerror" to be absent. Both now assert the property that matters — that no tag can form — because `onerror` surviving as inert text is fine. Exploitation required admin access either way: journal and essay text comes from the studio or from content/*.md. This removes the weakness, it does not close an open door. * fix(journal): contain file paths, fix frontmatter escaping, defuse two regexes Follow-up to the CodeQL findings on release PR #432. I went through all 23 alerts individually; this addresses the ones that are worth addressing and documents the ones that are not. Path containment (12 alerts, all false positives). Every path built from a slug goes through isValidSlug(), a strict `/^[a-zA-Z0-9_-]+$/` allowlist — verified against `../../etc/passwd`, `foo/../../bar`, `a/b`, `..` and friends, all rejected. CodeQL cannot see it because the check lives in another module. Added a containedPath() helper that resolves the path and refuses anything landing outside the content directory: a second lock on a door that was already locked, and a barrier the analysis can follow. Also removed the dead `slug.endsWith('.md')` branches — isValidSlug rejects dots, so they could never be taken. Frontmatter escaping (1 alert, a real bug). The serializer escaped `"` but not `\`, and the parser never unescaped anything. A title containing either character gained a backslash on every save/load cycle: Path C:\Users "quoted" -> Path C:\\Users \"quoted\" -> ... Escaping now covers the backslash first and the parser undoes both. A round trip test covers quotes, backslashes, colons and apostrophes. Two of three ReDoS regexes (2 alerts). The heading pattern had `\s+` next to `(.+)`, which overlap, so the engine tried every split of the whitespace run before failing; it is `[ \t]+` and `(\S.*)` now. The quote author pattern wrapped a lazy group around an optional group — the quadratic case — and is an index split on the first separator now. The third regex, the bold/italic pass, is deliberately left alone. Rewriting it with a negated class removes the backtracking but breaks nesting: `**bold *and italic* here**` renders as `*<em>bold </em>and italic<em> here</em>*`. The input is Markdown from an authenticated admin, never a visitor, so the worst case is an author slowing down their own page. The comment in the code says so. Not addressed: 5 js/insufficient-password-hash alerts. They ask for a slow KDF where the code uses SHA-256/HMAC — correct in general, but the admin password comes from an environment variable and is never stored, so a stronger KDF protects nothing that is not already in plaintext in the environment. 399 unit tests pass (18 new), build and tsc clean. * fix(journal): split the quote author by scanning, not by pattern Cleaning up after myself. #439 replaced the quote author regex `/^(.*?)(?:\s+--\s+(.+))?$/` — a lazy group around an optional one, the quadratic case — with `/\s+--\s+/`, and CodeQL promptly flagged the replacement for the same reason. One reported pattern traded for another. splitQuoteAuthor() scans for the first `--` that has whitespace on both sides. Linear, and it needs no reasoning about the regex engine at all. Behaviour is identical to the original regex, checked case by case against it: separator, no separator, several separators, tabs, wide gaps, `a--b` without spaces, leading and trailing separators, empty string. All nine are covered by tests, plus one asserting it stays fast on a 50k whitespace run. * security(admin): derive the session signing key with scrypt getSigningKey() ran the admin password through a single SHA-256 digest. It is key derivation rather than password storage, so it was never a stored-hash problem — but if the derived key ever leaked, one fast hash makes recovering the password by brute force cheap. CodeQL flags it as js/insufficient-password-hash and, for this particular alert, has a point. scrypt now. Two details that matter: The salt has to be stable. A random salt would produce a different key on every call and invalidate every session; it is derived from AUTH_SECRET, which is deployment-specific. Verified across separate processes: same inputs produce a verifying token, so a restart or redeploy does not log everyone out. The result is cached for the process lifetime. scrypt is deliberately slow and getSigningKey() runs on every admin request — deriving per call would add ~24ms to each one. The cache key is a digest of secret plus password, so a rotation misses the cache and derives again, and no extra plaintext copy of the password is kept around. Measured: first derivation 24ms, subsequent calls 0.12ms. Password change and secret change both invalidate an existing token, checked in separate processes. Note the one-time effect: existing admin sessions are invalidated by the change in derivation, so everyone logs in once more. * security(admin): key the signing-key cache on its inputs, not a digest #441 removed the SHA-256 digest of the admin password from the key derivation and introduced a new one three lines above it, as the cache key. Same rule, same file: CodeQL reported it immediately. The comment justifying it was wrong too. It claimed no second plaintext copy of the password was retained, while building the digest input allocates exactly that in order to hash it. The cache now holds the two input strings and compares them directly. They are the same objects the env and install caches already hold, so nothing extra is retained, and no fast hash of the password exists in memory for the life of the process. Re-verified after the change, in separate processes: a token from one process verifies in another with the same inputs, a changed password or secret rejects it, first derivation 24ms, cached calls 0.001ms. That leaves scrypt as the only place the password is hashed here. The two HMACs further down operate on the derived key and on token data, not on the password; the constant-time comparison in verifyAdminPassword is the previously dismissed one. --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
2026-08-14 16:55:07 +02:00
/* Album name + photo count, directly under the cover banner */
feat: redesign album drawer into a gorgeous centered two-column modal (#243) Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-05-31 21:30:00 +02:00
.modal-meta-box {
feat: redesign admin pagebuilder with slide-over drawers and svg icons (#242) Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-05-31 21:27:13 +02:00
display: flex;
flex-direction: column;
feat: redesign album drawer into a gorgeous centered two-column modal (#243) Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-05-31 21:30:00 +02:00
gap: 0.25rem;
release: v0.11.0 — journal fixes, admin URLs, design system cleanup (#432) * fix(screenshots): sharp-Typen fuer 0.34 und 0.35 gleichzeitig (#410) sharp 0.35 ist von `export =` auf ESM umgestellt: der Modul-Namespace ist nicht mehr aufrufbar, die Factory sitzt unter .default. Der Type-Check brach damit in scripts/screenshots.ts weg, sobald der Next-Bump (#402) sharp von 0.34.5 auf 0.35.3 mitzieht -- sharp ist hier keine deklarierte Dependency, sondern kommt ueber Next mit. Die Form wird jetzt aus dem installierten Paket abgeleitet statt festgeschrieben, zur Laufzeit wie im Typ. Geprueft mit beiden Versionen: tsc laeuft mit 0.34.5 und mit 0.35.3 fehlerfrei durch. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(deps): bump the nextjs group across 1 directory with 2 updates (#402) Bumps the nextjs group with 2 updates in the / directory: [next](https://github.com/vercel/next.js) and [eslint-config-next](https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next). Updates `next` from 16.2.12 to 16.3.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/compare/v16.2.12...v16.3.0) Updates `eslint-config-next` from 16.2.12 to 16.3.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/commits/v16.3.0/packages/eslint-config-next) --- updated-dependencies: - dependency-name: eslint-config-next dependency-version: 16.3.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: nextjs - dependency-name: next dependency-version: 16.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nextjs ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps-dev): bump prettier from 3.8.3 to 3.9.6 (#405) Bumps [prettier](https://github.com/prettier/prettier) from 3.8.3 to 3.9.6. - [Release notes](https://github.com/prettier/prettier/releases) - [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md) - [Commits](https://github.com/prettier/prettier/compare/3.8.3...3.9.6) --- updated-dependencies: - dependency-name: prettier dependency-version: 3.9.6 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * docs(changelog): Unreleased-Sektion fuer die Bumps nach v0.10.0 (#413) Die Dependency-PRs sind nach dem Release auf dev gelandet, teils auch auf main. Ohne Eintrag waeren sie beim naechsten Release unsichtbar -- inklusive Next 16.3.0, das CVE-2025-13465 mitbringt. Ausserdem im 0.10.0-Abschnitt nachgetragen, dass der Trivy-Scan bis #409 nie gelaufen ist. Der Fix steckt im Tag v0.10.0, fehlte aber in der Aufzaehlung -- und "Images werden bei jedem Publish gescannt" stand im Changelog, waehrend der Job im Action-Setup abbrach. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(gallery): per-album sort order, independent of Immich (#408) (#414) Album order was dictated entirely by Immich: getAlbum() sorted by the album's own asc/desc flag, so a Folio album always mirrored the archive. A curated series has a narrative order that has nothing to do with capture time, and changing the Immich album's sort to fit the website changes it for the archive too. Adds an optional per-album `sort` in gallery.yaml, editable in /admin, defaulting to today's behaviour so every existing config is unchanged: immich (default) | newest | oldest | filename | manual `manual` is a pinned *prefix*: `assetOrder` lists only the photos placed by hand, everything else follows in the album's Immich order. A full permutation of a 2,000-photo album would be ~80 KB of UUIDs in a file that is rewritten and copied to content/.backups/ on every admin save. It also makes drift fall out for free — photos removed in Immich never match, new ones land in the tail rather than being hidden. Sorting is applied after the cache read, not before the cache write, so the LRU keeps one canonical Immich-ordered copy per album. That avoids putting the mode in the cache key, lets a config change take effect without depending on invalidation, and keeps the stale-serving path correct. cache.get() returns the stored object by reference, so withSort() returns a shallow clone with a new array — sorting in place would reorder the shared entry, and under request coalescing every concurrent caller would be sorting the same array. Also fixes a prerequisite bug: /api/admin/albums/[albumId]/assets read album.assets from GET /albums/:id, which Immich 3.x no longer populates (lib/immich.ts:507). The hero picker's "This Album" tab returned nothing and threw outright when the key was absent. It now goes through the client's paginated metadata search, with ?types=all to opt videos in for the reorder editor. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): drop decorative emoji from the sort select labels (#415) An <option> cannot contain markup, so the SVG set in Icons is not reachable there — but a decorative emoji is not a substitute for it. Plain text instead; the album card badge already uses a real icon. The remaining emoji in the admin panel (asset picker tabs, section headings, layout picker options) predate this branch and are left for a separate cleanup. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): replace emoji icons with the shared SVG icon set (#416) The admin panel mixed two icon conventions: inline SVGs from `Icons.tsx` in most components, and decorative emoji in the asset picker and a few PageBuilder labels. Emoji render inconsistently across platforms, ignore the accent colour, and cannot inherit the `.svg-icon` sizing rules. - Icons.tsx: add `IconStar` (filled — it marks a state, not an action) and `IconImage`. - AssetPicker: the three tab labels and the favourite tile badge now use IconFolder / IconStar / IconImage. - PageBuilder: the "Standalone Albums" and "Subpages" headings use the icon set instead of an emoji. - PageBuilder: the layout picker drops its emoji for plain text. An <option> cannot contain markup, so an SVG is impossible there and a decorative glyph is not a substitute. - admin.css: align icon and label in the picker tabs, and swap the favourite badge's text-shadow for drop-shadow, which is what applies to an inline SVG. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): fold PageBuilder's local icons into the shared Icons module (#418) * refactor(admin): fold PageBuilder's local icons into the shared module PageBuilder.tsx carried its own `Icons` object duplicating most of the glyphs already exported by Icons.tsx, with hardcoded sizes and slightly divergent paths. Migrate all 32 call sites to the shared module and delete the local object. Five glyphs had no counterpart and are added to Icons.tsx as 1:1 ports of the local paths: IconX, IconPlus, IconHome, IconCopy, IconImage. The local ExternalLink and Check are dropped rather than ported — both had zero call sites. Two glyphs change shape slightly, which is the point of consolidating: the shared IconCamera includes the viewfinder bump the local copy omitted, and drag handles now use IconGripVertical. IconGripVertical uses the module's square 24x24 viewBox, so `.svg-drag` goes from 12x18 to 18x18 — the old non-square box would letterbox the glyph down to 12x12 and shrink the handle. * fix(admin): resolve icon-module integration after #416 Merging dev brought in #416, which added a second IconImage to Icons.tsx and two <Icons.Camera>/<Icons.Folder> section headers that reference the local Icons object this PR removes. Git merged both cleanly but the result did not type-check. - drop the duplicate IconImage (both copies were byte-identical) - point the two section headers at the imported IconCamera/IconFolder - refresh the SORT_LABELS comment: the icon set is imported now, not declared below --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> * fix(config): allow an empty gallery, guard against a double /api suffix (#421) An empty gallery is now a valid, rendered state instead of a throw: deriveGallery() no longer requires at least one album or subpage, so a deployment with no albums yet renders a bare homepage the owner can fill in via /admin. getConfig() also stops appending /api to an Immich URL that already ends in it, which previously produced .../api/api and broke every upstream request. Includes a restore of the per-album sort test cases, which the branch had lost by being cut before #408/#414. * feat(admin): favicon upload, served from the content volume (#422) Adds a bundled default favicon, an upload widget in admin Settings > General, and a route that serves the icon from the writable content/ volume with a fallback to the bundled default. Raster uploads (PNG/ICO/JPEG) are wrapped in an SVG container; the response carries its own CSP so an uploaded SVG cannot execute script on the origin. The GET route revalidates with an ETag instead of caching immutably, so a newly uploaded icon shows up immediately. Uploads are written via temp file + rename, and a Reset button restores the bundled default. * ci: flag unformatted files in a PR, without blocking it (#424) Prettier is configured as an error rule in eslint.config.mjs but has never run in CI, so part of the tree predates it. A final CI step now diffs against the PR base, runs prettier --list-different over the changed files, and emits a warning annotation per offender plus a job summary. Advisory by design: it never fails the job. Blocking would turn a PR red for merely touching a file that was already unformatted, and normalising the tree in one commit would wreck git blame and conflict with the PRs in flight. Requires fetch-depth: 0, since diffing against the base needs its history. * feat(install): first-run wizard gated by a one-time setup token (#419) Adds /install, a four-step first-run wizard: connect to Immich, optionally pick albums, name the site, finish. It verifies the credentials against the Immich server before writing anything, then writes gallery.yaml, settings.yaml and a content/install.json carrying the Immich credentials and a generated site secret. install.json exists because a running process cannot pick up new env vars — the wizard has to write configuration that takes effect without a restart. getInstallCredentials() merges it under the real environment, so env vars always win and rotation stays a matter of setting one. Both the page and the API routes are gated by a one-time setup token printed to the server log, so a deployment that is reachable before gallery.yaml exists cannot be configured by whoever finds it first. The token is stored in content/.setup-token (0600) rather than a module variable: Next.js bundles the page and each route handler separately, so a module-level token left the page and the API disagreeing inside one process and the wizard stuck on step 1. It is removed once the install completes. The admin password is stored as an scrypt hash using the scheme lib/auth.ts already applies to album passwords; a plaintext ADMIN_PASSWORD env var keeps working. * docs: document the setup wizard, fix the read-only content mount (#425) Quick Start now leads with the /install wizard, with the hand-written YAML route kept alongside it, and a First-Run Setup section covers the setup token, the files the wizard writes, and env-var precedence. Two corrections: both Docker examples mounted content/ as :ro, which silently breaks the wizard, the admin panel and the backup rotation alike — docs/admin-panel.md already said so and the README contradicted it. And nothing documented that content/install.json holds the Immich API key, so a backup of content/ is a backup of credentials. Also adds a Contributors section crediting the people whose work is in the project. * feat(admin): floating save bar pinned to the bottom of the viewport (#426) The save bar was the first, static element inside .admin-main. Since the document itself scrolls, it left the viewport as soon as you scrolled down — editing a subpage section or a settings block far below gave no visible dirty hint and no reachable save button. Replace it with a bottom-pinned floating bar shared by both editors. It only mounts while there is something to act on (unsaved changes, an in-flight save, or a result message), so it never covers content while idle. The success message clears after 5s, which hides the bar again. - new SaveBar component, replacing the duplicated markup in PageBuilder and SettingsEditor - adopt the previously unused .floating-save-bar CSS: slide-in keyframes (carrying translateX(-50%)), dirty border, wrap/gap, mobile variant and a prefers-reduced-motion opt-out; z-index 900 keeps it below modals - .admin-main gains bottom padding so the bar never covers page content - drop the now-unreachable idle hints: the ⌘S hint becomes a button title, the Live Sync note becomes a static line above the settings layout - header "Site" link now bypasses the cache (/?fresh=1), so the preview stays reachable when the bar is hidden Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(admin): themed listbox for the album sort control (#427) The per-album "Photo order" control was a native <select>. Because an <option> cannot contain markup, its choices could not use the admin panel's currentColor SVG set — the reason #415 had to fall back to plain text after dropping the emoji labels. Adds a Listbox component implementing the ARIA combobox/listbox pattern, so options can render a glyph beside their label: - DOM focus stays on the trigger button; the active option is announced through aria-activedescendant, keeping focus management to one element - Keyboard: arrows (clamped at the ends, like a native select), Home/End, Enter/Space to commit, Escape to cancel, Tab commits and moves on, and prefix type-ahead with a repeat-key cycle - Outside dismissal on pointerdown, so a press starting outside closes the popup before the click retargets The sort options now carry an icon each: calendar, arrow-down, arrow-up, an A→Z marker, and the drag glyph for manual — matching the badge the album card already shows. SORT_LABELS stays plain text because the badge feeds it to a title attribute. Closes #417 Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(git): ignore generated design handoff folders * fix(admin): stop the album sort dropdown clipping, and simplify the panel (#428) * fix(admin): render listbox popup in a portal so it escapes modal clipping The sort control's popup was position:absolute inside three clipping ancestors (.album-drawer overflow:hidden > .album-drawer-body overflow-y:auto > .modal-right-column overflow-y:auto), so it was cut off at the bottom of the Edit Album Details modal. z-index could not help: clipping happens before stacking. It also always hung below the trigger, with no flip. Portal the popup to document.body and position it from the trigger's viewport rect, flipping above when there is more room there and capping max-height to the space available so it scrolls internally rather than overflowing. It is dismissed on scroll and resize, since the anchor is only measured on open. The outside-pointerdown handler now also treats the popup as inside; without that the portalled list counts as outside, and a click on an option would close it before the selection commits. * refactor(admin): single-column album details panel The left column spent 1.2fr on a cover thumbnail and three stat rows, two of which (Status, Custom Hero) only restated the form fields opposite them, while the form itself was squeezed into 1.8fr behind a second nested scroller. Stack the drawer in one column instead: cover as a banner, then the form at full width, with the UUID moved into the footer. The body is now the only scroll container, which also removes one of the ancestors that was clipping the sort popup. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> * fix(admin): give the portalled listbox its theme back, lock the page behind modals (#429) Two defects in the album editor. The sort listbox popup painted transparent. Every --admin-* variable is scoped to .admin-layout, and since the popup moved into document.body it sits outside that subtree, so background/border/text all resolved to nothing. It now carries its own copy of the palette in both colour schemes, plus the font it no longer inherits. Scrolling inside a modal also moved the page behind it. No admin modal ever locked body scroll: the overlay covers the page but does not absorb wheel events, so a scroll starting on the backdrop — or continuing past the end of the modal's own scroller — reaches the document. overscroll-behavior cannot cover that case on its own, because it only applies to scroll containers and the backdrop is not one. useScrollLock freezes body while a modal is open and compensates for the width the scrollbar gives up, so nothing shifts underneath. Each lock restores the inline value it found, which makes nesting work without a counter — a picker opened from the drawer restores the drawer's hidden state instead of clearing it. Applied to both drawers and all four picker modals, which share the defect. overscroll-behavior: contain on the scrollers stops the chaining they can handle themselves. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com> * fix(security): allow unsafe-eval in CSP script-src during dev mode * feat(journal): add Journal Studio with split-screen editor, live preview and dedicated routes * fix(build): separate client parser from server journal-service and fix build type errors * fix(journal): Fotos rendern, Layout und Lightbox-Steuerung korrigieren Fünf unabhängige Fehler in der öffentlichen Journal- und Essay-Ansicht: * Foto-Blöcke wurden nie angezeigt. EssayView löst ein Foto über PhotoItem.id auf, und das sind verschlüsselte Tokens — die Blöcke aus dem Markdown tragen aber rohe Asset-UUIDs. Jede Zuordnung lief ins Leere, und nicht auflösbare Blöcke werden still verworfen. Die IDs werden jetzt serverseitig übersetzt; damit verschwinden nebenbei die rohen UUIDs aus dem Client-Payload, die dort laut Projektregel nie auftauchen dürfen. Nicht auflösbare Referenzen werden geloggt. * Überschriften standen weiter links als der Fließtext. Jeder Block hatte einzeln `max-width: 68ch`, und `ch` ist relativ zur Schrift des Elements — die Serif-Überschrift ergab eine breitere Spalte. Ersetzt durch eine gemeinsame, font-unabhängige `--essay-measure`. * Fullbleed-Fotos bluteten nur nach links aus: `.essay-figure` ist `width: 100%`, wodurch die Box überbestimmt ist und der negative rechte Margin verworfen wird. * Foto-Paare stellten beide Bilder gleich breit dar, wodurch ein Hochformat neben einem Querformat doppelt so hoch wurde. Jetzt eine Justified-Reihe: Breite proportional zum Seitenverhältnis, dadurch exakt gleiche Höhen ohne Beschnitt. * Die Lightbox hatte im Journal keine Tastatursteuerung und keine Scroll-Sperre — beides lag in PhotoGrid, also nur im Album-Raster. Verlagert in die Lightbox selbst, der doppelte Handler in PhotoGrid entfernt (sonst wäre pro Pfeildruck zwei Bilder weitergesprungen). Zusätzlich sind Proofing-Herzen und das EXIF-Panel im redaktionellen Modus abschaltbar und im Journal aus: Client-Proofing ist ein Übergabe-Workflow für Alben, keine Funktion einer Reportage. Auf der Übersicht wurde der Untertitel doppelt gerendert, weil extractExcerpt() auf ihn zurückfällt. * feat(admin): eigene URLs für alle Bereiche und überarbeiteter Journal Studio Das Panel war eine einzige Client-Komponente, die ihre Tabs über useState umschaltet: keine Route pro Bereich, kein Deep-Link, kein Zurück-Button, und nach jedem Reload landete man wieder auf "Pages". Auch der Journal-Editor hatte keine eigene URL. Jetzt sieben echte Routen (/admin, /admin/pages, /admin/journal, /admin/journal/<slug>, /admin/settings, /admin/settings/<section>, /admin/analytics). Die Shell mit Auth-Prüfung und Kopfzeile sitzt im Layout und umschließt children — so bleibt die Session-Prüfung über Routenwechsel montiert, statt bei jedem Tab-Wechsel neu zu laufen und den Spinner aufblitzen zu lassen. Unbekannte Settings-Sections fallen auf General zurück. Im selben Zug der Journal Studio, der die Routing-Änderung ohnehin berührt: * Alle Eingabefelder nutzten die Klasse `admin-input`, die in keinem CSS definiert war — sie fielen auf Browser-Defaults zurück. Jetzt gestylt, gescoped, damit der generische Name nicht ins übrige Panel leckt. * Der Split View ist per Divider verschiebbar (Maus, Tastatur, Doppelklick zum Zurücksetzen), Breite in localStorage. * Das Studio bricht aus der 1120px-Spalte aus, die Preview hat Platz. * Die Preview zeigte für jedes Foto fest 3:2 und log damit über das Layout der veröffentlichten Seite; die echten Verhältnisse werden jetzt an den Thumbnails gemessen. * Blöcke mit alten positionsbasierten Foto-Referenzen werden markiert — die lassen sich auf einer eigenständigen Journal-Seite nicht auflösen und verschwanden bisher stillschweigend. * Blocktyp-Chips als gemeinsame Komponente, monochrom und per Icon unterschieden statt in einer eigenen Blau/Lila/Orange-Palette, die sonst nirgends im Panel vorkommt. * Emojis raus, SVG-Icons rein. * fix(admin): Designsystem-Lücken im Panel schließen Eine systematische Suche nach Klassen, die im TSX benutzt, aber in keinem CSS definiert sind, hat vier Stellen mit demselben Muster gefunden: * `admin-btn-secondary` und `admin-btn-danger` existierten nicht. Sämtliche Löschen-Buttons sahen aus wie normale Buttons — keine Warnwirkung. Als `.admin-btn.admin-btn-danger` geschrieben, weil die Varianten mit den Größenklassen kombiniert werden, die weiter unten ihren eigenen Hintergrund setzen. * `page-progress-fill` fehlte: die Balken im Analytics-Panel waren leere Rinnen, der Wert unsichtbar. Ebenso `analytics-empty` und `admin-loading-container`. * `subpage-drawer-section`, `subpage-drawer-title-group` und `input-with-icon` im PageBuilder waren wirkungslos und teils mit Inline-Styles notdürftig kompensiert. * `grid-card-preview` fehlte, wodurch alle Layout-Vorschauen auf Höhe null kollabierten. Nur "Showcase" war sichtbar — und das aus Versehen, weil sein Tile `hero-tile` hieß und damit die `aspect-ratio` einer fremden PageBuilder-Klasse erbte. Umbenannt. Dazu die Theme-Vorschauen, die praktisch identisch aussahen: alle sieben zeigten dieselben drei quadratischen Kacheln, einziger Unterschied war die Hintergrundfarbe. Sie spiegeln jetzt die echten Preset-Daten aus lib/config/theme.ts — Schriftcharakter, Eckradius, Rasterdichte, Passepartout bzw. Schatten. Die Kopfzeile richtet sich an einer gemeinsamen Steuerhöhe aus. Der "Site"-Link war höher als die Buttons daneben: `.admin-btn` hatte keine explizite line-height, und <button> bekommt box-sizing: border-box vom Browser, <a> nicht. Die Statusanzeige setzte weder Schriftfamilie noch -größe und fiel auf den Browser-Default zurück — sie war nie Teil des Designsystems. Jetzt gleiche Höhe und Typografie, Pillenform als Zustandsanzeige, Trenner zur Aktionsgruppe. Das dauerhafte Pulsieren des grünen Punkts entfällt; Animation bleibt den Zuständen vorbehalten, die Aufmerksamkeit brauchen. Restliche Emojis durch SVG-Icons ersetzt. * feat(admin): add scroll-to-top toggle and SVG arrow The back-to-top button was always on and drew its arrow with the ↑ text character. Add a `scrollToTop` setting (General section in the admin panel, defaults to on so existing sites are unaffected) and replace the glyph with a stroked SVG that inherits currentColor across all presets. Scroll handling is now rAF-throttled, and prefers-reduced-motion turns off both the hover lift and the smooth scroll. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * security(journal): escape author HTML instead of filtering it CodeQL flags 26 high-severity alerts on the release PR; the bulk of them point at sanitizeHtml(), a denylist of three regexes whose output goes into dangerouslySetInnerHTML. I reproduced the bypasses before changing anything — all four pass the old filter: <img src=x onerror=alert(1)> unquoted handler, regex wants quotes <img src=x onerror='alert(1)'> single quotes, same reason <svg onload=alert(1)> not a <script> tag javasjavascript:cript:alert(1) one-pass replace, the rest recombines Plus an attribute breakout in the link renderer, which interpolated the URL into href="${url}" unescaped: [x](" onmouseover=alert(1) x=") -> <a href="" onmouseover=alert(1" ...> Replaced with escaping. Every `&<>"'` in author text becomes an entity before any markdown rule runs, so the only tags in the output are the ones renderInlineMarkdown builds itself and a URL cannot leave its attribute. Link schemes are now an allowlist (http, https, mailto, tel, relative, anchor); anything else renders as plain text. The serializer needed decodeHtmlEntities to match: without it a save would write `&lt;` into the Markdown file and the next parse would escape the `&` again, corrupting the text further on every round trip. A test covers parse -> serialize -> parse stability. Two existing tests asserted the old behaviour and were rewritten rather than deleted: one expected the script tag to be *removed* from the output, the other expected the substring "onerror" to be absent. Both now assert the property that matters — that no tag can form — because `onerror` surviving as inert text is fine. Exploitation required admin access either way: journal and essay text comes from the studio or from content/*.md. This removes the weakness, it does not close an open door. * fix(journal): contain file paths, fix frontmatter escaping, defuse two regexes Follow-up to the CodeQL findings on release PR #432. I went through all 23 alerts individually; this addresses the ones that are worth addressing and documents the ones that are not. Path containment (12 alerts, all false positives). Every path built from a slug goes through isValidSlug(), a strict `/^[a-zA-Z0-9_-]+$/` allowlist — verified against `../../etc/passwd`, `foo/../../bar`, `a/b`, `..` and friends, all rejected. CodeQL cannot see it because the check lives in another module. Added a containedPath() helper that resolves the path and refuses anything landing outside the content directory: a second lock on a door that was already locked, and a barrier the analysis can follow. Also removed the dead `slug.endsWith('.md')` branches — isValidSlug rejects dots, so they could never be taken. Frontmatter escaping (1 alert, a real bug). The serializer escaped `"` but not `\`, and the parser never unescaped anything. A title containing either character gained a backslash on every save/load cycle: Path C:\Users "quoted" -> Path C:\\Users \"quoted\" -> ... Escaping now covers the backslash first and the parser undoes both. A round trip test covers quotes, backslashes, colons and apostrophes. Two of three ReDoS regexes (2 alerts). The heading pattern had `\s+` next to `(.+)`, which overlap, so the engine tried every split of the whitespace run before failing; it is `[ \t]+` and `(\S.*)` now. The quote author pattern wrapped a lazy group around an optional group — the quadratic case — and is an index split on the first separator now. The third regex, the bold/italic pass, is deliberately left alone. Rewriting it with a negated class removes the backtracking but breaks nesting: `**bold *and italic* here**` renders as `*<em>bold </em>and italic<em> here</em>*`. The input is Markdown from an authenticated admin, never a visitor, so the worst case is an author slowing down their own page. The comment in the code says so. Not addressed: 5 js/insufficient-password-hash alerts. They ask for a slow KDF where the code uses SHA-256/HMAC — correct in general, but the admin password comes from an environment variable and is never stored, so a stronger KDF protects nothing that is not already in plaintext in the environment. 399 unit tests pass (18 new), build and tsc clean. * fix(journal): split the quote author by scanning, not by pattern Cleaning up after myself. #439 replaced the quote author regex `/^(.*?)(?:\s+--\s+(.+))?$/` — a lazy group around an optional one, the quadratic case — with `/\s+--\s+/`, and CodeQL promptly flagged the replacement for the same reason. One reported pattern traded for another. splitQuoteAuthor() scans for the first `--` that has whitespace on both sides. Linear, and it needs no reasoning about the regex engine at all. Behaviour is identical to the original regex, checked case by case against it: separator, no separator, several separators, tabs, wide gaps, `a--b` without spaces, leading and trailing separators, empty string. All nine are covered by tests, plus one asserting it stays fast on a 50k whitespace run. * security(admin): derive the session signing key with scrypt getSigningKey() ran the admin password through a single SHA-256 digest. It is key derivation rather than password storage, so it was never a stored-hash problem — but if the derived key ever leaked, one fast hash makes recovering the password by brute force cheap. CodeQL flags it as js/insufficient-password-hash and, for this particular alert, has a point. scrypt now. Two details that matter: The salt has to be stable. A random salt would produce a different key on every call and invalidate every session; it is derived from AUTH_SECRET, which is deployment-specific. Verified across separate processes: same inputs produce a verifying token, so a restart or redeploy does not log everyone out. The result is cached for the process lifetime. scrypt is deliberately slow and getSigningKey() runs on every admin request — deriving per call would add ~24ms to each one. The cache key is a digest of secret plus password, so a rotation misses the cache and derives again, and no extra plaintext copy of the password is kept around. Measured: first derivation 24ms, subsequent calls 0.12ms. Password change and secret change both invalidate an existing token, checked in separate processes. Note the one-time effect: existing admin sessions are invalidated by the change in derivation, so everyone logs in once more. * security(admin): key the signing-key cache on its inputs, not a digest #441 removed the SHA-256 digest of the admin password from the key derivation and introduced a new one three lines above it, as the cache key. Same rule, same file: CodeQL reported it immediately. The comment justifying it was wrong too. It claimed no second plaintext copy of the password was retained, while building the digest input allocates exactly that in order to hash it. The cache now holds the two input strings and compares them directly. They are the same objects the env and install caches already hold, so nothing extra is retained, and no fast hash of the password exists in memory for the life of the process. Re-verified after the change, in separate processes: a token from one process verifies in another with the same inputs, a changed password or secret rejects it, first derivation 24ms, cached calls 0.001ms. That leaves scrypt as the only place the password is hashed here. The two HMACs further down operate on the derived key and on token data, not on the password; the constant-time comparison in verifyAdminPassword is the previously dismissed one. --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
2026-08-14 16:55:07 +02:00
padding-bottom: 0.25rem;
border-bottom: 1px solid var(--admin-border);
feat: redesign admin pagebuilder with slide-over drawers and svg icons (#242) Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-05-31 21:27:13 +02:00
}
feat: redesign album drawer into a gorgeous centered two-column modal (#243) Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-05-31 21:30:00 +02:00
.modal-album-title {
font-size: 1.1rem;
font-weight: 700;
feat: redesign admin pagebuilder with slide-over drawers and svg icons (#242) Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-05-31 21:27:13 +02:00
color: var(--admin-text);
white-space: nowrap;
overflow: hidden;
text-overflow: ellipsis;
}
feat: redesign album drawer into a gorgeous centered two-column modal (#243) Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-05-31 21:30:00 +02:00
.modal-album-subtitle {
font-size: 0.8rem;
color: var(--admin-text-secondary);
}
feat: redesign admin pagebuilder with slide-over drawers and svg icons (#242) Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-05-31 21:27:13 +02:00
/* Drawer Copy UUID element */
.uuid-copy-box {
display: flex;
align-items: center;
background: var(--admin-bg-input);
border: 1px solid var(--admin-border);
border-radius: 6px;
padding: 0.4rem 0.5rem 0.4rem 0.75rem;
gap: 0.5rem;
}
.uuid-copy-box code {
font-family: monospace;
font-size: 0.75rem;
color: var(--admin-text-secondary);
flex: 1;
word-break: break-all;
user-select: all;
}
release: v0.11.0 — journal fixes, admin URLs, design system cleanup (#432) * fix(screenshots): sharp-Typen fuer 0.34 und 0.35 gleichzeitig (#410) sharp 0.35 ist von `export =` auf ESM umgestellt: der Modul-Namespace ist nicht mehr aufrufbar, die Factory sitzt unter .default. Der Type-Check brach damit in scripts/screenshots.ts weg, sobald der Next-Bump (#402) sharp von 0.34.5 auf 0.35.3 mitzieht -- sharp ist hier keine deklarierte Dependency, sondern kommt ueber Next mit. Die Form wird jetzt aus dem installierten Paket abgeleitet statt festgeschrieben, zur Laufzeit wie im Typ. Geprueft mit beiden Versionen: tsc laeuft mit 0.34.5 und mit 0.35.3 fehlerfrei durch. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(deps): bump the nextjs group across 1 directory with 2 updates (#402) Bumps the nextjs group with 2 updates in the / directory: [next](https://github.com/vercel/next.js) and [eslint-config-next](https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next). Updates `next` from 16.2.12 to 16.3.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/compare/v16.2.12...v16.3.0) Updates `eslint-config-next` from 16.2.12 to 16.3.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/commits/v16.3.0/packages/eslint-config-next) --- updated-dependencies: - dependency-name: eslint-config-next dependency-version: 16.3.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: nextjs - dependency-name: next dependency-version: 16.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nextjs ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps-dev): bump prettier from 3.8.3 to 3.9.6 (#405) Bumps [prettier](https://github.com/prettier/prettier) from 3.8.3 to 3.9.6. - [Release notes](https://github.com/prettier/prettier/releases) - [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md) - [Commits](https://github.com/prettier/prettier/compare/3.8.3...3.9.6) --- updated-dependencies: - dependency-name: prettier dependency-version: 3.9.6 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * docs(changelog): Unreleased-Sektion fuer die Bumps nach v0.10.0 (#413) Die Dependency-PRs sind nach dem Release auf dev gelandet, teils auch auf main. Ohne Eintrag waeren sie beim naechsten Release unsichtbar -- inklusive Next 16.3.0, das CVE-2025-13465 mitbringt. Ausserdem im 0.10.0-Abschnitt nachgetragen, dass der Trivy-Scan bis #409 nie gelaufen ist. Der Fix steckt im Tag v0.10.0, fehlte aber in der Aufzaehlung -- und "Images werden bei jedem Publish gescannt" stand im Changelog, waehrend der Job im Action-Setup abbrach. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(gallery): per-album sort order, independent of Immich (#408) (#414) Album order was dictated entirely by Immich: getAlbum() sorted by the album's own asc/desc flag, so a Folio album always mirrored the archive. A curated series has a narrative order that has nothing to do with capture time, and changing the Immich album's sort to fit the website changes it for the archive too. Adds an optional per-album `sort` in gallery.yaml, editable in /admin, defaulting to today's behaviour so every existing config is unchanged: immich (default) | newest | oldest | filename | manual `manual` is a pinned *prefix*: `assetOrder` lists only the photos placed by hand, everything else follows in the album's Immich order. A full permutation of a 2,000-photo album would be ~80 KB of UUIDs in a file that is rewritten and copied to content/.backups/ on every admin save. It also makes drift fall out for free — photos removed in Immich never match, new ones land in the tail rather than being hidden. Sorting is applied after the cache read, not before the cache write, so the LRU keeps one canonical Immich-ordered copy per album. That avoids putting the mode in the cache key, lets a config change take effect without depending on invalidation, and keeps the stale-serving path correct. cache.get() returns the stored object by reference, so withSort() returns a shallow clone with a new array — sorting in place would reorder the shared entry, and under request coalescing every concurrent caller would be sorting the same array. Also fixes a prerequisite bug: /api/admin/albums/[albumId]/assets read album.assets from GET /albums/:id, which Immich 3.x no longer populates (lib/immich.ts:507). The hero picker's "This Album" tab returned nothing and threw outright when the key was absent. It now goes through the client's paginated metadata search, with ?types=all to opt videos in for the reorder editor. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): drop decorative emoji from the sort select labels (#415) An <option> cannot contain markup, so the SVG set in Icons is not reachable there — but a decorative emoji is not a substitute for it. Plain text instead; the album card badge already uses a real icon. The remaining emoji in the admin panel (asset picker tabs, section headings, layout picker options) predate this branch and are left for a separate cleanup. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): replace emoji icons with the shared SVG icon set (#416) The admin panel mixed two icon conventions: inline SVGs from `Icons.tsx` in most components, and decorative emoji in the asset picker and a few PageBuilder labels. Emoji render inconsistently across platforms, ignore the accent colour, and cannot inherit the `.svg-icon` sizing rules. - Icons.tsx: add `IconStar` (filled — it marks a state, not an action) and `IconImage`. - AssetPicker: the three tab labels and the favourite tile badge now use IconFolder / IconStar / IconImage. - PageBuilder: the "Standalone Albums" and "Subpages" headings use the icon set instead of an emoji. - PageBuilder: the layout picker drops its emoji for plain text. An <option> cannot contain markup, so an SVG is impossible there and a decorative glyph is not a substitute. - admin.css: align icon and label in the picker tabs, and swap the favourite badge's text-shadow for drop-shadow, which is what applies to an inline SVG. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): fold PageBuilder's local icons into the shared Icons module (#418) * refactor(admin): fold PageBuilder's local icons into the shared module PageBuilder.tsx carried its own `Icons` object duplicating most of the glyphs already exported by Icons.tsx, with hardcoded sizes and slightly divergent paths. Migrate all 32 call sites to the shared module and delete the local object. Five glyphs had no counterpart and are added to Icons.tsx as 1:1 ports of the local paths: IconX, IconPlus, IconHome, IconCopy, IconImage. The local ExternalLink and Check are dropped rather than ported — both had zero call sites. Two glyphs change shape slightly, which is the point of consolidating: the shared IconCamera includes the viewfinder bump the local copy omitted, and drag handles now use IconGripVertical. IconGripVertical uses the module's square 24x24 viewBox, so `.svg-drag` goes from 12x18 to 18x18 — the old non-square box would letterbox the glyph down to 12x12 and shrink the handle. * fix(admin): resolve icon-module integration after #416 Merging dev brought in #416, which added a second IconImage to Icons.tsx and two <Icons.Camera>/<Icons.Folder> section headers that reference the local Icons object this PR removes. Git merged both cleanly but the result did not type-check. - drop the duplicate IconImage (both copies were byte-identical) - point the two section headers at the imported IconCamera/IconFolder - refresh the SORT_LABELS comment: the icon set is imported now, not declared below --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> * fix(config): allow an empty gallery, guard against a double /api suffix (#421) An empty gallery is now a valid, rendered state instead of a throw: deriveGallery() no longer requires at least one album or subpage, so a deployment with no albums yet renders a bare homepage the owner can fill in via /admin. getConfig() also stops appending /api to an Immich URL that already ends in it, which previously produced .../api/api and broke every upstream request. Includes a restore of the per-album sort test cases, which the branch had lost by being cut before #408/#414. * feat(admin): favicon upload, served from the content volume (#422) Adds a bundled default favicon, an upload widget in admin Settings > General, and a route that serves the icon from the writable content/ volume with a fallback to the bundled default. Raster uploads (PNG/ICO/JPEG) are wrapped in an SVG container; the response carries its own CSP so an uploaded SVG cannot execute script on the origin. The GET route revalidates with an ETag instead of caching immutably, so a newly uploaded icon shows up immediately. Uploads are written via temp file + rename, and a Reset button restores the bundled default. * ci: flag unformatted files in a PR, without blocking it (#424) Prettier is configured as an error rule in eslint.config.mjs but has never run in CI, so part of the tree predates it. A final CI step now diffs against the PR base, runs prettier --list-different over the changed files, and emits a warning annotation per offender plus a job summary. Advisory by design: it never fails the job. Blocking would turn a PR red for merely touching a file that was already unformatted, and normalising the tree in one commit would wreck git blame and conflict with the PRs in flight. Requires fetch-depth: 0, since diffing against the base needs its history. * feat(install): first-run wizard gated by a one-time setup token (#419) Adds /install, a four-step first-run wizard: connect to Immich, optionally pick albums, name the site, finish. It verifies the credentials against the Immich server before writing anything, then writes gallery.yaml, settings.yaml and a content/install.json carrying the Immich credentials and a generated site secret. install.json exists because a running process cannot pick up new env vars — the wizard has to write configuration that takes effect without a restart. getInstallCredentials() merges it under the real environment, so env vars always win and rotation stays a matter of setting one. Both the page and the API routes are gated by a one-time setup token printed to the server log, so a deployment that is reachable before gallery.yaml exists cannot be configured by whoever finds it first. The token is stored in content/.setup-token (0600) rather than a module variable: Next.js bundles the page and each route handler separately, so a module-level token left the page and the API disagreeing inside one process and the wizard stuck on step 1. It is removed once the install completes. The admin password is stored as an scrypt hash using the scheme lib/auth.ts already applies to album passwords; a plaintext ADMIN_PASSWORD env var keeps working. * docs: document the setup wizard, fix the read-only content mount (#425) Quick Start now leads with the /install wizard, with the hand-written YAML route kept alongside it, and a First-Run Setup section covers the setup token, the files the wizard writes, and env-var precedence. Two corrections: both Docker examples mounted content/ as :ro, which silently breaks the wizard, the admin panel and the backup rotation alike — docs/admin-panel.md already said so and the README contradicted it. And nothing documented that content/install.json holds the Immich API key, so a backup of content/ is a backup of credentials. Also adds a Contributors section crediting the people whose work is in the project. * feat(admin): floating save bar pinned to the bottom of the viewport (#426) The save bar was the first, static element inside .admin-main. Since the document itself scrolls, it left the viewport as soon as you scrolled down — editing a subpage section or a settings block far below gave no visible dirty hint and no reachable save button. Replace it with a bottom-pinned floating bar shared by both editors. It only mounts while there is something to act on (unsaved changes, an in-flight save, or a result message), so it never covers content while idle. The success message clears after 5s, which hides the bar again. - new SaveBar component, replacing the duplicated markup in PageBuilder and SettingsEditor - adopt the previously unused .floating-save-bar CSS: slide-in keyframes (carrying translateX(-50%)), dirty border, wrap/gap, mobile variant and a prefers-reduced-motion opt-out; z-index 900 keeps it below modals - .admin-main gains bottom padding so the bar never covers page content - drop the now-unreachable idle hints: the ⌘S hint becomes a button title, the Live Sync note becomes a static line above the settings layout - header "Site" link now bypasses the cache (/?fresh=1), so the preview stays reachable when the bar is hidden Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(admin): themed listbox for the album sort control (#427) The per-album "Photo order" control was a native <select>. Because an <option> cannot contain markup, its choices could not use the admin panel's currentColor SVG set — the reason #415 had to fall back to plain text after dropping the emoji labels. Adds a Listbox component implementing the ARIA combobox/listbox pattern, so options can render a glyph beside their label: - DOM focus stays on the trigger button; the active option is announced through aria-activedescendant, keeping focus management to one element - Keyboard: arrows (clamped at the ends, like a native select), Home/End, Enter/Space to commit, Escape to cancel, Tab commits and moves on, and prefix type-ahead with a repeat-key cycle - Outside dismissal on pointerdown, so a press starting outside closes the popup before the click retargets The sort options now carry an icon each: calendar, arrow-down, arrow-up, an A→Z marker, and the drag glyph for manual — matching the badge the album card already shows. SORT_LABELS stays plain text because the badge feeds it to a title attribute. Closes #417 Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(git): ignore generated design handoff folders * fix(admin): stop the album sort dropdown clipping, and simplify the panel (#428) * fix(admin): render listbox popup in a portal so it escapes modal clipping The sort control's popup was position:absolute inside three clipping ancestors (.album-drawer overflow:hidden > .album-drawer-body overflow-y:auto > .modal-right-column overflow-y:auto), so it was cut off at the bottom of the Edit Album Details modal. z-index could not help: clipping happens before stacking. It also always hung below the trigger, with no flip. Portal the popup to document.body and position it from the trigger's viewport rect, flipping above when there is more room there and capping max-height to the space available so it scrolls internally rather than overflowing. It is dismissed on scroll and resize, since the anchor is only measured on open. The outside-pointerdown handler now also treats the popup as inside; without that the portalled list counts as outside, and a click on an option would close it before the selection commits. * refactor(admin): single-column album details panel The left column spent 1.2fr on a cover thumbnail and three stat rows, two of which (Status, Custom Hero) only restated the form fields opposite them, while the form itself was squeezed into 1.8fr behind a second nested scroller. Stack the drawer in one column instead: cover as a banner, then the form at full width, with the UUID moved into the footer. The body is now the only scroll container, which also removes one of the ancestors that was clipping the sort popup. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> * fix(admin): give the portalled listbox its theme back, lock the page behind modals (#429) Two defects in the album editor. The sort listbox popup painted transparent. Every --admin-* variable is scoped to .admin-layout, and since the popup moved into document.body it sits outside that subtree, so background/border/text all resolved to nothing. It now carries its own copy of the palette in both colour schemes, plus the font it no longer inherits. Scrolling inside a modal also moved the page behind it. No admin modal ever locked body scroll: the overlay covers the page but does not absorb wheel events, so a scroll starting on the backdrop — or continuing past the end of the modal's own scroller — reaches the document. overscroll-behavior cannot cover that case on its own, because it only applies to scroll containers and the backdrop is not one. useScrollLock freezes body while a modal is open and compensates for the width the scrollbar gives up, so nothing shifts underneath. Each lock restores the inline value it found, which makes nesting work without a counter — a picker opened from the drawer restores the drawer's hidden state instead of clearing it. Applied to both drawers and all four picker modals, which share the defect. overscroll-behavior: contain on the scrollers stops the chaining they can handle themselves. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com> * fix(security): allow unsafe-eval in CSP script-src during dev mode * feat(journal): add Journal Studio with split-screen editor, live preview and dedicated routes * fix(build): separate client parser from server journal-service and fix build type errors * fix(journal): Fotos rendern, Layout und Lightbox-Steuerung korrigieren Fünf unabhängige Fehler in der öffentlichen Journal- und Essay-Ansicht: * Foto-Blöcke wurden nie angezeigt. EssayView löst ein Foto über PhotoItem.id auf, und das sind verschlüsselte Tokens — die Blöcke aus dem Markdown tragen aber rohe Asset-UUIDs. Jede Zuordnung lief ins Leere, und nicht auflösbare Blöcke werden still verworfen. Die IDs werden jetzt serverseitig übersetzt; damit verschwinden nebenbei die rohen UUIDs aus dem Client-Payload, die dort laut Projektregel nie auftauchen dürfen. Nicht auflösbare Referenzen werden geloggt. * Überschriften standen weiter links als der Fließtext. Jeder Block hatte einzeln `max-width: 68ch`, und `ch` ist relativ zur Schrift des Elements — die Serif-Überschrift ergab eine breitere Spalte. Ersetzt durch eine gemeinsame, font-unabhängige `--essay-measure`. * Fullbleed-Fotos bluteten nur nach links aus: `.essay-figure` ist `width: 100%`, wodurch die Box überbestimmt ist und der negative rechte Margin verworfen wird. * Foto-Paare stellten beide Bilder gleich breit dar, wodurch ein Hochformat neben einem Querformat doppelt so hoch wurde. Jetzt eine Justified-Reihe: Breite proportional zum Seitenverhältnis, dadurch exakt gleiche Höhen ohne Beschnitt. * Die Lightbox hatte im Journal keine Tastatursteuerung und keine Scroll-Sperre — beides lag in PhotoGrid, also nur im Album-Raster. Verlagert in die Lightbox selbst, der doppelte Handler in PhotoGrid entfernt (sonst wäre pro Pfeildruck zwei Bilder weitergesprungen). Zusätzlich sind Proofing-Herzen und das EXIF-Panel im redaktionellen Modus abschaltbar und im Journal aus: Client-Proofing ist ein Übergabe-Workflow für Alben, keine Funktion einer Reportage. Auf der Übersicht wurde der Untertitel doppelt gerendert, weil extractExcerpt() auf ihn zurückfällt. * feat(admin): eigene URLs für alle Bereiche und überarbeiteter Journal Studio Das Panel war eine einzige Client-Komponente, die ihre Tabs über useState umschaltet: keine Route pro Bereich, kein Deep-Link, kein Zurück-Button, und nach jedem Reload landete man wieder auf "Pages". Auch der Journal-Editor hatte keine eigene URL. Jetzt sieben echte Routen (/admin, /admin/pages, /admin/journal, /admin/journal/<slug>, /admin/settings, /admin/settings/<section>, /admin/analytics). Die Shell mit Auth-Prüfung und Kopfzeile sitzt im Layout und umschließt children — so bleibt die Session-Prüfung über Routenwechsel montiert, statt bei jedem Tab-Wechsel neu zu laufen und den Spinner aufblitzen zu lassen. Unbekannte Settings-Sections fallen auf General zurück. Im selben Zug der Journal Studio, der die Routing-Änderung ohnehin berührt: * Alle Eingabefelder nutzten die Klasse `admin-input`, die in keinem CSS definiert war — sie fielen auf Browser-Defaults zurück. Jetzt gestylt, gescoped, damit der generische Name nicht ins übrige Panel leckt. * Der Split View ist per Divider verschiebbar (Maus, Tastatur, Doppelklick zum Zurücksetzen), Breite in localStorage. * Das Studio bricht aus der 1120px-Spalte aus, die Preview hat Platz. * Die Preview zeigte für jedes Foto fest 3:2 und log damit über das Layout der veröffentlichten Seite; die echten Verhältnisse werden jetzt an den Thumbnails gemessen. * Blöcke mit alten positionsbasierten Foto-Referenzen werden markiert — die lassen sich auf einer eigenständigen Journal-Seite nicht auflösen und verschwanden bisher stillschweigend. * Blocktyp-Chips als gemeinsame Komponente, monochrom und per Icon unterschieden statt in einer eigenen Blau/Lila/Orange-Palette, die sonst nirgends im Panel vorkommt. * Emojis raus, SVG-Icons rein. * fix(admin): Designsystem-Lücken im Panel schließen Eine systematische Suche nach Klassen, die im TSX benutzt, aber in keinem CSS definiert sind, hat vier Stellen mit demselben Muster gefunden: * `admin-btn-secondary` und `admin-btn-danger` existierten nicht. Sämtliche Löschen-Buttons sahen aus wie normale Buttons — keine Warnwirkung. Als `.admin-btn.admin-btn-danger` geschrieben, weil die Varianten mit den Größenklassen kombiniert werden, die weiter unten ihren eigenen Hintergrund setzen. * `page-progress-fill` fehlte: die Balken im Analytics-Panel waren leere Rinnen, der Wert unsichtbar. Ebenso `analytics-empty` und `admin-loading-container`. * `subpage-drawer-section`, `subpage-drawer-title-group` und `input-with-icon` im PageBuilder waren wirkungslos und teils mit Inline-Styles notdürftig kompensiert. * `grid-card-preview` fehlte, wodurch alle Layout-Vorschauen auf Höhe null kollabierten. Nur "Showcase" war sichtbar — und das aus Versehen, weil sein Tile `hero-tile` hieß und damit die `aspect-ratio` einer fremden PageBuilder-Klasse erbte. Umbenannt. Dazu die Theme-Vorschauen, die praktisch identisch aussahen: alle sieben zeigten dieselben drei quadratischen Kacheln, einziger Unterschied war die Hintergrundfarbe. Sie spiegeln jetzt die echten Preset-Daten aus lib/config/theme.ts — Schriftcharakter, Eckradius, Rasterdichte, Passepartout bzw. Schatten. Die Kopfzeile richtet sich an einer gemeinsamen Steuerhöhe aus. Der "Site"-Link war höher als die Buttons daneben: `.admin-btn` hatte keine explizite line-height, und <button> bekommt box-sizing: border-box vom Browser, <a> nicht. Die Statusanzeige setzte weder Schriftfamilie noch -größe und fiel auf den Browser-Default zurück — sie war nie Teil des Designsystems. Jetzt gleiche Höhe und Typografie, Pillenform als Zustandsanzeige, Trenner zur Aktionsgruppe. Das dauerhafte Pulsieren des grünen Punkts entfällt; Animation bleibt den Zuständen vorbehalten, die Aufmerksamkeit brauchen. Restliche Emojis durch SVG-Icons ersetzt. * feat(admin): add scroll-to-top toggle and SVG arrow The back-to-top button was always on and drew its arrow with the ↑ text character. Add a `scrollToTop` setting (General section in the admin panel, defaults to on so existing sites are unaffected) and replace the glyph with a stroked SVG that inherits currentColor across all presets. Scroll handling is now rAF-throttled, and prefers-reduced-motion turns off both the hover lift and the smooth scroll. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * security(journal): escape author HTML instead of filtering it CodeQL flags 26 high-severity alerts on the release PR; the bulk of them point at sanitizeHtml(), a denylist of three regexes whose output goes into dangerouslySetInnerHTML. I reproduced the bypasses before changing anything — all four pass the old filter: <img src=x onerror=alert(1)> unquoted handler, regex wants quotes <img src=x onerror='alert(1)'> single quotes, same reason <svg onload=alert(1)> not a <script> tag javasjavascript:cript:alert(1) one-pass replace, the rest recombines Plus an attribute breakout in the link renderer, which interpolated the URL into href="${url}" unescaped: [x](" onmouseover=alert(1) x=") -> <a href="" onmouseover=alert(1" ...> Replaced with escaping. Every `&<>"'` in author text becomes an entity before any markdown rule runs, so the only tags in the output are the ones renderInlineMarkdown builds itself and a URL cannot leave its attribute. Link schemes are now an allowlist (http, https, mailto, tel, relative, anchor); anything else renders as plain text. The serializer needed decodeHtmlEntities to match: without it a save would write `&lt;` into the Markdown file and the next parse would escape the `&` again, corrupting the text further on every round trip. A test covers parse -> serialize -> parse stability. Two existing tests asserted the old behaviour and were rewritten rather than deleted: one expected the script tag to be *removed* from the output, the other expected the substring "onerror" to be absent. Both now assert the property that matters — that no tag can form — because `onerror` surviving as inert text is fine. Exploitation required admin access either way: journal and essay text comes from the studio or from content/*.md. This removes the weakness, it does not close an open door. * fix(journal): contain file paths, fix frontmatter escaping, defuse two regexes Follow-up to the CodeQL findings on release PR #432. I went through all 23 alerts individually; this addresses the ones that are worth addressing and documents the ones that are not. Path containment (12 alerts, all false positives). Every path built from a slug goes through isValidSlug(), a strict `/^[a-zA-Z0-9_-]+$/` allowlist — verified against `../../etc/passwd`, `foo/../../bar`, `a/b`, `..` and friends, all rejected. CodeQL cannot see it because the check lives in another module. Added a containedPath() helper that resolves the path and refuses anything landing outside the content directory: a second lock on a door that was already locked, and a barrier the analysis can follow. Also removed the dead `slug.endsWith('.md')` branches — isValidSlug rejects dots, so they could never be taken. Frontmatter escaping (1 alert, a real bug). The serializer escaped `"` but not `\`, and the parser never unescaped anything. A title containing either character gained a backslash on every save/load cycle: Path C:\Users "quoted" -> Path C:\\Users \"quoted\" -> ... Escaping now covers the backslash first and the parser undoes both. A round trip test covers quotes, backslashes, colons and apostrophes. Two of three ReDoS regexes (2 alerts). The heading pattern had `\s+` next to `(.+)`, which overlap, so the engine tried every split of the whitespace run before failing; it is `[ \t]+` and `(\S.*)` now. The quote author pattern wrapped a lazy group around an optional group — the quadratic case — and is an index split on the first separator now. The third regex, the bold/italic pass, is deliberately left alone. Rewriting it with a negated class removes the backtracking but breaks nesting: `**bold *and italic* here**` renders as `*<em>bold </em>and italic<em> here</em>*`. The input is Markdown from an authenticated admin, never a visitor, so the worst case is an author slowing down their own page. The comment in the code says so. Not addressed: 5 js/insufficient-password-hash alerts. They ask for a slow KDF where the code uses SHA-256/HMAC — correct in general, but the admin password comes from an environment variable and is never stored, so a stronger KDF protects nothing that is not already in plaintext in the environment. 399 unit tests pass (18 new), build and tsc clean. * fix(journal): split the quote author by scanning, not by pattern Cleaning up after myself. #439 replaced the quote author regex `/^(.*?)(?:\s+--\s+(.+))?$/` — a lazy group around an optional one, the quadratic case — with `/\s+--\s+/`, and CodeQL promptly flagged the replacement for the same reason. One reported pattern traded for another. splitQuoteAuthor() scans for the first `--` that has whitespace on both sides. Linear, and it needs no reasoning about the regex engine at all. Behaviour is identical to the original regex, checked case by case against it: separator, no separator, several separators, tabs, wide gaps, `a--b` without spaces, leading and trailing separators, empty string. All nine are covered by tests, plus one asserting it stays fast on a 50k whitespace run. * security(admin): derive the session signing key with scrypt getSigningKey() ran the admin password through a single SHA-256 digest. It is key derivation rather than password storage, so it was never a stored-hash problem — but if the derived key ever leaked, one fast hash makes recovering the password by brute force cheap. CodeQL flags it as js/insufficient-password-hash and, for this particular alert, has a point. scrypt now. Two details that matter: The salt has to be stable. A random salt would produce a different key on every call and invalidate every session; it is derived from AUTH_SECRET, which is deployment-specific. Verified across separate processes: same inputs produce a verifying token, so a restart or redeploy does not log everyone out. The result is cached for the process lifetime. scrypt is deliberately slow and getSigningKey() runs on every admin request — deriving per call would add ~24ms to each one. The cache key is a digest of secret plus password, so a rotation misses the cache and derives again, and no extra plaintext copy of the password is kept around. Measured: first derivation 24ms, subsequent calls 0.12ms. Password change and secret change both invalidate an existing token, checked in separate processes. Note the one-time effect: existing admin sessions are invalidated by the change in derivation, so everyone logs in once more. * security(admin): key the signing-key cache on its inputs, not a digest #441 removed the SHA-256 digest of the admin password from the key derivation and introduced a new one three lines above it, as the cache key. Same rule, same file: CodeQL reported it immediately. The comment justifying it was wrong too. It claimed no second plaintext copy of the password was retained, while building the digest input allocates exactly that in order to hash it. The cache now holds the two input strings and compares them directly. They are the same objects the env and install caches already hold, so nothing extra is retained, and no fast hash of the password exists in memory for the life of the process. Re-verified after the change, in separate processes: a token from one process verifies in another with the same inputs, a changed password or secret rejects it, first derivation 24ms, cached calls 0.001ms. That leaves scrypt as the only place the password is hashed here. The two HMACs further down operate on the derived key and on token data, not on the password; the constant-time comparison in verifyAdminPassword is the previously dismissed one. --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
2026-08-14 16:55:07 +02:00
/* In the footer the UUID is secondary to the two action buttons: it takes the
leftover width and truncates rather than wrapping the row onto two lines. */
.album-drawer-footer .uuid-copy-box {
flex: 1;
min-width: 0;
padding: 0.3rem 0.35rem 0.3rem 0.6rem;
}
.album-drawer-footer .uuid-copy-box code {
word-break: normal;
overflow: hidden;
text-overflow: ellipsis;
white-space: nowrap;
}
feat: redesign admin pagebuilder with slide-over drawers and svg icons (#242) Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-05-31 21:27:13 +02:00
.uuid-copy-btn {
background: none;
border: none;
color: var(--admin-text-muted);
cursor: pointer;
padding: 0.25rem;
display: flex;
align-items: center;
justify-content: center;
border-radius: 4px;
transition: all 0.15s ease;
}
.uuid-copy-btn:hover {
color: var(--admin-accent);
background: var(--admin-bg-elevated);
}
/* Section Card Improvements */
.section-card {
background: var(--admin-bg-raised);
border: 1px solid var(--admin-border);
border-radius: 12px;
padding: 1.25rem;
margin-bottom: 1.25rem;
box-shadow: 0 2px 8px rgba(0, 0, 0, 0.04);
chore(release): v0.10.0 (#400) Photo Essay mode, client proofing, studio-modern preset, admin panel overhaul, watermark, cookieless analytics, subpage toggle, SEO title templates. Analytics API now admin-only, Trivy scan on publish. Album order mirrors the Immich timeline; map theme, admin status panel, lightbox counter and Docker health check fixed. See CHANGELOG.md for the full list and the health-check upgrade note.
2026-08-10 09:56:20 +02:00
transition:
border-color 0.15s ease,
box-shadow 0.15s ease;
feat: redesign admin pagebuilder with slide-over drawers and svg icons (#242) Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-05-31 21:27:13 +02:00
}
.section-card:hover {
border-color: var(--admin-border-hover);
box-shadow: 0 4px 16px rgba(0, 0, 0, 0.1);
}
.section-header {
border-bottom: 1px solid var(--admin-border);
padding-bottom: 0.5rem;
margin-bottom: 0.75rem;
}
.section-title-input {
font-size: 0.95rem !important;
font-weight: 700 !important;
color: var(--admin-text) !important;
border-radius: 6px !important;
}
.section-desc-input {
border-color: transparent !important;
background: transparent !important;
padding-left: 0.4rem !important;
color: var(--admin-text-secondary) !important;
}
.section-desc-input:focus {
border-color: var(--admin-border) !important;
background: var(--admin-bg-input) !important;
}
/* ── Modern Subpage Details Spacing ── */
.subpage-detail {
margin-top: 1.5rem;
border: 1px solid var(--admin-border);
background: var(--admin-bg-elevated);
box-shadow: 0 6px 20px rgba(0, 0, 0, 0.2);
}
[data-theme='light'] .subpage-detail {
box-shadow: 0 6px 20px rgba(0, 0, 0, 0.05);
}
.subpage-meta {
padding: 1.25rem;
background: var(--admin-bg-raised);
border-bottom: 1px solid var(--admin-border);
}
security: add Trivy container scan to Docker publish workflow (#399) * feat(admin): add backup manager UI with 1-click restore * feat(admin): collapse older backup entries by default * fix(theme): isolate admin layout, instant DOM theme updates, and add Light/Dark mode toggle * feat(admin): replace text controls for Photo Frame and Hero Style with visual preview cards * fix(admin): define missing CSS rules for button system (.btn, .preset-btn) * feat(admin): redesign theme settings with segmented mode toggle, accent color swatches, and custom iOS-style toggle cards * feat(admin): upgrade all settings tabs with visual grid previews, Google SEO snippet preview, and toggle cards * feat(admin): overhaul Pages Builder UX with slide-over drawer, card hover badges, real-time search, and floating save bar * fix(admin): remove leftover dangling syntax snippet in PageBuilder.tsx * fix(admin): add position: relative to subpage-tile so hover overlay is contained inside the tile * style(admin): replace all emojis with clean Leica-style vector SVG icons * fix(types): extend IconProps with SVGProps to allow style prop on Leica SVG icons * feat(admin): add subpage live-preview, privacy analytics, and asset protection settings * fix(typecheck): fix AlbumEntry property access in subpage drawer preview mode * fix(types): fix ImmichAlbumInfo property names thumbnailAssetId and albumName in PageBuilder.tsx * fix(types): add protection and watermark optional properties to AppConfig interface * feat(settings): add toggle for disabling analytics tracking (defaults to enabled) * feat(ux): show status banner when analytics tracking is disabled + add live sync indicator * feat(watermark): render customizable watermark overlay on Lightbox images + rename section to Portfolio Features & Modules * fix(types): import type LightboxWatermark in PhotoGrid.tsx * fix(types): destructure watermark prop in PhotoGrid function signature * feat(seo): add configurable subpage title template and metadata descriptions * feat(seo): add generateMetadata to about page for title template support * feat(proofing): add client proofing, favorites selection, compact URL bitmasking, and export modal * feat(essay): add Photo Essay storytelling mode with RSC markdown parser and fullbleed/pair layouts * feat(subpages): add page enabled toggle to deactivate subpages without deleting them * feat(admin): add visual essay block builder for photo essay storytelling pages * security: add Trivy container scan to Docker publish workflow Scans the built image for CRITICAL/HIGH CVEs on every release and uploads results to the GitHub Security tab. Non-blocking for now (exit-code 0) so releases aren't gated on findings. Also documents the scan and existing Dependabot coverage in the README. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-08-07 11:08:04 +02:00
/* ── Status Dropdown Footer ── */
.status-dropdown-footer {
padding: 0.5rem 0.85rem;
background: var(--admin-bg-elevated);
border-top: 1px solid var(--admin-border);
display: flex;
justify-content: flex-end;
}
.admin-btn-sm {
padding: 0.35rem 0.65rem !important;
font-size: 0.75rem !important;
}
/* ── Backup Manager Modal ────────────────────────────────────── */
.backup-modal-backdrop {
position: fixed;
inset: 0;
background: rgba(0, 0, 0, 0.65);
backdrop-filter: blur(4px);
z-index: 999;
display: flex;
align-items: center;
justify-content: center;
padding: 1.5rem;
animation: fadeIn 0.15s ease-out;
}
.backup-modal-container {
background: var(--admin-bg-raised);
border: 1px solid var(--admin-border);
border-radius: 14px;
width: 100%;
max-width: 640px;
max-height: 85vh;
display: flex;
flex-direction: column;
box-shadow: 0 16px 48px rgba(0, 0, 0, 0.35);
overflow: hidden;
animation: scaleUp 0.15s cubic-bezier(0.16, 1, 0.3, 1);
}
.backup-modal-header {
display: flex;
align-items: flex-start;
justify-content: space-between;
padding: 1.25rem 1.5rem 0.75rem;
border-bottom: 1px solid var(--admin-border);
background: var(--admin-bg-elevated);
}
.backup-modal-header h2 {
margin: 0;
font-size: 1.15rem;
font-weight: 700;
color: var(--admin-text);
}
.backup-modal-subtitle {
margin: 0.25rem 0 0;
font-size: 0.8rem;
color: var(--admin-text-muted);
}
.backup-modal-close-btn {
background: none;
border: none;
font-size: 1.1rem;
color: var(--admin-text-muted);
cursor: pointer;
padding: 0.25rem 0.5rem;
border-radius: 6px;
line-height: 1;
transition: all 0.15s;
}
.backup-modal-close-btn:hover {
color: var(--admin-text);
background: var(--admin-bg-input);
}
/* Modal Tabs */
.backup-modal-tabs {
display: flex;
gap: 0.5rem;
padding: 0.75rem 1.5rem;
border-bottom: 1px solid var(--admin-border);
background: var(--admin-bg-raised);
}
.backup-modal-tab {
padding: 0.4rem 0.85rem;
font-size: 0.82rem;
font-weight: 600;
border-radius: 8px;
background: transparent;
border: 1px solid transparent;
color: var(--admin-text-muted);
cursor: pointer;
transition: all 0.15s;
}
.backup-modal-tab:hover {
color: var(--admin-text);
background: var(--admin-bg-elevated);
}
.backup-modal-tab.active {
background: var(--admin-bg-elevated);
border-color: var(--admin-border);
color: var(--admin-accent);
}
/* Modal Status Alert */
.backup-status-alert {
margin: 0.75rem 1.5rem 0;
padding: 0.65rem 0.85rem;
border-radius: 8px;
font-size: 0.82rem;
font-weight: 500;
}
.backup-status-alert.error {
background: rgba(239, 68, 68, 0.1);
border: 1px solid var(--admin-error, #ef4444);
color: var(--admin-error, #ef4444);
}
.backup-status-alert.success {
background: rgba(16, 185, 129, 0.1);
border: 1px solid var(--admin-success, #10b981);
color: var(--admin-success, #10b981);
}
/* Confirmation Box */
.backup-confirm-box {
margin: 0.75rem 1.5rem 0;
padding: 1rem;
background: rgba(239, 68, 68, 0.05);
border: 1px solid rgba(239, 68, 68, 0.3);
border-radius: 10px;
}
.backup-confirm-content strong {
display: block;
font-size: 0.9rem;
color: var(--admin-text);
margin-bottom: 0.25rem;
}
.backup-confirm-content p {
margin: 0 0 0.75rem;
font-size: 0.8rem;
color: var(--admin-text-secondary);
line-height: 1.4;
}
.backup-confirm-actions {
display: flex;
gap: 0.5rem;
justify-content: flex-end;
}
/* Modal Body & List */
.backup-modal-body {
flex: 1;
overflow-y: auto;
release: v0.11.0 — journal fixes, admin URLs, design system cleanup (#432) * fix(screenshots): sharp-Typen fuer 0.34 und 0.35 gleichzeitig (#410) sharp 0.35 ist von `export =` auf ESM umgestellt: der Modul-Namespace ist nicht mehr aufrufbar, die Factory sitzt unter .default. Der Type-Check brach damit in scripts/screenshots.ts weg, sobald der Next-Bump (#402) sharp von 0.34.5 auf 0.35.3 mitzieht -- sharp ist hier keine deklarierte Dependency, sondern kommt ueber Next mit. Die Form wird jetzt aus dem installierten Paket abgeleitet statt festgeschrieben, zur Laufzeit wie im Typ. Geprueft mit beiden Versionen: tsc laeuft mit 0.34.5 und mit 0.35.3 fehlerfrei durch. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(deps): bump the nextjs group across 1 directory with 2 updates (#402) Bumps the nextjs group with 2 updates in the / directory: [next](https://github.com/vercel/next.js) and [eslint-config-next](https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next). Updates `next` from 16.2.12 to 16.3.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/compare/v16.2.12...v16.3.0) Updates `eslint-config-next` from 16.2.12 to 16.3.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/commits/v16.3.0/packages/eslint-config-next) --- updated-dependencies: - dependency-name: eslint-config-next dependency-version: 16.3.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: nextjs - dependency-name: next dependency-version: 16.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nextjs ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps-dev): bump prettier from 3.8.3 to 3.9.6 (#405) Bumps [prettier](https://github.com/prettier/prettier) from 3.8.3 to 3.9.6. - [Release notes](https://github.com/prettier/prettier/releases) - [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md) - [Commits](https://github.com/prettier/prettier/compare/3.8.3...3.9.6) --- updated-dependencies: - dependency-name: prettier dependency-version: 3.9.6 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * docs(changelog): Unreleased-Sektion fuer die Bumps nach v0.10.0 (#413) Die Dependency-PRs sind nach dem Release auf dev gelandet, teils auch auf main. Ohne Eintrag waeren sie beim naechsten Release unsichtbar -- inklusive Next 16.3.0, das CVE-2025-13465 mitbringt. Ausserdem im 0.10.0-Abschnitt nachgetragen, dass der Trivy-Scan bis #409 nie gelaufen ist. Der Fix steckt im Tag v0.10.0, fehlte aber in der Aufzaehlung -- und "Images werden bei jedem Publish gescannt" stand im Changelog, waehrend der Job im Action-Setup abbrach. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(gallery): per-album sort order, independent of Immich (#408) (#414) Album order was dictated entirely by Immich: getAlbum() sorted by the album's own asc/desc flag, so a Folio album always mirrored the archive. A curated series has a narrative order that has nothing to do with capture time, and changing the Immich album's sort to fit the website changes it for the archive too. Adds an optional per-album `sort` in gallery.yaml, editable in /admin, defaulting to today's behaviour so every existing config is unchanged: immich (default) | newest | oldest | filename | manual `manual` is a pinned *prefix*: `assetOrder` lists only the photos placed by hand, everything else follows in the album's Immich order. A full permutation of a 2,000-photo album would be ~80 KB of UUIDs in a file that is rewritten and copied to content/.backups/ on every admin save. It also makes drift fall out for free — photos removed in Immich never match, new ones land in the tail rather than being hidden. Sorting is applied after the cache read, not before the cache write, so the LRU keeps one canonical Immich-ordered copy per album. That avoids putting the mode in the cache key, lets a config change take effect without depending on invalidation, and keeps the stale-serving path correct. cache.get() returns the stored object by reference, so withSort() returns a shallow clone with a new array — sorting in place would reorder the shared entry, and under request coalescing every concurrent caller would be sorting the same array. Also fixes a prerequisite bug: /api/admin/albums/[albumId]/assets read album.assets from GET /albums/:id, which Immich 3.x no longer populates (lib/immich.ts:507). The hero picker's "This Album" tab returned nothing and threw outright when the key was absent. It now goes through the client's paginated metadata search, with ?types=all to opt videos in for the reorder editor. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): drop decorative emoji from the sort select labels (#415) An <option> cannot contain markup, so the SVG set in Icons is not reachable there — but a decorative emoji is not a substitute for it. Plain text instead; the album card badge already uses a real icon. The remaining emoji in the admin panel (asset picker tabs, section headings, layout picker options) predate this branch and are left for a separate cleanup. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): replace emoji icons with the shared SVG icon set (#416) The admin panel mixed two icon conventions: inline SVGs from `Icons.tsx` in most components, and decorative emoji in the asset picker and a few PageBuilder labels. Emoji render inconsistently across platforms, ignore the accent colour, and cannot inherit the `.svg-icon` sizing rules. - Icons.tsx: add `IconStar` (filled — it marks a state, not an action) and `IconImage`. - AssetPicker: the three tab labels and the favourite tile badge now use IconFolder / IconStar / IconImage. - PageBuilder: the "Standalone Albums" and "Subpages" headings use the icon set instead of an emoji. - PageBuilder: the layout picker drops its emoji for plain text. An <option> cannot contain markup, so an SVG is impossible there and a decorative glyph is not a substitute. - admin.css: align icon and label in the picker tabs, and swap the favourite badge's text-shadow for drop-shadow, which is what applies to an inline SVG. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): fold PageBuilder's local icons into the shared Icons module (#418) * refactor(admin): fold PageBuilder's local icons into the shared module PageBuilder.tsx carried its own `Icons` object duplicating most of the glyphs already exported by Icons.tsx, with hardcoded sizes and slightly divergent paths. Migrate all 32 call sites to the shared module and delete the local object. Five glyphs had no counterpart and are added to Icons.tsx as 1:1 ports of the local paths: IconX, IconPlus, IconHome, IconCopy, IconImage. The local ExternalLink and Check are dropped rather than ported — both had zero call sites. Two glyphs change shape slightly, which is the point of consolidating: the shared IconCamera includes the viewfinder bump the local copy omitted, and drag handles now use IconGripVertical. IconGripVertical uses the module's square 24x24 viewBox, so `.svg-drag` goes from 12x18 to 18x18 — the old non-square box would letterbox the glyph down to 12x12 and shrink the handle. * fix(admin): resolve icon-module integration after #416 Merging dev brought in #416, which added a second IconImage to Icons.tsx and two <Icons.Camera>/<Icons.Folder> section headers that reference the local Icons object this PR removes. Git merged both cleanly but the result did not type-check. - drop the duplicate IconImage (both copies were byte-identical) - point the two section headers at the imported IconCamera/IconFolder - refresh the SORT_LABELS comment: the icon set is imported now, not declared below --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> * fix(config): allow an empty gallery, guard against a double /api suffix (#421) An empty gallery is now a valid, rendered state instead of a throw: deriveGallery() no longer requires at least one album or subpage, so a deployment with no albums yet renders a bare homepage the owner can fill in via /admin. getConfig() also stops appending /api to an Immich URL that already ends in it, which previously produced .../api/api and broke every upstream request. Includes a restore of the per-album sort test cases, which the branch had lost by being cut before #408/#414. * feat(admin): favicon upload, served from the content volume (#422) Adds a bundled default favicon, an upload widget in admin Settings > General, and a route that serves the icon from the writable content/ volume with a fallback to the bundled default. Raster uploads (PNG/ICO/JPEG) are wrapped in an SVG container; the response carries its own CSP so an uploaded SVG cannot execute script on the origin. The GET route revalidates with an ETag instead of caching immutably, so a newly uploaded icon shows up immediately. Uploads are written via temp file + rename, and a Reset button restores the bundled default. * ci: flag unformatted files in a PR, without blocking it (#424) Prettier is configured as an error rule in eslint.config.mjs but has never run in CI, so part of the tree predates it. A final CI step now diffs against the PR base, runs prettier --list-different over the changed files, and emits a warning annotation per offender plus a job summary. Advisory by design: it never fails the job. Blocking would turn a PR red for merely touching a file that was already unformatted, and normalising the tree in one commit would wreck git blame and conflict with the PRs in flight. Requires fetch-depth: 0, since diffing against the base needs its history. * feat(install): first-run wizard gated by a one-time setup token (#419) Adds /install, a four-step first-run wizard: connect to Immich, optionally pick albums, name the site, finish. It verifies the credentials against the Immich server before writing anything, then writes gallery.yaml, settings.yaml and a content/install.json carrying the Immich credentials and a generated site secret. install.json exists because a running process cannot pick up new env vars — the wizard has to write configuration that takes effect without a restart. getInstallCredentials() merges it under the real environment, so env vars always win and rotation stays a matter of setting one. Both the page and the API routes are gated by a one-time setup token printed to the server log, so a deployment that is reachable before gallery.yaml exists cannot be configured by whoever finds it first. The token is stored in content/.setup-token (0600) rather than a module variable: Next.js bundles the page and each route handler separately, so a module-level token left the page and the API disagreeing inside one process and the wizard stuck on step 1. It is removed once the install completes. The admin password is stored as an scrypt hash using the scheme lib/auth.ts already applies to album passwords; a plaintext ADMIN_PASSWORD env var keeps working. * docs: document the setup wizard, fix the read-only content mount (#425) Quick Start now leads with the /install wizard, with the hand-written YAML route kept alongside it, and a First-Run Setup section covers the setup token, the files the wizard writes, and env-var precedence. Two corrections: both Docker examples mounted content/ as :ro, which silently breaks the wizard, the admin panel and the backup rotation alike — docs/admin-panel.md already said so and the README contradicted it. And nothing documented that content/install.json holds the Immich API key, so a backup of content/ is a backup of credentials. Also adds a Contributors section crediting the people whose work is in the project. * feat(admin): floating save bar pinned to the bottom of the viewport (#426) The save bar was the first, static element inside .admin-main. Since the document itself scrolls, it left the viewport as soon as you scrolled down — editing a subpage section or a settings block far below gave no visible dirty hint and no reachable save button. Replace it with a bottom-pinned floating bar shared by both editors. It only mounts while there is something to act on (unsaved changes, an in-flight save, or a result message), so it never covers content while idle. The success message clears after 5s, which hides the bar again. - new SaveBar component, replacing the duplicated markup in PageBuilder and SettingsEditor - adopt the previously unused .floating-save-bar CSS: slide-in keyframes (carrying translateX(-50%)), dirty border, wrap/gap, mobile variant and a prefers-reduced-motion opt-out; z-index 900 keeps it below modals - .admin-main gains bottom padding so the bar never covers page content - drop the now-unreachable idle hints: the ⌘S hint becomes a button title, the Live Sync note becomes a static line above the settings layout - header "Site" link now bypasses the cache (/?fresh=1), so the preview stays reachable when the bar is hidden Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(admin): themed listbox for the album sort control (#427) The per-album "Photo order" control was a native <select>. Because an <option> cannot contain markup, its choices could not use the admin panel's currentColor SVG set — the reason #415 had to fall back to plain text after dropping the emoji labels. Adds a Listbox component implementing the ARIA combobox/listbox pattern, so options can render a glyph beside their label: - DOM focus stays on the trigger button; the active option is announced through aria-activedescendant, keeping focus management to one element - Keyboard: arrows (clamped at the ends, like a native select), Home/End, Enter/Space to commit, Escape to cancel, Tab commits and moves on, and prefix type-ahead with a repeat-key cycle - Outside dismissal on pointerdown, so a press starting outside closes the popup before the click retargets The sort options now carry an icon each: calendar, arrow-down, arrow-up, an A→Z marker, and the drag glyph for manual — matching the badge the album card already shows. SORT_LABELS stays plain text because the badge feeds it to a title attribute. Closes #417 Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(git): ignore generated design handoff folders * fix(admin): stop the album sort dropdown clipping, and simplify the panel (#428) * fix(admin): render listbox popup in a portal so it escapes modal clipping The sort control's popup was position:absolute inside three clipping ancestors (.album-drawer overflow:hidden > .album-drawer-body overflow-y:auto > .modal-right-column overflow-y:auto), so it was cut off at the bottom of the Edit Album Details modal. z-index could not help: clipping happens before stacking. It also always hung below the trigger, with no flip. Portal the popup to document.body and position it from the trigger's viewport rect, flipping above when there is more room there and capping max-height to the space available so it scrolls internally rather than overflowing. It is dismissed on scroll and resize, since the anchor is only measured on open. The outside-pointerdown handler now also treats the popup as inside; without that the portalled list counts as outside, and a click on an option would close it before the selection commits. * refactor(admin): single-column album details panel The left column spent 1.2fr on a cover thumbnail and three stat rows, two of which (Status, Custom Hero) only restated the form fields opposite them, while the form itself was squeezed into 1.8fr behind a second nested scroller. Stack the drawer in one column instead: cover as a banner, then the form at full width, with the UUID moved into the footer. The body is now the only scroll container, which also removes one of the ancestors that was clipping the sort popup. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> * fix(admin): give the portalled listbox its theme back, lock the page behind modals (#429) Two defects in the album editor. The sort listbox popup painted transparent. Every --admin-* variable is scoped to .admin-layout, and since the popup moved into document.body it sits outside that subtree, so background/border/text all resolved to nothing. It now carries its own copy of the palette in both colour schemes, plus the font it no longer inherits. Scrolling inside a modal also moved the page behind it. No admin modal ever locked body scroll: the overlay covers the page but does not absorb wheel events, so a scroll starting on the backdrop — or continuing past the end of the modal's own scroller — reaches the document. overscroll-behavior cannot cover that case on its own, because it only applies to scroll containers and the backdrop is not one. useScrollLock freezes body while a modal is open and compensates for the width the scrollbar gives up, so nothing shifts underneath. Each lock restores the inline value it found, which makes nesting work without a counter — a picker opened from the drawer restores the drawer's hidden state instead of clearing it. Applied to both drawers and all four picker modals, which share the defect. overscroll-behavior: contain on the scrollers stops the chaining they can handle themselves. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com> * fix(security): allow unsafe-eval in CSP script-src during dev mode * feat(journal): add Journal Studio with split-screen editor, live preview and dedicated routes * fix(build): separate client parser from server journal-service and fix build type errors * fix(journal): Fotos rendern, Layout und Lightbox-Steuerung korrigieren Fünf unabhängige Fehler in der öffentlichen Journal- und Essay-Ansicht: * Foto-Blöcke wurden nie angezeigt. EssayView löst ein Foto über PhotoItem.id auf, und das sind verschlüsselte Tokens — die Blöcke aus dem Markdown tragen aber rohe Asset-UUIDs. Jede Zuordnung lief ins Leere, und nicht auflösbare Blöcke werden still verworfen. Die IDs werden jetzt serverseitig übersetzt; damit verschwinden nebenbei die rohen UUIDs aus dem Client-Payload, die dort laut Projektregel nie auftauchen dürfen. Nicht auflösbare Referenzen werden geloggt. * Überschriften standen weiter links als der Fließtext. Jeder Block hatte einzeln `max-width: 68ch`, und `ch` ist relativ zur Schrift des Elements — die Serif-Überschrift ergab eine breitere Spalte. Ersetzt durch eine gemeinsame, font-unabhängige `--essay-measure`. * Fullbleed-Fotos bluteten nur nach links aus: `.essay-figure` ist `width: 100%`, wodurch die Box überbestimmt ist und der negative rechte Margin verworfen wird. * Foto-Paare stellten beide Bilder gleich breit dar, wodurch ein Hochformat neben einem Querformat doppelt so hoch wurde. Jetzt eine Justified-Reihe: Breite proportional zum Seitenverhältnis, dadurch exakt gleiche Höhen ohne Beschnitt. * Die Lightbox hatte im Journal keine Tastatursteuerung und keine Scroll-Sperre — beides lag in PhotoGrid, also nur im Album-Raster. Verlagert in die Lightbox selbst, der doppelte Handler in PhotoGrid entfernt (sonst wäre pro Pfeildruck zwei Bilder weitergesprungen). Zusätzlich sind Proofing-Herzen und das EXIF-Panel im redaktionellen Modus abschaltbar und im Journal aus: Client-Proofing ist ein Übergabe-Workflow für Alben, keine Funktion einer Reportage. Auf der Übersicht wurde der Untertitel doppelt gerendert, weil extractExcerpt() auf ihn zurückfällt. * feat(admin): eigene URLs für alle Bereiche und überarbeiteter Journal Studio Das Panel war eine einzige Client-Komponente, die ihre Tabs über useState umschaltet: keine Route pro Bereich, kein Deep-Link, kein Zurück-Button, und nach jedem Reload landete man wieder auf "Pages". Auch der Journal-Editor hatte keine eigene URL. Jetzt sieben echte Routen (/admin, /admin/pages, /admin/journal, /admin/journal/<slug>, /admin/settings, /admin/settings/<section>, /admin/analytics). Die Shell mit Auth-Prüfung und Kopfzeile sitzt im Layout und umschließt children — so bleibt die Session-Prüfung über Routenwechsel montiert, statt bei jedem Tab-Wechsel neu zu laufen und den Spinner aufblitzen zu lassen. Unbekannte Settings-Sections fallen auf General zurück. Im selben Zug der Journal Studio, der die Routing-Änderung ohnehin berührt: * Alle Eingabefelder nutzten die Klasse `admin-input`, die in keinem CSS definiert war — sie fielen auf Browser-Defaults zurück. Jetzt gestylt, gescoped, damit der generische Name nicht ins übrige Panel leckt. * Der Split View ist per Divider verschiebbar (Maus, Tastatur, Doppelklick zum Zurücksetzen), Breite in localStorage. * Das Studio bricht aus der 1120px-Spalte aus, die Preview hat Platz. * Die Preview zeigte für jedes Foto fest 3:2 und log damit über das Layout der veröffentlichten Seite; die echten Verhältnisse werden jetzt an den Thumbnails gemessen. * Blöcke mit alten positionsbasierten Foto-Referenzen werden markiert — die lassen sich auf einer eigenständigen Journal-Seite nicht auflösen und verschwanden bisher stillschweigend. * Blocktyp-Chips als gemeinsame Komponente, monochrom und per Icon unterschieden statt in einer eigenen Blau/Lila/Orange-Palette, die sonst nirgends im Panel vorkommt. * Emojis raus, SVG-Icons rein. * fix(admin): Designsystem-Lücken im Panel schließen Eine systematische Suche nach Klassen, die im TSX benutzt, aber in keinem CSS definiert sind, hat vier Stellen mit demselben Muster gefunden: * `admin-btn-secondary` und `admin-btn-danger` existierten nicht. Sämtliche Löschen-Buttons sahen aus wie normale Buttons — keine Warnwirkung. Als `.admin-btn.admin-btn-danger` geschrieben, weil die Varianten mit den Größenklassen kombiniert werden, die weiter unten ihren eigenen Hintergrund setzen. * `page-progress-fill` fehlte: die Balken im Analytics-Panel waren leere Rinnen, der Wert unsichtbar. Ebenso `analytics-empty` und `admin-loading-container`. * `subpage-drawer-section`, `subpage-drawer-title-group` und `input-with-icon` im PageBuilder waren wirkungslos und teils mit Inline-Styles notdürftig kompensiert. * `grid-card-preview` fehlte, wodurch alle Layout-Vorschauen auf Höhe null kollabierten. Nur "Showcase" war sichtbar — und das aus Versehen, weil sein Tile `hero-tile` hieß und damit die `aspect-ratio` einer fremden PageBuilder-Klasse erbte. Umbenannt. Dazu die Theme-Vorschauen, die praktisch identisch aussahen: alle sieben zeigten dieselben drei quadratischen Kacheln, einziger Unterschied war die Hintergrundfarbe. Sie spiegeln jetzt die echten Preset-Daten aus lib/config/theme.ts — Schriftcharakter, Eckradius, Rasterdichte, Passepartout bzw. Schatten. Die Kopfzeile richtet sich an einer gemeinsamen Steuerhöhe aus. Der "Site"-Link war höher als die Buttons daneben: `.admin-btn` hatte keine explizite line-height, und <button> bekommt box-sizing: border-box vom Browser, <a> nicht. Die Statusanzeige setzte weder Schriftfamilie noch -größe und fiel auf den Browser-Default zurück — sie war nie Teil des Designsystems. Jetzt gleiche Höhe und Typografie, Pillenform als Zustandsanzeige, Trenner zur Aktionsgruppe. Das dauerhafte Pulsieren des grünen Punkts entfällt; Animation bleibt den Zuständen vorbehalten, die Aufmerksamkeit brauchen. Restliche Emojis durch SVG-Icons ersetzt. * feat(admin): add scroll-to-top toggle and SVG arrow The back-to-top button was always on and drew its arrow with the ↑ text character. Add a `scrollToTop` setting (General section in the admin panel, defaults to on so existing sites are unaffected) and replace the glyph with a stroked SVG that inherits currentColor across all presets. Scroll handling is now rAF-throttled, and prefers-reduced-motion turns off both the hover lift and the smooth scroll. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * security(journal): escape author HTML instead of filtering it CodeQL flags 26 high-severity alerts on the release PR; the bulk of them point at sanitizeHtml(), a denylist of three regexes whose output goes into dangerouslySetInnerHTML. I reproduced the bypasses before changing anything — all four pass the old filter: <img src=x onerror=alert(1)> unquoted handler, regex wants quotes <img src=x onerror='alert(1)'> single quotes, same reason <svg onload=alert(1)> not a <script> tag javasjavascript:cript:alert(1) one-pass replace, the rest recombines Plus an attribute breakout in the link renderer, which interpolated the URL into href="${url}" unescaped: [x](" onmouseover=alert(1) x=") -> <a href="" onmouseover=alert(1" ...> Replaced with escaping. Every `&<>"'` in author text becomes an entity before any markdown rule runs, so the only tags in the output are the ones renderInlineMarkdown builds itself and a URL cannot leave its attribute. Link schemes are now an allowlist (http, https, mailto, tel, relative, anchor); anything else renders as plain text. The serializer needed decodeHtmlEntities to match: without it a save would write `&lt;` into the Markdown file and the next parse would escape the `&` again, corrupting the text further on every round trip. A test covers parse -> serialize -> parse stability. Two existing tests asserted the old behaviour and were rewritten rather than deleted: one expected the script tag to be *removed* from the output, the other expected the substring "onerror" to be absent. Both now assert the property that matters — that no tag can form — because `onerror` surviving as inert text is fine. Exploitation required admin access either way: journal and essay text comes from the studio or from content/*.md. This removes the weakness, it does not close an open door. * fix(journal): contain file paths, fix frontmatter escaping, defuse two regexes Follow-up to the CodeQL findings on release PR #432. I went through all 23 alerts individually; this addresses the ones that are worth addressing and documents the ones that are not. Path containment (12 alerts, all false positives). Every path built from a slug goes through isValidSlug(), a strict `/^[a-zA-Z0-9_-]+$/` allowlist — verified against `../../etc/passwd`, `foo/../../bar`, `a/b`, `..` and friends, all rejected. CodeQL cannot see it because the check lives in another module. Added a containedPath() helper that resolves the path and refuses anything landing outside the content directory: a second lock on a door that was already locked, and a barrier the analysis can follow. Also removed the dead `slug.endsWith('.md')` branches — isValidSlug rejects dots, so they could never be taken. Frontmatter escaping (1 alert, a real bug). The serializer escaped `"` but not `\`, and the parser never unescaped anything. A title containing either character gained a backslash on every save/load cycle: Path C:\Users "quoted" -> Path C:\\Users \"quoted\" -> ... Escaping now covers the backslash first and the parser undoes both. A round trip test covers quotes, backslashes, colons and apostrophes. Two of three ReDoS regexes (2 alerts). The heading pattern had `\s+` next to `(.+)`, which overlap, so the engine tried every split of the whitespace run before failing; it is `[ \t]+` and `(\S.*)` now. The quote author pattern wrapped a lazy group around an optional group — the quadratic case — and is an index split on the first separator now. The third regex, the bold/italic pass, is deliberately left alone. Rewriting it with a negated class removes the backtracking but breaks nesting: `**bold *and italic* here**` renders as `*<em>bold </em>and italic<em> here</em>*`. The input is Markdown from an authenticated admin, never a visitor, so the worst case is an author slowing down their own page. The comment in the code says so. Not addressed: 5 js/insufficient-password-hash alerts. They ask for a slow KDF where the code uses SHA-256/HMAC — correct in general, but the admin password comes from an environment variable and is never stored, so a stronger KDF protects nothing that is not already in plaintext in the environment. 399 unit tests pass (18 new), build and tsc clean. * fix(journal): split the quote author by scanning, not by pattern Cleaning up after myself. #439 replaced the quote author regex `/^(.*?)(?:\s+--\s+(.+))?$/` — a lazy group around an optional one, the quadratic case — with `/\s+--\s+/`, and CodeQL promptly flagged the replacement for the same reason. One reported pattern traded for another. splitQuoteAuthor() scans for the first `--` that has whitespace on both sides. Linear, and it needs no reasoning about the regex engine at all. Behaviour is identical to the original regex, checked case by case against it: separator, no separator, several separators, tabs, wide gaps, `a--b` without spaces, leading and trailing separators, empty string. All nine are covered by tests, plus one asserting it stays fast on a 50k whitespace run. * security(admin): derive the session signing key with scrypt getSigningKey() ran the admin password through a single SHA-256 digest. It is key derivation rather than password storage, so it was never a stored-hash problem — but if the derived key ever leaked, one fast hash makes recovering the password by brute force cheap. CodeQL flags it as js/insufficient-password-hash and, for this particular alert, has a point. scrypt now. Two details that matter: The salt has to be stable. A random salt would produce a different key on every call and invalidate every session; it is derived from AUTH_SECRET, which is deployment-specific. Verified across separate processes: same inputs produce a verifying token, so a restart or redeploy does not log everyone out. The result is cached for the process lifetime. scrypt is deliberately slow and getSigningKey() runs on every admin request — deriving per call would add ~24ms to each one. The cache key is a digest of secret plus password, so a rotation misses the cache and derives again, and no extra plaintext copy of the password is kept around. Measured: first derivation 24ms, subsequent calls 0.12ms. Password change and secret change both invalidate an existing token, checked in separate processes. Note the one-time effect: existing admin sessions are invalidated by the change in derivation, so everyone logs in once more. * security(admin): key the signing-key cache on its inputs, not a digest #441 removed the SHA-256 digest of the admin password from the key derivation and introduced a new one three lines above it, as the cache key. Same rule, same file: CodeQL reported it immediately. The comment justifying it was wrong too. It claimed no second plaintext copy of the password was retained, while building the digest input allocates exactly that in order to hash it. The cache now holds the two input strings and compares them directly. They are the same objects the env and install caches already hold, so nothing extra is retained, and no fast hash of the password exists in memory for the life of the process. Re-verified after the change, in separate processes: a token from one process verifies in another with the same inputs, a changed password or secret rejects it, first derivation 24ms, cached calls 0.001ms. That leaves scrypt as the only place the password is hashed here. The two HMACs further down operate on the derived key and on token data, not on the password; the constant-time comparison in verifyAdminPassword is the previously dismissed one. --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
2026-08-14 16:55:07 +02:00
overscroll-behavior: contain;
security: add Trivy container scan to Docker publish workflow (#399) * feat(admin): add backup manager UI with 1-click restore * feat(admin): collapse older backup entries by default * fix(theme): isolate admin layout, instant DOM theme updates, and add Light/Dark mode toggle * feat(admin): replace text controls for Photo Frame and Hero Style with visual preview cards * fix(admin): define missing CSS rules for button system (.btn, .preset-btn) * feat(admin): redesign theme settings with segmented mode toggle, accent color swatches, and custom iOS-style toggle cards * feat(admin): upgrade all settings tabs with visual grid previews, Google SEO snippet preview, and toggle cards * feat(admin): overhaul Pages Builder UX with slide-over drawer, card hover badges, real-time search, and floating save bar * fix(admin): remove leftover dangling syntax snippet in PageBuilder.tsx * fix(admin): add position: relative to subpage-tile so hover overlay is contained inside the tile * style(admin): replace all emojis with clean Leica-style vector SVG icons * fix(types): extend IconProps with SVGProps to allow style prop on Leica SVG icons * feat(admin): add subpage live-preview, privacy analytics, and asset protection settings * fix(typecheck): fix AlbumEntry property access in subpage drawer preview mode * fix(types): fix ImmichAlbumInfo property names thumbnailAssetId and albumName in PageBuilder.tsx * fix(types): add protection and watermark optional properties to AppConfig interface * feat(settings): add toggle for disabling analytics tracking (defaults to enabled) * feat(ux): show status banner when analytics tracking is disabled + add live sync indicator * feat(watermark): render customizable watermark overlay on Lightbox images + rename section to Portfolio Features & Modules * fix(types): import type LightboxWatermark in PhotoGrid.tsx * fix(types): destructure watermark prop in PhotoGrid function signature * feat(seo): add configurable subpage title template and metadata descriptions * feat(seo): add generateMetadata to about page for title template support * feat(proofing): add client proofing, favorites selection, compact URL bitmasking, and export modal * feat(essay): add Photo Essay storytelling mode with RSC markdown parser and fullbleed/pair layouts * feat(subpages): add page enabled toggle to deactivate subpages without deleting them * feat(admin): add visual essay block builder for photo essay storytelling pages * security: add Trivy container scan to Docker publish workflow Scans the built image for CRITICAL/HIGH CVEs on every release and uploads results to the GitHub Security tab. Non-blocking for now (exit-code 0) so releases aren't gated on findings. Also documents the scan and existing Dependabot coverage in the README. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-08-07 11:08:04 +02:00
padding: 1rem 1.5rem;
}
.backup-loading,
.backup-empty {
text-align: center;
padding: 2.5rem 1rem;
font-size: 0.85rem;
color: var(--admin-text-muted);
}
.backup-list {
display: flex;
flex-direction: column;
gap: 0.65rem;
}
.backup-item {
display: flex;
align-items: center;
justify-content: space-between;
padding: 0.75rem 1rem;
background: var(--admin-bg-elevated);
border: 1px solid var(--admin-border);
border-radius: 10px;
transition: border-color 0.15s;
}
.backup-item:hover {
border-color: var(--admin-border-hover);
}
.backup-item-info {
display: flex;
flex-direction: column;
gap: 0.2rem;
}
.backup-item-title {
display: flex;
align-items: center;
gap: 0.5rem;
}
.backup-filename {
font-size: 0.88rem;
font-weight: 600;
color: var(--admin-text);
}
.backup-badge {
font-size: 0.68rem;
font-weight: 600;
padding: 0.15rem 0.45rem;
border-radius: 4px;
text-transform: uppercase;
letter-spacing: 0.03em;
}
.backup-badge.pre-restore {
background: rgba(245, 158, 11, 0.15);
color: #f59e0b;
border: 1px solid rgba(245, 158, 11, 0.3);
}
.backup-item-meta code {
font-family: monospace;
font-size: 0.72rem;
color: var(--admin-text-muted);
}
.backup-modal-footer {
padding: 0.85rem 1.5rem;
border-top: 1px solid var(--admin-border);
background: var(--admin-bg-elevated);
display: flex;
justify-content: flex-end;
}
.backup-toggle-btn {
margin-top: 0.4rem;
padding: 0.55rem 0.85rem;
background: var(--admin-bg-elevated);
border: 1px dashed var(--admin-border);
border-radius: 8px;
color: var(--admin-text-secondary);
font-size: 0.78rem;
font-weight: 500;
cursor: pointer;
width: 100%;
text-align: center;
transition: all 0.15s ease;
}
.backup-toggle-btn:hover {
background: var(--admin-bg-raised);
border-color: var(--admin-accent);
color: var(--admin-accent);
}
/* ── Visual Cards for Photo Frame & Hero Style ────────────────── */
.frame-card-preview,
.hero-card-preview {
width: 100%;
aspect-ratio: 16 / 10;
padding: 0.5rem;
display: flex;
align-items: center;
justify-content: center;
background: var(--admin-bg-elevated);
border-bottom: 1px solid var(--admin-border);
position: relative;
overflow: hidden;
}
/* Photo Frame Demos */
.mini-frame-demo {
width: 70%;
height: 70%;
display: flex;
align-items: center;
justify-content: center;
transition: all 0.2s ease;
}
.mini-frame-photo {
width: 100%;
height: 100%;
background: linear-gradient(135deg, #444, #222);
border-radius: 2px;
}
.mini-frame-demo.frame-none .mini-frame-photo {
border: none;
}
.mini-frame-demo.frame-passepartout {
padding: 6px;
background: #ffffff;
box-shadow: inset 0 0 0 1px rgba(0, 0, 0, 0.1);
}
.mini-frame-demo.frame-shadow .mini-frame-photo {
box-shadow: 0 8px 16px rgba(0, 0, 0, 0.4);
}
/* Hero Style Demos */
.mini-hero-demo {
width: 100%;
height: 100%;
display: flex;
gap: 0.35rem;
padding: 0.25rem;
}
.demo-line {
height: 3px;
background: var(--admin-text-muted);
border-radius: 2px;
}
.demo-line.title {
width: 80%;
height: 5px;
background: var(--admin-accent);
}
.demo-line.title.giant {
width: 95%;
height: 8px;
margin-bottom: 0.2rem;
}
.demo-line.title.short {
width: 50%;
margin: 0 auto;
}
.demo-line.title.light {
width: 60%;
background: #ffffff;
}
.demo-line.sub {
width: 50%;
}
.hero-demo-split {
align-items: center;
}
.hero-demo-text {
flex: 1;
display: flex;
flex-direction: column;
gap: 0.25rem;
}
.hero-demo-photo {
flex: 1;
height: 100%;
background: linear-gradient(135deg, #3a3a3a, #1a1a1a);
border-radius: 3px;
}
.hero-demo-photo.small {
height: 60%;
width: 80%;
margin: 0 auto;
}
.hero-demo-photo.banner {
width: 100%;
height: 65%;
}
.hero-demo-full {
width: 100%;
height: 100%;
background: linear-gradient(135deg, #555, #111);
border-radius: 3px;
display: flex;
align-items: center;
justify-content: center;
}
.hero-demo-minimal,
.hero-demo-stacked {
flex-direction: column;
justify-content: center;
}
.hero-demo-center-text {
text-align: center;
width: 100%;
margin-bottom: 0.2rem;
}
.hero-demo-typographic {
flex-direction: column;
}
.hero-demo-grid2 {
display: flex;
gap: 0.25rem;
flex: 1;
}
.hero-demo-mosaic {
display: flex;
gap: 0.25rem;
width: 100%;
height: 100%;
}
.hero-demo-photo.big {
flex: 1.5;
}
.hero-demo-photo-col {
flex: 1;
display: flex;
flex-direction: column;
gap: 0.25rem;
}
/* ── Global Button System ────────────────────────────────────── */
.btn {
display: inline-flex;
align-items: center;
justify-content: center;
gap: 0.4rem;
padding: 0.5rem 1rem;
font-family: var(--font-sans, system-ui, sans-serif);
font-size: 0.82rem;
font-weight: 600;
border-radius: 8px;
border: 1px solid transparent;
cursor: pointer;
transition: all 0.15s ease;
line-height: 1.2;
}
.btn-sm {
padding: 0.35rem 0.65rem !important;
font-size: 0.75rem !important;
border-radius: 6px !important;
}
.btn-secondary {
background: var(--admin-bg-elevated, #242424);
border-color: var(--admin-border, #333333);
color: var(--admin-text, #ffffff);
}
.btn-secondary:hover {
background: var(--admin-bg-raised, #2e2e2e);
border-color: var(--admin-border-hover, #444444);
}
.btn-danger {
background: #ef4444;
color: #ffffff;
border-color: #ef4444;
}
.btn-danger:hover {
background: #dc2626;
border-color: #dc2626;
}
.btn-outline-danger {
background: transparent;
border-color: rgba(239, 68, 68, 0.4);
color: #ef4444;
}
.btn-outline-danger:hover {
background: rgba(239, 68, 68, 0.12);
border-color: #ef4444;
}
/* ── Preset Grid & Buttons (Grid Layout & Aspect Ratio) ───────── */
.preset-grid {
display: flex;
flex-wrap: wrap;
gap: 0.5rem;
margin-top: 0.35rem;
}
.preset-btn {
padding: 0.45rem 0.85rem;
background: var(--admin-bg-input, #1c1c1c);
border: 1px solid var(--admin-border, #333333);
border-radius: 8px;
color: var(--admin-text-secondary, #cccccc);
font-family: var(--font-sans, system-ui, sans-serif);
font-size: 0.8rem;
font-weight: 500;
cursor: pointer;
transition: all 0.15s ease;
text-transform: capitalize;
}
.preset-btn:hover {
background: var(--admin-bg-elevated, #282828);
border-color: var(--admin-border-hover, #555555);
color: var(--admin-text, #ffffff);
}
.preset-btn.active {
background: var(--admin-bg-elevated, #2a2a2a);
border-color: var(--admin-accent, #e60012);
color: var(--admin-accent, #e60012);
font-weight: 600;
box-shadow: 0 0 0 1px var(--admin-accent, #e60012);
}
/* ── Theme Settings Section Upgrades ─────────────────────────── */
.theme-settings-panel {
display: flex;
flex-direction: column;
gap: 1.5rem;
}
.settings-section-header {
margin-bottom: 0.5rem;
}
.settings-section-header h3 {
margin: 0 0 0.25rem 0;
font-size: 1.1rem;
font-weight: 700;
color: var(--admin-text);
}
.settings-section-sub {
margin: 0;
font-size: 0.8rem;
color: var(--admin-text-muted);
}
.settings-section-divider {
height: 1px;
background: var(--admin-border);
margin: 0.75rem 0;
}
/* Segmented Control (Mode Toggle) */
.segmented-control {
display: inline-flex;
background: var(--admin-bg-input, #1c1c1c);
padding: 4px;
border-radius: 10px;
border: 1px solid var(--admin-border, #333);
gap: 4px;
}
.segment-btn {
padding: 0.5rem 1.1rem;
font-size: 0.82rem;
font-weight: 600;
border-radius: 7px;
border: none;
background: transparent;
color: var(--admin-text-muted);
cursor: pointer;
transition: all 0.15s ease;
}
.segment-btn:hover {
color: var(--admin-text);
}
.segment-btn.active {
background: var(--admin-bg-elevated, #2d2d2d);
color: var(--admin-text, #ffffff);
box-shadow: 0 2px 8px rgba(0, 0, 0, 0.2);
}
/* Accent Color Swatches */
.accent-picker-wrapper {
display: flex;
flex-direction: column;
gap: 0.85rem;
}
.color-swatches-row {
display: flex;
align-items: center;
gap: 0.65rem;
flex-wrap: wrap;
}
.color-swatch-btn {
width: 32px;
height: 32px;
border-radius: 50%;
border: 2px solid transparent;
cursor: pointer;
chore(release): v0.10.0 (#400) Photo Essay mode, client proofing, studio-modern preset, admin panel overhaul, watermark, cookieless analytics, subpage toggle, SEO title templates. Analytics API now admin-only, Trivy scan on publish. Album order mirrors the Immich timeline; map theme, admin status panel, lightbox counter and Docker health check fixed. See CHANGELOG.md for the full list and the health-check upgrade note.
2026-08-10 09:56:20 +02:00
transition:
transform 0.15s ease,
border-color 0.15s ease,
box-shadow 0.15s ease;
security: add Trivy container scan to Docker publish workflow (#399) * feat(admin): add backup manager UI with 1-click restore * feat(admin): collapse older backup entries by default * fix(theme): isolate admin layout, instant DOM theme updates, and add Light/Dark mode toggle * feat(admin): replace text controls for Photo Frame and Hero Style with visual preview cards * fix(admin): define missing CSS rules for button system (.btn, .preset-btn) * feat(admin): redesign theme settings with segmented mode toggle, accent color swatches, and custom iOS-style toggle cards * feat(admin): upgrade all settings tabs with visual grid previews, Google SEO snippet preview, and toggle cards * feat(admin): overhaul Pages Builder UX with slide-over drawer, card hover badges, real-time search, and floating save bar * fix(admin): remove leftover dangling syntax snippet in PageBuilder.tsx * fix(admin): add position: relative to subpage-tile so hover overlay is contained inside the tile * style(admin): replace all emojis with clean Leica-style vector SVG icons * fix(types): extend IconProps with SVGProps to allow style prop on Leica SVG icons * feat(admin): add subpage live-preview, privacy analytics, and asset protection settings * fix(typecheck): fix AlbumEntry property access in subpage drawer preview mode * fix(types): fix ImmichAlbumInfo property names thumbnailAssetId and albumName in PageBuilder.tsx * fix(types): add protection and watermark optional properties to AppConfig interface * feat(settings): add toggle for disabling analytics tracking (defaults to enabled) * feat(ux): show status banner when analytics tracking is disabled + add live sync indicator * feat(watermark): render customizable watermark overlay on Lightbox images + rename section to Portfolio Features & Modules * fix(types): import type LightboxWatermark in PhotoGrid.tsx * fix(types): destructure watermark prop in PhotoGrid function signature * feat(seo): add configurable subpage title template and metadata descriptions * feat(seo): add generateMetadata to about page for title template support * feat(proofing): add client proofing, favorites selection, compact URL bitmasking, and export modal * feat(essay): add Photo Essay storytelling mode with RSC markdown parser and fullbleed/pair layouts * feat(subpages): add page enabled toggle to deactivate subpages without deleting them * feat(admin): add visual essay block builder for photo essay storytelling pages * security: add Trivy container scan to Docker publish workflow Scans the built image for CRITICAL/HIGH CVEs on every release and uploads results to the GitHub Security tab. Non-blocking for now (exit-code 0) so releases aren't gated on findings. Also documents the scan and existing Dependabot coverage in the README. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-08-07 11:08:04 +02:00
}
.color-swatch-btn:hover {
transform: scale(1.15);
}
.color-swatch-btn.active {
border-color: #ffffff;
box-shadow: 0 0 0 2px var(--admin-accent, #e60012);
transform: scale(1.15);
}
/* Custom Toggle Cards Grid */
.admin-toggle-cards-grid {
display: grid;
grid-template-columns: repeat(auto-fill, minmax(280px, 1fr));
gap: 1rem;
}
.admin-toggle-card {
display: flex;
align-items: center;
justify-content: space-between;
padding: 1rem 1.25rem;
background: var(--admin-bg-raised);
border: 1px solid var(--admin-border);
border-radius: 12px;
cursor: pointer;
text-align: left;
transition: all 0.15s ease;
}
.admin-toggle-card:hover {
border-color: var(--admin-border-hover);
background: var(--admin-bg-elevated);
}
.admin-toggle-card.active {
border-color: var(--admin-accent);
box-shadow: 0 0 0 1px var(--admin-accent);
}
.toggle-card-info {
display: flex;
flex-direction: column;
gap: 0.2rem;
padding-right: 1rem;
}
.toggle-card-title {
font-size: 0.88rem;
font-weight: 600;
color: var(--admin-text);
release: v0.11.0 — journal fixes, admin URLs, design system cleanup (#432) * fix(screenshots): sharp-Typen fuer 0.34 und 0.35 gleichzeitig (#410) sharp 0.35 ist von `export =` auf ESM umgestellt: der Modul-Namespace ist nicht mehr aufrufbar, die Factory sitzt unter .default. Der Type-Check brach damit in scripts/screenshots.ts weg, sobald der Next-Bump (#402) sharp von 0.34.5 auf 0.35.3 mitzieht -- sharp ist hier keine deklarierte Dependency, sondern kommt ueber Next mit. Die Form wird jetzt aus dem installierten Paket abgeleitet statt festgeschrieben, zur Laufzeit wie im Typ. Geprueft mit beiden Versionen: tsc laeuft mit 0.34.5 und mit 0.35.3 fehlerfrei durch. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(deps): bump the nextjs group across 1 directory with 2 updates (#402) Bumps the nextjs group with 2 updates in the / directory: [next](https://github.com/vercel/next.js) and [eslint-config-next](https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next). Updates `next` from 16.2.12 to 16.3.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/compare/v16.2.12...v16.3.0) Updates `eslint-config-next` from 16.2.12 to 16.3.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/commits/v16.3.0/packages/eslint-config-next) --- updated-dependencies: - dependency-name: eslint-config-next dependency-version: 16.3.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: nextjs - dependency-name: next dependency-version: 16.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nextjs ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps-dev): bump prettier from 3.8.3 to 3.9.6 (#405) Bumps [prettier](https://github.com/prettier/prettier) from 3.8.3 to 3.9.6. - [Release notes](https://github.com/prettier/prettier/releases) - [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md) - [Commits](https://github.com/prettier/prettier/compare/3.8.3...3.9.6) --- updated-dependencies: - dependency-name: prettier dependency-version: 3.9.6 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * docs(changelog): Unreleased-Sektion fuer die Bumps nach v0.10.0 (#413) Die Dependency-PRs sind nach dem Release auf dev gelandet, teils auch auf main. Ohne Eintrag waeren sie beim naechsten Release unsichtbar -- inklusive Next 16.3.0, das CVE-2025-13465 mitbringt. Ausserdem im 0.10.0-Abschnitt nachgetragen, dass der Trivy-Scan bis #409 nie gelaufen ist. Der Fix steckt im Tag v0.10.0, fehlte aber in der Aufzaehlung -- und "Images werden bei jedem Publish gescannt" stand im Changelog, waehrend der Job im Action-Setup abbrach. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(gallery): per-album sort order, independent of Immich (#408) (#414) Album order was dictated entirely by Immich: getAlbum() sorted by the album's own asc/desc flag, so a Folio album always mirrored the archive. A curated series has a narrative order that has nothing to do with capture time, and changing the Immich album's sort to fit the website changes it for the archive too. Adds an optional per-album `sort` in gallery.yaml, editable in /admin, defaulting to today's behaviour so every existing config is unchanged: immich (default) | newest | oldest | filename | manual `manual` is a pinned *prefix*: `assetOrder` lists only the photos placed by hand, everything else follows in the album's Immich order. A full permutation of a 2,000-photo album would be ~80 KB of UUIDs in a file that is rewritten and copied to content/.backups/ on every admin save. It also makes drift fall out for free — photos removed in Immich never match, new ones land in the tail rather than being hidden. Sorting is applied after the cache read, not before the cache write, so the LRU keeps one canonical Immich-ordered copy per album. That avoids putting the mode in the cache key, lets a config change take effect without depending on invalidation, and keeps the stale-serving path correct. cache.get() returns the stored object by reference, so withSort() returns a shallow clone with a new array — sorting in place would reorder the shared entry, and under request coalescing every concurrent caller would be sorting the same array. Also fixes a prerequisite bug: /api/admin/albums/[albumId]/assets read album.assets from GET /albums/:id, which Immich 3.x no longer populates (lib/immich.ts:507). The hero picker's "This Album" tab returned nothing and threw outright when the key was absent. It now goes through the client's paginated metadata search, with ?types=all to opt videos in for the reorder editor. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): drop decorative emoji from the sort select labels (#415) An <option> cannot contain markup, so the SVG set in Icons is not reachable there — but a decorative emoji is not a substitute for it. Plain text instead; the album card badge already uses a real icon. The remaining emoji in the admin panel (asset picker tabs, section headings, layout picker options) predate this branch and are left for a separate cleanup. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): replace emoji icons with the shared SVG icon set (#416) The admin panel mixed two icon conventions: inline SVGs from `Icons.tsx` in most components, and decorative emoji in the asset picker and a few PageBuilder labels. Emoji render inconsistently across platforms, ignore the accent colour, and cannot inherit the `.svg-icon` sizing rules. - Icons.tsx: add `IconStar` (filled — it marks a state, not an action) and `IconImage`. - AssetPicker: the three tab labels and the favourite tile badge now use IconFolder / IconStar / IconImage. - PageBuilder: the "Standalone Albums" and "Subpages" headings use the icon set instead of an emoji. - PageBuilder: the layout picker drops its emoji for plain text. An <option> cannot contain markup, so an SVG is impossible there and a decorative glyph is not a substitute. - admin.css: align icon and label in the picker tabs, and swap the favourite badge's text-shadow for drop-shadow, which is what applies to an inline SVG. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): fold PageBuilder's local icons into the shared Icons module (#418) * refactor(admin): fold PageBuilder's local icons into the shared module PageBuilder.tsx carried its own `Icons` object duplicating most of the glyphs already exported by Icons.tsx, with hardcoded sizes and slightly divergent paths. Migrate all 32 call sites to the shared module and delete the local object. Five glyphs had no counterpart and are added to Icons.tsx as 1:1 ports of the local paths: IconX, IconPlus, IconHome, IconCopy, IconImage. The local ExternalLink and Check are dropped rather than ported — both had zero call sites. Two glyphs change shape slightly, which is the point of consolidating: the shared IconCamera includes the viewfinder bump the local copy omitted, and drag handles now use IconGripVertical. IconGripVertical uses the module's square 24x24 viewBox, so `.svg-drag` goes from 12x18 to 18x18 — the old non-square box would letterbox the glyph down to 12x12 and shrink the handle. * fix(admin): resolve icon-module integration after #416 Merging dev brought in #416, which added a second IconImage to Icons.tsx and two <Icons.Camera>/<Icons.Folder> section headers that reference the local Icons object this PR removes. Git merged both cleanly but the result did not type-check. - drop the duplicate IconImage (both copies were byte-identical) - point the two section headers at the imported IconCamera/IconFolder - refresh the SORT_LABELS comment: the icon set is imported now, not declared below --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> * fix(config): allow an empty gallery, guard against a double /api suffix (#421) An empty gallery is now a valid, rendered state instead of a throw: deriveGallery() no longer requires at least one album or subpage, so a deployment with no albums yet renders a bare homepage the owner can fill in via /admin. getConfig() also stops appending /api to an Immich URL that already ends in it, which previously produced .../api/api and broke every upstream request. Includes a restore of the per-album sort test cases, which the branch had lost by being cut before #408/#414. * feat(admin): favicon upload, served from the content volume (#422) Adds a bundled default favicon, an upload widget in admin Settings > General, and a route that serves the icon from the writable content/ volume with a fallback to the bundled default. Raster uploads (PNG/ICO/JPEG) are wrapped in an SVG container; the response carries its own CSP so an uploaded SVG cannot execute script on the origin. The GET route revalidates with an ETag instead of caching immutably, so a newly uploaded icon shows up immediately. Uploads are written via temp file + rename, and a Reset button restores the bundled default. * ci: flag unformatted files in a PR, without blocking it (#424) Prettier is configured as an error rule in eslint.config.mjs but has never run in CI, so part of the tree predates it. A final CI step now diffs against the PR base, runs prettier --list-different over the changed files, and emits a warning annotation per offender plus a job summary. Advisory by design: it never fails the job. Blocking would turn a PR red for merely touching a file that was already unformatted, and normalising the tree in one commit would wreck git blame and conflict with the PRs in flight. Requires fetch-depth: 0, since diffing against the base needs its history. * feat(install): first-run wizard gated by a one-time setup token (#419) Adds /install, a four-step first-run wizard: connect to Immich, optionally pick albums, name the site, finish. It verifies the credentials against the Immich server before writing anything, then writes gallery.yaml, settings.yaml and a content/install.json carrying the Immich credentials and a generated site secret. install.json exists because a running process cannot pick up new env vars — the wizard has to write configuration that takes effect without a restart. getInstallCredentials() merges it under the real environment, so env vars always win and rotation stays a matter of setting one. Both the page and the API routes are gated by a one-time setup token printed to the server log, so a deployment that is reachable before gallery.yaml exists cannot be configured by whoever finds it first. The token is stored in content/.setup-token (0600) rather than a module variable: Next.js bundles the page and each route handler separately, so a module-level token left the page and the API disagreeing inside one process and the wizard stuck on step 1. It is removed once the install completes. The admin password is stored as an scrypt hash using the scheme lib/auth.ts already applies to album passwords; a plaintext ADMIN_PASSWORD env var keeps working. * docs: document the setup wizard, fix the read-only content mount (#425) Quick Start now leads with the /install wizard, with the hand-written YAML route kept alongside it, and a First-Run Setup section covers the setup token, the files the wizard writes, and env-var precedence. Two corrections: both Docker examples mounted content/ as :ro, which silently breaks the wizard, the admin panel and the backup rotation alike — docs/admin-panel.md already said so and the README contradicted it. And nothing documented that content/install.json holds the Immich API key, so a backup of content/ is a backup of credentials. Also adds a Contributors section crediting the people whose work is in the project. * feat(admin): floating save bar pinned to the bottom of the viewport (#426) The save bar was the first, static element inside .admin-main. Since the document itself scrolls, it left the viewport as soon as you scrolled down — editing a subpage section or a settings block far below gave no visible dirty hint and no reachable save button. Replace it with a bottom-pinned floating bar shared by both editors. It only mounts while there is something to act on (unsaved changes, an in-flight save, or a result message), so it never covers content while idle. The success message clears after 5s, which hides the bar again. - new SaveBar component, replacing the duplicated markup in PageBuilder and SettingsEditor - adopt the previously unused .floating-save-bar CSS: slide-in keyframes (carrying translateX(-50%)), dirty border, wrap/gap, mobile variant and a prefers-reduced-motion opt-out; z-index 900 keeps it below modals - .admin-main gains bottom padding so the bar never covers page content - drop the now-unreachable idle hints: the ⌘S hint becomes a button title, the Live Sync note becomes a static line above the settings layout - header "Site" link now bypasses the cache (/?fresh=1), so the preview stays reachable when the bar is hidden Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(admin): themed listbox for the album sort control (#427) The per-album "Photo order" control was a native <select>. Because an <option> cannot contain markup, its choices could not use the admin panel's currentColor SVG set — the reason #415 had to fall back to plain text after dropping the emoji labels. Adds a Listbox component implementing the ARIA combobox/listbox pattern, so options can render a glyph beside their label: - DOM focus stays on the trigger button; the active option is announced through aria-activedescendant, keeping focus management to one element - Keyboard: arrows (clamped at the ends, like a native select), Home/End, Enter/Space to commit, Escape to cancel, Tab commits and moves on, and prefix type-ahead with a repeat-key cycle - Outside dismissal on pointerdown, so a press starting outside closes the popup before the click retargets The sort options now carry an icon each: calendar, arrow-down, arrow-up, an A→Z marker, and the drag glyph for manual — matching the badge the album card already shows. SORT_LABELS stays plain text because the badge feeds it to a title attribute. Closes #417 Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(git): ignore generated design handoff folders * fix(admin): stop the album sort dropdown clipping, and simplify the panel (#428) * fix(admin): render listbox popup in a portal so it escapes modal clipping The sort control's popup was position:absolute inside three clipping ancestors (.album-drawer overflow:hidden > .album-drawer-body overflow-y:auto > .modal-right-column overflow-y:auto), so it was cut off at the bottom of the Edit Album Details modal. z-index could not help: clipping happens before stacking. It also always hung below the trigger, with no flip. Portal the popup to document.body and position it from the trigger's viewport rect, flipping above when there is more room there and capping max-height to the space available so it scrolls internally rather than overflowing. It is dismissed on scroll and resize, since the anchor is only measured on open. The outside-pointerdown handler now also treats the popup as inside; without that the portalled list counts as outside, and a click on an option would close it before the selection commits. * refactor(admin): single-column album details panel The left column spent 1.2fr on a cover thumbnail and three stat rows, two of which (Status, Custom Hero) only restated the form fields opposite them, while the form itself was squeezed into 1.8fr behind a second nested scroller. Stack the drawer in one column instead: cover as a banner, then the form at full width, with the UUID moved into the footer. The body is now the only scroll container, which also removes one of the ancestors that was clipping the sort popup. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> * fix(admin): give the portalled listbox its theme back, lock the page behind modals (#429) Two defects in the album editor. The sort listbox popup painted transparent. Every --admin-* variable is scoped to .admin-layout, and since the popup moved into document.body it sits outside that subtree, so background/border/text all resolved to nothing. It now carries its own copy of the palette in both colour schemes, plus the font it no longer inherits. Scrolling inside a modal also moved the page behind it. No admin modal ever locked body scroll: the overlay covers the page but does not absorb wheel events, so a scroll starting on the backdrop — or continuing past the end of the modal's own scroller — reaches the document. overscroll-behavior cannot cover that case on its own, because it only applies to scroll containers and the backdrop is not one. useScrollLock freezes body while a modal is open and compensates for the width the scrollbar gives up, so nothing shifts underneath. Each lock restores the inline value it found, which makes nesting work without a counter — a picker opened from the drawer restores the drawer's hidden state instead of clearing it. Applied to both drawers and all four picker modals, which share the defect. overscroll-behavior: contain on the scrollers stops the chaining they can handle themselves. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com> * fix(security): allow unsafe-eval in CSP script-src during dev mode * feat(journal): add Journal Studio with split-screen editor, live preview and dedicated routes * fix(build): separate client parser from server journal-service and fix build type errors * fix(journal): Fotos rendern, Layout und Lightbox-Steuerung korrigieren Fünf unabhängige Fehler in der öffentlichen Journal- und Essay-Ansicht: * Foto-Blöcke wurden nie angezeigt. EssayView löst ein Foto über PhotoItem.id auf, und das sind verschlüsselte Tokens — die Blöcke aus dem Markdown tragen aber rohe Asset-UUIDs. Jede Zuordnung lief ins Leere, und nicht auflösbare Blöcke werden still verworfen. Die IDs werden jetzt serverseitig übersetzt; damit verschwinden nebenbei die rohen UUIDs aus dem Client-Payload, die dort laut Projektregel nie auftauchen dürfen. Nicht auflösbare Referenzen werden geloggt. * Überschriften standen weiter links als der Fließtext. Jeder Block hatte einzeln `max-width: 68ch`, und `ch` ist relativ zur Schrift des Elements — die Serif-Überschrift ergab eine breitere Spalte. Ersetzt durch eine gemeinsame, font-unabhängige `--essay-measure`. * Fullbleed-Fotos bluteten nur nach links aus: `.essay-figure` ist `width: 100%`, wodurch die Box überbestimmt ist und der negative rechte Margin verworfen wird. * Foto-Paare stellten beide Bilder gleich breit dar, wodurch ein Hochformat neben einem Querformat doppelt so hoch wurde. Jetzt eine Justified-Reihe: Breite proportional zum Seitenverhältnis, dadurch exakt gleiche Höhen ohne Beschnitt. * Die Lightbox hatte im Journal keine Tastatursteuerung und keine Scroll-Sperre — beides lag in PhotoGrid, also nur im Album-Raster. Verlagert in die Lightbox selbst, der doppelte Handler in PhotoGrid entfernt (sonst wäre pro Pfeildruck zwei Bilder weitergesprungen). Zusätzlich sind Proofing-Herzen und das EXIF-Panel im redaktionellen Modus abschaltbar und im Journal aus: Client-Proofing ist ein Übergabe-Workflow für Alben, keine Funktion einer Reportage. Auf der Übersicht wurde der Untertitel doppelt gerendert, weil extractExcerpt() auf ihn zurückfällt. * feat(admin): eigene URLs für alle Bereiche und überarbeiteter Journal Studio Das Panel war eine einzige Client-Komponente, die ihre Tabs über useState umschaltet: keine Route pro Bereich, kein Deep-Link, kein Zurück-Button, und nach jedem Reload landete man wieder auf "Pages". Auch der Journal-Editor hatte keine eigene URL. Jetzt sieben echte Routen (/admin, /admin/pages, /admin/journal, /admin/journal/<slug>, /admin/settings, /admin/settings/<section>, /admin/analytics). Die Shell mit Auth-Prüfung und Kopfzeile sitzt im Layout und umschließt children — so bleibt die Session-Prüfung über Routenwechsel montiert, statt bei jedem Tab-Wechsel neu zu laufen und den Spinner aufblitzen zu lassen. Unbekannte Settings-Sections fallen auf General zurück. Im selben Zug der Journal Studio, der die Routing-Änderung ohnehin berührt: * Alle Eingabefelder nutzten die Klasse `admin-input`, die in keinem CSS definiert war — sie fielen auf Browser-Defaults zurück. Jetzt gestylt, gescoped, damit der generische Name nicht ins übrige Panel leckt. * Der Split View ist per Divider verschiebbar (Maus, Tastatur, Doppelklick zum Zurücksetzen), Breite in localStorage. * Das Studio bricht aus der 1120px-Spalte aus, die Preview hat Platz. * Die Preview zeigte für jedes Foto fest 3:2 und log damit über das Layout der veröffentlichten Seite; die echten Verhältnisse werden jetzt an den Thumbnails gemessen. * Blöcke mit alten positionsbasierten Foto-Referenzen werden markiert — die lassen sich auf einer eigenständigen Journal-Seite nicht auflösen und verschwanden bisher stillschweigend. * Blocktyp-Chips als gemeinsame Komponente, monochrom und per Icon unterschieden statt in einer eigenen Blau/Lila/Orange-Palette, die sonst nirgends im Panel vorkommt. * Emojis raus, SVG-Icons rein. * fix(admin): Designsystem-Lücken im Panel schließen Eine systematische Suche nach Klassen, die im TSX benutzt, aber in keinem CSS definiert sind, hat vier Stellen mit demselben Muster gefunden: * `admin-btn-secondary` und `admin-btn-danger` existierten nicht. Sämtliche Löschen-Buttons sahen aus wie normale Buttons — keine Warnwirkung. Als `.admin-btn.admin-btn-danger` geschrieben, weil die Varianten mit den Größenklassen kombiniert werden, die weiter unten ihren eigenen Hintergrund setzen. * `page-progress-fill` fehlte: die Balken im Analytics-Panel waren leere Rinnen, der Wert unsichtbar. Ebenso `analytics-empty` und `admin-loading-container`. * `subpage-drawer-section`, `subpage-drawer-title-group` und `input-with-icon` im PageBuilder waren wirkungslos und teils mit Inline-Styles notdürftig kompensiert. * `grid-card-preview` fehlte, wodurch alle Layout-Vorschauen auf Höhe null kollabierten. Nur "Showcase" war sichtbar — und das aus Versehen, weil sein Tile `hero-tile` hieß und damit die `aspect-ratio` einer fremden PageBuilder-Klasse erbte. Umbenannt. Dazu die Theme-Vorschauen, die praktisch identisch aussahen: alle sieben zeigten dieselben drei quadratischen Kacheln, einziger Unterschied war die Hintergrundfarbe. Sie spiegeln jetzt die echten Preset-Daten aus lib/config/theme.ts — Schriftcharakter, Eckradius, Rasterdichte, Passepartout bzw. Schatten. Die Kopfzeile richtet sich an einer gemeinsamen Steuerhöhe aus. Der "Site"-Link war höher als die Buttons daneben: `.admin-btn` hatte keine explizite line-height, und <button> bekommt box-sizing: border-box vom Browser, <a> nicht. Die Statusanzeige setzte weder Schriftfamilie noch -größe und fiel auf den Browser-Default zurück — sie war nie Teil des Designsystems. Jetzt gleiche Höhe und Typografie, Pillenform als Zustandsanzeige, Trenner zur Aktionsgruppe. Das dauerhafte Pulsieren des grünen Punkts entfällt; Animation bleibt den Zuständen vorbehalten, die Aufmerksamkeit brauchen. Restliche Emojis durch SVG-Icons ersetzt. * feat(admin): add scroll-to-top toggle and SVG arrow The back-to-top button was always on and drew its arrow with the ↑ text character. Add a `scrollToTop` setting (General section in the admin panel, defaults to on so existing sites are unaffected) and replace the glyph with a stroked SVG that inherits currentColor across all presets. Scroll handling is now rAF-throttled, and prefers-reduced-motion turns off both the hover lift and the smooth scroll. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * security(journal): escape author HTML instead of filtering it CodeQL flags 26 high-severity alerts on the release PR; the bulk of them point at sanitizeHtml(), a denylist of three regexes whose output goes into dangerouslySetInnerHTML. I reproduced the bypasses before changing anything — all four pass the old filter: <img src=x onerror=alert(1)> unquoted handler, regex wants quotes <img src=x onerror='alert(1)'> single quotes, same reason <svg onload=alert(1)> not a <script> tag javasjavascript:cript:alert(1) one-pass replace, the rest recombines Plus an attribute breakout in the link renderer, which interpolated the URL into href="${url}" unescaped: [x](" onmouseover=alert(1) x=") -> <a href="" onmouseover=alert(1" ...> Replaced with escaping. Every `&<>"'` in author text becomes an entity before any markdown rule runs, so the only tags in the output are the ones renderInlineMarkdown builds itself and a URL cannot leave its attribute. Link schemes are now an allowlist (http, https, mailto, tel, relative, anchor); anything else renders as plain text. The serializer needed decodeHtmlEntities to match: without it a save would write `&lt;` into the Markdown file and the next parse would escape the `&` again, corrupting the text further on every round trip. A test covers parse -> serialize -> parse stability. Two existing tests asserted the old behaviour and were rewritten rather than deleted: one expected the script tag to be *removed* from the output, the other expected the substring "onerror" to be absent. Both now assert the property that matters — that no tag can form — because `onerror` surviving as inert text is fine. Exploitation required admin access either way: journal and essay text comes from the studio or from content/*.md. This removes the weakness, it does not close an open door. * fix(journal): contain file paths, fix frontmatter escaping, defuse two regexes Follow-up to the CodeQL findings on release PR #432. I went through all 23 alerts individually; this addresses the ones that are worth addressing and documents the ones that are not. Path containment (12 alerts, all false positives). Every path built from a slug goes through isValidSlug(), a strict `/^[a-zA-Z0-9_-]+$/` allowlist — verified against `../../etc/passwd`, `foo/../../bar`, `a/b`, `..` and friends, all rejected. CodeQL cannot see it because the check lives in another module. Added a containedPath() helper that resolves the path and refuses anything landing outside the content directory: a second lock on a door that was already locked, and a barrier the analysis can follow. Also removed the dead `slug.endsWith('.md')` branches — isValidSlug rejects dots, so they could never be taken. Frontmatter escaping (1 alert, a real bug). The serializer escaped `"` but not `\`, and the parser never unescaped anything. A title containing either character gained a backslash on every save/load cycle: Path C:\Users "quoted" -> Path C:\\Users \"quoted\" -> ... Escaping now covers the backslash first and the parser undoes both. A round trip test covers quotes, backslashes, colons and apostrophes. Two of three ReDoS regexes (2 alerts). The heading pattern had `\s+` next to `(.+)`, which overlap, so the engine tried every split of the whitespace run before failing; it is `[ \t]+` and `(\S.*)` now. The quote author pattern wrapped a lazy group around an optional group — the quadratic case — and is an index split on the first separator now. The third regex, the bold/italic pass, is deliberately left alone. Rewriting it with a negated class removes the backtracking but breaks nesting: `**bold *and italic* here**` renders as `*<em>bold </em>and italic<em> here</em>*`. The input is Markdown from an authenticated admin, never a visitor, so the worst case is an author slowing down their own page. The comment in the code says so. Not addressed: 5 js/insufficient-password-hash alerts. They ask for a slow KDF where the code uses SHA-256/HMAC — correct in general, but the admin password comes from an environment variable and is never stored, so a stronger KDF protects nothing that is not already in plaintext in the environment. 399 unit tests pass (18 new), build and tsc clean. * fix(journal): split the quote author by scanning, not by pattern Cleaning up after myself. #439 replaced the quote author regex `/^(.*?)(?:\s+--\s+(.+))?$/` — a lazy group around an optional one, the quadratic case — with `/\s+--\s+/`, and CodeQL promptly flagged the replacement for the same reason. One reported pattern traded for another. splitQuoteAuthor() scans for the first `--` that has whitespace on both sides. Linear, and it needs no reasoning about the regex engine at all. Behaviour is identical to the original regex, checked case by case against it: separator, no separator, several separators, tabs, wide gaps, `a--b` without spaces, leading and trailing separators, empty string. All nine are covered by tests, plus one asserting it stays fast on a 50k whitespace run. * security(admin): derive the session signing key with scrypt getSigningKey() ran the admin password through a single SHA-256 digest. It is key derivation rather than password storage, so it was never a stored-hash problem — but if the derived key ever leaked, one fast hash makes recovering the password by brute force cheap. CodeQL flags it as js/insufficient-password-hash and, for this particular alert, has a point. scrypt now. Two details that matter: The salt has to be stable. A random salt would produce a different key on every call and invalidate every session; it is derived from AUTH_SECRET, which is deployment-specific. Verified across separate processes: same inputs produce a verifying token, so a restart or redeploy does not log everyone out. The result is cached for the process lifetime. scrypt is deliberately slow and getSigningKey() runs on every admin request — deriving per call would add ~24ms to each one. The cache key is a digest of secret plus password, so a rotation misses the cache and derives again, and no extra plaintext copy of the password is kept around. Measured: first derivation 24ms, subsequent calls 0.12ms. Password change and secret change both invalidate an existing token, checked in separate processes. Note the one-time effect: existing admin sessions are invalidated by the change in derivation, so everyone logs in once more. * security(admin): key the signing-key cache on its inputs, not a digest #441 removed the SHA-256 digest of the admin password from the key derivation and introduced a new one three lines above it, as the cache key. Same rule, same file: CodeQL reported it immediately. The comment justifying it was wrong too. It claimed no second plaintext copy of the password was retained, while building the digest input allocates exactly that in order to hash it. The cache now holds the two input strings and compares them directly. They are the same objects the env and install caches already hold, so nothing extra is retained, and no fast hash of the password exists in memory for the life of the process. Re-verified after the change, in separate processes: a token from one process verifies in another with the same inputs, a changed password or secret rejects it, first derivation 24ms, cached calls 0.001ms. That leaves scrypt as the only place the password is hashed here. The two HMACs further down operate on the derived key and on token data, not on the password; the constant-time comparison in verifyAdminPassword is the previously dismissed one. --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
2026-08-14 16:55:07 +02:00
display: inline-flex;
align-items: center;
gap: 6px;
security: add Trivy container scan to Docker publish workflow (#399) * feat(admin): add backup manager UI with 1-click restore * feat(admin): collapse older backup entries by default * fix(theme): isolate admin layout, instant DOM theme updates, and add Light/Dark mode toggle * feat(admin): replace text controls for Photo Frame and Hero Style with visual preview cards * fix(admin): define missing CSS rules for button system (.btn, .preset-btn) * feat(admin): redesign theme settings with segmented mode toggle, accent color swatches, and custom iOS-style toggle cards * feat(admin): upgrade all settings tabs with visual grid previews, Google SEO snippet preview, and toggle cards * feat(admin): overhaul Pages Builder UX with slide-over drawer, card hover badges, real-time search, and floating save bar * fix(admin): remove leftover dangling syntax snippet in PageBuilder.tsx * fix(admin): add position: relative to subpage-tile so hover overlay is contained inside the tile * style(admin): replace all emojis with clean Leica-style vector SVG icons * fix(types): extend IconProps with SVGProps to allow style prop on Leica SVG icons * feat(admin): add subpage live-preview, privacy analytics, and asset protection settings * fix(typecheck): fix AlbumEntry property access in subpage drawer preview mode * fix(types): fix ImmichAlbumInfo property names thumbnailAssetId and albumName in PageBuilder.tsx * fix(types): add protection and watermark optional properties to AppConfig interface * feat(settings): add toggle for disabling analytics tracking (defaults to enabled) * feat(ux): show status banner when analytics tracking is disabled + add live sync indicator * feat(watermark): render customizable watermark overlay on Lightbox images + rename section to Portfolio Features & Modules * fix(types): import type LightboxWatermark in PhotoGrid.tsx * fix(types): destructure watermark prop in PhotoGrid function signature * feat(seo): add configurable subpage title template and metadata descriptions * feat(seo): add generateMetadata to about page for title template support * feat(proofing): add client proofing, favorites selection, compact URL bitmasking, and export modal * feat(essay): add Photo Essay storytelling mode with RSC markdown parser and fullbleed/pair layouts * feat(subpages): add page enabled toggle to deactivate subpages without deleting them * feat(admin): add visual essay block builder for photo essay storytelling pages * security: add Trivy container scan to Docker publish workflow Scans the built image for CRITICAL/HIGH CVEs on every release and uploads results to the GitHub Security tab. Non-blocking for now (exit-code 0) so releases aren't gated on findings. Also documents the scan and existing Dependabot coverage in the README. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-08-07 11:08:04 +02:00
}
.toggle-card-desc {
font-size: 0.75rem;
color: var(--admin-text-muted);
line-height: 1.3;
}
/* iOS Style Switch Slider */
.switch-toggle {
width: 42px;
height: 24px;
background: var(--admin-border, #444);
border-radius: 12px;
position: relative;
transition: background-color 0.2s ease;
flex-shrink: 0;
}
.switch-toggle.on {
background: var(--admin-accent, #e60012);
}
.switch-slider {
width: 18px;
height: 18px;
background: #ffffff;
border-radius: 50%;
position: absolute;
top: 3px;
left: 3px;
transition: transform 0.2s cubic-bezier(0.16, 1, 0.3, 1);
box-shadow: 0 1px 3px rgba(0, 0, 0, 0.3);
}
.switch-toggle.on .switch-slider {
transform: translateX(18px);
}
/* ── Google Search Result Snippet Preview ────────────────────── */
.google-snippet-preview {
background: var(--admin-bg-raised);
border: 1px solid var(--admin-border);
border-radius: 12px;
padding: 1rem 1.25rem;
margin-bottom: 1.25rem;
}
.google-snippet-header {
font-size: 0.8rem;
font-weight: 600;
color: var(--admin-text-muted);
margin-bottom: 0.75rem;
text-transform: uppercase;
letter-spacing: 0.04em;
}
.google-snippet-card {
background: #ffffff;
border-radius: 8px;
padding: 1rem 1.25rem;
box-shadow: 0 2px 10px rgba(0, 0, 0, 0.08);
font-family: Arial, sans-serif;
color: #202124;
}
.google-snippet-url {
font-size: 0.78rem;
color: #202124;
margin-bottom: 0.2rem;
word-break: break-all;
}
.google-snippet-arrow {
font-size: 0.6rem;
color: #5f6368;
}
.google-snippet-title {
font-size: 1.15rem;
font-weight: 400;
color: #1a0dab;
line-height: 1.3;
margin-bottom: 0.25rem;
cursor: pointer;
}
.google-snippet-title:hover {
text-decoration: underline;
}
.google-snippet-desc {
font-size: 0.85rem;
color: #4d5156;
line-height: 1.4;
word-break: break-word;
}
/* Aspect Ratio Mini Preview Box */
.ratio-card-preview {
width: 100%;
aspect-ratio: 16 / 10;
display: flex;
align-items: center;
justify-content: center;
background: var(--admin-bg-elevated);
border-bottom: 1px solid var(--admin-border);
}
.mini-aspect-box {
width: 44px;
height: 44px;
border: 2px dashed var(--admin-accent);
border-radius: 4px;
display: flex;
align-items: center;
justify-content: center;
}
chore(release): v0.10.0 (#400) Photo Essay mode, client proofing, studio-modern preset, admin panel overhaul, watermark, cookieless analytics, subpage toggle, SEO title templates. Analytics API now admin-only, Trivy scan on publish. Album order mirrors the Immich timeline; map theme, admin status panel, lightbox counter and Docker health check fixed. See CHANGELOG.md for the full list and the health-check upgrade note.
2026-08-10 09:56:20 +02:00
.mini-aspect-box.ratio-1 {
width: 34px;
height: 34px;
}
.mini-aspect-box.ratio-3-2 {
width: 46px;
height: 30px;
}
.mini-aspect-box.ratio-2-3 {
width: 30px;
height: 44px;
}
.mini-aspect-box.ratio-16-9 {
width: 50px;
height: 28px;
}
.mini-aspect-box.ratio-auto {
width: 42px;
height: 32px;
border-style: solid;
}
security: add Trivy container scan to Docker publish workflow (#399) * feat(admin): add backup manager UI with 1-click restore * feat(admin): collapse older backup entries by default * fix(theme): isolate admin layout, instant DOM theme updates, and add Light/Dark mode toggle * feat(admin): replace text controls for Photo Frame and Hero Style with visual preview cards * fix(admin): define missing CSS rules for button system (.btn, .preset-btn) * feat(admin): redesign theme settings with segmented mode toggle, accent color swatches, and custom iOS-style toggle cards * feat(admin): upgrade all settings tabs with visual grid previews, Google SEO snippet preview, and toggle cards * feat(admin): overhaul Pages Builder UX with slide-over drawer, card hover badges, real-time search, and floating save bar * fix(admin): remove leftover dangling syntax snippet in PageBuilder.tsx * fix(admin): add position: relative to subpage-tile so hover overlay is contained inside the tile * style(admin): replace all emojis with clean Leica-style vector SVG icons * fix(types): extend IconProps with SVGProps to allow style prop on Leica SVG icons * feat(admin): add subpage live-preview, privacy analytics, and asset protection settings * fix(typecheck): fix AlbumEntry property access in subpage drawer preview mode * fix(types): fix ImmichAlbumInfo property names thumbnailAssetId and albumName in PageBuilder.tsx * fix(types): add protection and watermark optional properties to AppConfig interface * feat(settings): add toggle for disabling analytics tracking (defaults to enabled) * feat(ux): show status banner when analytics tracking is disabled + add live sync indicator * feat(watermark): render customizable watermark overlay on Lightbox images + rename section to Portfolio Features & Modules * fix(types): import type LightboxWatermark in PhotoGrid.tsx * fix(types): destructure watermark prop in PhotoGrid function signature * feat(seo): add configurable subpage title template and metadata descriptions * feat(seo): add generateMetadata to about page for title template support * feat(proofing): add client proofing, favorites selection, compact URL bitmasking, and export modal * feat(essay): add Photo Essay storytelling mode with RSC markdown parser and fullbleed/pair layouts * feat(subpages): add page enabled toggle to deactivate subpages without deleting them * feat(admin): add visual essay block builder for photo essay storytelling pages * security: add Trivy container scan to Docker publish workflow Scans the built image for CRITICAL/HIGH CVEs on every release and uploads results to the GitHub Security tab. Non-blocking for now (exit-code 0) so releases aren't gated on findings. Also documents the scan and existing Dependabot coverage in the README. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-08-07 11:08:04 +02:00
.mini-aspect-inner {
width: 100%;
height: 100%;
background: var(--admin-accent);
opacity: 0.2;
}
/* Grid Layout Mini Demos */
release: v0.11.0 — journal fixes, admin URLs, design system cleanup (#432) * fix(screenshots): sharp-Typen fuer 0.34 und 0.35 gleichzeitig (#410) sharp 0.35 ist von `export =` auf ESM umgestellt: der Modul-Namespace ist nicht mehr aufrufbar, die Factory sitzt unter .default. Der Type-Check brach damit in scripts/screenshots.ts weg, sobald der Next-Bump (#402) sharp von 0.34.5 auf 0.35.3 mitzieht -- sharp ist hier keine deklarierte Dependency, sondern kommt ueber Next mit. Die Form wird jetzt aus dem installierten Paket abgeleitet statt festgeschrieben, zur Laufzeit wie im Typ. Geprueft mit beiden Versionen: tsc laeuft mit 0.34.5 und mit 0.35.3 fehlerfrei durch. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(deps): bump the nextjs group across 1 directory with 2 updates (#402) Bumps the nextjs group with 2 updates in the / directory: [next](https://github.com/vercel/next.js) and [eslint-config-next](https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next). Updates `next` from 16.2.12 to 16.3.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/compare/v16.2.12...v16.3.0) Updates `eslint-config-next` from 16.2.12 to 16.3.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/commits/v16.3.0/packages/eslint-config-next) --- updated-dependencies: - dependency-name: eslint-config-next dependency-version: 16.3.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: nextjs - dependency-name: next dependency-version: 16.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nextjs ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps-dev): bump prettier from 3.8.3 to 3.9.6 (#405) Bumps [prettier](https://github.com/prettier/prettier) from 3.8.3 to 3.9.6. - [Release notes](https://github.com/prettier/prettier/releases) - [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md) - [Commits](https://github.com/prettier/prettier/compare/3.8.3...3.9.6) --- updated-dependencies: - dependency-name: prettier dependency-version: 3.9.6 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * docs(changelog): Unreleased-Sektion fuer die Bumps nach v0.10.0 (#413) Die Dependency-PRs sind nach dem Release auf dev gelandet, teils auch auf main. Ohne Eintrag waeren sie beim naechsten Release unsichtbar -- inklusive Next 16.3.0, das CVE-2025-13465 mitbringt. Ausserdem im 0.10.0-Abschnitt nachgetragen, dass der Trivy-Scan bis #409 nie gelaufen ist. Der Fix steckt im Tag v0.10.0, fehlte aber in der Aufzaehlung -- und "Images werden bei jedem Publish gescannt" stand im Changelog, waehrend der Job im Action-Setup abbrach. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(gallery): per-album sort order, independent of Immich (#408) (#414) Album order was dictated entirely by Immich: getAlbum() sorted by the album's own asc/desc flag, so a Folio album always mirrored the archive. A curated series has a narrative order that has nothing to do with capture time, and changing the Immich album's sort to fit the website changes it for the archive too. Adds an optional per-album `sort` in gallery.yaml, editable in /admin, defaulting to today's behaviour so every existing config is unchanged: immich (default) | newest | oldest | filename | manual `manual` is a pinned *prefix*: `assetOrder` lists only the photos placed by hand, everything else follows in the album's Immich order. A full permutation of a 2,000-photo album would be ~80 KB of UUIDs in a file that is rewritten and copied to content/.backups/ on every admin save. It also makes drift fall out for free — photos removed in Immich never match, new ones land in the tail rather than being hidden. Sorting is applied after the cache read, not before the cache write, so the LRU keeps one canonical Immich-ordered copy per album. That avoids putting the mode in the cache key, lets a config change take effect without depending on invalidation, and keeps the stale-serving path correct. cache.get() returns the stored object by reference, so withSort() returns a shallow clone with a new array — sorting in place would reorder the shared entry, and under request coalescing every concurrent caller would be sorting the same array. Also fixes a prerequisite bug: /api/admin/albums/[albumId]/assets read album.assets from GET /albums/:id, which Immich 3.x no longer populates (lib/immich.ts:507). The hero picker's "This Album" tab returned nothing and threw outright when the key was absent. It now goes through the client's paginated metadata search, with ?types=all to opt videos in for the reorder editor. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): drop decorative emoji from the sort select labels (#415) An <option> cannot contain markup, so the SVG set in Icons is not reachable there — but a decorative emoji is not a substitute for it. Plain text instead; the album card badge already uses a real icon. The remaining emoji in the admin panel (asset picker tabs, section headings, layout picker options) predate this branch and are left for a separate cleanup. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): replace emoji icons with the shared SVG icon set (#416) The admin panel mixed two icon conventions: inline SVGs from `Icons.tsx` in most components, and decorative emoji in the asset picker and a few PageBuilder labels. Emoji render inconsistently across platforms, ignore the accent colour, and cannot inherit the `.svg-icon` sizing rules. - Icons.tsx: add `IconStar` (filled — it marks a state, not an action) and `IconImage`. - AssetPicker: the three tab labels and the favourite tile badge now use IconFolder / IconStar / IconImage. - PageBuilder: the "Standalone Albums" and "Subpages" headings use the icon set instead of an emoji. - PageBuilder: the layout picker drops its emoji for plain text. An <option> cannot contain markup, so an SVG is impossible there and a decorative glyph is not a substitute. - admin.css: align icon and label in the picker tabs, and swap the favourite badge's text-shadow for drop-shadow, which is what applies to an inline SVG. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): fold PageBuilder's local icons into the shared Icons module (#418) * refactor(admin): fold PageBuilder's local icons into the shared module PageBuilder.tsx carried its own `Icons` object duplicating most of the glyphs already exported by Icons.tsx, with hardcoded sizes and slightly divergent paths. Migrate all 32 call sites to the shared module and delete the local object. Five glyphs had no counterpart and are added to Icons.tsx as 1:1 ports of the local paths: IconX, IconPlus, IconHome, IconCopy, IconImage. The local ExternalLink and Check are dropped rather than ported — both had zero call sites. Two glyphs change shape slightly, which is the point of consolidating: the shared IconCamera includes the viewfinder bump the local copy omitted, and drag handles now use IconGripVertical. IconGripVertical uses the module's square 24x24 viewBox, so `.svg-drag` goes from 12x18 to 18x18 — the old non-square box would letterbox the glyph down to 12x12 and shrink the handle. * fix(admin): resolve icon-module integration after #416 Merging dev brought in #416, which added a second IconImage to Icons.tsx and two <Icons.Camera>/<Icons.Folder> section headers that reference the local Icons object this PR removes. Git merged both cleanly but the result did not type-check. - drop the duplicate IconImage (both copies were byte-identical) - point the two section headers at the imported IconCamera/IconFolder - refresh the SORT_LABELS comment: the icon set is imported now, not declared below --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> * fix(config): allow an empty gallery, guard against a double /api suffix (#421) An empty gallery is now a valid, rendered state instead of a throw: deriveGallery() no longer requires at least one album or subpage, so a deployment with no albums yet renders a bare homepage the owner can fill in via /admin. getConfig() also stops appending /api to an Immich URL that already ends in it, which previously produced .../api/api and broke every upstream request. Includes a restore of the per-album sort test cases, which the branch had lost by being cut before #408/#414. * feat(admin): favicon upload, served from the content volume (#422) Adds a bundled default favicon, an upload widget in admin Settings > General, and a route that serves the icon from the writable content/ volume with a fallback to the bundled default. Raster uploads (PNG/ICO/JPEG) are wrapped in an SVG container; the response carries its own CSP so an uploaded SVG cannot execute script on the origin. The GET route revalidates with an ETag instead of caching immutably, so a newly uploaded icon shows up immediately. Uploads are written via temp file + rename, and a Reset button restores the bundled default. * ci: flag unformatted files in a PR, without blocking it (#424) Prettier is configured as an error rule in eslint.config.mjs but has never run in CI, so part of the tree predates it. A final CI step now diffs against the PR base, runs prettier --list-different over the changed files, and emits a warning annotation per offender plus a job summary. Advisory by design: it never fails the job. Blocking would turn a PR red for merely touching a file that was already unformatted, and normalising the tree in one commit would wreck git blame and conflict with the PRs in flight. Requires fetch-depth: 0, since diffing against the base needs its history. * feat(install): first-run wizard gated by a one-time setup token (#419) Adds /install, a four-step first-run wizard: connect to Immich, optionally pick albums, name the site, finish. It verifies the credentials against the Immich server before writing anything, then writes gallery.yaml, settings.yaml and a content/install.json carrying the Immich credentials and a generated site secret. install.json exists because a running process cannot pick up new env vars — the wizard has to write configuration that takes effect without a restart. getInstallCredentials() merges it under the real environment, so env vars always win and rotation stays a matter of setting one. Both the page and the API routes are gated by a one-time setup token printed to the server log, so a deployment that is reachable before gallery.yaml exists cannot be configured by whoever finds it first. The token is stored in content/.setup-token (0600) rather than a module variable: Next.js bundles the page and each route handler separately, so a module-level token left the page and the API disagreeing inside one process and the wizard stuck on step 1. It is removed once the install completes. The admin password is stored as an scrypt hash using the scheme lib/auth.ts already applies to album passwords; a plaintext ADMIN_PASSWORD env var keeps working. * docs: document the setup wizard, fix the read-only content mount (#425) Quick Start now leads with the /install wizard, with the hand-written YAML route kept alongside it, and a First-Run Setup section covers the setup token, the files the wizard writes, and env-var precedence. Two corrections: both Docker examples mounted content/ as :ro, which silently breaks the wizard, the admin panel and the backup rotation alike — docs/admin-panel.md already said so and the README contradicted it. And nothing documented that content/install.json holds the Immich API key, so a backup of content/ is a backup of credentials. Also adds a Contributors section crediting the people whose work is in the project. * feat(admin): floating save bar pinned to the bottom of the viewport (#426) The save bar was the first, static element inside .admin-main. Since the document itself scrolls, it left the viewport as soon as you scrolled down — editing a subpage section or a settings block far below gave no visible dirty hint and no reachable save button. Replace it with a bottom-pinned floating bar shared by both editors. It only mounts while there is something to act on (unsaved changes, an in-flight save, or a result message), so it never covers content while idle. The success message clears after 5s, which hides the bar again. - new SaveBar component, replacing the duplicated markup in PageBuilder and SettingsEditor - adopt the previously unused .floating-save-bar CSS: slide-in keyframes (carrying translateX(-50%)), dirty border, wrap/gap, mobile variant and a prefers-reduced-motion opt-out; z-index 900 keeps it below modals - .admin-main gains bottom padding so the bar never covers page content - drop the now-unreachable idle hints: the ⌘S hint becomes a button title, the Live Sync note becomes a static line above the settings layout - header "Site" link now bypasses the cache (/?fresh=1), so the preview stays reachable when the bar is hidden Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(admin): themed listbox for the album sort control (#427) The per-album "Photo order" control was a native <select>. Because an <option> cannot contain markup, its choices could not use the admin panel's currentColor SVG set — the reason #415 had to fall back to plain text after dropping the emoji labels. Adds a Listbox component implementing the ARIA combobox/listbox pattern, so options can render a glyph beside their label: - DOM focus stays on the trigger button; the active option is announced through aria-activedescendant, keeping focus management to one element - Keyboard: arrows (clamped at the ends, like a native select), Home/End, Enter/Space to commit, Escape to cancel, Tab commits and moves on, and prefix type-ahead with a repeat-key cycle - Outside dismissal on pointerdown, so a press starting outside closes the popup before the click retargets The sort options now carry an icon each: calendar, arrow-down, arrow-up, an A→Z marker, and the drag glyph for manual — matching the badge the album card already shows. SORT_LABELS stays plain text because the badge feeds it to a title attribute. Closes #417 Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(git): ignore generated design handoff folders * fix(admin): stop the album sort dropdown clipping, and simplify the panel (#428) * fix(admin): render listbox popup in a portal so it escapes modal clipping The sort control's popup was position:absolute inside three clipping ancestors (.album-drawer overflow:hidden > .album-drawer-body overflow-y:auto > .modal-right-column overflow-y:auto), so it was cut off at the bottom of the Edit Album Details modal. z-index could not help: clipping happens before stacking. It also always hung below the trigger, with no flip. Portal the popup to document.body and position it from the trigger's viewport rect, flipping above when there is more room there and capping max-height to the space available so it scrolls internally rather than overflowing. It is dismissed on scroll and resize, since the anchor is only measured on open. The outside-pointerdown handler now also treats the popup as inside; without that the portalled list counts as outside, and a click on an option would close it before the selection commits. * refactor(admin): single-column album details panel The left column spent 1.2fr on a cover thumbnail and three stat rows, two of which (Status, Custom Hero) only restated the form fields opposite them, while the form itself was squeezed into 1.8fr behind a second nested scroller. Stack the drawer in one column instead: cover as a banner, then the form at full width, with the UUID moved into the footer. The body is now the only scroll container, which also removes one of the ancestors that was clipping the sort popup. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> * fix(admin): give the portalled listbox its theme back, lock the page behind modals (#429) Two defects in the album editor. The sort listbox popup painted transparent. Every --admin-* variable is scoped to .admin-layout, and since the popup moved into document.body it sits outside that subtree, so background/border/text all resolved to nothing. It now carries its own copy of the palette in both colour schemes, plus the font it no longer inherits. Scrolling inside a modal also moved the page behind it. No admin modal ever locked body scroll: the overlay covers the page but does not absorb wheel events, so a scroll starting on the backdrop — or continuing past the end of the modal's own scroller — reaches the document. overscroll-behavior cannot cover that case on its own, because it only applies to scroll containers and the backdrop is not one. useScrollLock freezes body while a modal is open and compensates for the width the scrollbar gives up, so nothing shifts underneath. Each lock restores the inline value it found, which makes nesting work without a counter — a picker opened from the drawer restores the drawer's hidden state instead of clearing it. Applied to both drawers and all four picker modals, which share the defect. overscroll-behavior: contain on the scrollers stops the chaining they can handle themselves. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com> * fix(security): allow unsafe-eval in CSP script-src during dev mode * feat(journal): add Journal Studio with split-screen editor, live preview and dedicated routes * fix(build): separate client parser from server journal-service and fix build type errors * fix(journal): Fotos rendern, Layout und Lightbox-Steuerung korrigieren Fünf unabhängige Fehler in der öffentlichen Journal- und Essay-Ansicht: * Foto-Blöcke wurden nie angezeigt. EssayView löst ein Foto über PhotoItem.id auf, und das sind verschlüsselte Tokens — die Blöcke aus dem Markdown tragen aber rohe Asset-UUIDs. Jede Zuordnung lief ins Leere, und nicht auflösbare Blöcke werden still verworfen. Die IDs werden jetzt serverseitig übersetzt; damit verschwinden nebenbei die rohen UUIDs aus dem Client-Payload, die dort laut Projektregel nie auftauchen dürfen. Nicht auflösbare Referenzen werden geloggt. * Überschriften standen weiter links als der Fließtext. Jeder Block hatte einzeln `max-width: 68ch`, und `ch` ist relativ zur Schrift des Elements — die Serif-Überschrift ergab eine breitere Spalte. Ersetzt durch eine gemeinsame, font-unabhängige `--essay-measure`. * Fullbleed-Fotos bluteten nur nach links aus: `.essay-figure` ist `width: 100%`, wodurch die Box überbestimmt ist und der negative rechte Margin verworfen wird. * Foto-Paare stellten beide Bilder gleich breit dar, wodurch ein Hochformat neben einem Querformat doppelt so hoch wurde. Jetzt eine Justified-Reihe: Breite proportional zum Seitenverhältnis, dadurch exakt gleiche Höhen ohne Beschnitt. * Die Lightbox hatte im Journal keine Tastatursteuerung und keine Scroll-Sperre — beides lag in PhotoGrid, also nur im Album-Raster. Verlagert in die Lightbox selbst, der doppelte Handler in PhotoGrid entfernt (sonst wäre pro Pfeildruck zwei Bilder weitergesprungen). Zusätzlich sind Proofing-Herzen und das EXIF-Panel im redaktionellen Modus abschaltbar und im Journal aus: Client-Proofing ist ein Übergabe-Workflow für Alben, keine Funktion einer Reportage. Auf der Übersicht wurde der Untertitel doppelt gerendert, weil extractExcerpt() auf ihn zurückfällt. * feat(admin): eigene URLs für alle Bereiche und überarbeiteter Journal Studio Das Panel war eine einzige Client-Komponente, die ihre Tabs über useState umschaltet: keine Route pro Bereich, kein Deep-Link, kein Zurück-Button, und nach jedem Reload landete man wieder auf "Pages". Auch der Journal-Editor hatte keine eigene URL. Jetzt sieben echte Routen (/admin, /admin/pages, /admin/journal, /admin/journal/<slug>, /admin/settings, /admin/settings/<section>, /admin/analytics). Die Shell mit Auth-Prüfung und Kopfzeile sitzt im Layout und umschließt children — so bleibt die Session-Prüfung über Routenwechsel montiert, statt bei jedem Tab-Wechsel neu zu laufen und den Spinner aufblitzen zu lassen. Unbekannte Settings-Sections fallen auf General zurück. Im selben Zug der Journal Studio, der die Routing-Änderung ohnehin berührt: * Alle Eingabefelder nutzten die Klasse `admin-input`, die in keinem CSS definiert war — sie fielen auf Browser-Defaults zurück. Jetzt gestylt, gescoped, damit der generische Name nicht ins übrige Panel leckt. * Der Split View ist per Divider verschiebbar (Maus, Tastatur, Doppelklick zum Zurücksetzen), Breite in localStorage. * Das Studio bricht aus der 1120px-Spalte aus, die Preview hat Platz. * Die Preview zeigte für jedes Foto fest 3:2 und log damit über das Layout der veröffentlichten Seite; die echten Verhältnisse werden jetzt an den Thumbnails gemessen. * Blöcke mit alten positionsbasierten Foto-Referenzen werden markiert — die lassen sich auf einer eigenständigen Journal-Seite nicht auflösen und verschwanden bisher stillschweigend. * Blocktyp-Chips als gemeinsame Komponente, monochrom und per Icon unterschieden statt in einer eigenen Blau/Lila/Orange-Palette, die sonst nirgends im Panel vorkommt. * Emojis raus, SVG-Icons rein. * fix(admin): Designsystem-Lücken im Panel schließen Eine systematische Suche nach Klassen, die im TSX benutzt, aber in keinem CSS definiert sind, hat vier Stellen mit demselben Muster gefunden: * `admin-btn-secondary` und `admin-btn-danger` existierten nicht. Sämtliche Löschen-Buttons sahen aus wie normale Buttons — keine Warnwirkung. Als `.admin-btn.admin-btn-danger` geschrieben, weil die Varianten mit den Größenklassen kombiniert werden, die weiter unten ihren eigenen Hintergrund setzen. * `page-progress-fill` fehlte: die Balken im Analytics-Panel waren leere Rinnen, der Wert unsichtbar. Ebenso `analytics-empty` und `admin-loading-container`. * `subpage-drawer-section`, `subpage-drawer-title-group` und `input-with-icon` im PageBuilder waren wirkungslos und teils mit Inline-Styles notdürftig kompensiert. * `grid-card-preview` fehlte, wodurch alle Layout-Vorschauen auf Höhe null kollabierten. Nur "Showcase" war sichtbar — und das aus Versehen, weil sein Tile `hero-tile` hieß und damit die `aspect-ratio` einer fremden PageBuilder-Klasse erbte. Umbenannt. Dazu die Theme-Vorschauen, die praktisch identisch aussahen: alle sieben zeigten dieselben drei quadratischen Kacheln, einziger Unterschied war die Hintergrundfarbe. Sie spiegeln jetzt die echten Preset-Daten aus lib/config/theme.ts — Schriftcharakter, Eckradius, Rasterdichte, Passepartout bzw. Schatten. Die Kopfzeile richtet sich an einer gemeinsamen Steuerhöhe aus. Der "Site"-Link war höher als die Buttons daneben: `.admin-btn` hatte keine explizite line-height, und <button> bekommt box-sizing: border-box vom Browser, <a> nicht. Die Statusanzeige setzte weder Schriftfamilie noch -größe und fiel auf den Browser-Default zurück — sie war nie Teil des Designsystems. Jetzt gleiche Höhe und Typografie, Pillenform als Zustandsanzeige, Trenner zur Aktionsgruppe. Das dauerhafte Pulsieren des grünen Punkts entfällt; Animation bleibt den Zuständen vorbehalten, die Aufmerksamkeit brauchen. Restliche Emojis durch SVG-Icons ersetzt. * feat(admin): add scroll-to-top toggle and SVG arrow The back-to-top button was always on and drew its arrow with the ↑ text character. Add a `scrollToTop` setting (General section in the admin panel, defaults to on so existing sites are unaffected) and replace the glyph with a stroked SVG that inherits currentColor across all presets. Scroll handling is now rAF-throttled, and prefers-reduced-motion turns off both the hover lift and the smooth scroll. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * security(journal): escape author HTML instead of filtering it CodeQL flags 26 high-severity alerts on the release PR; the bulk of them point at sanitizeHtml(), a denylist of three regexes whose output goes into dangerouslySetInnerHTML. I reproduced the bypasses before changing anything — all four pass the old filter: <img src=x onerror=alert(1)> unquoted handler, regex wants quotes <img src=x onerror='alert(1)'> single quotes, same reason <svg onload=alert(1)> not a <script> tag javasjavascript:cript:alert(1) one-pass replace, the rest recombines Plus an attribute breakout in the link renderer, which interpolated the URL into href="${url}" unescaped: [x](" onmouseover=alert(1) x=") -> <a href="" onmouseover=alert(1" ...> Replaced with escaping. Every `&<>"'` in author text becomes an entity before any markdown rule runs, so the only tags in the output are the ones renderInlineMarkdown builds itself and a URL cannot leave its attribute. Link schemes are now an allowlist (http, https, mailto, tel, relative, anchor); anything else renders as plain text. The serializer needed decodeHtmlEntities to match: without it a save would write `&lt;` into the Markdown file and the next parse would escape the `&` again, corrupting the text further on every round trip. A test covers parse -> serialize -> parse stability. Two existing tests asserted the old behaviour and were rewritten rather than deleted: one expected the script tag to be *removed* from the output, the other expected the substring "onerror" to be absent. Both now assert the property that matters — that no tag can form — because `onerror` surviving as inert text is fine. Exploitation required admin access either way: journal and essay text comes from the studio or from content/*.md. This removes the weakness, it does not close an open door. * fix(journal): contain file paths, fix frontmatter escaping, defuse two regexes Follow-up to the CodeQL findings on release PR #432. I went through all 23 alerts individually; this addresses the ones that are worth addressing and documents the ones that are not. Path containment (12 alerts, all false positives). Every path built from a slug goes through isValidSlug(), a strict `/^[a-zA-Z0-9_-]+$/` allowlist — verified against `../../etc/passwd`, `foo/../../bar`, `a/b`, `..` and friends, all rejected. CodeQL cannot see it because the check lives in another module. Added a containedPath() helper that resolves the path and refuses anything landing outside the content directory: a second lock on a door that was already locked, and a barrier the analysis can follow. Also removed the dead `slug.endsWith('.md')` branches — isValidSlug rejects dots, so they could never be taken. Frontmatter escaping (1 alert, a real bug). The serializer escaped `"` but not `\`, and the parser never unescaped anything. A title containing either character gained a backslash on every save/load cycle: Path C:\Users "quoted" -> Path C:\\Users \"quoted\" -> ... Escaping now covers the backslash first and the parser undoes both. A round trip test covers quotes, backslashes, colons and apostrophes. Two of three ReDoS regexes (2 alerts). The heading pattern had `\s+` next to `(.+)`, which overlap, so the engine tried every split of the whitespace run before failing; it is `[ \t]+` and `(\S.*)` now. The quote author pattern wrapped a lazy group around an optional group — the quadratic case — and is an index split on the first separator now. The third regex, the bold/italic pass, is deliberately left alone. Rewriting it with a negated class removes the backtracking but breaks nesting: `**bold *and italic* here**` renders as `*<em>bold </em>and italic<em> here</em>*`. The input is Markdown from an authenticated admin, never a visitor, so the worst case is an author slowing down their own page. The comment in the code says so. Not addressed: 5 js/insufficient-password-hash alerts. They ask for a slow KDF where the code uses SHA-256/HMAC — correct in general, but the admin password comes from an environment variable and is never stored, so a stronger KDF protects nothing that is not already in plaintext in the environment. 399 unit tests pass (18 new), build and tsc clean. * fix(journal): split the quote author by scanning, not by pattern Cleaning up after myself. #439 replaced the quote author regex `/^(.*?)(?:\s+--\s+(.+))?$/` — a lazy group around an optional one, the quadratic case — with `/\s+--\s+/`, and CodeQL promptly flagged the replacement for the same reason. One reported pattern traded for another. splitQuoteAuthor() scans for the first `--` that has whitespace on both sides. Linear, and it needs no reasoning about the regex engine at all. Behaviour is identical to the original regex, checked case by case against it: separator, no separator, several separators, tabs, wide gaps, `a--b` without spaces, leading and trailing separators, empty string. All nine are covered by tests, plus one asserting it stays fast on a 50k whitespace run. * security(admin): derive the session signing key with scrypt getSigningKey() ran the admin password through a single SHA-256 digest. It is key derivation rather than password storage, so it was never a stored-hash problem — but if the derived key ever leaked, one fast hash makes recovering the password by brute force cheap. CodeQL flags it as js/insufficient-password-hash and, for this particular alert, has a point. scrypt now. Two details that matter: The salt has to be stable. A random salt would produce a different key on every call and invalidate every session; it is derived from AUTH_SECRET, which is deployment-specific. Verified across separate processes: same inputs produce a verifying token, so a restart or redeploy does not log everyone out. The result is cached for the process lifetime. scrypt is deliberately slow and getSigningKey() runs on every admin request — deriving per call would add ~24ms to each one. The cache key is a digest of secret plus password, so a rotation misses the cache and derives again, and no extra plaintext copy of the password is kept around. Measured: first derivation 24ms, subsequent calls 0.12ms. Password change and secret change both invalidate an existing token, checked in separate processes. Note the one-time effect: existing admin sessions are invalidated by the change in derivation, so everyone logs in once more. * security(admin): key the signing-key cache on its inputs, not a digest #441 removed the SHA-256 digest of the admin password from the key derivation and introduced a new one three lines above it, as the cache key. Same rule, same file: CodeQL reported it immediately. The comment justifying it was wrong too. It claimed no second plaintext copy of the password was retained, while building the digest input allocates exactly that in order to hash it. The cache now holds the two input strings and compares them directly. They are the same objects the env and install caches already hold, so nothing extra is retained, and no fast hash of the password exists in memory for the life of the process. Re-verified after the change, in separate processes: a token from one process verifies in another with the same inputs, a changed password or secret rejects it, first derivation 24ms, cached calls 0.001ms. That leaves scrypt as the only place the password is hashed here. The two HMACs further down operate on the derived key and on token data, not on the password; the constant-time comparison in verifyAdminPassword is the previously dismissed one. --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
2026-08-14 16:55:07 +02:00
/*
* Same framing as .ratio-card-preview. Without an explicit box here the demos
* (which size themselves with height: 100%) collapse to zero height.
*/
.grid-card-preview {
width: 100%;
aspect-ratio: 16 / 10;
background: var(--admin-bg-elevated);
border-bottom: 1px solid var(--admin-border);
overflow: hidden;
}
security: add Trivy container scan to Docker publish workflow (#399) * feat(admin): add backup manager UI with 1-click restore * feat(admin): collapse older backup entries by default * fix(theme): isolate admin layout, instant DOM theme updates, and add Light/Dark mode toggle * feat(admin): replace text controls for Photo Frame and Hero Style with visual preview cards * fix(admin): define missing CSS rules for button system (.btn, .preset-btn) * feat(admin): redesign theme settings with segmented mode toggle, accent color swatches, and custom iOS-style toggle cards * feat(admin): upgrade all settings tabs with visual grid previews, Google SEO snippet preview, and toggle cards * feat(admin): overhaul Pages Builder UX with slide-over drawer, card hover badges, real-time search, and floating save bar * fix(admin): remove leftover dangling syntax snippet in PageBuilder.tsx * fix(admin): add position: relative to subpage-tile so hover overlay is contained inside the tile * style(admin): replace all emojis with clean Leica-style vector SVG icons * fix(types): extend IconProps with SVGProps to allow style prop on Leica SVG icons * feat(admin): add subpage live-preview, privacy analytics, and asset protection settings * fix(typecheck): fix AlbumEntry property access in subpage drawer preview mode * fix(types): fix ImmichAlbumInfo property names thumbnailAssetId and albumName in PageBuilder.tsx * fix(types): add protection and watermark optional properties to AppConfig interface * feat(settings): add toggle for disabling analytics tracking (defaults to enabled) * feat(ux): show status banner when analytics tracking is disabled + add live sync indicator * feat(watermark): render customizable watermark overlay on Lightbox images + rename section to Portfolio Features & Modules * fix(types): import type LightboxWatermark in PhotoGrid.tsx * fix(types): destructure watermark prop in PhotoGrid function signature * feat(seo): add configurable subpage title template and metadata descriptions * feat(seo): add generateMetadata to about page for title template support * feat(proofing): add client proofing, favorites selection, compact URL bitmasking, and export modal * feat(essay): add Photo Essay storytelling mode with RSC markdown parser and fullbleed/pair layouts * feat(subpages): add page enabled toggle to deactivate subpages without deleting them * feat(admin): add visual essay block builder for photo essay storytelling pages * security: add Trivy container scan to Docker publish workflow Scans the built image for CRITICAL/HIGH CVEs on every release and uploads results to the GitHub Security tab. Non-blocking for now (exit-code 0) so releases aren't gated on findings. Also documents the scan and existing Dependabot coverage in the README. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-08-07 11:08:04 +02:00
.mini-layout-demo {
width: 100%;
height: 100%;
padding: 0.35rem;
display: flex;
flex-direction: column;
gap: 0.25rem;
}
.demo-masonry-col-group {
display: flex;
gap: 0.25rem;
height: 100%;
width: 100%;
}
.demo-col {
flex: 1;
display: flex;
flex-direction: column;
gap: 0.25rem;
}
.demo-tile {
release: v0.11.0 — journal fixes, admin URLs, design system cleanup (#432) * fix(screenshots): sharp-Typen fuer 0.34 und 0.35 gleichzeitig (#410) sharp 0.35 ist von `export =` auf ESM umgestellt: der Modul-Namespace ist nicht mehr aufrufbar, die Factory sitzt unter .default. Der Type-Check brach damit in scripts/screenshots.ts weg, sobald der Next-Bump (#402) sharp von 0.34.5 auf 0.35.3 mitzieht -- sharp ist hier keine deklarierte Dependency, sondern kommt ueber Next mit. Die Form wird jetzt aus dem installierten Paket abgeleitet statt festgeschrieben, zur Laufzeit wie im Typ. Geprueft mit beiden Versionen: tsc laeuft mit 0.34.5 und mit 0.35.3 fehlerfrei durch. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(deps): bump the nextjs group across 1 directory with 2 updates (#402) Bumps the nextjs group with 2 updates in the / directory: [next](https://github.com/vercel/next.js) and [eslint-config-next](https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next). Updates `next` from 16.2.12 to 16.3.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/compare/v16.2.12...v16.3.0) Updates `eslint-config-next` from 16.2.12 to 16.3.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/commits/v16.3.0/packages/eslint-config-next) --- updated-dependencies: - dependency-name: eslint-config-next dependency-version: 16.3.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: nextjs - dependency-name: next dependency-version: 16.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nextjs ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps-dev): bump prettier from 3.8.3 to 3.9.6 (#405) Bumps [prettier](https://github.com/prettier/prettier) from 3.8.3 to 3.9.6. - [Release notes](https://github.com/prettier/prettier/releases) - [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md) - [Commits](https://github.com/prettier/prettier/compare/3.8.3...3.9.6) --- updated-dependencies: - dependency-name: prettier dependency-version: 3.9.6 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * docs(changelog): Unreleased-Sektion fuer die Bumps nach v0.10.0 (#413) Die Dependency-PRs sind nach dem Release auf dev gelandet, teils auch auf main. Ohne Eintrag waeren sie beim naechsten Release unsichtbar -- inklusive Next 16.3.0, das CVE-2025-13465 mitbringt. Ausserdem im 0.10.0-Abschnitt nachgetragen, dass der Trivy-Scan bis #409 nie gelaufen ist. Der Fix steckt im Tag v0.10.0, fehlte aber in der Aufzaehlung -- und "Images werden bei jedem Publish gescannt" stand im Changelog, waehrend der Job im Action-Setup abbrach. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(gallery): per-album sort order, independent of Immich (#408) (#414) Album order was dictated entirely by Immich: getAlbum() sorted by the album's own asc/desc flag, so a Folio album always mirrored the archive. A curated series has a narrative order that has nothing to do with capture time, and changing the Immich album's sort to fit the website changes it for the archive too. Adds an optional per-album `sort` in gallery.yaml, editable in /admin, defaulting to today's behaviour so every existing config is unchanged: immich (default) | newest | oldest | filename | manual `manual` is a pinned *prefix*: `assetOrder` lists only the photos placed by hand, everything else follows in the album's Immich order. A full permutation of a 2,000-photo album would be ~80 KB of UUIDs in a file that is rewritten and copied to content/.backups/ on every admin save. It also makes drift fall out for free — photos removed in Immich never match, new ones land in the tail rather than being hidden. Sorting is applied after the cache read, not before the cache write, so the LRU keeps one canonical Immich-ordered copy per album. That avoids putting the mode in the cache key, lets a config change take effect without depending on invalidation, and keeps the stale-serving path correct. cache.get() returns the stored object by reference, so withSort() returns a shallow clone with a new array — sorting in place would reorder the shared entry, and under request coalescing every concurrent caller would be sorting the same array. Also fixes a prerequisite bug: /api/admin/albums/[albumId]/assets read album.assets from GET /albums/:id, which Immich 3.x no longer populates (lib/immich.ts:507). The hero picker's "This Album" tab returned nothing and threw outright when the key was absent. It now goes through the client's paginated metadata search, with ?types=all to opt videos in for the reorder editor. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): drop decorative emoji from the sort select labels (#415) An <option> cannot contain markup, so the SVG set in Icons is not reachable there — but a decorative emoji is not a substitute for it. Plain text instead; the album card badge already uses a real icon. The remaining emoji in the admin panel (asset picker tabs, section headings, layout picker options) predate this branch and are left for a separate cleanup. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): replace emoji icons with the shared SVG icon set (#416) The admin panel mixed two icon conventions: inline SVGs from `Icons.tsx` in most components, and decorative emoji in the asset picker and a few PageBuilder labels. Emoji render inconsistently across platforms, ignore the accent colour, and cannot inherit the `.svg-icon` sizing rules. - Icons.tsx: add `IconStar` (filled — it marks a state, not an action) and `IconImage`. - AssetPicker: the three tab labels and the favourite tile badge now use IconFolder / IconStar / IconImage. - PageBuilder: the "Standalone Albums" and "Subpages" headings use the icon set instead of an emoji. - PageBuilder: the layout picker drops its emoji for plain text. An <option> cannot contain markup, so an SVG is impossible there and a decorative glyph is not a substitute. - admin.css: align icon and label in the picker tabs, and swap the favourite badge's text-shadow for drop-shadow, which is what applies to an inline SVG. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): fold PageBuilder's local icons into the shared Icons module (#418) * refactor(admin): fold PageBuilder's local icons into the shared module PageBuilder.tsx carried its own `Icons` object duplicating most of the glyphs already exported by Icons.tsx, with hardcoded sizes and slightly divergent paths. Migrate all 32 call sites to the shared module and delete the local object. Five glyphs had no counterpart and are added to Icons.tsx as 1:1 ports of the local paths: IconX, IconPlus, IconHome, IconCopy, IconImage. The local ExternalLink and Check are dropped rather than ported — both had zero call sites. Two glyphs change shape slightly, which is the point of consolidating: the shared IconCamera includes the viewfinder bump the local copy omitted, and drag handles now use IconGripVertical. IconGripVertical uses the module's square 24x24 viewBox, so `.svg-drag` goes from 12x18 to 18x18 — the old non-square box would letterbox the glyph down to 12x12 and shrink the handle. * fix(admin): resolve icon-module integration after #416 Merging dev brought in #416, which added a second IconImage to Icons.tsx and two <Icons.Camera>/<Icons.Folder> section headers that reference the local Icons object this PR removes. Git merged both cleanly but the result did not type-check. - drop the duplicate IconImage (both copies were byte-identical) - point the two section headers at the imported IconCamera/IconFolder - refresh the SORT_LABELS comment: the icon set is imported now, not declared below --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> * fix(config): allow an empty gallery, guard against a double /api suffix (#421) An empty gallery is now a valid, rendered state instead of a throw: deriveGallery() no longer requires at least one album or subpage, so a deployment with no albums yet renders a bare homepage the owner can fill in via /admin. getConfig() also stops appending /api to an Immich URL that already ends in it, which previously produced .../api/api and broke every upstream request. Includes a restore of the per-album sort test cases, which the branch had lost by being cut before #408/#414. * feat(admin): favicon upload, served from the content volume (#422) Adds a bundled default favicon, an upload widget in admin Settings > General, and a route that serves the icon from the writable content/ volume with a fallback to the bundled default. Raster uploads (PNG/ICO/JPEG) are wrapped in an SVG container; the response carries its own CSP so an uploaded SVG cannot execute script on the origin. The GET route revalidates with an ETag instead of caching immutably, so a newly uploaded icon shows up immediately. Uploads are written via temp file + rename, and a Reset button restores the bundled default. * ci: flag unformatted files in a PR, without blocking it (#424) Prettier is configured as an error rule in eslint.config.mjs but has never run in CI, so part of the tree predates it. A final CI step now diffs against the PR base, runs prettier --list-different over the changed files, and emits a warning annotation per offender plus a job summary. Advisory by design: it never fails the job. Blocking would turn a PR red for merely touching a file that was already unformatted, and normalising the tree in one commit would wreck git blame and conflict with the PRs in flight. Requires fetch-depth: 0, since diffing against the base needs its history. * feat(install): first-run wizard gated by a one-time setup token (#419) Adds /install, a four-step first-run wizard: connect to Immich, optionally pick albums, name the site, finish. It verifies the credentials against the Immich server before writing anything, then writes gallery.yaml, settings.yaml and a content/install.json carrying the Immich credentials and a generated site secret. install.json exists because a running process cannot pick up new env vars — the wizard has to write configuration that takes effect without a restart. getInstallCredentials() merges it under the real environment, so env vars always win and rotation stays a matter of setting one. Both the page and the API routes are gated by a one-time setup token printed to the server log, so a deployment that is reachable before gallery.yaml exists cannot be configured by whoever finds it first. The token is stored in content/.setup-token (0600) rather than a module variable: Next.js bundles the page and each route handler separately, so a module-level token left the page and the API disagreeing inside one process and the wizard stuck on step 1. It is removed once the install completes. The admin password is stored as an scrypt hash using the scheme lib/auth.ts already applies to album passwords; a plaintext ADMIN_PASSWORD env var keeps working. * docs: document the setup wizard, fix the read-only content mount (#425) Quick Start now leads with the /install wizard, with the hand-written YAML route kept alongside it, and a First-Run Setup section covers the setup token, the files the wizard writes, and env-var precedence. Two corrections: both Docker examples mounted content/ as :ro, which silently breaks the wizard, the admin panel and the backup rotation alike — docs/admin-panel.md already said so and the README contradicted it. And nothing documented that content/install.json holds the Immich API key, so a backup of content/ is a backup of credentials. Also adds a Contributors section crediting the people whose work is in the project. * feat(admin): floating save bar pinned to the bottom of the viewport (#426) The save bar was the first, static element inside .admin-main. Since the document itself scrolls, it left the viewport as soon as you scrolled down — editing a subpage section or a settings block far below gave no visible dirty hint and no reachable save button. Replace it with a bottom-pinned floating bar shared by both editors. It only mounts while there is something to act on (unsaved changes, an in-flight save, or a result message), so it never covers content while idle. The success message clears after 5s, which hides the bar again. - new SaveBar component, replacing the duplicated markup in PageBuilder and SettingsEditor - adopt the previously unused .floating-save-bar CSS: slide-in keyframes (carrying translateX(-50%)), dirty border, wrap/gap, mobile variant and a prefers-reduced-motion opt-out; z-index 900 keeps it below modals - .admin-main gains bottom padding so the bar never covers page content - drop the now-unreachable idle hints: the ⌘S hint becomes a button title, the Live Sync note becomes a static line above the settings layout - header "Site" link now bypasses the cache (/?fresh=1), so the preview stays reachable when the bar is hidden Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(admin): themed listbox for the album sort control (#427) The per-album "Photo order" control was a native <select>. Because an <option> cannot contain markup, its choices could not use the admin panel's currentColor SVG set — the reason #415 had to fall back to plain text after dropping the emoji labels. Adds a Listbox component implementing the ARIA combobox/listbox pattern, so options can render a glyph beside their label: - DOM focus stays on the trigger button; the active option is announced through aria-activedescendant, keeping focus management to one element - Keyboard: arrows (clamped at the ends, like a native select), Home/End, Enter/Space to commit, Escape to cancel, Tab commits and moves on, and prefix type-ahead with a repeat-key cycle - Outside dismissal on pointerdown, so a press starting outside closes the popup before the click retargets The sort options now carry an icon each: calendar, arrow-down, arrow-up, an A→Z marker, and the drag glyph for manual — matching the badge the album card already shows. SORT_LABELS stays plain text because the badge feeds it to a title attribute. Closes #417 Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(git): ignore generated design handoff folders * fix(admin): stop the album sort dropdown clipping, and simplify the panel (#428) * fix(admin): render listbox popup in a portal so it escapes modal clipping The sort control's popup was position:absolute inside three clipping ancestors (.album-drawer overflow:hidden > .album-drawer-body overflow-y:auto > .modal-right-column overflow-y:auto), so it was cut off at the bottom of the Edit Album Details modal. z-index could not help: clipping happens before stacking. It also always hung below the trigger, with no flip. Portal the popup to document.body and position it from the trigger's viewport rect, flipping above when there is more room there and capping max-height to the space available so it scrolls internally rather than overflowing. It is dismissed on scroll and resize, since the anchor is only measured on open. The outside-pointerdown handler now also treats the popup as inside; without that the portalled list counts as outside, and a click on an option would close it before the selection commits. * refactor(admin): single-column album details panel The left column spent 1.2fr on a cover thumbnail and three stat rows, two of which (Status, Custom Hero) only restated the form fields opposite them, while the form itself was squeezed into 1.8fr behind a second nested scroller. Stack the drawer in one column instead: cover as a banner, then the form at full width, with the UUID moved into the footer. The body is now the only scroll container, which also removes one of the ancestors that was clipping the sort popup. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> * fix(admin): give the portalled listbox its theme back, lock the page behind modals (#429) Two defects in the album editor. The sort listbox popup painted transparent. Every --admin-* variable is scoped to .admin-layout, and since the popup moved into document.body it sits outside that subtree, so background/border/text all resolved to nothing. It now carries its own copy of the palette in both colour schemes, plus the font it no longer inherits. Scrolling inside a modal also moved the page behind it. No admin modal ever locked body scroll: the overlay covers the page but does not absorb wheel events, so a scroll starting on the backdrop — or continuing past the end of the modal's own scroller — reaches the document. overscroll-behavior cannot cover that case on its own, because it only applies to scroll containers and the backdrop is not one. useScrollLock freezes body while a modal is open and compensates for the width the scrollbar gives up, so nothing shifts underneath. Each lock restores the inline value it found, which makes nesting work without a counter — a picker opened from the drawer restores the drawer's hidden state instead of clearing it. Applied to both drawers and all four picker modals, which share the defect. overscroll-behavior: contain on the scrollers stops the chaining they can handle themselves. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com> * fix(security): allow unsafe-eval in CSP script-src during dev mode * feat(journal): add Journal Studio with split-screen editor, live preview and dedicated routes * fix(build): separate client parser from server journal-service and fix build type errors * fix(journal): Fotos rendern, Layout und Lightbox-Steuerung korrigieren Fünf unabhängige Fehler in der öffentlichen Journal- und Essay-Ansicht: * Foto-Blöcke wurden nie angezeigt. EssayView löst ein Foto über PhotoItem.id auf, und das sind verschlüsselte Tokens — die Blöcke aus dem Markdown tragen aber rohe Asset-UUIDs. Jede Zuordnung lief ins Leere, und nicht auflösbare Blöcke werden still verworfen. Die IDs werden jetzt serverseitig übersetzt; damit verschwinden nebenbei die rohen UUIDs aus dem Client-Payload, die dort laut Projektregel nie auftauchen dürfen. Nicht auflösbare Referenzen werden geloggt. * Überschriften standen weiter links als der Fließtext. Jeder Block hatte einzeln `max-width: 68ch`, und `ch` ist relativ zur Schrift des Elements — die Serif-Überschrift ergab eine breitere Spalte. Ersetzt durch eine gemeinsame, font-unabhängige `--essay-measure`. * Fullbleed-Fotos bluteten nur nach links aus: `.essay-figure` ist `width: 100%`, wodurch die Box überbestimmt ist und der negative rechte Margin verworfen wird. * Foto-Paare stellten beide Bilder gleich breit dar, wodurch ein Hochformat neben einem Querformat doppelt so hoch wurde. Jetzt eine Justified-Reihe: Breite proportional zum Seitenverhältnis, dadurch exakt gleiche Höhen ohne Beschnitt. * Die Lightbox hatte im Journal keine Tastatursteuerung und keine Scroll-Sperre — beides lag in PhotoGrid, also nur im Album-Raster. Verlagert in die Lightbox selbst, der doppelte Handler in PhotoGrid entfernt (sonst wäre pro Pfeildruck zwei Bilder weitergesprungen). Zusätzlich sind Proofing-Herzen und das EXIF-Panel im redaktionellen Modus abschaltbar und im Journal aus: Client-Proofing ist ein Übergabe-Workflow für Alben, keine Funktion einer Reportage. Auf der Übersicht wurde der Untertitel doppelt gerendert, weil extractExcerpt() auf ihn zurückfällt. * feat(admin): eigene URLs für alle Bereiche und überarbeiteter Journal Studio Das Panel war eine einzige Client-Komponente, die ihre Tabs über useState umschaltet: keine Route pro Bereich, kein Deep-Link, kein Zurück-Button, und nach jedem Reload landete man wieder auf "Pages". Auch der Journal-Editor hatte keine eigene URL. Jetzt sieben echte Routen (/admin, /admin/pages, /admin/journal, /admin/journal/<slug>, /admin/settings, /admin/settings/<section>, /admin/analytics). Die Shell mit Auth-Prüfung und Kopfzeile sitzt im Layout und umschließt children — so bleibt die Session-Prüfung über Routenwechsel montiert, statt bei jedem Tab-Wechsel neu zu laufen und den Spinner aufblitzen zu lassen. Unbekannte Settings-Sections fallen auf General zurück. Im selben Zug der Journal Studio, der die Routing-Änderung ohnehin berührt: * Alle Eingabefelder nutzten die Klasse `admin-input`, die in keinem CSS definiert war — sie fielen auf Browser-Defaults zurück. Jetzt gestylt, gescoped, damit der generische Name nicht ins übrige Panel leckt. * Der Split View ist per Divider verschiebbar (Maus, Tastatur, Doppelklick zum Zurücksetzen), Breite in localStorage. * Das Studio bricht aus der 1120px-Spalte aus, die Preview hat Platz. * Die Preview zeigte für jedes Foto fest 3:2 und log damit über das Layout der veröffentlichten Seite; die echten Verhältnisse werden jetzt an den Thumbnails gemessen. * Blöcke mit alten positionsbasierten Foto-Referenzen werden markiert — die lassen sich auf einer eigenständigen Journal-Seite nicht auflösen und verschwanden bisher stillschweigend. * Blocktyp-Chips als gemeinsame Komponente, monochrom und per Icon unterschieden statt in einer eigenen Blau/Lila/Orange-Palette, die sonst nirgends im Panel vorkommt. * Emojis raus, SVG-Icons rein. * fix(admin): Designsystem-Lücken im Panel schließen Eine systematische Suche nach Klassen, die im TSX benutzt, aber in keinem CSS definiert sind, hat vier Stellen mit demselben Muster gefunden: * `admin-btn-secondary` und `admin-btn-danger` existierten nicht. Sämtliche Löschen-Buttons sahen aus wie normale Buttons — keine Warnwirkung. Als `.admin-btn.admin-btn-danger` geschrieben, weil die Varianten mit den Größenklassen kombiniert werden, die weiter unten ihren eigenen Hintergrund setzen. * `page-progress-fill` fehlte: die Balken im Analytics-Panel waren leere Rinnen, der Wert unsichtbar. Ebenso `analytics-empty` und `admin-loading-container`. * `subpage-drawer-section`, `subpage-drawer-title-group` und `input-with-icon` im PageBuilder waren wirkungslos und teils mit Inline-Styles notdürftig kompensiert. * `grid-card-preview` fehlte, wodurch alle Layout-Vorschauen auf Höhe null kollabierten. Nur "Showcase" war sichtbar — und das aus Versehen, weil sein Tile `hero-tile` hieß und damit die `aspect-ratio` einer fremden PageBuilder-Klasse erbte. Umbenannt. Dazu die Theme-Vorschauen, die praktisch identisch aussahen: alle sieben zeigten dieselben drei quadratischen Kacheln, einziger Unterschied war die Hintergrundfarbe. Sie spiegeln jetzt die echten Preset-Daten aus lib/config/theme.ts — Schriftcharakter, Eckradius, Rasterdichte, Passepartout bzw. Schatten. Die Kopfzeile richtet sich an einer gemeinsamen Steuerhöhe aus. Der "Site"-Link war höher als die Buttons daneben: `.admin-btn` hatte keine explizite line-height, und <button> bekommt box-sizing: border-box vom Browser, <a> nicht. Die Statusanzeige setzte weder Schriftfamilie noch -größe und fiel auf den Browser-Default zurück — sie war nie Teil des Designsystems. Jetzt gleiche Höhe und Typografie, Pillenform als Zustandsanzeige, Trenner zur Aktionsgruppe. Das dauerhafte Pulsieren des grünen Punkts entfällt; Animation bleibt den Zuständen vorbehalten, die Aufmerksamkeit brauchen. Restliche Emojis durch SVG-Icons ersetzt. * feat(admin): add scroll-to-top toggle and SVG arrow The back-to-top button was always on and drew its arrow with the ↑ text character. Add a `scrollToTop` setting (General section in the admin panel, defaults to on so existing sites are unaffected) and replace the glyph with a stroked SVG that inherits currentColor across all presets. Scroll handling is now rAF-throttled, and prefers-reduced-motion turns off both the hover lift and the smooth scroll. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * security(journal): escape author HTML instead of filtering it CodeQL flags 26 high-severity alerts on the release PR; the bulk of them point at sanitizeHtml(), a denylist of three regexes whose output goes into dangerouslySetInnerHTML. I reproduced the bypasses before changing anything — all four pass the old filter: <img src=x onerror=alert(1)> unquoted handler, regex wants quotes <img src=x onerror='alert(1)'> single quotes, same reason <svg onload=alert(1)> not a <script> tag javasjavascript:cript:alert(1) one-pass replace, the rest recombines Plus an attribute breakout in the link renderer, which interpolated the URL into href="${url}" unescaped: [x](" onmouseover=alert(1) x=") -> <a href="" onmouseover=alert(1" ...> Replaced with escaping. Every `&<>"'` in author text becomes an entity before any markdown rule runs, so the only tags in the output are the ones renderInlineMarkdown builds itself and a URL cannot leave its attribute. Link schemes are now an allowlist (http, https, mailto, tel, relative, anchor); anything else renders as plain text. The serializer needed decodeHtmlEntities to match: without it a save would write `&lt;` into the Markdown file and the next parse would escape the `&` again, corrupting the text further on every round trip. A test covers parse -> serialize -> parse stability. Two existing tests asserted the old behaviour and were rewritten rather than deleted: one expected the script tag to be *removed* from the output, the other expected the substring "onerror" to be absent. Both now assert the property that matters — that no tag can form — because `onerror` surviving as inert text is fine. Exploitation required admin access either way: journal and essay text comes from the studio or from content/*.md. This removes the weakness, it does not close an open door. * fix(journal): contain file paths, fix frontmatter escaping, defuse two regexes Follow-up to the CodeQL findings on release PR #432. I went through all 23 alerts individually; this addresses the ones that are worth addressing and documents the ones that are not. Path containment (12 alerts, all false positives). Every path built from a slug goes through isValidSlug(), a strict `/^[a-zA-Z0-9_-]+$/` allowlist — verified against `../../etc/passwd`, `foo/../../bar`, `a/b`, `..` and friends, all rejected. CodeQL cannot see it because the check lives in another module. Added a containedPath() helper that resolves the path and refuses anything landing outside the content directory: a second lock on a door that was already locked, and a barrier the analysis can follow. Also removed the dead `slug.endsWith('.md')` branches — isValidSlug rejects dots, so they could never be taken. Frontmatter escaping (1 alert, a real bug). The serializer escaped `"` but not `\`, and the parser never unescaped anything. A title containing either character gained a backslash on every save/load cycle: Path C:\Users "quoted" -> Path C:\\Users \"quoted\" -> ... Escaping now covers the backslash first and the parser undoes both. A round trip test covers quotes, backslashes, colons and apostrophes. Two of three ReDoS regexes (2 alerts). The heading pattern had `\s+` next to `(.+)`, which overlap, so the engine tried every split of the whitespace run before failing; it is `[ \t]+` and `(\S.*)` now. The quote author pattern wrapped a lazy group around an optional group — the quadratic case — and is an index split on the first separator now. The third regex, the bold/italic pass, is deliberately left alone. Rewriting it with a negated class removes the backtracking but breaks nesting: `**bold *and italic* here**` renders as `*<em>bold </em>and italic<em> here</em>*`. The input is Markdown from an authenticated admin, never a visitor, so the worst case is an author slowing down their own page. The comment in the code says so. Not addressed: 5 js/insufficient-password-hash alerts. They ask for a slow KDF where the code uses SHA-256/HMAC — correct in general, but the admin password comes from an environment variable and is never stored, so a stronger KDF protects nothing that is not already in plaintext in the environment. 399 unit tests pass (18 new), build and tsc clean. * fix(journal): split the quote author by scanning, not by pattern Cleaning up after myself. #439 replaced the quote author regex `/^(.*?)(?:\s+--\s+(.+))?$/` — a lazy group around an optional one, the quadratic case — with `/\s+--\s+/`, and CodeQL promptly flagged the replacement for the same reason. One reported pattern traded for another. splitQuoteAuthor() scans for the first `--` that has whitespace on both sides. Linear, and it needs no reasoning about the regex engine at all. Behaviour is identical to the original regex, checked case by case against it: separator, no separator, several separators, tabs, wide gaps, `a--b` without spaces, leading and trailing separators, empty string. All nine are covered by tests, plus one asserting it stays fast on a 50k whitespace run. * security(admin): derive the session signing key with scrypt getSigningKey() ran the admin password through a single SHA-256 digest. It is key derivation rather than password storage, so it was never a stored-hash problem — but if the derived key ever leaked, one fast hash makes recovering the password by brute force cheap. CodeQL flags it as js/insufficient-password-hash and, for this particular alert, has a point. scrypt now. Two details that matter: The salt has to be stable. A random salt would produce a different key on every call and invalidate every session; it is derived from AUTH_SECRET, which is deployment-specific. Verified across separate processes: same inputs produce a verifying token, so a restart or redeploy does not log everyone out. The result is cached for the process lifetime. scrypt is deliberately slow and getSigningKey() runs on every admin request — deriving per call would add ~24ms to each one. The cache key is a digest of secret plus password, so a rotation misses the cache and derives again, and no extra plaintext copy of the password is kept around. Measured: first derivation 24ms, subsequent calls 0.12ms. Password change and secret change both invalidate an existing token, checked in separate processes. Note the one-time effect: existing admin sessions are invalidated by the change in derivation, so everyone logs in once more. * security(admin): key the signing-key cache on its inputs, not a digest #441 removed the SHA-256 digest of the admin password from the key derivation and introduced a new one three lines above it, as the cache key. Same rule, same file: CodeQL reported it immediately. The comment justifying it was wrong too. It claimed no second plaintext copy of the password was retained, while building the digest input allocates exactly that in order to hash it. The cache now holds the two input strings and compares them directly. They are the same objects the env and install caches already hold, so nothing extra is retained, and no fast hash of the password exists in memory for the life of the process. Re-verified after the change, in separate processes: a token from one process verifies in another with the same inputs, a changed password or secret rejects it, first derivation 24ms, cached calls 0.001ms. That leaves scrypt as the only place the password is hashed here. The two HMACs further down operate on the derived key and on token data, not on the password; the constant-time comparison in verifyAdminPassword is the previously dismissed one. --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
2026-08-14 16:55:07 +02:00
background: var(--admin-text-secondary);
opacity: 0.35;
security: add Trivy container scan to Docker publish workflow (#399) * feat(admin): add backup manager UI with 1-click restore * feat(admin): collapse older backup entries by default * fix(theme): isolate admin layout, instant DOM theme updates, and add Light/Dark mode toggle * feat(admin): replace text controls for Photo Frame and Hero Style with visual preview cards * fix(admin): define missing CSS rules for button system (.btn, .preset-btn) * feat(admin): redesign theme settings with segmented mode toggle, accent color swatches, and custom iOS-style toggle cards * feat(admin): upgrade all settings tabs with visual grid previews, Google SEO snippet preview, and toggle cards * feat(admin): overhaul Pages Builder UX with slide-over drawer, card hover badges, real-time search, and floating save bar * fix(admin): remove leftover dangling syntax snippet in PageBuilder.tsx * fix(admin): add position: relative to subpage-tile so hover overlay is contained inside the tile * style(admin): replace all emojis with clean Leica-style vector SVG icons * fix(types): extend IconProps with SVGProps to allow style prop on Leica SVG icons * feat(admin): add subpage live-preview, privacy analytics, and asset protection settings * fix(typecheck): fix AlbumEntry property access in subpage drawer preview mode * fix(types): fix ImmichAlbumInfo property names thumbnailAssetId and albumName in PageBuilder.tsx * fix(types): add protection and watermark optional properties to AppConfig interface * feat(settings): add toggle for disabling analytics tracking (defaults to enabled) * feat(ux): show status banner when analytics tracking is disabled + add live sync indicator * feat(watermark): render customizable watermark overlay on Lightbox images + rename section to Portfolio Features & Modules * fix(types): import type LightboxWatermark in PhotoGrid.tsx * fix(types): destructure watermark prop in PhotoGrid function signature * feat(seo): add configurable subpage title template and metadata descriptions * feat(seo): add generateMetadata to about page for title template support * feat(proofing): add client proofing, favorites selection, compact URL bitmasking, and export modal * feat(essay): add Photo Essay storytelling mode with RSC markdown parser and fullbleed/pair layouts * feat(subpages): add page enabled toggle to deactivate subpages without deleting them * feat(admin): add visual essay block builder for photo essay storytelling pages * security: add Trivy container scan to Docker publish workflow Scans the built image for CRITICAL/HIGH CVEs on every release and uploads results to the GitHub Security tab. Non-blocking for now (exit-code 0) so releases aren't gated on findings. Also documents the scan and existing Dependabot coverage in the README. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-08-07 11:08:04 +02:00
border-radius: 2px;
flex: 1;
release: v0.11.0 — journal fixes, admin URLs, design system cleanup (#432) * fix(screenshots): sharp-Typen fuer 0.34 und 0.35 gleichzeitig (#410) sharp 0.35 ist von `export =` auf ESM umgestellt: der Modul-Namespace ist nicht mehr aufrufbar, die Factory sitzt unter .default. Der Type-Check brach damit in scripts/screenshots.ts weg, sobald der Next-Bump (#402) sharp von 0.34.5 auf 0.35.3 mitzieht -- sharp ist hier keine deklarierte Dependency, sondern kommt ueber Next mit. Die Form wird jetzt aus dem installierten Paket abgeleitet statt festgeschrieben, zur Laufzeit wie im Typ. Geprueft mit beiden Versionen: tsc laeuft mit 0.34.5 und mit 0.35.3 fehlerfrei durch. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(deps): bump the nextjs group across 1 directory with 2 updates (#402) Bumps the nextjs group with 2 updates in the / directory: [next](https://github.com/vercel/next.js) and [eslint-config-next](https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next). Updates `next` from 16.2.12 to 16.3.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/compare/v16.2.12...v16.3.0) Updates `eslint-config-next` from 16.2.12 to 16.3.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/commits/v16.3.0/packages/eslint-config-next) --- updated-dependencies: - dependency-name: eslint-config-next dependency-version: 16.3.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: nextjs - dependency-name: next dependency-version: 16.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nextjs ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps-dev): bump prettier from 3.8.3 to 3.9.6 (#405) Bumps [prettier](https://github.com/prettier/prettier) from 3.8.3 to 3.9.6. - [Release notes](https://github.com/prettier/prettier/releases) - [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md) - [Commits](https://github.com/prettier/prettier/compare/3.8.3...3.9.6) --- updated-dependencies: - dependency-name: prettier dependency-version: 3.9.6 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * docs(changelog): Unreleased-Sektion fuer die Bumps nach v0.10.0 (#413) Die Dependency-PRs sind nach dem Release auf dev gelandet, teils auch auf main. Ohne Eintrag waeren sie beim naechsten Release unsichtbar -- inklusive Next 16.3.0, das CVE-2025-13465 mitbringt. Ausserdem im 0.10.0-Abschnitt nachgetragen, dass der Trivy-Scan bis #409 nie gelaufen ist. Der Fix steckt im Tag v0.10.0, fehlte aber in der Aufzaehlung -- und "Images werden bei jedem Publish gescannt" stand im Changelog, waehrend der Job im Action-Setup abbrach. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(gallery): per-album sort order, independent of Immich (#408) (#414) Album order was dictated entirely by Immich: getAlbum() sorted by the album's own asc/desc flag, so a Folio album always mirrored the archive. A curated series has a narrative order that has nothing to do with capture time, and changing the Immich album's sort to fit the website changes it for the archive too. Adds an optional per-album `sort` in gallery.yaml, editable in /admin, defaulting to today's behaviour so every existing config is unchanged: immich (default) | newest | oldest | filename | manual `manual` is a pinned *prefix*: `assetOrder` lists only the photos placed by hand, everything else follows in the album's Immich order. A full permutation of a 2,000-photo album would be ~80 KB of UUIDs in a file that is rewritten and copied to content/.backups/ on every admin save. It also makes drift fall out for free — photos removed in Immich never match, new ones land in the tail rather than being hidden. Sorting is applied after the cache read, not before the cache write, so the LRU keeps one canonical Immich-ordered copy per album. That avoids putting the mode in the cache key, lets a config change take effect without depending on invalidation, and keeps the stale-serving path correct. cache.get() returns the stored object by reference, so withSort() returns a shallow clone with a new array — sorting in place would reorder the shared entry, and under request coalescing every concurrent caller would be sorting the same array. Also fixes a prerequisite bug: /api/admin/albums/[albumId]/assets read album.assets from GET /albums/:id, which Immich 3.x no longer populates (lib/immich.ts:507). The hero picker's "This Album" tab returned nothing and threw outright when the key was absent. It now goes through the client's paginated metadata search, with ?types=all to opt videos in for the reorder editor. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): drop decorative emoji from the sort select labels (#415) An <option> cannot contain markup, so the SVG set in Icons is not reachable there — but a decorative emoji is not a substitute for it. Plain text instead; the album card badge already uses a real icon. The remaining emoji in the admin panel (asset picker tabs, section headings, layout picker options) predate this branch and are left for a separate cleanup. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): replace emoji icons with the shared SVG icon set (#416) The admin panel mixed two icon conventions: inline SVGs from `Icons.tsx` in most components, and decorative emoji in the asset picker and a few PageBuilder labels. Emoji render inconsistently across platforms, ignore the accent colour, and cannot inherit the `.svg-icon` sizing rules. - Icons.tsx: add `IconStar` (filled — it marks a state, not an action) and `IconImage`. - AssetPicker: the three tab labels and the favourite tile badge now use IconFolder / IconStar / IconImage. - PageBuilder: the "Standalone Albums" and "Subpages" headings use the icon set instead of an emoji. - PageBuilder: the layout picker drops its emoji for plain text. An <option> cannot contain markup, so an SVG is impossible there and a decorative glyph is not a substitute. - admin.css: align icon and label in the picker tabs, and swap the favourite badge's text-shadow for drop-shadow, which is what applies to an inline SVG. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): fold PageBuilder's local icons into the shared Icons module (#418) * refactor(admin): fold PageBuilder's local icons into the shared module PageBuilder.tsx carried its own `Icons` object duplicating most of the glyphs already exported by Icons.tsx, with hardcoded sizes and slightly divergent paths. Migrate all 32 call sites to the shared module and delete the local object. Five glyphs had no counterpart and are added to Icons.tsx as 1:1 ports of the local paths: IconX, IconPlus, IconHome, IconCopy, IconImage. The local ExternalLink and Check are dropped rather than ported — both had zero call sites. Two glyphs change shape slightly, which is the point of consolidating: the shared IconCamera includes the viewfinder bump the local copy omitted, and drag handles now use IconGripVertical. IconGripVertical uses the module's square 24x24 viewBox, so `.svg-drag` goes from 12x18 to 18x18 — the old non-square box would letterbox the glyph down to 12x12 and shrink the handle. * fix(admin): resolve icon-module integration after #416 Merging dev brought in #416, which added a second IconImage to Icons.tsx and two <Icons.Camera>/<Icons.Folder> section headers that reference the local Icons object this PR removes. Git merged both cleanly but the result did not type-check. - drop the duplicate IconImage (both copies were byte-identical) - point the two section headers at the imported IconCamera/IconFolder - refresh the SORT_LABELS comment: the icon set is imported now, not declared below --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> * fix(config): allow an empty gallery, guard against a double /api suffix (#421) An empty gallery is now a valid, rendered state instead of a throw: deriveGallery() no longer requires at least one album or subpage, so a deployment with no albums yet renders a bare homepage the owner can fill in via /admin. getConfig() also stops appending /api to an Immich URL that already ends in it, which previously produced .../api/api and broke every upstream request. Includes a restore of the per-album sort test cases, which the branch had lost by being cut before #408/#414. * feat(admin): favicon upload, served from the content volume (#422) Adds a bundled default favicon, an upload widget in admin Settings > General, and a route that serves the icon from the writable content/ volume with a fallback to the bundled default. Raster uploads (PNG/ICO/JPEG) are wrapped in an SVG container; the response carries its own CSP so an uploaded SVG cannot execute script on the origin. The GET route revalidates with an ETag instead of caching immutably, so a newly uploaded icon shows up immediately. Uploads are written via temp file + rename, and a Reset button restores the bundled default. * ci: flag unformatted files in a PR, without blocking it (#424) Prettier is configured as an error rule in eslint.config.mjs but has never run in CI, so part of the tree predates it. A final CI step now diffs against the PR base, runs prettier --list-different over the changed files, and emits a warning annotation per offender plus a job summary. Advisory by design: it never fails the job. Blocking would turn a PR red for merely touching a file that was already unformatted, and normalising the tree in one commit would wreck git blame and conflict with the PRs in flight. Requires fetch-depth: 0, since diffing against the base needs its history. * feat(install): first-run wizard gated by a one-time setup token (#419) Adds /install, a four-step first-run wizard: connect to Immich, optionally pick albums, name the site, finish. It verifies the credentials against the Immich server before writing anything, then writes gallery.yaml, settings.yaml and a content/install.json carrying the Immich credentials and a generated site secret. install.json exists because a running process cannot pick up new env vars — the wizard has to write configuration that takes effect without a restart. getInstallCredentials() merges it under the real environment, so env vars always win and rotation stays a matter of setting one. Both the page and the API routes are gated by a one-time setup token printed to the server log, so a deployment that is reachable before gallery.yaml exists cannot be configured by whoever finds it first. The token is stored in content/.setup-token (0600) rather than a module variable: Next.js bundles the page and each route handler separately, so a module-level token left the page and the API disagreeing inside one process and the wizard stuck on step 1. It is removed once the install completes. The admin password is stored as an scrypt hash using the scheme lib/auth.ts already applies to album passwords; a plaintext ADMIN_PASSWORD env var keeps working. * docs: document the setup wizard, fix the read-only content mount (#425) Quick Start now leads with the /install wizard, with the hand-written YAML route kept alongside it, and a First-Run Setup section covers the setup token, the files the wizard writes, and env-var precedence. Two corrections: both Docker examples mounted content/ as :ro, which silently breaks the wizard, the admin panel and the backup rotation alike — docs/admin-panel.md already said so and the README contradicted it. And nothing documented that content/install.json holds the Immich API key, so a backup of content/ is a backup of credentials. Also adds a Contributors section crediting the people whose work is in the project. * feat(admin): floating save bar pinned to the bottom of the viewport (#426) The save bar was the first, static element inside .admin-main. Since the document itself scrolls, it left the viewport as soon as you scrolled down — editing a subpage section or a settings block far below gave no visible dirty hint and no reachable save button. Replace it with a bottom-pinned floating bar shared by both editors. It only mounts while there is something to act on (unsaved changes, an in-flight save, or a result message), so it never covers content while idle. The success message clears after 5s, which hides the bar again. - new SaveBar component, replacing the duplicated markup in PageBuilder and SettingsEditor - adopt the previously unused .floating-save-bar CSS: slide-in keyframes (carrying translateX(-50%)), dirty border, wrap/gap, mobile variant and a prefers-reduced-motion opt-out; z-index 900 keeps it below modals - .admin-main gains bottom padding so the bar never covers page content - drop the now-unreachable idle hints: the ⌘S hint becomes a button title, the Live Sync note becomes a static line above the settings layout - header "Site" link now bypasses the cache (/?fresh=1), so the preview stays reachable when the bar is hidden Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(admin): themed listbox for the album sort control (#427) The per-album "Photo order" control was a native <select>. Because an <option> cannot contain markup, its choices could not use the admin panel's currentColor SVG set — the reason #415 had to fall back to plain text after dropping the emoji labels. Adds a Listbox component implementing the ARIA combobox/listbox pattern, so options can render a glyph beside their label: - DOM focus stays on the trigger button; the active option is announced through aria-activedescendant, keeping focus management to one element - Keyboard: arrows (clamped at the ends, like a native select), Home/End, Enter/Space to commit, Escape to cancel, Tab commits and moves on, and prefix type-ahead with a repeat-key cycle - Outside dismissal on pointerdown, so a press starting outside closes the popup before the click retargets The sort options now carry an icon each: calendar, arrow-down, arrow-up, an A→Z marker, and the drag glyph for manual — matching the badge the album card already shows. SORT_LABELS stays plain text because the badge feeds it to a title attribute. Closes #417 Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(git): ignore generated design handoff folders * fix(admin): stop the album sort dropdown clipping, and simplify the panel (#428) * fix(admin): render listbox popup in a portal so it escapes modal clipping The sort control's popup was position:absolute inside three clipping ancestors (.album-drawer overflow:hidden > .album-drawer-body overflow-y:auto > .modal-right-column overflow-y:auto), so it was cut off at the bottom of the Edit Album Details modal. z-index could not help: clipping happens before stacking. It also always hung below the trigger, with no flip. Portal the popup to document.body and position it from the trigger's viewport rect, flipping above when there is more room there and capping max-height to the space available so it scrolls internally rather than overflowing. It is dismissed on scroll and resize, since the anchor is only measured on open. The outside-pointerdown handler now also treats the popup as inside; without that the portalled list counts as outside, and a click on an option would close it before the selection commits. * refactor(admin): single-column album details panel The left column spent 1.2fr on a cover thumbnail and three stat rows, two of which (Status, Custom Hero) only restated the form fields opposite them, while the form itself was squeezed into 1.8fr behind a second nested scroller. Stack the drawer in one column instead: cover as a banner, then the form at full width, with the UUID moved into the footer. The body is now the only scroll container, which also removes one of the ancestors that was clipping the sort popup. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> * fix(admin): give the portalled listbox its theme back, lock the page behind modals (#429) Two defects in the album editor. The sort listbox popup painted transparent. Every --admin-* variable is scoped to .admin-layout, and since the popup moved into document.body it sits outside that subtree, so background/border/text all resolved to nothing. It now carries its own copy of the palette in both colour schemes, plus the font it no longer inherits. Scrolling inside a modal also moved the page behind it. No admin modal ever locked body scroll: the overlay covers the page but does not absorb wheel events, so a scroll starting on the backdrop — or continuing past the end of the modal's own scroller — reaches the document. overscroll-behavior cannot cover that case on its own, because it only applies to scroll containers and the backdrop is not one. useScrollLock freezes body while a modal is open and compensates for the width the scrollbar gives up, so nothing shifts underneath. Each lock restores the inline value it found, which makes nesting work without a counter — a picker opened from the drawer restores the drawer's hidden state instead of clearing it. Applied to both drawers and all four picker modals, which share the defect. overscroll-behavior: contain on the scrollers stops the chaining they can handle themselves. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com> * fix(security): allow unsafe-eval in CSP script-src during dev mode * feat(journal): add Journal Studio with split-screen editor, live preview and dedicated routes * fix(build): separate client parser from server journal-service and fix build type errors * fix(journal): Fotos rendern, Layout und Lightbox-Steuerung korrigieren Fünf unabhängige Fehler in der öffentlichen Journal- und Essay-Ansicht: * Foto-Blöcke wurden nie angezeigt. EssayView löst ein Foto über PhotoItem.id auf, und das sind verschlüsselte Tokens — die Blöcke aus dem Markdown tragen aber rohe Asset-UUIDs. Jede Zuordnung lief ins Leere, und nicht auflösbare Blöcke werden still verworfen. Die IDs werden jetzt serverseitig übersetzt; damit verschwinden nebenbei die rohen UUIDs aus dem Client-Payload, die dort laut Projektregel nie auftauchen dürfen. Nicht auflösbare Referenzen werden geloggt. * Überschriften standen weiter links als der Fließtext. Jeder Block hatte einzeln `max-width: 68ch`, und `ch` ist relativ zur Schrift des Elements — die Serif-Überschrift ergab eine breitere Spalte. Ersetzt durch eine gemeinsame, font-unabhängige `--essay-measure`. * Fullbleed-Fotos bluteten nur nach links aus: `.essay-figure` ist `width: 100%`, wodurch die Box überbestimmt ist und der negative rechte Margin verworfen wird. * Foto-Paare stellten beide Bilder gleich breit dar, wodurch ein Hochformat neben einem Querformat doppelt so hoch wurde. Jetzt eine Justified-Reihe: Breite proportional zum Seitenverhältnis, dadurch exakt gleiche Höhen ohne Beschnitt. * Die Lightbox hatte im Journal keine Tastatursteuerung und keine Scroll-Sperre — beides lag in PhotoGrid, also nur im Album-Raster. Verlagert in die Lightbox selbst, der doppelte Handler in PhotoGrid entfernt (sonst wäre pro Pfeildruck zwei Bilder weitergesprungen). Zusätzlich sind Proofing-Herzen und das EXIF-Panel im redaktionellen Modus abschaltbar und im Journal aus: Client-Proofing ist ein Übergabe-Workflow für Alben, keine Funktion einer Reportage. Auf der Übersicht wurde der Untertitel doppelt gerendert, weil extractExcerpt() auf ihn zurückfällt. * feat(admin): eigene URLs für alle Bereiche und überarbeiteter Journal Studio Das Panel war eine einzige Client-Komponente, die ihre Tabs über useState umschaltet: keine Route pro Bereich, kein Deep-Link, kein Zurück-Button, und nach jedem Reload landete man wieder auf "Pages". Auch der Journal-Editor hatte keine eigene URL. Jetzt sieben echte Routen (/admin, /admin/pages, /admin/journal, /admin/journal/<slug>, /admin/settings, /admin/settings/<section>, /admin/analytics). Die Shell mit Auth-Prüfung und Kopfzeile sitzt im Layout und umschließt children — so bleibt die Session-Prüfung über Routenwechsel montiert, statt bei jedem Tab-Wechsel neu zu laufen und den Spinner aufblitzen zu lassen. Unbekannte Settings-Sections fallen auf General zurück. Im selben Zug der Journal Studio, der die Routing-Änderung ohnehin berührt: * Alle Eingabefelder nutzten die Klasse `admin-input`, die in keinem CSS definiert war — sie fielen auf Browser-Defaults zurück. Jetzt gestylt, gescoped, damit der generische Name nicht ins übrige Panel leckt. * Der Split View ist per Divider verschiebbar (Maus, Tastatur, Doppelklick zum Zurücksetzen), Breite in localStorage. * Das Studio bricht aus der 1120px-Spalte aus, die Preview hat Platz. * Die Preview zeigte für jedes Foto fest 3:2 und log damit über das Layout der veröffentlichten Seite; die echten Verhältnisse werden jetzt an den Thumbnails gemessen. * Blöcke mit alten positionsbasierten Foto-Referenzen werden markiert — die lassen sich auf einer eigenständigen Journal-Seite nicht auflösen und verschwanden bisher stillschweigend. * Blocktyp-Chips als gemeinsame Komponente, monochrom und per Icon unterschieden statt in einer eigenen Blau/Lila/Orange-Palette, die sonst nirgends im Panel vorkommt. * Emojis raus, SVG-Icons rein. * fix(admin): Designsystem-Lücken im Panel schließen Eine systematische Suche nach Klassen, die im TSX benutzt, aber in keinem CSS definiert sind, hat vier Stellen mit demselben Muster gefunden: * `admin-btn-secondary` und `admin-btn-danger` existierten nicht. Sämtliche Löschen-Buttons sahen aus wie normale Buttons — keine Warnwirkung. Als `.admin-btn.admin-btn-danger` geschrieben, weil die Varianten mit den Größenklassen kombiniert werden, die weiter unten ihren eigenen Hintergrund setzen. * `page-progress-fill` fehlte: die Balken im Analytics-Panel waren leere Rinnen, der Wert unsichtbar. Ebenso `analytics-empty` und `admin-loading-container`. * `subpage-drawer-section`, `subpage-drawer-title-group` und `input-with-icon` im PageBuilder waren wirkungslos und teils mit Inline-Styles notdürftig kompensiert. * `grid-card-preview` fehlte, wodurch alle Layout-Vorschauen auf Höhe null kollabierten. Nur "Showcase" war sichtbar — und das aus Versehen, weil sein Tile `hero-tile` hieß und damit die `aspect-ratio` einer fremden PageBuilder-Klasse erbte. Umbenannt. Dazu die Theme-Vorschauen, die praktisch identisch aussahen: alle sieben zeigten dieselben drei quadratischen Kacheln, einziger Unterschied war die Hintergrundfarbe. Sie spiegeln jetzt die echten Preset-Daten aus lib/config/theme.ts — Schriftcharakter, Eckradius, Rasterdichte, Passepartout bzw. Schatten. Die Kopfzeile richtet sich an einer gemeinsamen Steuerhöhe aus. Der "Site"-Link war höher als die Buttons daneben: `.admin-btn` hatte keine explizite line-height, und <button> bekommt box-sizing: border-box vom Browser, <a> nicht. Die Statusanzeige setzte weder Schriftfamilie noch -größe und fiel auf den Browser-Default zurück — sie war nie Teil des Designsystems. Jetzt gleiche Höhe und Typografie, Pillenform als Zustandsanzeige, Trenner zur Aktionsgruppe. Das dauerhafte Pulsieren des grünen Punkts entfällt; Animation bleibt den Zuständen vorbehalten, die Aufmerksamkeit brauchen. Restliche Emojis durch SVG-Icons ersetzt. * feat(admin): add scroll-to-top toggle and SVG arrow The back-to-top button was always on and drew its arrow with the ↑ text character. Add a `scrollToTop` setting (General section in the admin panel, defaults to on so existing sites are unaffected) and replace the glyph with a stroked SVG that inherits currentColor across all presets. Scroll handling is now rAF-throttled, and prefers-reduced-motion turns off both the hover lift and the smooth scroll. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * security(journal): escape author HTML instead of filtering it CodeQL flags 26 high-severity alerts on the release PR; the bulk of them point at sanitizeHtml(), a denylist of three regexes whose output goes into dangerouslySetInnerHTML. I reproduced the bypasses before changing anything — all four pass the old filter: <img src=x onerror=alert(1)> unquoted handler, regex wants quotes <img src=x onerror='alert(1)'> single quotes, same reason <svg onload=alert(1)> not a <script> tag javasjavascript:cript:alert(1) one-pass replace, the rest recombines Plus an attribute breakout in the link renderer, which interpolated the URL into href="${url}" unescaped: [x](" onmouseover=alert(1) x=") -> <a href="" onmouseover=alert(1" ...> Replaced with escaping. Every `&<>"'` in author text becomes an entity before any markdown rule runs, so the only tags in the output are the ones renderInlineMarkdown builds itself and a URL cannot leave its attribute. Link schemes are now an allowlist (http, https, mailto, tel, relative, anchor); anything else renders as plain text. The serializer needed decodeHtmlEntities to match: without it a save would write `&lt;` into the Markdown file and the next parse would escape the `&` again, corrupting the text further on every round trip. A test covers parse -> serialize -> parse stability. Two existing tests asserted the old behaviour and were rewritten rather than deleted: one expected the script tag to be *removed* from the output, the other expected the substring "onerror" to be absent. Both now assert the property that matters — that no tag can form — because `onerror` surviving as inert text is fine. Exploitation required admin access either way: journal and essay text comes from the studio or from content/*.md. This removes the weakness, it does not close an open door. * fix(journal): contain file paths, fix frontmatter escaping, defuse two regexes Follow-up to the CodeQL findings on release PR #432. I went through all 23 alerts individually; this addresses the ones that are worth addressing and documents the ones that are not. Path containment (12 alerts, all false positives). Every path built from a slug goes through isValidSlug(), a strict `/^[a-zA-Z0-9_-]+$/` allowlist — verified against `../../etc/passwd`, `foo/../../bar`, `a/b`, `..` and friends, all rejected. CodeQL cannot see it because the check lives in another module. Added a containedPath() helper that resolves the path and refuses anything landing outside the content directory: a second lock on a door that was already locked, and a barrier the analysis can follow. Also removed the dead `slug.endsWith('.md')` branches — isValidSlug rejects dots, so they could never be taken. Frontmatter escaping (1 alert, a real bug). The serializer escaped `"` but not `\`, and the parser never unescaped anything. A title containing either character gained a backslash on every save/load cycle: Path C:\Users "quoted" -> Path C:\\Users \"quoted\" -> ... Escaping now covers the backslash first and the parser undoes both. A round trip test covers quotes, backslashes, colons and apostrophes. Two of three ReDoS regexes (2 alerts). The heading pattern had `\s+` next to `(.+)`, which overlap, so the engine tried every split of the whitespace run before failing; it is `[ \t]+` and `(\S.*)` now. The quote author pattern wrapped a lazy group around an optional group — the quadratic case — and is an index split on the first separator now. The third regex, the bold/italic pass, is deliberately left alone. Rewriting it with a negated class removes the backtracking but breaks nesting: `**bold *and italic* here**` renders as `*<em>bold </em>and italic<em> here</em>*`. The input is Markdown from an authenticated admin, never a visitor, so the worst case is an author slowing down their own page. The comment in the code says so. Not addressed: 5 js/insufficient-password-hash alerts. They ask for a slow KDF where the code uses SHA-256/HMAC — correct in general, but the admin password comes from an environment variable and is never stored, so a stronger KDF protects nothing that is not already in plaintext in the environment. 399 unit tests pass (18 new), build and tsc clean. * fix(journal): split the quote author by scanning, not by pattern Cleaning up after myself. #439 replaced the quote author regex `/^(.*?)(?:\s+--\s+(.+))?$/` — a lazy group around an optional one, the quadratic case — with `/\s+--\s+/`, and CodeQL promptly flagged the replacement for the same reason. One reported pattern traded for another. splitQuoteAuthor() scans for the first `--` that has whitespace on both sides. Linear, and it needs no reasoning about the regex engine at all. Behaviour is identical to the original regex, checked case by case against it: separator, no separator, several separators, tabs, wide gaps, `a--b` without spaces, leading and trailing separators, empty string. All nine are covered by tests, plus one asserting it stays fast on a 50k whitespace run. * security(admin): derive the session signing key with scrypt getSigningKey() ran the admin password through a single SHA-256 digest. It is key derivation rather than password storage, so it was never a stored-hash problem — but if the derived key ever leaked, one fast hash makes recovering the password by brute force cheap. CodeQL flags it as js/insufficient-password-hash and, for this particular alert, has a point. scrypt now. Two details that matter: The salt has to be stable. A random salt would produce a different key on every call and invalidate every session; it is derived from AUTH_SECRET, which is deployment-specific. Verified across separate processes: same inputs produce a verifying token, so a restart or redeploy does not log everyone out. The result is cached for the process lifetime. scrypt is deliberately slow and getSigningKey() runs on every admin request — deriving per call would add ~24ms to each one. The cache key is a digest of secret plus password, so a rotation misses the cache and derives again, and no extra plaintext copy of the password is kept around. Measured: first derivation 24ms, subsequent calls 0.12ms. Password change and secret change both invalidate an existing token, checked in separate processes. Note the one-time effect: existing admin sessions are invalidated by the change in derivation, so everyone logs in once more. * security(admin): key the signing-key cache on its inputs, not a digest #441 removed the SHA-256 digest of the admin password from the key derivation and introduced a new one three lines above it, as the cache key. Same rule, same file: CodeQL reported it immediately. The comment justifying it was wrong too. It claimed no second plaintext copy of the password was retained, while building the digest input allocates exactly that in order to hash it. The cache now holds the two input strings and compares them directly. They are the same objects the env and install caches already hold, so nothing extra is retained, and no fast hash of the password exists in memory for the life of the process. Re-verified after the change, in separate processes: a token from one process verifies in another with the same inputs, a changed password or secret rejects it, first derivation 24ms, cached calls 0.001ms. That leaves scrypt as the only place the password is hashed here. The two HMACs further down operate on the derived key and on token data, not on the password; the constant-time comparison in verifyAdminPassword is the previously dismissed one. --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
2026-08-14 16:55:07 +02:00
transition:
background 0.15s ease,
opacity 0.15s ease;
}
/* The selected layout tints its diagram with the accent colour. */
.preset-card.active .demo-tile {
background: var(--admin-accent);
opacity: 0.55;
security: add Trivy container scan to Docker publish workflow (#399) * feat(admin): add backup manager UI with 1-click restore * feat(admin): collapse older backup entries by default * fix(theme): isolate admin layout, instant DOM theme updates, and add Light/Dark mode toggle * feat(admin): replace text controls for Photo Frame and Hero Style with visual preview cards * fix(admin): define missing CSS rules for button system (.btn, .preset-btn) * feat(admin): redesign theme settings with segmented mode toggle, accent color swatches, and custom iOS-style toggle cards * feat(admin): upgrade all settings tabs with visual grid previews, Google SEO snippet preview, and toggle cards * feat(admin): overhaul Pages Builder UX with slide-over drawer, card hover badges, real-time search, and floating save bar * fix(admin): remove leftover dangling syntax snippet in PageBuilder.tsx * fix(admin): add position: relative to subpage-tile so hover overlay is contained inside the tile * style(admin): replace all emojis with clean Leica-style vector SVG icons * fix(types): extend IconProps with SVGProps to allow style prop on Leica SVG icons * feat(admin): add subpage live-preview, privacy analytics, and asset protection settings * fix(typecheck): fix AlbumEntry property access in subpage drawer preview mode * fix(types): fix ImmichAlbumInfo property names thumbnailAssetId and albumName in PageBuilder.tsx * fix(types): add protection and watermark optional properties to AppConfig interface * feat(settings): add toggle for disabling analytics tracking (defaults to enabled) * feat(ux): show status banner when analytics tracking is disabled + add live sync indicator * feat(watermark): render customizable watermark overlay on Lightbox images + rename section to Portfolio Features & Modules * fix(types): import type LightboxWatermark in PhotoGrid.tsx * fix(types): destructure watermark prop in PhotoGrid function signature * feat(seo): add configurable subpage title template and metadata descriptions * feat(seo): add generateMetadata to about page for title template support * feat(proofing): add client proofing, favorites selection, compact URL bitmasking, and export modal * feat(essay): add Photo Essay storytelling mode with RSC markdown parser and fullbleed/pair layouts * feat(subpages): add page enabled toggle to deactivate subpages without deleting them * feat(admin): add visual essay block builder for photo essay storytelling pages * security: add Trivy container scan to Docker publish workflow Scans the built image for CRITICAL/HIGH CVEs on every release and uploads results to the GitHub Security tab. Non-blocking for now (exit-code 0) so releases aren't gated on findings. Also documents the scan and existing Dependabot coverage in the README. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-08-07 11:08:04 +02:00
}
chore(release): v0.10.0 (#400) Photo Essay mode, client proofing, studio-modern preset, admin panel overhaul, watermark, cookieless analytics, subpage toggle, SEO title templates. Analytics API now admin-only, Trivy scan on publish. Album order mirrors the Immich timeline; map theme, admin status panel, lightbox counter and Docker health check fixed. See CHANGELOG.md for the full list and the health-check upgrade note.
2026-08-10 09:56:20 +02:00
.demo-tile.h-high {
flex: 2;
}
.demo-tile.h-low {
flex: 1;
}
.demo-tile.h-med {
flex: 1.5;
}
security: add Trivy container scan to Docker publish workflow (#399) * feat(admin): add backup manager UI with 1-click restore * feat(admin): collapse older backup entries by default * fix(theme): isolate admin layout, instant DOM theme updates, and add Light/Dark mode toggle * feat(admin): replace text controls for Photo Frame and Hero Style with visual preview cards * fix(admin): define missing CSS rules for button system (.btn, .preset-btn) * feat(admin): redesign theme settings with segmented mode toggle, accent color swatches, and custom iOS-style toggle cards * feat(admin): upgrade all settings tabs with visual grid previews, Google SEO snippet preview, and toggle cards * feat(admin): overhaul Pages Builder UX with slide-over drawer, card hover badges, real-time search, and floating save bar * fix(admin): remove leftover dangling syntax snippet in PageBuilder.tsx * fix(admin): add position: relative to subpage-tile so hover overlay is contained inside the tile * style(admin): replace all emojis with clean Leica-style vector SVG icons * fix(types): extend IconProps with SVGProps to allow style prop on Leica SVG icons * feat(admin): add subpage live-preview, privacy analytics, and asset protection settings * fix(typecheck): fix AlbumEntry property access in subpage drawer preview mode * fix(types): fix ImmichAlbumInfo property names thumbnailAssetId and albumName in PageBuilder.tsx * fix(types): add protection and watermark optional properties to AppConfig interface * feat(settings): add toggle for disabling analytics tracking (defaults to enabled) * feat(ux): show status banner when analytics tracking is disabled + add live sync indicator * feat(watermark): render customizable watermark overlay on Lightbox images + rename section to Portfolio Features & Modules * fix(types): import type LightboxWatermark in PhotoGrid.tsx * fix(types): destructure watermark prop in PhotoGrid function signature * feat(seo): add configurable subpage title template and metadata descriptions * feat(seo): add generateMetadata to about page for title template support * feat(proofing): add client proofing, favorites selection, compact URL bitmasking, and export modal * feat(essay): add Photo Essay storytelling mode with RSC markdown parser and fullbleed/pair layouts * feat(subpages): add page enabled toggle to deactivate subpages without deleting them * feat(admin): add visual essay block builder for photo essay storytelling pages * security: add Trivy container scan to Docker publish workflow Scans the built image for CRITICAL/HIGH CVEs on every release and uploads results to the GitHub Security tab. Non-blocking for now (exit-code 0) so releases aren't gated on findings. Also documents the scan and existing Dependabot coverage in the README. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-08-07 11:08:04 +02:00
.demo-uniform-grid {
display: grid;
grid-template-columns: repeat(3, 1fr);
gap: 0.25rem;
height: 100%;
}
.demo-showcase-grid {
display: flex;
gap: 0.25rem;
height: 100%;
}
release: v0.11.0 — journal fixes, admin URLs, design system cleanup (#432) * fix(screenshots): sharp-Typen fuer 0.34 und 0.35 gleichzeitig (#410) sharp 0.35 ist von `export =` auf ESM umgestellt: der Modul-Namespace ist nicht mehr aufrufbar, die Factory sitzt unter .default. Der Type-Check brach damit in scripts/screenshots.ts weg, sobald der Next-Bump (#402) sharp von 0.34.5 auf 0.35.3 mitzieht -- sharp ist hier keine deklarierte Dependency, sondern kommt ueber Next mit. Die Form wird jetzt aus dem installierten Paket abgeleitet statt festgeschrieben, zur Laufzeit wie im Typ. Geprueft mit beiden Versionen: tsc laeuft mit 0.34.5 und mit 0.35.3 fehlerfrei durch. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(deps): bump the nextjs group across 1 directory with 2 updates (#402) Bumps the nextjs group with 2 updates in the / directory: [next](https://github.com/vercel/next.js) and [eslint-config-next](https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next). Updates `next` from 16.2.12 to 16.3.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/compare/v16.2.12...v16.3.0) Updates `eslint-config-next` from 16.2.12 to 16.3.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/commits/v16.3.0/packages/eslint-config-next) --- updated-dependencies: - dependency-name: eslint-config-next dependency-version: 16.3.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: nextjs - dependency-name: next dependency-version: 16.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nextjs ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps-dev): bump prettier from 3.8.3 to 3.9.6 (#405) Bumps [prettier](https://github.com/prettier/prettier) from 3.8.3 to 3.9.6. - [Release notes](https://github.com/prettier/prettier/releases) - [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md) - [Commits](https://github.com/prettier/prettier/compare/3.8.3...3.9.6) --- updated-dependencies: - dependency-name: prettier dependency-version: 3.9.6 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * docs(changelog): Unreleased-Sektion fuer die Bumps nach v0.10.0 (#413) Die Dependency-PRs sind nach dem Release auf dev gelandet, teils auch auf main. Ohne Eintrag waeren sie beim naechsten Release unsichtbar -- inklusive Next 16.3.0, das CVE-2025-13465 mitbringt. Ausserdem im 0.10.0-Abschnitt nachgetragen, dass der Trivy-Scan bis #409 nie gelaufen ist. Der Fix steckt im Tag v0.10.0, fehlte aber in der Aufzaehlung -- und "Images werden bei jedem Publish gescannt" stand im Changelog, waehrend der Job im Action-Setup abbrach. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(gallery): per-album sort order, independent of Immich (#408) (#414) Album order was dictated entirely by Immich: getAlbum() sorted by the album's own asc/desc flag, so a Folio album always mirrored the archive. A curated series has a narrative order that has nothing to do with capture time, and changing the Immich album's sort to fit the website changes it for the archive too. Adds an optional per-album `sort` in gallery.yaml, editable in /admin, defaulting to today's behaviour so every existing config is unchanged: immich (default) | newest | oldest | filename | manual `manual` is a pinned *prefix*: `assetOrder` lists only the photos placed by hand, everything else follows in the album's Immich order. A full permutation of a 2,000-photo album would be ~80 KB of UUIDs in a file that is rewritten and copied to content/.backups/ on every admin save. It also makes drift fall out for free — photos removed in Immich never match, new ones land in the tail rather than being hidden. Sorting is applied after the cache read, not before the cache write, so the LRU keeps one canonical Immich-ordered copy per album. That avoids putting the mode in the cache key, lets a config change take effect without depending on invalidation, and keeps the stale-serving path correct. cache.get() returns the stored object by reference, so withSort() returns a shallow clone with a new array — sorting in place would reorder the shared entry, and under request coalescing every concurrent caller would be sorting the same array. Also fixes a prerequisite bug: /api/admin/albums/[albumId]/assets read album.assets from GET /albums/:id, which Immich 3.x no longer populates (lib/immich.ts:507). The hero picker's "This Album" tab returned nothing and threw outright when the key was absent. It now goes through the client's paginated metadata search, with ?types=all to opt videos in for the reorder editor. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): drop decorative emoji from the sort select labels (#415) An <option> cannot contain markup, so the SVG set in Icons is not reachable there — but a decorative emoji is not a substitute for it. Plain text instead; the album card badge already uses a real icon. The remaining emoji in the admin panel (asset picker tabs, section headings, layout picker options) predate this branch and are left for a separate cleanup. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): replace emoji icons with the shared SVG icon set (#416) The admin panel mixed two icon conventions: inline SVGs from `Icons.tsx` in most components, and decorative emoji in the asset picker and a few PageBuilder labels. Emoji render inconsistently across platforms, ignore the accent colour, and cannot inherit the `.svg-icon` sizing rules. - Icons.tsx: add `IconStar` (filled — it marks a state, not an action) and `IconImage`. - AssetPicker: the three tab labels and the favourite tile badge now use IconFolder / IconStar / IconImage. - PageBuilder: the "Standalone Albums" and "Subpages" headings use the icon set instead of an emoji. - PageBuilder: the layout picker drops its emoji for plain text. An <option> cannot contain markup, so an SVG is impossible there and a decorative glyph is not a substitute. - admin.css: align icon and label in the picker tabs, and swap the favourite badge's text-shadow for drop-shadow, which is what applies to an inline SVG. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): fold PageBuilder's local icons into the shared Icons module (#418) * refactor(admin): fold PageBuilder's local icons into the shared module PageBuilder.tsx carried its own `Icons` object duplicating most of the glyphs already exported by Icons.tsx, with hardcoded sizes and slightly divergent paths. Migrate all 32 call sites to the shared module and delete the local object. Five glyphs had no counterpart and are added to Icons.tsx as 1:1 ports of the local paths: IconX, IconPlus, IconHome, IconCopy, IconImage. The local ExternalLink and Check are dropped rather than ported — both had zero call sites. Two glyphs change shape slightly, which is the point of consolidating: the shared IconCamera includes the viewfinder bump the local copy omitted, and drag handles now use IconGripVertical. IconGripVertical uses the module's square 24x24 viewBox, so `.svg-drag` goes from 12x18 to 18x18 — the old non-square box would letterbox the glyph down to 12x12 and shrink the handle. * fix(admin): resolve icon-module integration after #416 Merging dev brought in #416, which added a second IconImage to Icons.tsx and two <Icons.Camera>/<Icons.Folder> section headers that reference the local Icons object this PR removes. Git merged both cleanly but the result did not type-check. - drop the duplicate IconImage (both copies were byte-identical) - point the two section headers at the imported IconCamera/IconFolder - refresh the SORT_LABELS comment: the icon set is imported now, not declared below --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> * fix(config): allow an empty gallery, guard against a double /api suffix (#421) An empty gallery is now a valid, rendered state instead of a throw: deriveGallery() no longer requires at least one album or subpage, so a deployment with no albums yet renders a bare homepage the owner can fill in via /admin. getConfig() also stops appending /api to an Immich URL that already ends in it, which previously produced .../api/api and broke every upstream request. Includes a restore of the per-album sort test cases, which the branch had lost by being cut before #408/#414. * feat(admin): favicon upload, served from the content volume (#422) Adds a bundled default favicon, an upload widget in admin Settings > General, and a route that serves the icon from the writable content/ volume with a fallback to the bundled default. Raster uploads (PNG/ICO/JPEG) are wrapped in an SVG container; the response carries its own CSP so an uploaded SVG cannot execute script on the origin. The GET route revalidates with an ETag instead of caching immutably, so a newly uploaded icon shows up immediately. Uploads are written via temp file + rename, and a Reset button restores the bundled default. * ci: flag unformatted files in a PR, without blocking it (#424) Prettier is configured as an error rule in eslint.config.mjs but has never run in CI, so part of the tree predates it. A final CI step now diffs against the PR base, runs prettier --list-different over the changed files, and emits a warning annotation per offender plus a job summary. Advisory by design: it never fails the job. Blocking would turn a PR red for merely touching a file that was already unformatted, and normalising the tree in one commit would wreck git blame and conflict with the PRs in flight. Requires fetch-depth: 0, since diffing against the base needs its history. * feat(install): first-run wizard gated by a one-time setup token (#419) Adds /install, a four-step first-run wizard: connect to Immich, optionally pick albums, name the site, finish. It verifies the credentials against the Immich server before writing anything, then writes gallery.yaml, settings.yaml and a content/install.json carrying the Immich credentials and a generated site secret. install.json exists because a running process cannot pick up new env vars — the wizard has to write configuration that takes effect without a restart. getInstallCredentials() merges it under the real environment, so env vars always win and rotation stays a matter of setting one. Both the page and the API routes are gated by a one-time setup token printed to the server log, so a deployment that is reachable before gallery.yaml exists cannot be configured by whoever finds it first. The token is stored in content/.setup-token (0600) rather than a module variable: Next.js bundles the page and each route handler separately, so a module-level token left the page and the API disagreeing inside one process and the wizard stuck on step 1. It is removed once the install completes. The admin password is stored as an scrypt hash using the scheme lib/auth.ts already applies to album passwords; a plaintext ADMIN_PASSWORD env var keeps working. * docs: document the setup wizard, fix the read-only content mount (#425) Quick Start now leads with the /install wizard, with the hand-written YAML route kept alongside it, and a First-Run Setup section covers the setup token, the files the wizard writes, and env-var precedence. Two corrections: both Docker examples mounted content/ as :ro, which silently breaks the wizard, the admin panel and the backup rotation alike — docs/admin-panel.md already said so and the README contradicted it. And nothing documented that content/install.json holds the Immich API key, so a backup of content/ is a backup of credentials. Also adds a Contributors section crediting the people whose work is in the project. * feat(admin): floating save bar pinned to the bottom of the viewport (#426) The save bar was the first, static element inside .admin-main. Since the document itself scrolls, it left the viewport as soon as you scrolled down — editing a subpage section or a settings block far below gave no visible dirty hint and no reachable save button. Replace it with a bottom-pinned floating bar shared by both editors. It only mounts while there is something to act on (unsaved changes, an in-flight save, or a result message), so it never covers content while idle. The success message clears after 5s, which hides the bar again. - new SaveBar component, replacing the duplicated markup in PageBuilder and SettingsEditor - adopt the previously unused .floating-save-bar CSS: slide-in keyframes (carrying translateX(-50%)), dirty border, wrap/gap, mobile variant and a prefers-reduced-motion opt-out; z-index 900 keeps it below modals - .admin-main gains bottom padding so the bar never covers page content - drop the now-unreachable idle hints: the ⌘S hint becomes a button title, the Live Sync note becomes a static line above the settings layout - header "Site" link now bypasses the cache (/?fresh=1), so the preview stays reachable when the bar is hidden Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(admin): themed listbox for the album sort control (#427) The per-album "Photo order" control was a native <select>. Because an <option> cannot contain markup, its choices could not use the admin panel's currentColor SVG set — the reason #415 had to fall back to plain text after dropping the emoji labels. Adds a Listbox component implementing the ARIA combobox/listbox pattern, so options can render a glyph beside their label: - DOM focus stays on the trigger button; the active option is announced through aria-activedescendant, keeping focus management to one element - Keyboard: arrows (clamped at the ends, like a native select), Home/End, Enter/Space to commit, Escape to cancel, Tab commits and moves on, and prefix type-ahead with a repeat-key cycle - Outside dismissal on pointerdown, so a press starting outside closes the popup before the click retargets The sort options now carry an icon each: calendar, arrow-down, arrow-up, an A→Z marker, and the drag glyph for manual — matching the badge the album card already shows. SORT_LABELS stays plain text because the badge feeds it to a title attribute. Closes #417 Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(git): ignore generated design handoff folders * fix(admin): stop the album sort dropdown clipping, and simplify the panel (#428) * fix(admin): render listbox popup in a portal so it escapes modal clipping The sort control's popup was position:absolute inside three clipping ancestors (.album-drawer overflow:hidden > .album-drawer-body overflow-y:auto > .modal-right-column overflow-y:auto), so it was cut off at the bottom of the Edit Album Details modal. z-index could not help: clipping happens before stacking. It also always hung below the trigger, with no flip. Portal the popup to document.body and position it from the trigger's viewport rect, flipping above when there is more room there and capping max-height to the space available so it scrolls internally rather than overflowing. It is dismissed on scroll and resize, since the anchor is only measured on open. The outside-pointerdown handler now also treats the popup as inside; without that the portalled list counts as outside, and a click on an option would close it before the selection commits. * refactor(admin): single-column album details panel The left column spent 1.2fr on a cover thumbnail and three stat rows, two of which (Status, Custom Hero) only restated the form fields opposite them, while the form itself was squeezed into 1.8fr behind a second nested scroller. Stack the drawer in one column instead: cover as a banner, then the form at full width, with the UUID moved into the footer. The body is now the only scroll container, which also removes one of the ancestors that was clipping the sort popup. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> * fix(admin): give the portalled listbox its theme back, lock the page behind modals (#429) Two defects in the album editor. The sort listbox popup painted transparent. Every --admin-* variable is scoped to .admin-layout, and since the popup moved into document.body it sits outside that subtree, so background/border/text all resolved to nothing. It now carries its own copy of the palette in both colour schemes, plus the font it no longer inherits. Scrolling inside a modal also moved the page behind it. No admin modal ever locked body scroll: the overlay covers the page but does not absorb wheel events, so a scroll starting on the backdrop — or continuing past the end of the modal's own scroller — reaches the document. overscroll-behavior cannot cover that case on its own, because it only applies to scroll containers and the backdrop is not one. useScrollLock freezes body while a modal is open and compensates for the width the scrollbar gives up, so nothing shifts underneath. Each lock restores the inline value it found, which makes nesting work without a counter — a picker opened from the drawer restores the drawer's hidden state instead of clearing it. Applied to both drawers and all four picker modals, which share the defect. overscroll-behavior: contain on the scrollers stops the chaining they can handle themselves. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com> * fix(security): allow unsafe-eval in CSP script-src during dev mode * feat(journal): add Journal Studio with split-screen editor, live preview and dedicated routes * fix(build): separate client parser from server journal-service and fix build type errors * fix(journal): Fotos rendern, Layout und Lightbox-Steuerung korrigieren Fünf unabhängige Fehler in der öffentlichen Journal- und Essay-Ansicht: * Foto-Blöcke wurden nie angezeigt. EssayView löst ein Foto über PhotoItem.id auf, und das sind verschlüsselte Tokens — die Blöcke aus dem Markdown tragen aber rohe Asset-UUIDs. Jede Zuordnung lief ins Leere, und nicht auflösbare Blöcke werden still verworfen. Die IDs werden jetzt serverseitig übersetzt; damit verschwinden nebenbei die rohen UUIDs aus dem Client-Payload, die dort laut Projektregel nie auftauchen dürfen. Nicht auflösbare Referenzen werden geloggt. * Überschriften standen weiter links als der Fließtext. Jeder Block hatte einzeln `max-width: 68ch`, und `ch` ist relativ zur Schrift des Elements — die Serif-Überschrift ergab eine breitere Spalte. Ersetzt durch eine gemeinsame, font-unabhängige `--essay-measure`. * Fullbleed-Fotos bluteten nur nach links aus: `.essay-figure` ist `width: 100%`, wodurch die Box überbestimmt ist und der negative rechte Margin verworfen wird. * Foto-Paare stellten beide Bilder gleich breit dar, wodurch ein Hochformat neben einem Querformat doppelt so hoch wurde. Jetzt eine Justified-Reihe: Breite proportional zum Seitenverhältnis, dadurch exakt gleiche Höhen ohne Beschnitt. * Die Lightbox hatte im Journal keine Tastatursteuerung und keine Scroll-Sperre — beides lag in PhotoGrid, also nur im Album-Raster. Verlagert in die Lightbox selbst, der doppelte Handler in PhotoGrid entfernt (sonst wäre pro Pfeildruck zwei Bilder weitergesprungen). Zusätzlich sind Proofing-Herzen und das EXIF-Panel im redaktionellen Modus abschaltbar und im Journal aus: Client-Proofing ist ein Übergabe-Workflow für Alben, keine Funktion einer Reportage. Auf der Übersicht wurde der Untertitel doppelt gerendert, weil extractExcerpt() auf ihn zurückfällt. * feat(admin): eigene URLs für alle Bereiche und überarbeiteter Journal Studio Das Panel war eine einzige Client-Komponente, die ihre Tabs über useState umschaltet: keine Route pro Bereich, kein Deep-Link, kein Zurück-Button, und nach jedem Reload landete man wieder auf "Pages". Auch der Journal-Editor hatte keine eigene URL. Jetzt sieben echte Routen (/admin, /admin/pages, /admin/journal, /admin/journal/<slug>, /admin/settings, /admin/settings/<section>, /admin/analytics). Die Shell mit Auth-Prüfung und Kopfzeile sitzt im Layout und umschließt children — so bleibt die Session-Prüfung über Routenwechsel montiert, statt bei jedem Tab-Wechsel neu zu laufen und den Spinner aufblitzen zu lassen. Unbekannte Settings-Sections fallen auf General zurück. Im selben Zug der Journal Studio, der die Routing-Änderung ohnehin berührt: * Alle Eingabefelder nutzten die Klasse `admin-input`, die in keinem CSS definiert war — sie fielen auf Browser-Defaults zurück. Jetzt gestylt, gescoped, damit der generische Name nicht ins übrige Panel leckt. * Der Split View ist per Divider verschiebbar (Maus, Tastatur, Doppelklick zum Zurücksetzen), Breite in localStorage. * Das Studio bricht aus der 1120px-Spalte aus, die Preview hat Platz. * Die Preview zeigte für jedes Foto fest 3:2 und log damit über das Layout der veröffentlichten Seite; die echten Verhältnisse werden jetzt an den Thumbnails gemessen. * Blöcke mit alten positionsbasierten Foto-Referenzen werden markiert — die lassen sich auf einer eigenständigen Journal-Seite nicht auflösen und verschwanden bisher stillschweigend. * Blocktyp-Chips als gemeinsame Komponente, monochrom und per Icon unterschieden statt in einer eigenen Blau/Lila/Orange-Palette, die sonst nirgends im Panel vorkommt. * Emojis raus, SVG-Icons rein. * fix(admin): Designsystem-Lücken im Panel schließen Eine systematische Suche nach Klassen, die im TSX benutzt, aber in keinem CSS definiert sind, hat vier Stellen mit demselben Muster gefunden: * `admin-btn-secondary` und `admin-btn-danger` existierten nicht. Sämtliche Löschen-Buttons sahen aus wie normale Buttons — keine Warnwirkung. Als `.admin-btn.admin-btn-danger` geschrieben, weil die Varianten mit den Größenklassen kombiniert werden, die weiter unten ihren eigenen Hintergrund setzen. * `page-progress-fill` fehlte: die Balken im Analytics-Panel waren leere Rinnen, der Wert unsichtbar. Ebenso `analytics-empty` und `admin-loading-container`. * `subpage-drawer-section`, `subpage-drawer-title-group` und `input-with-icon` im PageBuilder waren wirkungslos und teils mit Inline-Styles notdürftig kompensiert. * `grid-card-preview` fehlte, wodurch alle Layout-Vorschauen auf Höhe null kollabierten. Nur "Showcase" war sichtbar — und das aus Versehen, weil sein Tile `hero-tile` hieß und damit die `aspect-ratio` einer fremden PageBuilder-Klasse erbte. Umbenannt. Dazu die Theme-Vorschauen, die praktisch identisch aussahen: alle sieben zeigten dieselben drei quadratischen Kacheln, einziger Unterschied war die Hintergrundfarbe. Sie spiegeln jetzt die echten Preset-Daten aus lib/config/theme.ts — Schriftcharakter, Eckradius, Rasterdichte, Passepartout bzw. Schatten. Die Kopfzeile richtet sich an einer gemeinsamen Steuerhöhe aus. Der "Site"-Link war höher als die Buttons daneben: `.admin-btn` hatte keine explizite line-height, und <button> bekommt box-sizing: border-box vom Browser, <a> nicht. Die Statusanzeige setzte weder Schriftfamilie noch -größe und fiel auf den Browser-Default zurück — sie war nie Teil des Designsystems. Jetzt gleiche Höhe und Typografie, Pillenform als Zustandsanzeige, Trenner zur Aktionsgruppe. Das dauerhafte Pulsieren des grünen Punkts entfällt; Animation bleibt den Zuständen vorbehalten, die Aufmerksamkeit brauchen. Restliche Emojis durch SVG-Icons ersetzt. * feat(admin): add scroll-to-top toggle and SVG arrow The back-to-top button was always on and drew its arrow with the ↑ text character. Add a `scrollToTop` setting (General section in the admin panel, defaults to on so existing sites are unaffected) and replace the glyph with a stroked SVG that inherits currentColor across all presets. Scroll handling is now rAF-throttled, and prefers-reduced-motion turns off both the hover lift and the smooth scroll. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * security(journal): escape author HTML instead of filtering it CodeQL flags 26 high-severity alerts on the release PR; the bulk of them point at sanitizeHtml(), a denylist of three regexes whose output goes into dangerouslySetInnerHTML. I reproduced the bypasses before changing anything — all four pass the old filter: <img src=x onerror=alert(1)> unquoted handler, regex wants quotes <img src=x onerror='alert(1)'> single quotes, same reason <svg onload=alert(1)> not a <script> tag javasjavascript:cript:alert(1) one-pass replace, the rest recombines Plus an attribute breakout in the link renderer, which interpolated the URL into href="${url}" unescaped: [x](" onmouseover=alert(1) x=") -> <a href="" onmouseover=alert(1" ...> Replaced with escaping. Every `&<>"'` in author text becomes an entity before any markdown rule runs, so the only tags in the output are the ones renderInlineMarkdown builds itself and a URL cannot leave its attribute. Link schemes are now an allowlist (http, https, mailto, tel, relative, anchor); anything else renders as plain text. The serializer needed decodeHtmlEntities to match: without it a save would write `&lt;` into the Markdown file and the next parse would escape the `&` again, corrupting the text further on every round trip. A test covers parse -> serialize -> parse stability. Two existing tests asserted the old behaviour and were rewritten rather than deleted: one expected the script tag to be *removed* from the output, the other expected the substring "onerror" to be absent. Both now assert the property that matters — that no tag can form — because `onerror` surviving as inert text is fine. Exploitation required admin access either way: journal and essay text comes from the studio or from content/*.md. This removes the weakness, it does not close an open door. * fix(journal): contain file paths, fix frontmatter escaping, defuse two regexes Follow-up to the CodeQL findings on release PR #432. I went through all 23 alerts individually; this addresses the ones that are worth addressing and documents the ones that are not. Path containment (12 alerts, all false positives). Every path built from a slug goes through isValidSlug(), a strict `/^[a-zA-Z0-9_-]+$/` allowlist — verified against `../../etc/passwd`, `foo/../../bar`, `a/b`, `..` and friends, all rejected. CodeQL cannot see it because the check lives in another module. Added a containedPath() helper that resolves the path and refuses anything landing outside the content directory: a second lock on a door that was already locked, and a barrier the analysis can follow. Also removed the dead `slug.endsWith('.md')` branches — isValidSlug rejects dots, so they could never be taken. Frontmatter escaping (1 alert, a real bug). The serializer escaped `"` but not `\`, and the parser never unescaped anything. A title containing either character gained a backslash on every save/load cycle: Path C:\Users "quoted" -> Path C:\\Users \"quoted\" -> ... Escaping now covers the backslash first and the parser undoes both. A round trip test covers quotes, backslashes, colons and apostrophes. Two of three ReDoS regexes (2 alerts). The heading pattern had `\s+` next to `(.+)`, which overlap, so the engine tried every split of the whitespace run before failing; it is `[ \t]+` and `(\S.*)` now. The quote author pattern wrapped a lazy group around an optional group — the quadratic case — and is an index split on the first separator now. The third regex, the bold/italic pass, is deliberately left alone. Rewriting it with a negated class removes the backtracking but breaks nesting: `**bold *and italic* here**` renders as `*<em>bold </em>and italic<em> here</em>*`. The input is Markdown from an authenticated admin, never a visitor, so the worst case is an author slowing down their own page. The comment in the code says so. Not addressed: 5 js/insufficient-password-hash alerts. They ask for a slow KDF where the code uses SHA-256/HMAC — correct in general, but the admin password comes from an environment variable and is never stored, so a stronger KDF protects nothing that is not already in plaintext in the environment. 399 unit tests pass (18 new), build and tsc clean. * fix(journal): split the quote author by scanning, not by pattern Cleaning up after myself. #439 replaced the quote author regex `/^(.*?)(?:\s+--\s+(.+))?$/` — a lazy group around an optional one, the quadratic case — with `/\s+--\s+/`, and CodeQL promptly flagged the replacement for the same reason. One reported pattern traded for another. splitQuoteAuthor() scans for the first `--` that has whitespace on both sides. Linear, and it needs no reasoning about the regex engine at all. Behaviour is identical to the original regex, checked case by case against it: separator, no separator, several separators, tabs, wide gaps, `a--b` without spaces, leading and trailing separators, empty string. All nine are covered by tests, plus one asserting it stays fast on a 50k whitespace run. * security(admin): derive the session signing key with scrypt getSigningKey() ran the admin password through a single SHA-256 digest. It is key derivation rather than password storage, so it was never a stored-hash problem — but if the derived key ever leaked, one fast hash makes recovering the password by brute force cheap. CodeQL flags it as js/insufficient-password-hash and, for this particular alert, has a point. scrypt now. Two details that matter: The salt has to be stable. A random salt would produce a different key on every call and invalidate every session; it is derived from AUTH_SECRET, which is deployment-specific. Verified across separate processes: same inputs produce a verifying token, so a restart or redeploy does not log everyone out. The result is cached for the process lifetime. scrypt is deliberately slow and getSigningKey() runs on every admin request — deriving per call would add ~24ms to each one. The cache key is a digest of secret plus password, so a rotation misses the cache and derives again, and no extra plaintext copy of the password is kept around. Measured: first derivation 24ms, subsequent calls 0.12ms. Password change and secret change both invalidate an existing token, checked in separate processes. Note the one-time effect: existing admin sessions are invalidated by the change in derivation, so everyone logs in once more. * security(admin): key the signing-key cache on its inputs, not a digest #441 removed the SHA-256 digest of the admin password from the key derivation and introduced a new one three lines above it, as the cache key. Same rule, same file: CodeQL reported it immediately. The comment justifying it was wrong too. It claimed no second plaintext copy of the password was retained, while building the digest input allocates exactly that in order to hash it. The cache now holds the two input strings and compares them directly. They are the same objects the env and install caches already hold, so nothing extra is retained, and no fast hash of the password exists in memory for the life of the process. Re-verified after the change, in separate processes: a token from one process verifies in another with the same inputs, a changed password or secret rejects it, first derivation 24ms, cached calls 0.001ms. That leaves scrypt as the only place the password is hashed here. The two HMACs further down operate on the derived key and on token data, not on the password; the constant-time comparison in verifyAdminPassword is the previously dismissed one. --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
2026-08-14 16:55:07 +02:00
/* Deliberately NOT named .hero-tile — that class belongs to the page builder
* and its `aspect-ratio` would leak into this demo. */
.demo-tile.demo-hero {
chore(release): v0.10.0 (#400) Photo Essay mode, client proofing, studio-modern preset, admin panel overhaul, watermark, cookieless analytics, subpage toggle, SEO title templates. Analytics API now admin-only, Trivy scan on publish. Album order mirrors the Immich timeline; map theme, admin status panel, lightbox counter and Docker health check fixed. See CHANGELOG.md for the full list and the health-check upgrade note.
2026-08-10 09:56:20 +02:00
flex: 2;
}
security: add Trivy container scan to Docker publish workflow (#399) * feat(admin): add backup manager UI with 1-click restore * feat(admin): collapse older backup entries by default * fix(theme): isolate admin layout, instant DOM theme updates, and add Light/Dark mode toggle * feat(admin): replace text controls for Photo Frame and Hero Style with visual preview cards * fix(admin): define missing CSS rules for button system (.btn, .preset-btn) * feat(admin): redesign theme settings with segmented mode toggle, accent color swatches, and custom iOS-style toggle cards * feat(admin): upgrade all settings tabs with visual grid previews, Google SEO snippet preview, and toggle cards * feat(admin): overhaul Pages Builder UX with slide-over drawer, card hover badges, real-time search, and floating save bar * fix(admin): remove leftover dangling syntax snippet in PageBuilder.tsx * fix(admin): add position: relative to subpage-tile so hover overlay is contained inside the tile * style(admin): replace all emojis with clean Leica-style vector SVG icons * fix(types): extend IconProps with SVGProps to allow style prop on Leica SVG icons * feat(admin): add subpage live-preview, privacy analytics, and asset protection settings * fix(typecheck): fix AlbumEntry property access in subpage drawer preview mode * fix(types): fix ImmichAlbumInfo property names thumbnailAssetId and albumName in PageBuilder.tsx * fix(types): add protection and watermark optional properties to AppConfig interface * feat(settings): add toggle for disabling analytics tracking (defaults to enabled) * feat(ux): show status banner when analytics tracking is disabled + add live sync indicator * feat(watermark): render customizable watermark overlay on Lightbox images + rename section to Portfolio Features & Modules * fix(types): import type LightboxWatermark in PhotoGrid.tsx * fix(types): destructure watermark prop in PhotoGrid function signature * feat(seo): add configurable subpage title template and metadata descriptions * feat(seo): add generateMetadata to about page for title template support * feat(proofing): add client proofing, favorites selection, compact URL bitmasking, and export modal * feat(essay): add Photo Essay storytelling mode with RSC markdown parser and fullbleed/pair layouts * feat(subpages): add page enabled toggle to deactivate subpages without deleting them * feat(admin): add visual essay block builder for photo essay storytelling pages * security: add Trivy container scan to Docker publish workflow Scans the built image for CRITICAL/HIGH CVEs on every release and uploads results to the GitHub Security tab. Non-blocking for now (exit-code 0) so releases aren't gated on findings. Also documents the scan and existing Dependabot coverage in the README. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-08-07 11:08:04 +02:00
.demo-filmstrip-row {
display: flex;
gap: 0.25rem;
height: 100%;
align-items: center;
}
release: v0.11.0 — journal fixes, admin URLs, design system cleanup (#432) * fix(screenshots): sharp-Typen fuer 0.34 und 0.35 gleichzeitig (#410) sharp 0.35 ist von `export =` auf ESM umgestellt: der Modul-Namespace ist nicht mehr aufrufbar, die Factory sitzt unter .default. Der Type-Check brach damit in scripts/screenshots.ts weg, sobald der Next-Bump (#402) sharp von 0.34.5 auf 0.35.3 mitzieht -- sharp ist hier keine deklarierte Dependency, sondern kommt ueber Next mit. Die Form wird jetzt aus dem installierten Paket abgeleitet statt festgeschrieben, zur Laufzeit wie im Typ. Geprueft mit beiden Versionen: tsc laeuft mit 0.34.5 und mit 0.35.3 fehlerfrei durch. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(deps): bump the nextjs group across 1 directory with 2 updates (#402) Bumps the nextjs group with 2 updates in the / directory: [next](https://github.com/vercel/next.js) and [eslint-config-next](https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next). Updates `next` from 16.2.12 to 16.3.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/compare/v16.2.12...v16.3.0) Updates `eslint-config-next` from 16.2.12 to 16.3.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/commits/v16.3.0/packages/eslint-config-next) --- updated-dependencies: - dependency-name: eslint-config-next dependency-version: 16.3.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: nextjs - dependency-name: next dependency-version: 16.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nextjs ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps-dev): bump prettier from 3.8.3 to 3.9.6 (#405) Bumps [prettier](https://github.com/prettier/prettier) from 3.8.3 to 3.9.6. - [Release notes](https://github.com/prettier/prettier/releases) - [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md) - [Commits](https://github.com/prettier/prettier/compare/3.8.3...3.9.6) --- updated-dependencies: - dependency-name: prettier dependency-version: 3.9.6 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * docs(changelog): Unreleased-Sektion fuer die Bumps nach v0.10.0 (#413) Die Dependency-PRs sind nach dem Release auf dev gelandet, teils auch auf main. Ohne Eintrag waeren sie beim naechsten Release unsichtbar -- inklusive Next 16.3.0, das CVE-2025-13465 mitbringt. Ausserdem im 0.10.0-Abschnitt nachgetragen, dass der Trivy-Scan bis #409 nie gelaufen ist. Der Fix steckt im Tag v0.10.0, fehlte aber in der Aufzaehlung -- und "Images werden bei jedem Publish gescannt" stand im Changelog, waehrend der Job im Action-Setup abbrach. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(gallery): per-album sort order, independent of Immich (#408) (#414) Album order was dictated entirely by Immich: getAlbum() sorted by the album's own asc/desc flag, so a Folio album always mirrored the archive. A curated series has a narrative order that has nothing to do with capture time, and changing the Immich album's sort to fit the website changes it for the archive too. Adds an optional per-album `sort` in gallery.yaml, editable in /admin, defaulting to today's behaviour so every existing config is unchanged: immich (default) | newest | oldest | filename | manual `manual` is a pinned *prefix*: `assetOrder` lists only the photos placed by hand, everything else follows in the album's Immich order. A full permutation of a 2,000-photo album would be ~80 KB of UUIDs in a file that is rewritten and copied to content/.backups/ on every admin save. It also makes drift fall out for free — photos removed in Immich never match, new ones land in the tail rather than being hidden. Sorting is applied after the cache read, not before the cache write, so the LRU keeps one canonical Immich-ordered copy per album. That avoids putting the mode in the cache key, lets a config change take effect without depending on invalidation, and keeps the stale-serving path correct. cache.get() returns the stored object by reference, so withSort() returns a shallow clone with a new array — sorting in place would reorder the shared entry, and under request coalescing every concurrent caller would be sorting the same array. Also fixes a prerequisite bug: /api/admin/albums/[albumId]/assets read album.assets from GET /albums/:id, which Immich 3.x no longer populates (lib/immich.ts:507). The hero picker's "This Album" tab returned nothing and threw outright when the key was absent. It now goes through the client's paginated metadata search, with ?types=all to opt videos in for the reorder editor. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): drop decorative emoji from the sort select labels (#415) An <option> cannot contain markup, so the SVG set in Icons is not reachable there — but a decorative emoji is not a substitute for it. Plain text instead; the album card badge already uses a real icon. The remaining emoji in the admin panel (asset picker tabs, section headings, layout picker options) predate this branch and are left for a separate cleanup. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): replace emoji icons with the shared SVG icon set (#416) The admin panel mixed two icon conventions: inline SVGs from `Icons.tsx` in most components, and decorative emoji in the asset picker and a few PageBuilder labels. Emoji render inconsistently across platforms, ignore the accent colour, and cannot inherit the `.svg-icon` sizing rules. - Icons.tsx: add `IconStar` (filled — it marks a state, not an action) and `IconImage`. - AssetPicker: the three tab labels and the favourite tile badge now use IconFolder / IconStar / IconImage. - PageBuilder: the "Standalone Albums" and "Subpages" headings use the icon set instead of an emoji. - PageBuilder: the layout picker drops its emoji for plain text. An <option> cannot contain markup, so an SVG is impossible there and a decorative glyph is not a substitute. - admin.css: align icon and label in the picker tabs, and swap the favourite badge's text-shadow for drop-shadow, which is what applies to an inline SVG. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): fold PageBuilder's local icons into the shared Icons module (#418) * refactor(admin): fold PageBuilder's local icons into the shared module PageBuilder.tsx carried its own `Icons` object duplicating most of the glyphs already exported by Icons.tsx, with hardcoded sizes and slightly divergent paths. Migrate all 32 call sites to the shared module and delete the local object. Five glyphs had no counterpart and are added to Icons.tsx as 1:1 ports of the local paths: IconX, IconPlus, IconHome, IconCopy, IconImage. The local ExternalLink and Check are dropped rather than ported — both had zero call sites. Two glyphs change shape slightly, which is the point of consolidating: the shared IconCamera includes the viewfinder bump the local copy omitted, and drag handles now use IconGripVertical. IconGripVertical uses the module's square 24x24 viewBox, so `.svg-drag` goes from 12x18 to 18x18 — the old non-square box would letterbox the glyph down to 12x12 and shrink the handle. * fix(admin): resolve icon-module integration after #416 Merging dev brought in #416, which added a second IconImage to Icons.tsx and two <Icons.Camera>/<Icons.Folder> section headers that reference the local Icons object this PR removes. Git merged both cleanly but the result did not type-check. - drop the duplicate IconImage (both copies were byte-identical) - point the two section headers at the imported IconCamera/IconFolder - refresh the SORT_LABELS comment: the icon set is imported now, not declared below --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> * fix(config): allow an empty gallery, guard against a double /api suffix (#421) An empty gallery is now a valid, rendered state instead of a throw: deriveGallery() no longer requires at least one album or subpage, so a deployment with no albums yet renders a bare homepage the owner can fill in via /admin. getConfig() also stops appending /api to an Immich URL that already ends in it, which previously produced .../api/api and broke every upstream request. Includes a restore of the per-album sort test cases, which the branch had lost by being cut before #408/#414. * feat(admin): favicon upload, served from the content volume (#422) Adds a bundled default favicon, an upload widget in admin Settings > General, and a route that serves the icon from the writable content/ volume with a fallback to the bundled default. Raster uploads (PNG/ICO/JPEG) are wrapped in an SVG container; the response carries its own CSP so an uploaded SVG cannot execute script on the origin. The GET route revalidates with an ETag instead of caching immutably, so a newly uploaded icon shows up immediately. Uploads are written via temp file + rename, and a Reset button restores the bundled default. * ci: flag unformatted files in a PR, without blocking it (#424) Prettier is configured as an error rule in eslint.config.mjs but has never run in CI, so part of the tree predates it. A final CI step now diffs against the PR base, runs prettier --list-different over the changed files, and emits a warning annotation per offender plus a job summary. Advisory by design: it never fails the job. Blocking would turn a PR red for merely touching a file that was already unformatted, and normalising the tree in one commit would wreck git blame and conflict with the PRs in flight. Requires fetch-depth: 0, since diffing against the base needs its history. * feat(install): first-run wizard gated by a one-time setup token (#419) Adds /install, a four-step first-run wizard: connect to Immich, optionally pick albums, name the site, finish. It verifies the credentials against the Immich server before writing anything, then writes gallery.yaml, settings.yaml and a content/install.json carrying the Immich credentials and a generated site secret. install.json exists because a running process cannot pick up new env vars — the wizard has to write configuration that takes effect without a restart. getInstallCredentials() merges it under the real environment, so env vars always win and rotation stays a matter of setting one. Both the page and the API routes are gated by a one-time setup token printed to the server log, so a deployment that is reachable before gallery.yaml exists cannot be configured by whoever finds it first. The token is stored in content/.setup-token (0600) rather than a module variable: Next.js bundles the page and each route handler separately, so a module-level token left the page and the API disagreeing inside one process and the wizard stuck on step 1. It is removed once the install completes. The admin password is stored as an scrypt hash using the scheme lib/auth.ts already applies to album passwords; a plaintext ADMIN_PASSWORD env var keeps working. * docs: document the setup wizard, fix the read-only content mount (#425) Quick Start now leads with the /install wizard, with the hand-written YAML route kept alongside it, and a First-Run Setup section covers the setup token, the files the wizard writes, and env-var precedence. Two corrections: both Docker examples mounted content/ as :ro, which silently breaks the wizard, the admin panel and the backup rotation alike — docs/admin-panel.md already said so and the README contradicted it. And nothing documented that content/install.json holds the Immich API key, so a backup of content/ is a backup of credentials. Also adds a Contributors section crediting the people whose work is in the project. * feat(admin): floating save bar pinned to the bottom of the viewport (#426) The save bar was the first, static element inside .admin-main. Since the document itself scrolls, it left the viewport as soon as you scrolled down — editing a subpage section or a settings block far below gave no visible dirty hint and no reachable save button. Replace it with a bottom-pinned floating bar shared by both editors. It only mounts while there is something to act on (unsaved changes, an in-flight save, or a result message), so it never covers content while idle. The success message clears after 5s, which hides the bar again. - new SaveBar component, replacing the duplicated markup in PageBuilder and SettingsEditor - adopt the previously unused .floating-save-bar CSS: slide-in keyframes (carrying translateX(-50%)), dirty border, wrap/gap, mobile variant and a prefers-reduced-motion opt-out; z-index 900 keeps it below modals - .admin-main gains bottom padding so the bar never covers page content - drop the now-unreachable idle hints: the ⌘S hint becomes a button title, the Live Sync note becomes a static line above the settings layout - header "Site" link now bypasses the cache (/?fresh=1), so the preview stays reachable when the bar is hidden Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(admin): themed listbox for the album sort control (#427) The per-album "Photo order" control was a native <select>. Because an <option> cannot contain markup, its choices could not use the admin panel's currentColor SVG set — the reason #415 had to fall back to plain text after dropping the emoji labels. Adds a Listbox component implementing the ARIA combobox/listbox pattern, so options can render a glyph beside their label: - DOM focus stays on the trigger button; the active option is announced through aria-activedescendant, keeping focus management to one element - Keyboard: arrows (clamped at the ends, like a native select), Home/End, Enter/Space to commit, Escape to cancel, Tab commits and moves on, and prefix type-ahead with a repeat-key cycle - Outside dismissal on pointerdown, so a press starting outside closes the popup before the click retargets The sort options now carry an icon each: calendar, arrow-down, arrow-up, an A→Z marker, and the drag glyph for manual — matching the badge the album card already shows. SORT_LABELS stays plain text because the badge feeds it to a title attribute. Closes #417 Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(git): ignore generated design handoff folders * fix(admin): stop the album sort dropdown clipping, and simplify the panel (#428) * fix(admin): render listbox popup in a portal so it escapes modal clipping The sort control's popup was position:absolute inside three clipping ancestors (.album-drawer overflow:hidden > .album-drawer-body overflow-y:auto > .modal-right-column overflow-y:auto), so it was cut off at the bottom of the Edit Album Details modal. z-index could not help: clipping happens before stacking. It also always hung below the trigger, with no flip. Portal the popup to document.body and position it from the trigger's viewport rect, flipping above when there is more room there and capping max-height to the space available so it scrolls internally rather than overflowing. It is dismissed on scroll and resize, since the anchor is only measured on open. The outside-pointerdown handler now also treats the popup as inside; without that the portalled list counts as outside, and a click on an option would close it before the selection commits. * refactor(admin): single-column album details panel The left column spent 1.2fr on a cover thumbnail and three stat rows, two of which (Status, Custom Hero) only restated the form fields opposite them, while the form itself was squeezed into 1.8fr behind a second nested scroller. Stack the drawer in one column instead: cover as a banner, then the form at full width, with the UUID moved into the footer. The body is now the only scroll container, which also removes one of the ancestors that was clipping the sort popup. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> * fix(admin): give the portalled listbox its theme back, lock the page behind modals (#429) Two defects in the album editor. The sort listbox popup painted transparent. Every --admin-* variable is scoped to .admin-layout, and since the popup moved into document.body it sits outside that subtree, so background/border/text all resolved to nothing. It now carries its own copy of the palette in both colour schemes, plus the font it no longer inherits. Scrolling inside a modal also moved the page behind it. No admin modal ever locked body scroll: the overlay covers the page but does not absorb wheel events, so a scroll starting on the backdrop — or continuing past the end of the modal's own scroller — reaches the document. overscroll-behavior cannot cover that case on its own, because it only applies to scroll containers and the backdrop is not one. useScrollLock freezes body while a modal is open and compensates for the width the scrollbar gives up, so nothing shifts underneath. Each lock restores the inline value it found, which makes nesting work without a counter — a picker opened from the drawer restores the drawer's hidden state instead of clearing it. Applied to both drawers and all four picker modals, which share the defect. overscroll-behavior: contain on the scrollers stops the chaining they can handle themselves. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com> * fix(security): allow unsafe-eval in CSP script-src during dev mode * feat(journal): add Journal Studio with split-screen editor, live preview and dedicated routes * fix(build): separate client parser from server journal-service and fix build type errors * fix(journal): Fotos rendern, Layout und Lightbox-Steuerung korrigieren Fünf unabhängige Fehler in der öffentlichen Journal- und Essay-Ansicht: * Foto-Blöcke wurden nie angezeigt. EssayView löst ein Foto über PhotoItem.id auf, und das sind verschlüsselte Tokens — die Blöcke aus dem Markdown tragen aber rohe Asset-UUIDs. Jede Zuordnung lief ins Leere, und nicht auflösbare Blöcke werden still verworfen. Die IDs werden jetzt serverseitig übersetzt; damit verschwinden nebenbei die rohen UUIDs aus dem Client-Payload, die dort laut Projektregel nie auftauchen dürfen. Nicht auflösbare Referenzen werden geloggt. * Überschriften standen weiter links als der Fließtext. Jeder Block hatte einzeln `max-width: 68ch`, und `ch` ist relativ zur Schrift des Elements — die Serif-Überschrift ergab eine breitere Spalte. Ersetzt durch eine gemeinsame, font-unabhängige `--essay-measure`. * Fullbleed-Fotos bluteten nur nach links aus: `.essay-figure` ist `width: 100%`, wodurch die Box überbestimmt ist und der negative rechte Margin verworfen wird. * Foto-Paare stellten beide Bilder gleich breit dar, wodurch ein Hochformat neben einem Querformat doppelt so hoch wurde. Jetzt eine Justified-Reihe: Breite proportional zum Seitenverhältnis, dadurch exakt gleiche Höhen ohne Beschnitt. * Die Lightbox hatte im Journal keine Tastatursteuerung und keine Scroll-Sperre — beides lag in PhotoGrid, also nur im Album-Raster. Verlagert in die Lightbox selbst, der doppelte Handler in PhotoGrid entfernt (sonst wäre pro Pfeildruck zwei Bilder weitergesprungen). Zusätzlich sind Proofing-Herzen und das EXIF-Panel im redaktionellen Modus abschaltbar und im Journal aus: Client-Proofing ist ein Übergabe-Workflow für Alben, keine Funktion einer Reportage. Auf der Übersicht wurde der Untertitel doppelt gerendert, weil extractExcerpt() auf ihn zurückfällt. * feat(admin): eigene URLs für alle Bereiche und überarbeiteter Journal Studio Das Panel war eine einzige Client-Komponente, die ihre Tabs über useState umschaltet: keine Route pro Bereich, kein Deep-Link, kein Zurück-Button, und nach jedem Reload landete man wieder auf "Pages". Auch der Journal-Editor hatte keine eigene URL. Jetzt sieben echte Routen (/admin, /admin/pages, /admin/journal, /admin/journal/<slug>, /admin/settings, /admin/settings/<section>, /admin/analytics). Die Shell mit Auth-Prüfung und Kopfzeile sitzt im Layout und umschließt children — so bleibt die Session-Prüfung über Routenwechsel montiert, statt bei jedem Tab-Wechsel neu zu laufen und den Spinner aufblitzen zu lassen. Unbekannte Settings-Sections fallen auf General zurück. Im selben Zug der Journal Studio, der die Routing-Änderung ohnehin berührt: * Alle Eingabefelder nutzten die Klasse `admin-input`, die in keinem CSS definiert war — sie fielen auf Browser-Defaults zurück. Jetzt gestylt, gescoped, damit der generische Name nicht ins übrige Panel leckt. * Der Split View ist per Divider verschiebbar (Maus, Tastatur, Doppelklick zum Zurücksetzen), Breite in localStorage. * Das Studio bricht aus der 1120px-Spalte aus, die Preview hat Platz. * Die Preview zeigte für jedes Foto fest 3:2 und log damit über das Layout der veröffentlichten Seite; die echten Verhältnisse werden jetzt an den Thumbnails gemessen. * Blöcke mit alten positionsbasierten Foto-Referenzen werden markiert — die lassen sich auf einer eigenständigen Journal-Seite nicht auflösen und verschwanden bisher stillschweigend. * Blocktyp-Chips als gemeinsame Komponente, monochrom und per Icon unterschieden statt in einer eigenen Blau/Lila/Orange-Palette, die sonst nirgends im Panel vorkommt. * Emojis raus, SVG-Icons rein. * fix(admin): Designsystem-Lücken im Panel schließen Eine systematische Suche nach Klassen, die im TSX benutzt, aber in keinem CSS definiert sind, hat vier Stellen mit demselben Muster gefunden: * `admin-btn-secondary` und `admin-btn-danger` existierten nicht. Sämtliche Löschen-Buttons sahen aus wie normale Buttons — keine Warnwirkung. Als `.admin-btn.admin-btn-danger` geschrieben, weil die Varianten mit den Größenklassen kombiniert werden, die weiter unten ihren eigenen Hintergrund setzen. * `page-progress-fill` fehlte: die Balken im Analytics-Panel waren leere Rinnen, der Wert unsichtbar. Ebenso `analytics-empty` und `admin-loading-container`. * `subpage-drawer-section`, `subpage-drawer-title-group` und `input-with-icon` im PageBuilder waren wirkungslos und teils mit Inline-Styles notdürftig kompensiert. * `grid-card-preview` fehlte, wodurch alle Layout-Vorschauen auf Höhe null kollabierten. Nur "Showcase" war sichtbar — und das aus Versehen, weil sein Tile `hero-tile` hieß und damit die `aspect-ratio` einer fremden PageBuilder-Klasse erbte. Umbenannt. Dazu die Theme-Vorschauen, die praktisch identisch aussahen: alle sieben zeigten dieselben drei quadratischen Kacheln, einziger Unterschied war die Hintergrundfarbe. Sie spiegeln jetzt die echten Preset-Daten aus lib/config/theme.ts — Schriftcharakter, Eckradius, Rasterdichte, Passepartout bzw. Schatten. Die Kopfzeile richtet sich an einer gemeinsamen Steuerhöhe aus. Der "Site"-Link war höher als die Buttons daneben: `.admin-btn` hatte keine explizite line-height, und <button> bekommt box-sizing: border-box vom Browser, <a> nicht. Die Statusanzeige setzte weder Schriftfamilie noch -größe und fiel auf den Browser-Default zurück — sie war nie Teil des Designsystems. Jetzt gleiche Höhe und Typografie, Pillenform als Zustandsanzeige, Trenner zur Aktionsgruppe. Das dauerhafte Pulsieren des grünen Punkts entfällt; Animation bleibt den Zuständen vorbehalten, die Aufmerksamkeit brauchen. Restliche Emojis durch SVG-Icons ersetzt. * feat(admin): add scroll-to-top toggle and SVG arrow The back-to-top button was always on and drew its arrow with the ↑ text character. Add a `scrollToTop` setting (General section in the admin panel, defaults to on so existing sites are unaffected) and replace the glyph with a stroked SVG that inherits currentColor across all presets. Scroll handling is now rAF-throttled, and prefers-reduced-motion turns off both the hover lift and the smooth scroll. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * security(journal): escape author HTML instead of filtering it CodeQL flags 26 high-severity alerts on the release PR; the bulk of them point at sanitizeHtml(), a denylist of three regexes whose output goes into dangerouslySetInnerHTML. I reproduced the bypasses before changing anything — all four pass the old filter: <img src=x onerror=alert(1)> unquoted handler, regex wants quotes <img src=x onerror='alert(1)'> single quotes, same reason <svg onload=alert(1)> not a <script> tag javasjavascript:cript:alert(1) one-pass replace, the rest recombines Plus an attribute breakout in the link renderer, which interpolated the URL into href="${url}" unescaped: [x](" onmouseover=alert(1) x=") -> <a href="" onmouseover=alert(1" ...> Replaced with escaping. Every `&<>"'` in author text becomes an entity before any markdown rule runs, so the only tags in the output are the ones renderInlineMarkdown builds itself and a URL cannot leave its attribute. Link schemes are now an allowlist (http, https, mailto, tel, relative, anchor); anything else renders as plain text. The serializer needed decodeHtmlEntities to match: without it a save would write `&lt;` into the Markdown file and the next parse would escape the `&` again, corrupting the text further on every round trip. A test covers parse -> serialize -> parse stability. Two existing tests asserted the old behaviour and were rewritten rather than deleted: one expected the script tag to be *removed* from the output, the other expected the substring "onerror" to be absent. Both now assert the property that matters — that no tag can form — because `onerror` surviving as inert text is fine. Exploitation required admin access either way: journal and essay text comes from the studio or from content/*.md. This removes the weakness, it does not close an open door. * fix(journal): contain file paths, fix frontmatter escaping, defuse two regexes Follow-up to the CodeQL findings on release PR #432. I went through all 23 alerts individually; this addresses the ones that are worth addressing and documents the ones that are not. Path containment (12 alerts, all false positives). Every path built from a slug goes through isValidSlug(), a strict `/^[a-zA-Z0-9_-]+$/` allowlist — verified against `../../etc/passwd`, `foo/../../bar`, `a/b`, `..` and friends, all rejected. CodeQL cannot see it because the check lives in another module. Added a containedPath() helper that resolves the path and refuses anything landing outside the content directory: a second lock on a door that was already locked, and a barrier the analysis can follow. Also removed the dead `slug.endsWith('.md')` branches — isValidSlug rejects dots, so they could never be taken. Frontmatter escaping (1 alert, a real bug). The serializer escaped `"` but not `\`, and the parser never unescaped anything. A title containing either character gained a backslash on every save/load cycle: Path C:\Users "quoted" -> Path C:\\Users \"quoted\" -> ... Escaping now covers the backslash first and the parser undoes both. A round trip test covers quotes, backslashes, colons and apostrophes. Two of three ReDoS regexes (2 alerts). The heading pattern had `\s+` next to `(.+)`, which overlap, so the engine tried every split of the whitespace run before failing; it is `[ \t]+` and `(\S.*)` now. The quote author pattern wrapped a lazy group around an optional group — the quadratic case — and is an index split on the first separator now. The third regex, the bold/italic pass, is deliberately left alone. Rewriting it with a negated class removes the backtracking but breaks nesting: `**bold *and italic* here**` renders as `*<em>bold </em>and italic<em> here</em>*`. The input is Markdown from an authenticated admin, never a visitor, so the worst case is an author slowing down their own page. The comment in the code says so. Not addressed: 5 js/insufficient-password-hash alerts. They ask for a slow KDF where the code uses SHA-256/HMAC — correct in general, but the admin password comes from an environment variable and is never stored, so a stronger KDF protects nothing that is not already in plaintext in the environment. 399 unit tests pass (18 new), build and tsc clean. * fix(journal): split the quote author by scanning, not by pattern Cleaning up after myself. #439 replaced the quote author regex `/^(.*?)(?:\s+--\s+(.+))?$/` — a lazy group around an optional one, the quadratic case — with `/\s+--\s+/`, and CodeQL promptly flagged the replacement for the same reason. One reported pattern traded for another. splitQuoteAuthor() scans for the first `--` that has whitespace on both sides. Linear, and it needs no reasoning about the regex engine at all. Behaviour is identical to the original regex, checked case by case against it: separator, no separator, several separators, tabs, wide gaps, `a--b` without spaces, leading and trailing separators, empty string. All nine are covered by tests, plus one asserting it stays fast on a 50k whitespace run. * security(admin): derive the session signing key with scrypt getSigningKey() ran the admin password through a single SHA-256 digest. It is key derivation rather than password storage, so it was never a stored-hash problem — but if the derived key ever leaked, one fast hash makes recovering the password by brute force cheap. CodeQL flags it as js/insufficient-password-hash and, for this particular alert, has a point. scrypt now. Two details that matter: The salt has to be stable. A random salt would produce a different key on every call and invalidate every session; it is derived from AUTH_SECRET, which is deployment-specific. Verified across separate processes: same inputs produce a verifying token, so a restart or redeploy does not log everyone out. The result is cached for the process lifetime. scrypt is deliberately slow and getSigningKey() runs on every admin request — deriving per call would add ~24ms to each one. The cache key is a digest of secret plus password, so a rotation misses the cache and derives again, and no extra plaintext copy of the password is kept around. Measured: first derivation 24ms, subsequent calls 0.12ms. Password change and secret change both invalidate an existing token, checked in separate processes. Note the one-time effect: existing admin sessions are invalidated by the change in derivation, so everyone logs in once more. * security(admin): key the signing-key cache on its inputs, not a digest #441 removed the SHA-256 digest of the admin password from the key derivation and introduced a new one three lines above it, as the cache key. Same rule, same file: CodeQL reported it immediately. The comment justifying it was wrong too. It claimed no second plaintext copy of the password was retained, while building the digest input allocates exactly that in order to hash it. The cache now holds the two input strings and compares them directly. They are the same objects the env and install caches already hold, so nothing extra is retained, and no fast hash of the password exists in memory for the life of the process. Re-verified after the change, in separate processes: a token from one process verifies in another with the same inputs, a changed password or secret rejects it, first derivation 24ms, cached calls 0.001ms. That leaves scrypt as the only place the password is hashed here. The two HMACs further down operate on the derived key and on token data, not on the password; the constant-time comparison in verifyAdminPassword is the previously dismissed one. --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
2026-08-14 16:55:07 +02:00
/* A band of wide tiles running off the right edge — the horizontal scroll hint
* that separates this demo from the uniform grid. */
security: add Trivy container scan to Docker publish workflow (#399) * feat(admin): add backup manager UI with 1-click restore * feat(admin): collapse older backup entries by default * fix(theme): isolate admin layout, instant DOM theme updates, and add Light/Dark mode toggle * feat(admin): replace text controls for Photo Frame and Hero Style with visual preview cards * fix(admin): define missing CSS rules for button system (.btn, .preset-btn) * feat(admin): redesign theme settings with segmented mode toggle, accent color swatches, and custom iOS-style toggle cards * feat(admin): upgrade all settings tabs with visual grid previews, Google SEO snippet preview, and toggle cards * feat(admin): overhaul Pages Builder UX with slide-over drawer, card hover badges, real-time search, and floating save bar * fix(admin): remove leftover dangling syntax snippet in PageBuilder.tsx * fix(admin): add position: relative to subpage-tile so hover overlay is contained inside the tile * style(admin): replace all emojis with clean Leica-style vector SVG icons * fix(types): extend IconProps with SVGProps to allow style prop on Leica SVG icons * feat(admin): add subpage live-preview, privacy analytics, and asset protection settings * fix(typecheck): fix AlbumEntry property access in subpage drawer preview mode * fix(types): fix ImmichAlbumInfo property names thumbnailAssetId and albumName in PageBuilder.tsx * fix(types): add protection and watermark optional properties to AppConfig interface * feat(settings): add toggle for disabling analytics tracking (defaults to enabled) * feat(ux): show status banner when analytics tracking is disabled + add live sync indicator * feat(watermark): render customizable watermark overlay on Lightbox images + rename section to Portfolio Features & Modules * fix(types): import type LightboxWatermark in PhotoGrid.tsx * fix(types): destructure watermark prop in PhotoGrid function signature * feat(seo): add configurable subpage title template and metadata descriptions * feat(seo): add generateMetadata to about page for title template support * feat(proofing): add client proofing, favorites selection, compact URL bitmasking, and export modal * feat(essay): add Photo Essay storytelling mode with RSC markdown parser and fullbleed/pair layouts * feat(subpages): add page enabled toggle to deactivate subpages without deleting them * feat(admin): add visual essay block builder for photo essay storytelling pages * security: add Trivy container scan to Docker publish workflow Scans the built image for CRITICAL/HIGH CVEs on every release and uploads results to the GitHub Security tab. Non-blocking for now (exit-code 0) so releases aren't gated on findings. Also documents the scan and existing Dependabot coverage in the README. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-08-07 11:08:04 +02:00
.demo-tile.strip {
release: v0.11.0 — journal fixes, admin URLs, design system cleanup (#432) * fix(screenshots): sharp-Typen fuer 0.34 und 0.35 gleichzeitig (#410) sharp 0.35 ist von `export =` auf ESM umgestellt: der Modul-Namespace ist nicht mehr aufrufbar, die Factory sitzt unter .default. Der Type-Check brach damit in scripts/screenshots.ts weg, sobald der Next-Bump (#402) sharp von 0.34.5 auf 0.35.3 mitzieht -- sharp ist hier keine deklarierte Dependency, sondern kommt ueber Next mit. Die Form wird jetzt aus dem installierten Paket abgeleitet statt festgeschrieben, zur Laufzeit wie im Typ. Geprueft mit beiden Versionen: tsc laeuft mit 0.34.5 und mit 0.35.3 fehlerfrei durch. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(deps): bump the nextjs group across 1 directory with 2 updates (#402) Bumps the nextjs group with 2 updates in the / directory: [next](https://github.com/vercel/next.js) and [eslint-config-next](https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next). Updates `next` from 16.2.12 to 16.3.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/compare/v16.2.12...v16.3.0) Updates `eslint-config-next` from 16.2.12 to 16.3.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/commits/v16.3.0/packages/eslint-config-next) --- updated-dependencies: - dependency-name: eslint-config-next dependency-version: 16.3.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: nextjs - dependency-name: next dependency-version: 16.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nextjs ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps-dev): bump prettier from 3.8.3 to 3.9.6 (#405) Bumps [prettier](https://github.com/prettier/prettier) from 3.8.3 to 3.9.6. - [Release notes](https://github.com/prettier/prettier/releases) - [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md) - [Commits](https://github.com/prettier/prettier/compare/3.8.3...3.9.6) --- updated-dependencies: - dependency-name: prettier dependency-version: 3.9.6 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * docs(changelog): Unreleased-Sektion fuer die Bumps nach v0.10.0 (#413) Die Dependency-PRs sind nach dem Release auf dev gelandet, teils auch auf main. Ohne Eintrag waeren sie beim naechsten Release unsichtbar -- inklusive Next 16.3.0, das CVE-2025-13465 mitbringt. Ausserdem im 0.10.0-Abschnitt nachgetragen, dass der Trivy-Scan bis #409 nie gelaufen ist. Der Fix steckt im Tag v0.10.0, fehlte aber in der Aufzaehlung -- und "Images werden bei jedem Publish gescannt" stand im Changelog, waehrend der Job im Action-Setup abbrach. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(gallery): per-album sort order, independent of Immich (#408) (#414) Album order was dictated entirely by Immich: getAlbum() sorted by the album's own asc/desc flag, so a Folio album always mirrored the archive. A curated series has a narrative order that has nothing to do with capture time, and changing the Immich album's sort to fit the website changes it for the archive too. Adds an optional per-album `sort` in gallery.yaml, editable in /admin, defaulting to today's behaviour so every existing config is unchanged: immich (default) | newest | oldest | filename | manual `manual` is a pinned *prefix*: `assetOrder` lists only the photos placed by hand, everything else follows in the album's Immich order. A full permutation of a 2,000-photo album would be ~80 KB of UUIDs in a file that is rewritten and copied to content/.backups/ on every admin save. It also makes drift fall out for free — photos removed in Immich never match, new ones land in the tail rather than being hidden. Sorting is applied after the cache read, not before the cache write, so the LRU keeps one canonical Immich-ordered copy per album. That avoids putting the mode in the cache key, lets a config change take effect without depending on invalidation, and keeps the stale-serving path correct. cache.get() returns the stored object by reference, so withSort() returns a shallow clone with a new array — sorting in place would reorder the shared entry, and under request coalescing every concurrent caller would be sorting the same array. Also fixes a prerequisite bug: /api/admin/albums/[albumId]/assets read album.assets from GET /albums/:id, which Immich 3.x no longer populates (lib/immich.ts:507). The hero picker's "This Album" tab returned nothing and threw outright when the key was absent. It now goes through the client's paginated metadata search, with ?types=all to opt videos in for the reorder editor. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): drop decorative emoji from the sort select labels (#415) An <option> cannot contain markup, so the SVG set in Icons is not reachable there — but a decorative emoji is not a substitute for it. Plain text instead; the album card badge already uses a real icon. The remaining emoji in the admin panel (asset picker tabs, section headings, layout picker options) predate this branch and are left for a separate cleanup. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): replace emoji icons with the shared SVG icon set (#416) The admin panel mixed two icon conventions: inline SVGs from `Icons.tsx` in most components, and decorative emoji in the asset picker and a few PageBuilder labels. Emoji render inconsistently across platforms, ignore the accent colour, and cannot inherit the `.svg-icon` sizing rules. - Icons.tsx: add `IconStar` (filled — it marks a state, not an action) and `IconImage`. - AssetPicker: the three tab labels and the favourite tile badge now use IconFolder / IconStar / IconImage. - PageBuilder: the "Standalone Albums" and "Subpages" headings use the icon set instead of an emoji. - PageBuilder: the layout picker drops its emoji for plain text. An <option> cannot contain markup, so an SVG is impossible there and a decorative glyph is not a substitute. - admin.css: align icon and label in the picker tabs, and swap the favourite badge's text-shadow for drop-shadow, which is what applies to an inline SVG. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): fold PageBuilder's local icons into the shared Icons module (#418) * refactor(admin): fold PageBuilder's local icons into the shared module PageBuilder.tsx carried its own `Icons` object duplicating most of the glyphs already exported by Icons.tsx, with hardcoded sizes and slightly divergent paths. Migrate all 32 call sites to the shared module and delete the local object. Five glyphs had no counterpart and are added to Icons.tsx as 1:1 ports of the local paths: IconX, IconPlus, IconHome, IconCopy, IconImage. The local ExternalLink and Check are dropped rather than ported — both had zero call sites. Two glyphs change shape slightly, which is the point of consolidating: the shared IconCamera includes the viewfinder bump the local copy omitted, and drag handles now use IconGripVertical. IconGripVertical uses the module's square 24x24 viewBox, so `.svg-drag` goes from 12x18 to 18x18 — the old non-square box would letterbox the glyph down to 12x12 and shrink the handle. * fix(admin): resolve icon-module integration after #416 Merging dev brought in #416, which added a second IconImage to Icons.tsx and two <Icons.Camera>/<Icons.Folder> section headers that reference the local Icons object this PR removes. Git merged both cleanly but the result did not type-check. - drop the duplicate IconImage (both copies were byte-identical) - point the two section headers at the imported IconCamera/IconFolder - refresh the SORT_LABELS comment: the icon set is imported now, not declared below --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> * fix(config): allow an empty gallery, guard against a double /api suffix (#421) An empty gallery is now a valid, rendered state instead of a throw: deriveGallery() no longer requires at least one album or subpage, so a deployment with no albums yet renders a bare homepage the owner can fill in via /admin. getConfig() also stops appending /api to an Immich URL that already ends in it, which previously produced .../api/api and broke every upstream request. Includes a restore of the per-album sort test cases, which the branch had lost by being cut before #408/#414. * feat(admin): favicon upload, served from the content volume (#422) Adds a bundled default favicon, an upload widget in admin Settings > General, and a route that serves the icon from the writable content/ volume with a fallback to the bundled default. Raster uploads (PNG/ICO/JPEG) are wrapped in an SVG container; the response carries its own CSP so an uploaded SVG cannot execute script on the origin. The GET route revalidates with an ETag instead of caching immutably, so a newly uploaded icon shows up immediately. Uploads are written via temp file + rename, and a Reset button restores the bundled default. * ci: flag unformatted files in a PR, without blocking it (#424) Prettier is configured as an error rule in eslint.config.mjs but has never run in CI, so part of the tree predates it. A final CI step now diffs against the PR base, runs prettier --list-different over the changed files, and emits a warning annotation per offender plus a job summary. Advisory by design: it never fails the job. Blocking would turn a PR red for merely touching a file that was already unformatted, and normalising the tree in one commit would wreck git blame and conflict with the PRs in flight. Requires fetch-depth: 0, since diffing against the base needs its history. * feat(install): first-run wizard gated by a one-time setup token (#419) Adds /install, a four-step first-run wizard: connect to Immich, optionally pick albums, name the site, finish. It verifies the credentials against the Immich server before writing anything, then writes gallery.yaml, settings.yaml and a content/install.json carrying the Immich credentials and a generated site secret. install.json exists because a running process cannot pick up new env vars — the wizard has to write configuration that takes effect without a restart. getInstallCredentials() merges it under the real environment, so env vars always win and rotation stays a matter of setting one. Both the page and the API routes are gated by a one-time setup token printed to the server log, so a deployment that is reachable before gallery.yaml exists cannot be configured by whoever finds it first. The token is stored in content/.setup-token (0600) rather than a module variable: Next.js bundles the page and each route handler separately, so a module-level token left the page and the API disagreeing inside one process and the wizard stuck on step 1. It is removed once the install completes. The admin password is stored as an scrypt hash using the scheme lib/auth.ts already applies to album passwords; a plaintext ADMIN_PASSWORD env var keeps working. * docs: document the setup wizard, fix the read-only content mount (#425) Quick Start now leads with the /install wizard, with the hand-written YAML route kept alongside it, and a First-Run Setup section covers the setup token, the files the wizard writes, and env-var precedence. Two corrections: both Docker examples mounted content/ as :ro, which silently breaks the wizard, the admin panel and the backup rotation alike — docs/admin-panel.md already said so and the README contradicted it. And nothing documented that content/install.json holds the Immich API key, so a backup of content/ is a backup of credentials. Also adds a Contributors section crediting the people whose work is in the project. * feat(admin): floating save bar pinned to the bottom of the viewport (#426) The save bar was the first, static element inside .admin-main. Since the document itself scrolls, it left the viewport as soon as you scrolled down — editing a subpage section or a settings block far below gave no visible dirty hint and no reachable save button. Replace it with a bottom-pinned floating bar shared by both editors. It only mounts while there is something to act on (unsaved changes, an in-flight save, or a result message), so it never covers content while idle. The success message clears after 5s, which hides the bar again. - new SaveBar component, replacing the duplicated markup in PageBuilder and SettingsEditor - adopt the previously unused .floating-save-bar CSS: slide-in keyframes (carrying translateX(-50%)), dirty border, wrap/gap, mobile variant and a prefers-reduced-motion opt-out; z-index 900 keeps it below modals - .admin-main gains bottom padding so the bar never covers page content - drop the now-unreachable idle hints: the ⌘S hint becomes a button title, the Live Sync note becomes a static line above the settings layout - header "Site" link now bypasses the cache (/?fresh=1), so the preview stays reachable when the bar is hidden Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(admin): themed listbox for the album sort control (#427) The per-album "Photo order" control was a native <select>. Because an <option> cannot contain markup, its choices could not use the admin panel's currentColor SVG set — the reason #415 had to fall back to plain text after dropping the emoji labels. Adds a Listbox component implementing the ARIA combobox/listbox pattern, so options can render a glyph beside their label: - DOM focus stays on the trigger button; the active option is announced through aria-activedescendant, keeping focus management to one element - Keyboard: arrows (clamped at the ends, like a native select), Home/End, Enter/Space to commit, Escape to cancel, Tab commits and moves on, and prefix type-ahead with a repeat-key cycle - Outside dismissal on pointerdown, so a press starting outside closes the popup before the click retargets The sort options now carry an icon each: calendar, arrow-down, arrow-up, an A→Z marker, and the drag glyph for manual — matching the badge the album card already shows. SORT_LABELS stays plain text because the badge feeds it to a title attribute. Closes #417 Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(git): ignore generated design handoff folders * fix(admin): stop the album sort dropdown clipping, and simplify the panel (#428) * fix(admin): render listbox popup in a portal so it escapes modal clipping The sort control's popup was position:absolute inside three clipping ancestors (.album-drawer overflow:hidden > .album-drawer-body overflow-y:auto > .modal-right-column overflow-y:auto), so it was cut off at the bottom of the Edit Album Details modal. z-index could not help: clipping happens before stacking. It also always hung below the trigger, with no flip. Portal the popup to document.body and position it from the trigger's viewport rect, flipping above when there is more room there and capping max-height to the space available so it scrolls internally rather than overflowing. It is dismissed on scroll and resize, since the anchor is only measured on open. The outside-pointerdown handler now also treats the popup as inside; without that the portalled list counts as outside, and a click on an option would close it before the selection commits. * refactor(admin): single-column album details panel The left column spent 1.2fr on a cover thumbnail and three stat rows, two of which (Status, Custom Hero) only restated the form fields opposite them, while the form itself was squeezed into 1.8fr behind a second nested scroller. Stack the drawer in one column instead: cover as a banner, then the form at full width, with the UUID moved into the footer. The body is now the only scroll container, which also removes one of the ancestors that was clipping the sort popup. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> * fix(admin): give the portalled listbox its theme back, lock the page behind modals (#429) Two defects in the album editor. The sort listbox popup painted transparent. Every --admin-* variable is scoped to .admin-layout, and since the popup moved into document.body it sits outside that subtree, so background/border/text all resolved to nothing. It now carries its own copy of the palette in both colour schemes, plus the font it no longer inherits. Scrolling inside a modal also moved the page behind it. No admin modal ever locked body scroll: the overlay covers the page but does not absorb wheel events, so a scroll starting on the backdrop — or continuing past the end of the modal's own scroller — reaches the document. overscroll-behavior cannot cover that case on its own, because it only applies to scroll containers and the backdrop is not one. useScrollLock freezes body while a modal is open and compensates for the width the scrollbar gives up, so nothing shifts underneath. Each lock restores the inline value it found, which makes nesting work without a counter — a picker opened from the drawer restores the drawer's hidden state instead of clearing it. Applied to both drawers and all four picker modals, which share the defect. overscroll-behavior: contain on the scrollers stops the chaining they can handle themselves. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com> * fix(security): allow unsafe-eval in CSP script-src during dev mode * feat(journal): add Journal Studio with split-screen editor, live preview and dedicated routes * fix(build): separate client parser from server journal-service and fix build type errors * fix(journal): Fotos rendern, Layout und Lightbox-Steuerung korrigieren Fünf unabhängige Fehler in der öffentlichen Journal- und Essay-Ansicht: * Foto-Blöcke wurden nie angezeigt. EssayView löst ein Foto über PhotoItem.id auf, und das sind verschlüsselte Tokens — die Blöcke aus dem Markdown tragen aber rohe Asset-UUIDs. Jede Zuordnung lief ins Leere, und nicht auflösbare Blöcke werden still verworfen. Die IDs werden jetzt serverseitig übersetzt; damit verschwinden nebenbei die rohen UUIDs aus dem Client-Payload, die dort laut Projektregel nie auftauchen dürfen. Nicht auflösbare Referenzen werden geloggt. * Überschriften standen weiter links als der Fließtext. Jeder Block hatte einzeln `max-width: 68ch`, und `ch` ist relativ zur Schrift des Elements — die Serif-Überschrift ergab eine breitere Spalte. Ersetzt durch eine gemeinsame, font-unabhängige `--essay-measure`. * Fullbleed-Fotos bluteten nur nach links aus: `.essay-figure` ist `width: 100%`, wodurch die Box überbestimmt ist und der negative rechte Margin verworfen wird. * Foto-Paare stellten beide Bilder gleich breit dar, wodurch ein Hochformat neben einem Querformat doppelt so hoch wurde. Jetzt eine Justified-Reihe: Breite proportional zum Seitenverhältnis, dadurch exakt gleiche Höhen ohne Beschnitt. * Die Lightbox hatte im Journal keine Tastatursteuerung und keine Scroll-Sperre — beides lag in PhotoGrid, also nur im Album-Raster. Verlagert in die Lightbox selbst, der doppelte Handler in PhotoGrid entfernt (sonst wäre pro Pfeildruck zwei Bilder weitergesprungen). Zusätzlich sind Proofing-Herzen und das EXIF-Panel im redaktionellen Modus abschaltbar und im Journal aus: Client-Proofing ist ein Übergabe-Workflow für Alben, keine Funktion einer Reportage. Auf der Übersicht wurde der Untertitel doppelt gerendert, weil extractExcerpt() auf ihn zurückfällt. * feat(admin): eigene URLs für alle Bereiche und überarbeiteter Journal Studio Das Panel war eine einzige Client-Komponente, die ihre Tabs über useState umschaltet: keine Route pro Bereich, kein Deep-Link, kein Zurück-Button, und nach jedem Reload landete man wieder auf "Pages". Auch der Journal-Editor hatte keine eigene URL. Jetzt sieben echte Routen (/admin, /admin/pages, /admin/journal, /admin/journal/<slug>, /admin/settings, /admin/settings/<section>, /admin/analytics). Die Shell mit Auth-Prüfung und Kopfzeile sitzt im Layout und umschließt children — so bleibt die Session-Prüfung über Routenwechsel montiert, statt bei jedem Tab-Wechsel neu zu laufen und den Spinner aufblitzen zu lassen. Unbekannte Settings-Sections fallen auf General zurück. Im selben Zug der Journal Studio, der die Routing-Änderung ohnehin berührt: * Alle Eingabefelder nutzten die Klasse `admin-input`, die in keinem CSS definiert war — sie fielen auf Browser-Defaults zurück. Jetzt gestylt, gescoped, damit der generische Name nicht ins übrige Panel leckt. * Der Split View ist per Divider verschiebbar (Maus, Tastatur, Doppelklick zum Zurücksetzen), Breite in localStorage. * Das Studio bricht aus der 1120px-Spalte aus, die Preview hat Platz. * Die Preview zeigte für jedes Foto fest 3:2 und log damit über das Layout der veröffentlichten Seite; die echten Verhältnisse werden jetzt an den Thumbnails gemessen. * Blöcke mit alten positionsbasierten Foto-Referenzen werden markiert — die lassen sich auf einer eigenständigen Journal-Seite nicht auflösen und verschwanden bisher stillschweigend. * Blocktyp-Chips als gemeinsame Komponente, monochrom und per Icon unterschieden statt in einer eigenen Blau/Lila/Orange-Palette, die sonst nirgends im Panel vorkommt. * Emojis raus, SVG-Icons rein. * fix(admin): Designsystem-Lücken im Panel schließen Eine systematische Suche nach Klassen, die im TSX benutzt, aber in keinem CSS definiert sind, hat vier Stellen mit demselben Muster gefunden: * `admin-btn-secondary` und `admin-btn-danger` existierten nicht. Sämtliche Löschen-Buttons sahen aus wie normale Buttons — keine Warnwirkung. Als `.admin-btn.admin-btn-danger` geschrieben, weil die Varianten mit den Größenklassen kombiniert werden, die weiter unten ihren eigenen Hintergrund setzen. * `page-progress-fill` fehlte: die Balken im Analytics-Panel waren leere Rinnen, der Wert unsichtbar. Ebenso `analytics-empty` und `admin-loading-container`. * `subpage-drawer-section`, `subpage-drawer-title-group` und `input-with-icon` im PageBuilder waren wirkungslos und teils mit Inline-Styles notdürftig kompensiert. * `grid-card-preview` fehlte, wodurch alle Layout-Vorschauen auf Höhe null kollabierten. Nur "Showcase" war sichtbar — und das aus Versehen, weil sein Tile `hero-tile` hieß und damit die `aspect-ratio` einer fremden PageBuilder-Klasse erbte. Umbenannt. Dazu die Theme-Vorschauen, die praktisch identisch aussahen: alle sieben zeigten dieselben drei quadratischen Kacheln, einziger Unterschied war die Hintergrundfarbe. Sie spiegeln jetzt die echten Preset-Daten aus lib/config/theme.ts — Schriftcharakter, Eckradius, Rasterdichte, Passepartout bzw. Schatten. Die Kopfzeile richtet sich an einer gemeinsamen Steuerhöhe aus. Der "Site"-Link war höher als die Buttons daneben: `.admin-btn` hatte keine explizite line-height, und <button> bekommt box-sizing: border-box vom Browser, <a> nicht. Die Statusanzeige setzte weder Schriftfamilie noch -größe und fiel auf den Browser-Default zurück — sie war nie Teil des Designsystems. Jetzt gleiche Höhe und Typografie, Pillenform als Zustandsanzeige, Trenner zur Aktionsgruppe. Das dauerhafte Pulsieren des grünen Punkts entfällt; Animation bleibt den Zuständen vorbehalten, die Aufmerksamkeit brauchen. Restliche Emojis durch SVG-Icons ersetzt. * feat(admin): add scroll-to-top toggle and SVG arrow The back-to-top button was always on and drew its arrow with the ↑ text character. Add a `scrollToTop` setting (General section in the admin panel, defaults to on so existing sites are unaffected) and replace the glyph with a stroked SVG that inherits currentColor across all presets. Scroll handling is now rAF-throttled, and prefers-reduced-motion turns off both the hover lift and the smooth scroll. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * security(journal): escape author HTML instead of filtering it CodeQL flags 26 high-severity alerts on the release PR; the bulk of them point at sanitizeHtml(), a denylist of three regexes whose output goes into dangerouslySetInnerHTML. I reproduced the bypasses before changing anything — all four pass the old filter: <img src=x onerror=alert(1)> unquoted handler, regex wants quotes <img src=x onerror='alert(1)'> single quotes, same reason <svg onload=alert(1)> not a <script> tag javasjavascript:cript:alert(1) one-pass replace, the rest recombines Plus an attribute breakout in the link renderer, which interpolated the URL into href="${url}" unescaped: [x](" onmouseover=alert(1) x=") -> <a href="" onmouseover=alert(1" ...> Replaced with escaping. Every `&<>"'` in author text becomes an entity before any markdown rule runs, so the only tags in the output are the ones renderInlineMarkdown builds itself and a URL cannot leave its attribute. Link schemes are now an allowlist (http, https, mailto, tel, relative, anchor); anything else renders as plain text. The serializer needed decodeHtmlEntities to match: without it a save would write `&lt;` into the Markdown file and the next parse would escape the `&` again, corrupting the text further on every round trip. A test covers parse -> serialize -> parse stability. Two existing tests asserted the old behaviour and were rewritten rather than deleted: one expected the script tag to be *removed* from the output, the other expected the substring "onerror" to be absent. Both now assert the property that matters — that no tag can form — because `onerror` surviving as inert text is fine. Exploitation required admin access either way: journal and essay text comes from the studio or from content/*.md. This removes the weakness, it does not close an open door. * fix(journal): contain file paths, fix frontmatter escaping, defuse two regexes Follow-up to the CodeQL findings on release PR #432. I went through all 23 alerts individually; this addresses the ones that are worth addressing and documents the ones that are not. Path containment (12 alerts, all false positives). Every path built from a slug goes through isValidSlug(), a strict `/^[a-zA-Z0-9_-]+$/` allowlist — verified against `../../etc/passwd`, `foo/../../bar`, `a/b`, `..` and friends, all rejected. CodeQL cannot see it because the check lives in another module. Added a containedPath() helper that resolves the path and refuses anything landing outside the content directory: a second lock on a door that was already locked, and a barrier the analysis can follow. Also removed the dead `slug.endsWith('.md')` branches — isValidSlug rejects dots, so they could never be taken. Frontmatter escaping (1 alert, a real bug). The serializer escaped `"` but not `\`, and the parser never unescaped anything. A title containing either character gained a backslash on every save/load cycle: Path C:\Users "quoted" -> Path C:\\Users \"quoted\" -> ... Escaping now covers the backslash first and the parser undoes both. A round trip test covers quotes, backslashes, colons and apostrophes. Two of three ReDoS regexes (2 alerts). The heading pattern had `\s+` next to `(.+)`, which overlap, so the engine tried every split of the whitespace run before failing; it is `[ \t]+` and `(\S.*)` now. The quote author pattern wrapped a lazy group around an optional group — the quadratic case — and is an index split on the first separator now. The third regex, the bold/italic pass, is deliberately left alone. Rewriting it with a negated class removes the backtracking but breaks nesting: `**bold *and italic* here**` renders as `*<em>bold </em>and italic<em> here</em>*`. The input is Markdown from an authenticated admin, never a visitor, so the worst case is an author slowing down their own page. The comment in the code says so. Not addressed: 5 js/insufficient-password-hash alerts. They ask for a slow KDF where the code uses SHA-256/HMAC — correct in general, but the admin password comes from an environment variable and is never stored, so a stronger KDF protects nothing that is not already in plaintext in the environment. 399 unit tests pass (18 new), build and tsc clean. * fix(journal): split the quote author by scanning, not by pattern Cleaning up after myself. #439 replaced the quote author regex `/^(.*?)(?:\s+--\s+(.+))?$/` — a lazy group around an optional one, the quadratic case — with `/\s+--\s+/`, and CodeQL promptly flagged the replacement for the same reason. One reported pattern traded for another. splitQuoteAuthor() scans for the first `--` that has whitespace on both sides. Linear, and it needs no reasoning about the regex engine at all. Behaviour is identical to the original regex, checked case by case against it: separator, no separator, several separators, tabs, wide gaps, `a--b` without spaces, leading and trailing separators, empty string. All nine are covered by tests, plus one asserting it stays fast on a 50k whitespace run. * security(admin): derive the session signing key with scrypt getSigningKey() ran the admin password through a single SHA-256 digest. It is key derivation rather than password storage, so it was never a stored-hash problem — but if the derived key ever leaked, one fast hash makes recovering the password by brute force cheap. CodeQL flags it as js/insufficient-password-hash and, for this particular alert, has a point. scrypt now. Two details that matter: The salt has to be stable. A random salt would produce a different key on every call and invalidate every session; it is derived from AUTH_SECRET, which is deployment-specific. Verified across separate processes: same inputs produce a verifying token, so a restart or redeploy does not log everyone out. The result is cached for the process lifetime. scrypt is deliberately slow and getSigningKey() runs on every admin request — deriving per call would add ~24ms to each one. The cache key is a digest of secret plus password, so a rotation misses the cache and derives again, and no extra plaintext copy of the password is kept around. Measured: first derivation 24ms, subsequent calls 0.12ms. Password change and secret change both invalidate an existing token, checked in separate processes. Note the one-time effect: existing admin sessions are invalidated by the change in derivation, so everyone logs in once more. * security(admin): key the signing-key cache on its inputs, not a digest #441 removed the SHA-256 digest of the admin password from the key derivation and introduced a new one three lines above it, as the cache key. Same rule, same file: CodeQL reported it immediately. The comment justifying it was wrong too. It claimed no second plaintext copy of the password was retained, while building the digest input allocates exactly that in order to hash it. The cache now holds the two input strings and compares them directly. They are the same objects the env and install caches already hold, so nothing extra is retained, and no fast hash of the password exists in memory for the life of the process. Re-verified after the change, in separate processes: a token from one process verifies in another with the same inputs, a changed password or secret rejects it, first derivation 24ms, cached calls 0.001ms. That leaves scrypt as the only place the password is hashed here. The two HMACs further down operate on the derived key and on token data, not on the password; the constant-time comparison in verifyAdminPassword is the previously dismissed one. --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
2026-08-14 16:55:07 +02:00
width: 46%;
height: 62%;
security: add Trivy container scan to Docker publish workflow (#399) * feat(admin): add backup manager UI with 1-click restore * feat(admin): collapse older backup entries by default * fix(theme): isolate admin layout, instant DOM theme updates, and add Light/Dark mode toggle * feat(admin): replace text controls for Photo Frame and Hero Style with visual preview cards * fix(admin): define missing CSS rules for button system (.btn, .preset-btn) * feat(admin): redesign theme settings with segmented mode toggle, accent color swatches, and custom iOS-style toggle cards * feat(admin): upgrade all settings tabs with visual grid previews, Google SEO snippet preview, and toggle cards * feat(admin): overhaul Pages Builder UX with slide-over drawer, card hover badges, real-time search, and floating save bar * fix(admin): remove leftover dangling syntax snippet in PageBuilder.tsx * fix(admin): add position: relative to subpage-tile so hover overlay is contained inside the tile * style(admin): replace all emojis with clean Leica-style vector SVG icons * fix(types): extend IconProps with SVGProps to allow style prop on Leica SVG icons * feat(admin): add subpage live-preview, privacy analytics, and asset protection settings * fix(typecheck): fix AlbumEntry property access in subpage drawer preview mode * fix(types): fix ImmichAlbumInfo property names thumbnailAssetId and albumName in PageBuilder.tsx * fix(types): add protection and watermark optional properties to AppConfig interface * feat(settings): add toggle for disabling analytics tracking (defaults to enabled) * feat(ux): show status banner when analytics tracking is disabled + add live sync indicator * feat(watermark): render customizable watermark overlay on Lightbox images + rename section to Portfolio Features & Modules * fix(types): import type LightboxWatermark in PhotoGrid.tsx * fix(types): destructure watermark prop in PhotoGrid function signature * feat(seo): add configurable subpage title template and metadata descriptions * feat(seo): add generateMetadata to about page for title template support * feat(proofing): add client proofing, favorites selection, compact URL bitmasking, and export modal * feat(essay): add Photo Essay storytelling mode with RSC markdown parser and fullbleed/pair layouts * feat(subpages): add page enabled toggle to deactivate subpages without deleting them * feat(admin): add visual essay block builder for photo essay storytelling pages * security: add Trivy container scan to Docker publish workflow Scans the built image for CRITICAL/HIGH CVEs on every release and uploads results to the GitHub Security tab. Non-blocking for now (exit-code 0) so releases aren't gated on findings. Also documents the scan and existing Dependabot coverage in the README. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-08-07 11:08:04 +02:00
flex-shrink: 0;
}
.demo-editorial-flow {
display: flex;
flex-direction: column;
gap: 0.25rem;
height: 100%;
}
.demo-tile.wide {
width: 100%;
height: 45%;
}
.demo-row {
display: flex;
gap: 0.25rem;
flex: 1;
}
/* ── Subpage Tile Badges & Hover Actions ─────────────────────── */
.subpage-badge-protected {
position: absolute;
top: 8px;
right: 8px;
background: rgba(0, 0, 0, 0.75);
backdrop-filter: blur(8px);
color: #ffca28;
font-size: 0.7rem;
font-weight: 600;
padding: 2px 8px;
border-radius: 12px;
border: 1px solid rgba(255, 202, 40, 0.3);
z-index: 2;
}
.subpage-hover-overlay {
position: absolute;
inset: 0;
background: rgba(0, 0, 0, 0.55);
backdrop-filter: blur(3px);
display: flex;
align-items: center;
justify-content: center;
opacity: 0;
transition: opacity 0.2s ease;
}
.subpage-tile:hover .subpage-hover-overlay {
opacity: 1;
}
.hover-action-btn {
font-size: 0.78rem;
font-weight: 600;
color: #ffffff;
background: var(--admin-accent, #e60012);
padding: 0.4rem 0.85rem;
border-radius: 20px;
box-shadow: 0 4px 12px rgba(0, 0, 0, 0.4);
}
.subpage-tile-title-row {
display: flex;
align-items: center;
justify-content: space-between;
gap: 0.5rem;
}
.subpage-tile-slug {
font-size: 0.7rem;
color: var(--admin-text-muted);
font-family: var(--font-mono, monospace);
background: var(--admin-bg-input);
padding: 1px 6px;
border-radius: 4px;
}
/* ── Subpage Slide-Over Drawer Modal ──────────────────────────── */
.subpage-drawer-backdrop {
position: fixed;
inset: 0;
background: rgba(0, 0, 0, 0.65);
backdrop-filter: blur(6px);
z-index: 999;
display: flex;
justify-content: flex-end;
animation: fadeIn 0.2s ease-out;
}
.subpage-drawer-container {
width: 100%;
max-width: 620px;
height: 100vh;
background: var(--admin-bg-card, #181818);
border-left: 1px solid var(--admin-border, #333);
display: flex;
flex-direction: column;
box-shadow: -10px 0 30px rgba(0, 0, 0, 0.5);
animation: slideInRight 0.25s cubic-bezier(0.16, 1, 0.3, 1);
}
@keyframes slideInRight {
chore(release): v0.10.0 (#400) Photo Essay mode, client proofing, studio-modern preset, admin panel overhaul, watermark, cookieless analytics, subpage toggle, SEO title templates. Analytics API now admin-only, Trivy scan on publish. Album order mirrors the Immich timeline; map theme, admin status panel, lightbox counter and Docker health check fixed. See CHANGELOG.md for the full list and the health-check upgrade note.
2026-08-10 09:56:20 +02:00
from {
transform: translateX(100%);
}
to {
transform: translateX(0);
}
security: add Trivy container scan to Docker publish workflow (#399) * feat(admin): add backup manager UI with 1-click restore * feat(admin): collapse older backup entries by default * fix(theme): isolate admin layout, instant DOM theme updates, and add Light/Dark mode toggle * feat(admin): replace text controls for Photo Frame and Hero Style with visual preview cards * fix(admin): define missing CSS rules for button system (.btn, .preset-btn) * feat(admin): redesign theme settings with segmented mode toggle, accent color swatches, and custom iOS-style toggle cards * feat(admin): upgrade all settings tabs with visual grid previews, Google SEO snippet preview, and toggle cards * feat(admin): overhaul Pages Builder UX with slide-over drawer, card hover badges, real-time search, and floating save bar * fix(admin): remove leftover dangling syntax snippet in PageBuilder.tsx * fix(admin): add position: relative to subpage-tile so hover overlay is contained inside the tile * style(admin): replace all emojis with clean Leica-style vector SVG icons * fix(types): extend IconProps with SVGProps to allow style prop on Leica SVG icons * feat(admin): add subpage live-preview, privacy analytics, and asset protection settings * fix(typecheck): fix AlbumEntry property access in subpage drawer preview mode * fix(types): fix ImmichAlbumInfo property names thumbnailAssetId and albumName in PageBuilder.tsx * fix(types): add protection and watermark optional properties to AppConfig interface * feat(settings): add toggle for disabling analytics tracking (defaults to enabled) * feat(ux): show status banner when analytics tracking is disabled + add live sync indicator * feat(watermark): render customizable watermark overlay on Lightbox images + rename section to Portfolio Features & Modules * fix(types): import type LightboxWatermark in PhotoGrid.tsx * fix(types): destructure watermark prop in PhotoGrid function signature * feat(seo): add configurable subpage title template and metadata descriptions * feat(seo): add generateMetadata to about page for title template support * feat(proofing): add client proofing, favorites selection, compact URL bitmasking, and export modal * feat(essay): add Photo Essay storytelling mode with RSC markdown parser and fullbleed/pair layouts * feat(subpages): add page enabled toggle to deactivate subpages without deleting them * feat(admin): add visual essay block builder for photo essay storytelling pages * security: add Trivy container scan to Docker publish workflow Scans the built image for CRITICAL/HIGH CVEs on every release and uploads results to the GitHub Security tab. Non-blocking for now (exit-code 0) so releases aren't gated on findings. Also documents the scan and existing Dependabot coverage in the README. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-08-07 11:08:04 +02:00
}
.subpage-drawer-header {
padding: 1.25rem 1.5rem;
border-bottom: 1px solid var(--admin-border);
display: flex;
align-items: center;
justify-content: space-between;
background: var(--admin-bg-raised);
}
.subpage-drawer-breadcrumb {
font-size: 0.75rem;
color: var(--admin-text-muted);
text-transform: uppercase;
letter-spacing: 0.05em;
font-weight: 600;
}
.subpage-drawer-title {
margin: 0.2rem 0 0 0;
font-size: 1.2rem;
font-weight: 700;
color: var(--admin-text);
}
.subpage-drawer-header-actions {
display: flex;
align-items: center;
gap: 0.5rem;
}
.subpage-drawer-body {
padding: 1.5rem;
overflow-y: auto;
release: v0.11.0 — journal fixes, admin URLs, design system cleanup (#432) * fix(screenshots): sharp-Typen fuer 0.34 und 0.35 gleichzeitig (#410) sharp 0.35 ist von `export =` auf ESM umgestellt: der Modul-Namespace ist nicht mehr aufrufbar, die Factory sitzt unter .default. Der Type-Check brach damit in scripts/screenshots.ts weg, sobald der Next-Bump (#402) sharp von 0.34.5 auf 0.35.3 mitzieht -- sharp ist hier keine deklarierte Dependency, sondern kommt ueber Next mit. Die Form wird jetzt aus dem installierten Paket abgeleitet statt festgeschrieben, zur Laufzeit wie im Typ. Geprueft mit beiden Versionen: tsc laeuft mit 0.34.5 und mit 0.35.3 fehlerfrei durch. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(deps): bump the nextjs group across 1 directory with 2 updates (#402) Bumps the nextjs group with 2 updates in the / directory: [next](https://github.com/vercel/next.js) and [eslint-config-next](https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next). Updates `next` from 16.2.12 to 16.3.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/compare/v16.2.12...v16.3.0) Updates `eslint-config-next` from 16.2.12 to 16.3.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/commits/v16.3.0/packages/eslint-config-next) --- updated-dependencies: - dependency-name: eslint-config-next dependency-version: 16.3.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: nextjs - dependency-name: next dependency-version: 16.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nextjs ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps-dev): bump prettier from 3.8.3 to 3.9.6 (#405) Bumps [prettier](https://github.com/prettier/prettier) from 3.8.3 to 3.9.6. - [Release notes](https://github.com/prettier/prettier/releases) - [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md) - [Commits](https://github.com/prettier/prettier/compare/3.8.3...3.9.6) --- updated-dependencies: - dependency-name: prettier dependency-version: 3.9.6 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * docs(changelog): Unreleased-Sektion fuer die Bumps nach v0.10.0 (#413) Die Dependency-PRs sind nach dem Release auf dev gelandet, teils auch auf main. Ohne Eintrag waeren sie beim naechsten Release unsichtbar -- inklusive Next 16.3.0, das CVE-2025-13465 mitbringt. Ausserdem im 0.10.0-Abschnitt nachgetragen, dass der Trivy-Scan bis #409 nie gelaufen ist. Der Fix steckt im Tag v0.10.0, fehlte aber in der Aufzaehlung -- und "Images werden bei jedem Publish gescannt" stand im Changelog, waehrend der Job im Action-Setup abbrach. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(gallery): per-album sort order, independent of Immich (#408) (#414) Album order was dictated entirely by Immich: getAlbum() sorted by the album's own asc/desc flag, so a Folio album always mirrored the archive. A curated series has a narrative order that has nothing to do with capture time, and changing the Immich album's sort to fit the website changes it for the archive too. Adds an optional per-album `sort` in gallery.yaml, editable in /admin, defaulting to today's behaviour so every existing config is unchanged: immich (default) | newest | oldest | filename | manual `manual` is a pinned *prefix*: `assetOrder` lists only the photos placed by hand, everything else follows in the album's Immich order. A full permutation of a 2,000-photo album would be ~80 KB of UUIDs in a file that is rewritten and copied to content/.backups/ on every admin save. It also makes drift fall out for free — photos removed in Immich never match, new ones land in the tail rather than being hidden. Sorting is applied after the cache read, not before the cache write, so the LRU keeps one canonical Immich-ordered copy per album. That avoids putting the mode in the cache key, lets a config change take effect without depending on invalidation, and keeps the stale-serving path correct. cache.get() returns the stored object by reference, so withSort() returns a shallow clone with a new array — sorting in place would reorder the shared entry, and under request coalescing every concurrent caller would be sorting the same array. Also fixes a prerequisite bug: /api/admin/albums/[albumId]/assets read album.assets from GET /albums/:id, which Immich 3.x no longer populates (lib/immich.ts:507). The hero picker's "This Album" tab returned nothing and threw outright when the key was absent. It now goes through the client's paginated metadata search, with ?types=all to opt videos in for the reorder editor. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): drop decorative emoji from the sort select labels (#415) An <option> cannot contain markup, so the SVG set in Icons is not reachable there — but a decorative emoji is not a substitute for it. Plain text instead; the album card badge already uses a real icon. The remaining emoji in the admin panel (asset picker tabs, section headings, layout picker options) predate this branch and are left for a separate cleanup. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): replace emoji icons with the shared SVG icon set (#416) The admin panel mixed two icon conventions: inline SVGs from `Icons.tsx` in most components, and decorative emoji in the asset picker and a few PageBuilder labels. Emoji render inconsistently across platforms, ignore the accent colour, and cannot inherit the `.svg-icon` sizing rules. - Icons.tsx: add `IconStar` (filled — it marks a state, not an action) and `IconImage`. - AssetPicker: the three tab labels and the favourite tile badge now use IconFolder / IconStar / IconImage. - PageBuilder: the "Standalone Albums" and "Subpages" headings use the icon set instead of an emoji. - PageBuilder: the layout picker drops its emoji for plain text. An <option> cannot contain markup, so an SVG is impossible there and a decorative glyph is not a substitute. - admin.css: align icon and label in the picker tabs, and swap the favourite badge's text-shadow for drop-shadow, which is what applies to an inline SVG. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): fold PageBuilder's local icons into the shared Icons module (#418) * refactor(admin): fold PageBuilder's local icons into the shared module PageBuilder.tsx carried its own `Icons` object duplicating most of the glyphs already exported by Icons.tsx, with hardcoded sizes and slightly divergent paths. Migrate all 32 call sites to the shared module and delete the local object. Five glyphs had no counterpart and are added to Icons.tsx as 1:1 ports of the local paths: IconX, IconPlus, IconHome, IconCopy, IconImage. The local ExternalLink and Check are dropped rather than ported — both had zero call sites. Two glyphs change shape slightly, which is the point of consolidating: the shared IconCamera includes the viewfinder bump the local copy omitted, and drag handles now use IconGripVertical. IconGripVertical uses the module's square 24x24 viewBox, so `.svg-drag` goes from 12x18 to 18x18 — the old non-square box would letterbox the glyph down to 12x12 and shrink the handle. * fix(admin): resolve icon-module integration after #416 Merging dev brought in #416, which added a second IconImage to Icons.tsx and two <Icons.Camera>/<Icons.Folder> section headers that reference the local Icons object this PR removes. Git merged both cleanly but the result did not type-check. - drop the duplicate IconImage (both copies were byte-identical) - point the two section headers at the imported IconCamera/IconFolder - refresh the SORT_LABELS comment: the icon set is imported now, not declared below --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> * fix(config): allow an empty gallery, guard against a double /api suffix (#421) An empty gallery is now a valid, rendered state instead of a throw: deriveGallery() no longer requires at least one album or subpage, so a deployment with no albums yet renders a bare homepage the owner can fill in via /admin. getConfig() also stops appending /api to an Immich URL that already ends in it, which previously produced .../api/api and broke every upstream request. Includes a restore of the per-album sort test cases, which the branch had lost by being cut before #408/#414. * feat(admin): favicon upload, served from the content volume (#422) Adds a bundled default favicon, an upload widget in admin Settings > General, and a route that serves the icon from the writable content/ volume with a fallback to the bundled default. Raster uploads (PNG/ICO/JPEG) are wrapped in an SVG container; the response carries its own CSP so an uploaded SVG cannot execute script on the origin. The GET route revalidates with an ETag instead of caching immutably, so a newly uploaded icon shows up immediately. Uploads are written via temp file + rename, and a Reset button restores the bundled default. * ci: flag unformatted files in a PR, without blocking it (#424) Prettier is configured as an error rule in eslint.config.mjs but has never run in CI, so part of the tree predates it. A final CI step now diffs against the PR base, runs prettier --list-different over the changed files, and emits a warning annotation per offender plus a job summary. Advisory by design: it never fails the job. Blocking would turn a PR red for merely touching a file that was already unformatted, and normalising the tree in one commit would wreck git blame and conflict with the PRs in flight. Requires fetch-depth: 0, since diffing against the base needs its history. * feat(install): first-run wizard gated by a one-time setup token (#419) Adds /install, a four-step first-run wizard: connect to Immich, optionally pick albums, name the site, finish. It verifies the credentials against the Immich server before writing anything, then writes gallery.yaml, settings.yaml and a content/install.json carrying the Immich credentials and a generated site secret. install.json exists because a running process cannot pick up new env vars — the wizard has to write configuration that takes effect without a restart. getInstallCredentials() merges it under the real environment, so env vars always win and rotation stays a matter of setting one. Both the page and the API routes are gated by a one-time setup token printed to the server log, so a deployment that is reachable before gallery.yaml exists cannot be configured by whoever finds it first. The token is stored in content/.setup-token (0600) rather than a module variable: Next.js bundles the page and each route handler separately, so a module-level token left the page and the API disagreeing inside one process and the wizard stuck on step 1. It is removed once the install completes. The admin password is stored as an scrypt hash using the scheme lib/auth.ts already applies to album passwords; a plaintext ADMIN_PASSWORD env var keeps working. * docs: document the setup wizard, fix the read-only content mount (#425) Quick Start now leads with the /install wizard, with the hand-written YAML route kept alongside it, and a First-Run Setup section covers the setup token, the files the wizard writes, and env-var precedence. Two corrections: both Docker examples mounted content/ as :ro, which silently breaks the wizard, the admin panel and the backup rotation alike — docs/admin-panel.md already said so and the README contradicted it. And nothing documented that content/install.json holds the Immich API key, so a backup of content/ is a backup of credentials. Also adds a Contributors section crediting the people whose work is in the project. * feat(admin): floating save bar pinned to the bottom of the viewport (#426) The save bar was the first, static element inside .admin-main. Since the document itself scrolls, it left the viewport as soon as you scrolled down — editing a subpage section or a settings block far below gave no visible dirty hint and no reachable save button. Replace it with a bottom-pinned floating bar shared by both editors. It only mounts while there is something to act on (unsaved changes, an in-flight save, or a result message), so it never covers content while idle. The success message clears after 5s, which hides the bar again. - new SaveBar component, replacing the duplicated markup in PageBuilder and SettingsEditor - adopt the previously unused .floating-save-bar CSS: slide-in keyframes (carrying translateX(-50%)), dirty border, wrap/gap, mobile variant and a prefers-reduced-motion opt-out; z-index 900 keeps it below modals - .admin-main gains bottom padding so the bar never covers page content - drop the now-unreachable idle hints: the ⌘S hint becomes a button title, the Live Sync note becomes a static line above the settings layout - header "Site" link now bypasses the cache (/?fresh=1), so the preview stays reachable when the bar is hidden Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(admin): themed listbox for the album sort control (#427) The per-album "Photo order" control was a native <select>. Because an <option> cannot contain markup, its choices could not use the admin panel's currentColor SVG set — the reason #415 had to fall back to plain text after dropping the emoji labels. Adds a Listbox component implementing the ARIA combobox/listbox pattern, so options can render a glyph beside their label: - DOM focus stays on the trigger button; the active option is announced through aria-activedescendant, keeping focus management to one element - Keyboard: arrows (clamped at the ends, like a native select), Home/End, Enter/Space to commit, Escape to cancel, Tab commits and moves on, and prefix type-ahead with a repeat-key cycle - Outside dismissal on pointerdown, so a press starting outside closes the popup before the click retargets The sort options now carry an icon each: calendar, arrow-down, arrow-up, an A→Z marker, and the drag glyph for manual — matching the badge the album card already shows. SORT_LABELS stays plain text because the badge feeds it to a title attribute. Closes #417 Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(git): ignore generated design handoff folders * fix(admin): stop the album sort dropdown clipping, and simplify the panel (#428) * fix(admin): render listbox popup in a portal so it escapes modal clipping The sort control's popup was position:absolute inside three clipping ancestors (.album-drawer overflow:hidden > .album-drawer-body overflow-y:auto > .modal-right-column overflow-y:auto), so it was cut off at the bottom of the Edit Album Details modal. z-index could not help: clipping happens before stacking. It also always hung below the trigger, with no flip. Portal the popup to document.body and position it from the trigger's viewport rect, flipping above when there is more room there and capping max-height to the space available so it scrolls internally rather than overflowing. It is dismissed on scroll and resize, since the anchor is only measured on open. The outside-pointerdown handler now also treats the popup as inside; without that the portalled list counts as outside, and a click on an option would close it before the selection commits. * refactor(admin): single-column album details panel The left column spent 1.2fr on a cover thumbnail and three stat rows, two of which (Status, Custom Hero) only restated the form fields opposite them, while the form itself was squeezed into 1.8fr behind a second nested scroller. Stack the drawer in one column instead: cover as a banner, then the form at full width, with the UUID moved into the footer. The body is now the only scroll container, which also removes one of the ancestors that was clipping the sort popup. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> * fix(admin): give the portalled listbox its theme back, lock the page behind modals (#429) Two defects in the album editor. The sort listbox popup painted transparent. Every --admin-* variable is scoped to .admin-layout, and since the popup moved into document.body it sits outside that subtree, so background/border/text all resolved to nothing. It now carries its own copy of the palette in both colour schemes, plus the font it no longer inherits. Scrolling inside a modal also moved the page behind it. No admin modal ever locked body scroll: the overlay covers the page but does not absorb wheel events, so a scroll starting on the backdrop — or continuing past the end of the modal's own scroller — reaches the document. overscroll-behavior cannot cover that case on its own, because it only applies to scroll containers and the backdrop is not one. useScrollLock freezes body while a modal is open and compensates for the width the scrollbar gives up, so nothing shifts underneath. Each lock restores the inline value it found, which makes nesting work without a counter — a picker opened from the drawer restores the drawer's hidden state instead of clearing it. Applied to both drawers and all four picker modals, which share the defect. overscroll-behavior: contain on the scrollers stops the chaining they can handle themselves. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com> * fix(security): allow unsafe-eval in CSP script-src during dev mode * feat(journal): add Journal Studio with split-screen editor, live preview and dedicated routes * fix(build): separate client parser from server journal-service and fix build type errors * fix(journal): Fotos rendern, Layout und Lightbox-Steuerung korrigieren Fünf unabhängige Fehler in der öffentlichen Journal- und Essay-Ansicht: * Foto-Blöcke wurden nie angezeigt. EssayView löst ein Foto über PhotoItem.id auf, und das sind verschlüsselte Tokens — die Blöcke aus dem Markdown tragen aber rohe Asset-UUIDs. Jede Zuordnung lief ins Leere, und nicht auflösbare Blöcke werden still verworfen. Die IDs werden jetzt serverseitig übersetzt; damit verschwinden nebenbei die rohen UUIDs aus dem Client-Payload, die dort laut Projektregel nie auftauchen dürfen. Nicht auflösbare Referenzen werden geloggt. * Überschriften standen weiter links als der Fließtext. Jeder Block hatte einzeln `max-width: 68ch`, und `ch` ist relativ zur Schrift des Elements — die Serif-Überschrift ergab eine breitere Spalte. Ersetzt durch eine gemeinsame, font-unabhängige `--essay-measure`. * Fullbleed-Fotos bluteten nur nach links aus: `.essay-figure` ist `width: 100%`, wodurch die Box überbestimmt ist und der negative rechte Margin verworfen wird. * Foto-Paare stellten beide Bilder gleich breit dar, wodurch ein Hochformat neben einem Querformat doppelt so hoch wurde. Jetzt eine Justified-Reihe: Breite proportional zum Seitenverhältnis, dadurch exakt gleiche Höhen ohne Beschnitt. * Die Lightbox hatte im Journal keine Tastatursteuerung und keine Scroll-Sperre — beides lag in PhotoGrid, also nur im Album-Raster. Verlagert in die Lightbox selbst, der doppelte Handler in PhotoGrid entfernt (sonst wäre pro Pfeildruck zwei Bilder weitergesprungen). Zusätzlich sind Proofing-Herzen und das EXIF-Panel im redaktionellen Modus abschaltbar und im Journal aus: Client-Proofing ist ein Übergabe-Workflow für Alben, keine Funktion einer Reportage. Auf der Übersicht wurde der Untertitel doppelt gerendert, weil extractExcerpt() auf ihn zurückfällt. * feat(admin): eigene URLs für alle Bereiche und überarbeiteter Journal Studio Das Panel war eine einzige Client-Komponente, die ihre Tabs über useState umschaltet: keine Route pro Bereich, kein Deep-Link, kein Zurück-Button, und nach jedem Reload landete man wieder auf "Pages". Auch der Journal-Editor hatte keine eigene URL. Jetzt sieben echte Routen (/admin, /admin/pages, /admin/journal, /admin/journal/<slug>, /admin/settings, /admin/settings/<section>, /admin/analytics). Die Shell mit Auth-Prüfung und Kopfzeile sitzt im Layout und umschließt children — so bleibt die Session-Prüfung über Routenwechsel montiert, statt bei jedem Tab-Wechsel neu zu laufen und den Spinner aufblitzen zu lassen. Unbekannte Settings-Sections fallen auf General zurück. Im selben Zug der Journal Studio, der die Routing-Änderung ohnehin berührt: * Alle Eingabefelder nutzten die Klasse `admin-input`, die in keinem CSS definiert war — sie fielen auf Browser-Defaults zurück. Jetzt gestylt, gescoped, damit der generische Name nicht ins übrige Panel leckt. * Der Split View ist per Divider verschiebbar (Maus, Tastatur, Doppelklick zum Zurücksetzen), Breite in localStorage. * Das Studio bricht aus der 1120px-Spalte aus, die Preview hat Platz. * Die Preview zeigte für jedes Foto fest 3:2 und log damit über das Layout der veröffentlichten Seite; die echten Verhältnisse werden jetzt an den Thumbnails gemessen. * Blöcke mit alten positionsbasierten Foto-Referenzen werden markiert — die lassen sich auf einer eigenständigen Journal-Seite nicht auflösen und verschwanden bisher stillschweigend. * Blocktyp-Chips als gemeinsame Komponente, monochrom und per Icon unterschieden statt in einer eigenen Blau/Lila/Orange-Palette, die sonst nirgends im Panel vorkommt. * Emojis raus, SVG-Icons rein. * fix(admin): Designsystem-Lücken im Panel schließen Eine systematische Suche nach Klassen, die im TSX benutzt, aber in keinem CSS definiert sind, hat vier Stellen mit demselben Muster gefunden: * `admin-btn-secondary` und `admin-btn-danger` existierten nicht. Sämtliche Löschen-Buttons sahen aus wie normale Buttons — keine Warnwirkung. Als `.admin-btn.admin-btn-danger` geschrieben, weil die Varianten mit den Größenklassen kombiniert werden, die weiter unten ihren eigenen Hintergrund setzen. * `page-progress-fill` fehlte: die Balken im Analytics-Panel waren leere Rinnen, der Wert unsichtbar. Ebenso `analytics-empty` und `admin-loading-container`. * `subpage-drawer-section`, `subpage-drawer-title-group` und `input-with-icon` im PageBuilder waren wirkungslos und teils mit Inline-Styles notdürftig kompensiert. * `grid-card-preview` fehlte, wodurch alle Layout-Vorschauen auf Höhe null kollabierten. Nur "Showcase" war sichtbar — und das aus Versehen, weil sein Tile `hero-tile` hieß und damit die `aspect-ratio` einer fremden PageBuilder-Klasse erbte. Umbenannt. Dazu die Theme-Vorschauen, die praktisch identisch aussahen: alle sieben zeigten dieselben drei quadratischen Kacheln, einziger Unterschied war die Hintergrundfarbe. Sie spiegeln jetzt die echten Preset-Daten aus lib/config/theme.ts — Schriftcharakter, Eckradius, Rasterdichte, Passepartout bzw. Schatten. Die Kopfzeile richtet sich an einer gemeinsamen Steuerhöhe aus. Der "Site"-Link war höher als die Buttons daneben: `.admin-btn` hatte keine explizite line-height, und <button> bekommt box-sizing: border-box vom Browser, <a> nicht. Die Statusanzeige setzte weder Schriftfamilie noch -größe und fiel auf den Browser-Default zurück — sie war nie Teil des Designsystems. Jetzt gleiche Höhe und Typografie, Pillenform als Zustandsanzeige, Trenner zur Aktionsgruppe. Das dauerhafte Pulsieren des grünen Punkts entfällt; Animation bleibt den Zuständen vorbehalten, die Aufmerksamkeit brauchen. Restliche Emojis durch SVG-Icons ersetzt. * feat(admin): add scroll-to-top toggle and SVG arrow The back-to-top button was always on and drew its arrow with the ↑ text character. Add a `scrollToTop` setting (General section in the admin panel, defaults to on so existing sites are unaffected) and replace the glyph with a stroked SVG that inherits currentColor across all presets. Scroll handling is now rAF-throttled, and prefers-reduced-motion turns off both the hover lift and the smooth scroll. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * security(journal): escape author HTML instead of filtering it CodeQL flags 26 high-severity alerts on the release PR; the bulk of them point at sanitizeHtml(), a denylist of three regexes whose output goes into dangerouslySetInnerHTML. I reproduced the bypasses before changing anything — all four pass the old filter: <img src=x onerror=alert(1)> unquoted handler, regex wants quotes <img src=x onerror='alert(1)'> single quotes, same reason <svg onload=alert(1)> not a <script> tag javasjavascript:cript:alert(1) one-pass replace, the rest recombines Plus an attribute breakout in the link renderer, which interpolated the URL into href="${url}" unescaped: [x](" onmouseover=alert(1) x=") -> <a href="" onmouseover=alert(1" ...> Replaced with escaping. Every `&<>"'` in author text becomes an entity before any markdown rule runs, so the only tags in the output are the ones renderInlineMarkdown builds itself and a URL cannot leave its attribute. Link schemes are now an allowlist (http, https, mailto, tel, relative, anchor); anything else renders as plain text. The serializer needed decodeHtmlEntities to match: without it a save would write `&lt;` into the Markdown file and the next parse would escape the `&` again, corrupting the text further on every round trip. A test covers parse -> serialize -> parse stability. Two existing tests asserted the old behaviour and were rewritten rather than deleted: one expected the script tag to be *removed* from the output, the other expected the substring "onerror" to be absent. Both now assert the property that matters — that no tag can form — because `onerror` surviving as inert text is fine. Exploitation required admin access either way: journal and essay text comes from the studio or from content/*.md. This removes the weakness, it does not close an open door. * fix(journal): contain file paths, fix frontmatter escaping, defuse two regexes Follow-up to the CodeQL findings on release PR #432. I went through all 23 alerts individually; this addresses the ones that are worth addressing and documents the ones that are not. Path containment (12 alerts, all false positives). Every path built from a slug goes through isValidSlug(), a strict `/^[a-zA-Z0-9_-]+$/` allowlist — verified against `../../etc/passwd`, `foo/../../bar`, `a/b`, `..` and friends, all rejected. CodeQL cannot see it because the check lives in another module. Added a containedPath() helper that resolves the path and refuses anything landing outside the content directory: a second lock on a door that was already locked, and a barrier the analysis can follow. Also removed the dead `slug.endsWith('.md')` branches — isValidSlug rejects dots, so they could never be taken. Frontmatter escaping (1 alert, a real bug). The serializer escaped `"` but not `\`, and the parser never unescaped anything. A title containing either character gained a backslash on every save/load cycle: Path C:\Users "quoted" -> Path C:\\Users \"quoted\" -> ... Escaping now covers the backslash first and the parser undoes both. A round trip test covers quotes, backslashes, colons and apostrophes. Two of three ReDoS regexes (2 alerts). The heading pattern had `\s+` next to `(.+)`, which overlap, so the engine tried every split of the whitespace run before failing; it is `[ \t]+` and `(\S.*)` now. The quote author pattern wrapped a lazy group around an optional group — the quadratic case — and is an index split on the first separator now. The third regex, the bold/italic pass, is deliberately left alone. Rewriting it with a negated class removes the backtracking but breaks nesting: `**bold *and italic* here**` renders as `*<em>bold </em>and italic<em> here</em>*`. The input is Markdown from an authenticated admin, never a visitor, so the worst case is an author slowing down their own page. The comment in the code says so. Not addressed: 5 js/insufficient-password-hash alerts. They ask for a slow KDF where the code uses SHA-256/HMAC — correct in general, but the admin password comes from an environment variable and is never stored, so a stronger KDF protects nothing that is not already in plaintext in the environment. 399 unit tests pass (18 new), build and tsc clean. * fix(journal): split the quote author by scanning, not by pattern Cleaning up after myself. #439 replaced the quote author regex `/^(.*?)(?:\s+--\s+(.+))?$/` — a lazy group around an optional one, the quadratic case — with `/\s+--\s+/`, and CodeQL promptly flagged the replacement for the same reason. One reported pattern traded for another. splitQuoteAuthor() scans for the first `--` that has whitespace on both sides. Linear, and it needs no reasoning about the regex engine at all. Behaviour is identical to the original regex, checked case by case against it: separator, no separator, several separators, tabs, wide gaps, `a--b` without spaces, leading and trailing separators, empty string. All nine are covered by tests, plus one asserting it stays fast on a 50k whitespace run. * security(admin): derive the session signing key with scrypt getSigningKey() ran the admin password through a single SHA-256 digest. It is key derivation rather than password storage, so it was never a stored-hash problem — but if the derived key ever leaked, one fast hash makes recovering the password by brute force cheap. CodeQL flags it as js/insufficient-password-hash and, for this particular alert, has a point. scrypt now. Two details that matter: The salt has to be stable. A random salt would produce a different key on every call and invalidate every session; it is derived from AUTH_SECRET, which is deployment-specific. Verified across separate processes: same inputs produce a verifying token, so a restart or redeploy does not log everyone out. The result is cached for the process lifetime. scrypt is deliberately slow and getSigningKey() runs on every admin request — deriving per call would add ~24ms to each one. The cache key is a digest of secret plus password, so a rotation misses the cache and derives again, and no extra plaintext copy of the password is kept around. Measured: first derivation 24ms, subsequent calls 0.12ms. Password change and secret change both invalidate an existing token, checked in separate processes. Note the one-time effect: existing admin sessions are invalidated by the change in derivation, so everyone logs in once more. * security(admin): key the signing-key cache on its inputs, not a digest #441 removed the SHA-256 digest of the admin password from the key derivation and introduced a new one three lines above it, as the cache key. Same rule, same file: CodeQL reported it immediately. The comment justifying it was wrong too. It claimed no second plaintext copy of the password was retained, while building the digest input allocates exactly that in order to hash it. The cache now holds the two input strings and compares them directly. They are the same objects the env and install caches already hold, so nothing extra is retained, and no fast hash of the password exists in memory for the life of the process. Re-verified after the change, in separate processes: a token from one process verifies in another with the same inputs, a changed password or secret rejects it, first derivation 24ms, cached calls 0.001ms. That leaves scrypt as the only place the password is hashed here. The two HMACs further down operate on the derived key and on token data, not on the password; the constant-time comparison in verifyAdminPassword is the previously dismissed one. --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
2026-08-14 16:55:07 +02:00
overscroll-behavior: contain;
security: add Trivy container scan to Docker publish workflow (#399) * feat(admin): add backup manager UI with 1-click restore * feat(admin): collapse older backup entries by default * fix(theme): isolate admin layout, instant DOM theme updates, and add Light/Dark mode toggle * feat(admin): replace text controls for Photo Frame and Hero Style with visual preview cards * fix(admin): define missing CSS rules for button system (.btn, .preset-btn) * feat(admin): redesign theme settings with segmented mode toggle, accent color swatches, and custom iOS-style toggle cards * feat(admin): upgrade all settings tabs with visual grid previews, Google SEO snippet preview, and toggle cards * feat(admin): overhaul Pages Builder UX with slide-over drawer, card hover badges, real-time search, and floating save bar * fix(admin): remove leftover dangling syntax snippet in PageBuilder.tsx * fix(admin): add position: relative to subpage-tile so hover overlay is contained inside the tile * style(admin): replace all emojis with clean Leica-style vector SVG icons * fix(types): extend IconProps with SVGProps to allow style prop on Leica SVG icons * feat(admin): add subpage live-preview, privacy analytics, and asset protection settings * fix(typecheck): fix AlbumEntry property access in subpage drawer preview mode * fix(types): fix ImmichAlbumInfo property names thumbnailAssetId and albumName in PageBuilder.tsx * fix(types): add protection and watermark optional properties to AppConfig interface * feat(settings): add toggle for disabling analytics tracking (defaults to enabled) * feat(ux): show status banner when analytics tracking is disabled + add live sync indicator * feat(watermark): render customizable watermark overlay on Lightbox images + rename section to Portfolio Features & Modules * fix(types): import type LightboxWatermark in PhotoGrid.tsx * fix(types): destructure watermark prop in PhotoGrid function signature * feat(seo): add configurable subpage title template and metadata descriptions * feat(seo): add generateMetadata to about page for title template support * feat(proofing): add client proofing, favorites selection, compact URL bitmasking, and export modal * feat(essay): add Photo Essay storytelling mode with RSC markdown parser and fullbleed/pair layouts * feat(subpages): add page enabled toggle to deactivate subpages without deleting them * feat(admin): add visual essay block builder for photo essay storytelling pages * security: add Trivy container scan to Docker publish workflow Scans the built image for CRITICAL/HIGH CVEs on every release and uploads results to the GitHub Security tab. Non-blocking for now (exit-code 0) so releases aren't gated on findings. Also documents the scan and existing Dependabot coverage in the README. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-08-07 11:08:04 +02:00
flex: 1;
display: flex;
flex-direction: column;
gap: 1.25rem;
}
.subpage-drawer-footer {
padding: 1rem 1.5rem;
border-top: 1px solid var(--admin-border);
background: var(--admin-bg-raised);
display: flex;
align-items: center;
justify-content: space-between;
}
release: v0.11.0 — journal fixes, admin URLs, design system cleanup (#432) * fix(screenshots): sharp-Typen fuer 0.34 und 0.35 gleichzeitig (#410) sharp 0.35 ist von `export =` auf ESM umgestellt: der Modul-Namespace ist nicht mehr aufrufbar, die Factory sitzt unter .default. Der Type-Check brach damit in scripts/screenshots.ts weg, sobald der Next-Bump (#402) sharp von 0.34.5 auf 0.35.3 mitzieht -- sharp ist hier keine deklarierte Dependency, sondern kommt ueber Next mit. Die Form wird jetzt aus dem installierten Paket abgeleitet statt festgeschrieben, zur Laufzeit wie im Typ. Geprueft mit beiden Versionen: tsc laeuft mit 0.34.5 und mit 0.35.3 fehlerfrei durch. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(deps): bump the nextjs group across 1 directory with 2 updates (#402) Bumps the nextjs group with 2 updates in the / directory: [next](https://github.com/vercel/next.js) and [eslint-config-next](https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next). Updates `next` from 16.2.12 to 16.3.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/compare/v16.2.12...v16.3.0) Updates `eslint-config-next` from 16.2.12 to 16.3.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/commits/v16.3.0/packages/eslint-config-next) --- updated-dependencies: - dependency-name: eslint-config-next dependency-version: 16.3.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: nextjs - dependency-name: next dependency-version: 16.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nextjs ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps-dev): bump prettier from 3.8.3 to 3.9.6 (#405) Bumps [prettier](https://github.com/prettier/prettier) from 3.8.3 to 3.9.6. - [Release notes](https://github.com/prettier/prettier/releases) - [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md) - [Commits](https://github.com/prettier/prettier/compare/3.8.3...3.9.6) --- updated-dependencies: - dependency-name: prettier dependency-version: 3.9.6 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * docs(changelog): Unreleased-Sektion fuer die Bumps nach v0.10.0 (#413) Die Dependency-PRs sind nach dem Release auf dev gelandet, teils auch auf main. Ohne Eintrag waeren sie beim naechsten Release unsichtbar -- inklusive Next 16.3.0, das CVE-2025-13465 mitbringt. Ausserdem im 0.10.0-Abschnitt nachgetragen, dass der Trivy-Scan bis #409 nie gelaufen ist. Der Fix steckt im Tag v0.10.0, fehlte aber in der Aufzaehlung -- und "Images werden bei jedem Publish gescannt" stand im Changelog, waehrend der Job im Action-Setup abbrach. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(gallery): per-album sort order, independent of Immich (#408) (#414) Album order was dictated entirely by Immich: getAlbum() sorted by the album's own asc/desc flag, so a Folio album always mirrored the archive. A curated series has a narrative order that has nothing to do with capture time, and changing the Immich album's sort to fit the website changes it for the archive too. Adds an optional per-album `sort` in gallery.yaml, editable in /admin, defaulting to today's behaviour so every existing config is unchanged: immich (default) | newest | oldest | filename | manual `manual` is a pinned *prefix*: `assetOrder` lists only the photos placed by hand, everything else follows in the album's Immich order. A full permutation of a 2,000-photo album would be ~80 KB of UUIDs in a file that is rewritten and copied to content/.backups/ on every admin save. It also makes drift fall out for free — photos removed in Immich never match, new ones land in the tail rather than being hidden. Sorting is applied after the cache read, not before the cache write, so the LRU keeps one canonical Immich-ordered copy per album. That avoids putting the mode in the cache key, lets a config change take effect without depending on invalidation, and keeps the stale-serving path correct. cache.get() returns the stored object by reference, so withSort() returns a shallow clone with a new array — sorting in place would reorder the shared entry, and under request coalescing every concurrent caller would be sorting the same array. Also fixes a prerequisite bug: /api/admin/albums/[albumId]/assets read album.assets from GET /albums/:id, which Immich 3.x no longer populates (lib/immich.ts:507). The hero picker's "This Album" tab returned nothing and threw outright when the key was absent. It now goes through the client's paginated metadata search, with ?types=all to opt videos in for the reorder editor. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): drop decorative emoji from the sort select labels (#415) An <option> cannot contain markup, so the SVG set in Icons is not reachable there — but a decorative emoji is not a substitute for it. Plain text instead; the album card badge already uses a real icon. The remaining emoji in the admin panel (asset picker tabs, section headings, layout picker options) predate this branch and are left for a separate cleanup. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): replace emoji icons with the shared SVG icon set (#416) The admin panel mixed two icon conventions: inline SVGs from `Icons.tsx` in most components, and decorative emoji in the asset picker and a few PageBuilder labels. Emoji render inconsistently across platforms, ignore the accent colour, and cannot inherit the `.svg-icon` sizing rules. - Icons.tsx: add `IconStar` (filled — it marks a state, not an action) and `IconImage`. - AssetPicker: the three tab labels and the favourite tile badge now use IconFolder / IconStar / IconImage. - PageBuilder: the "Standalone Albums" and "Subpages" headings use the icon set instead of an emoji. - PageBuilder: the layout picker drops its emoji for plain text. An <option> cannot contain markup, so an SVG is impossible there and a decorative glyph is not a substitute. - admin.css: align icon and label in the picker tabs, and swap the favourite badge's text-shadow for drop-shadow, which is what applies to an inline SVG. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): fold PageBuilder's local icons into the shared Icons module (#418) * refactor(admin): fold PageBuilder's local icons into the shared module PageBuilder.tsx carried its own `Icons` object duplicating most of the glyphs already exported by Icons.tsx, with hardcoded sizes and slightly divergent paths. Migrate all 32 call sites to the shared module and delete the local object. Five glyphs had no counterpart and are added to Icons.tsx as 1:1 ports of the local paths: IconX, IconPlus, IconHome, IconCopy, IconImage. The local ExternalLink and Check are dropped rather than ported — both had zero call sites. Two glyphs change shape slightly, which is the point of consolidating: the shared IconCamera includes the viewfinder bump the local copy omitted, and drag handles now use IconGripVertical. IconGripVertical uses the module's square 24x24 viewBox, so `.svg-drag` goes from 12x18 to 18x18 — the old non-square box would letterbox the glyph down to 12x12 and shrink the handle. * fix(admin): resolve icon-module integration after #416 Merging dev brought in #416, which added a second IconImage to Icons.tsx and two <Icons.Camera>/<Icons.Folder> section headers that reference the local Icons object this PR removes. Git merged both cleanly but the result did not type-check. - drop the duplicate IconImage (both copies were byte-identical) - point the two section headers at the imported IconCamera/IconFolder - refresh the SORT_LABELS comment: the icon set is imported now, not declared below --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> * fix(config): allow an empty gallery, guard against a double /api suffix (#421) An empty gallery is now a valid, rendered state instead of a throw: deriveGallery() no longer requires at least one album or subpage, so a deployment with no albums yet renders a bare homepage the owner can fill in via /admin. getConfig() also stops appending /api to an Immich URL that already ends in it, which previously produced .../api/api and broke every upstream request. Includes a restore of the per-album sort test cases, which the branch had lost by being cut before #408/#414. * feat(admin): favicon upload, served from the content volume (#422) Adds a bundled default favicon, an upload widget in admin Settings > General, and a route that serves the icon from the writable content/ volume with a fallback to the bundled default. Raster uploads (PNG/ICO/JPEG) are wrapped in an SVG container; the response carries its own CSP so an uploaded SVG cannot execute script on the origin. The GET route revalidates with an ETag instead of caching immutably, so a newly uploaded icon shows up immediately. Uploads are written via temp file + rename, and a Reset button restores the bundled default. * ci: flag unformatted files in a PR, without blocking it (#424) Prettier is configured as an error rule in eslint.config.mjs but has never run in CI, so part of the tree predates it. A final CI step now diffs against the PR base, runs prettier --list-different over the changed files, and emits a warning annotation per offender plus a job summary. Advisory by design: it never fails the job. Blocking would turn a PR red for merely touching a file that was already unformatted, and normalising the tree in one commit would wreck git blame and conflict with the PRs in flight. Requires fetch-depth: 0, since diffing against the base needs its history. * feat(install): first-run wizard gated by a one-time setup token (#419) Adds /install, a four-step first-run wizard: connect to Immich, optionally pick albums, name the site, finish. It verifies the credentials against the Immich server before writing anything, then writes gallery.yaml, settings.yaml and a content/install.json carrying the Immich credentials and a generated site secret. install.json exists because a running process cannot pick up new env vars — the wizard has to write configuration that takes effect without a restart. getInstallCredentials() merges it under the real environment, so env vars always win and rotation stays a matter of setting one. Both the page and the API routes are gated by a one-time setup token printed to the server log, so a deployment that is reachable before gallery.yaml exists cannot be configured by whoever finds it first. The token is stored in content/.setup-token (0600) rather than a module variable: Next.js bundles the page and each route handler separately, so a module-level token left the page and the API disagreeing inside one process and the wizard stuck on step 1. It is removed once the install completes. The admin password is stored as an scrypt hash using the scheme lib/auth.ts already applies to album passwords; a plaintext ADMIN_PASSWORD env var keeps working. * docs: document the setup wizard, fix the read-only content mount (#425) Quick Start now leads with the /install wizard, with the hand-written YAML route kept alongside it, and a First-Run Setup section covers the setup token, the files the wizard writes, and env-var precedence. Two corrections: both Docker examples mounted content/ as :ro, which silently breaks the wizard, the admin panel and the backup rotation alike — docs/admin-panel.md already said so and the README contradicted it. And nothing documented that content/install.json holds the Immich API key, so a backup of content/ is a backup of credentials. Also adds a Contributors section crediting the people whose work is in the project. * feat(admin): floating save bar pinned to the bottom of the viewport (#426) The save bar was the first, static element inside .admin-main. Since the document itself scrolls, it left the viewport as soon as you scrolled down — editing a subpage section or a settings block far below gave no visible dirty hint and no reachable save button. Replace it with a bottom-pinned floating bar shared by both editors. It only mounts while there is something to act on (unsaved changes, an in-flight save, or a result message), so it never covers content while idle. The success message clears after 5s, which hides the bar again. - new SaveBar component, replacing the duplicated markup in PageBuilder and SettingsEditor - adopt the previously unused .floating-save-bar CSS: slide-in keyframes (carrying translateX(-50%)), dirty border, wrap/gap, mobile variant and a prefers-reduced-motion opt-out; z-index 900 keeps it below modals - .admin-main gains bottom padding so the bar never covers page content - drop the now-unreachable idle hints: the ⌘S hint becomes a button title, the Live Sync note becomes a static line above the settings layout - header "Site" link now bypasses the cache (/?fresh=1), so the preview stays reachable when the bar is hidden Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(admin): themed listbox for the album sort control (#427) The per-album "Photo order" control was a native <select>. Because an <option> cannot contain markup, its choices could not use the admin panel's currentColor SVG set — the reason #415 had to fall back to plain text after dropping the emoji labels. Adds a Listbox component implementing the ARIA combobox/listbox pattern, so options can render a glyph beside their label: - DOM focus stays on the trigger button; the active option is announced through aria-activedescendant, keeping focus management to one element - Keyboard: arrows (clamped at the ends, like a native select), Home/End, Enter/Space to commit, Escape to cancel, Tab commits and moves on, and prefix type-ahead with a repeat-key cycle - Outside dismissal on pointerdown, so a press starting outside closes the popup before the click retargets The sort options now carry an icon each: calendar, arrow-down, arrow-up, an A→Z marker, and the drag glyph for manual — matching the badge the album card already shows. SORT_LABELS stays plain text because the badge feeds it to a title attribute. Closes #417 Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(git): ignore generated design handoff folders * fix(admin): stop the album sort dropdown clipping, and simplify the panel (#428) * fix(admin): render listbox popup in a portal so it escapes modal clipping The sort control's popup was position:absolute inside three clipping ancestors (.album-drawer overflow:hidden > .album-drawer-body overflow-y:auto > .modal-right-column overflow-y:auto), so it was cut off at the bottom of the Edit Album Details modal. z-index could not help: clipping happens before stacking. It also always hung below the trigger, with no flip. Portal the popup to document.body and position it from the trigger's viewport rect, flipping above when there is more room there and capping max-height to the space available so it scrolls internally rather than overflowing. It is dismissed on scroll and resize, since the anchor is only measured on open. The outside-pointerdown handler now also treats the popup as inside; without that the portalled list counts as outside, and a click on an option would close it before the selection commits. * refactor(admin): single-column album details panel The left column spent 1.2fr on a cover thumbnail and three stat rows, two of which (Status, Custom Hero) only restated the form fields opposite them, while the form itself was squeezed into 1.8fr behind a second nested scroller. Stack the drawer in one column instead: cover as a banner, then the form at full width, with the UUID moved into the footer. The body is now the only scroll container, which also removes one of the ancestors that was clipping the sort popup. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> * fix(admin): give the portalled listbox its theme back, lock the page behind modals (#429) Two defects in the album editor. The sort listbox popup painted transparent. Every --admin-* variable is scoped to .admin-layout, and since the popup moved into document.body it sits outside that subtree, so background/border/text all resolved to nothing. It now carries its own copy of the palette in both colour schemes, plus the font it no longer inherits. Scrolling inside a modal also moved the page behind it. No admin modal ever locked body scroll: the overlay covers the page but does not absorb wheel events, so a scroll starting on the backdrop — or continuing past the end of the modal's own scroller — reaches the document. overscroll-behavior cannot cover that case on its own, because it only applies to scroll containers and the backdrop is not one. useScrollLock freezes body while a modal is open and compensates for the width the scrollbar gives up, so nothing shifts underneath. Each lock restores the inline value it found, which makes nesting work without a counter — a picker opened from the drawer restores the drawer's hidden state instead of clearing it. Applied to both drawers and all four picker modals, which share the defect. overscroll-behavior: contain on the scrollers stops the chaining they can handle themselves. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com> * fix(security): allow unsafe-eval in CSP script-src during dev mode * feat(journal): add Journal Studio with split-screen editor, live preview and dedicated routes * fix(build): separate client parser from server journal-service and fix build type errors * fix(journal): Fotos rendern, Layout und Lightbox-Steuerung korrigieren Fünf unabhängige Fehler in der öffentlichen Journal- und Essay-Ansicht: * Foto-Blöcke wurden nie angezeigt. EssayView löst ein Foto über PhotoItem.id auf, und das sind verschlüsselte Tokens — die Blöcke aus dem Markdown tragen aber rohe Asset-UUIDs. Jede Zuordnung lief ins Leere, und nicht auflösbare Blöcke werden still verworfen. Die IDs werden jetzt serverseitig übersetzt; damit verschwinden nebenbei die rohen UUIDs aus dem Client-Payload, die dort laut Projektregel nie auftauchen dürfen. Nicht auflösbare Referenzen werden geloggt. * Überschriften standen weiter links als der Fließtext. Jeder Block hatte einzeln `max-width: 68ch`, und `ch` ist relativ zur Schrift des Elements — die Serif-Überschrift ergab eine breitere Spalte. Ersetzt durch eine gemeinsame, font-unabhängige `--essay-measure`. * Fullbleed-Fotos bluteten nur nach links aus: `.essay-figure` ist `width: 100%`, wodurch die Box überbestimmt ist und der negative rechte Margin verworfen wird. * Foto-Paare stellten beide Bilder gleich breit dar, wodurch ein Hochformat neben einem Querformat doppelt so hoch wurde. Jetzt eine Justified-Reihe: Breite proportional zum Seitenverhältnis, dadurch exakt gleiche Höhen ohne Beschnitt. * Die Lightbox hatte im Journal keine Tastatursteuerung und keine Scroll-Sperre — beides lag in PhotoGrid, also nur im Album-Raster. Verlagert in die Lightbox selbst, der doppelte Handler in PhotoGrid entfernt (sonst wäre pro Pfeildruck zwei Bilder weitergesprungen). Zusätzlich sind Proofing-Herzen und das EXIF-Panel im redaktionellen Modus abschaltbar und im Journal aus: Client-Proofing ist ein Übergabe-Workflow für Alben, keine Funktion einer Reportage. Auf der Übersicht wurde der Untertitel doppelt gerendert, weil extractExcerpt() auf ihn zurückfällt. * feat(admin): eigene URLs für alle Bereiche und überarbeiteter Journal Studio Das Panel war eine einzige Client-Komponente, die ihre Tabs über useState umschaltet: keine Route pro Bereich, kein Deep-Link, kein Zurück-Button, und nach jedem Reload landete man wieder auf "Pages". Auch der Journal-Editor hatte keine eigene URL. Jetzt sieben echte Routen (/admin, /admin/pages, /admin/journal, /admin/journal/<slug>, /admin/settings, /admin/settings/<section>, /admin/analytics). Die Shell mit Auth-Prüfung und Kopfzeile sitzt im Layout und umschließt children — so bleibt die Session-Prüfung über Routenwechsel montiert, statt bei jedem Tab-Wechsel neu zu laufen und den Spinner aufblitzen zu lassen. Unbekannte Settings-Sections fallen auf General zurück. Im selben Zug der Journal Studio, der die Routing-Änderung ohnehin berührt: * Alle Eingabefelder nutzten die Klasse `admin-input`, die in keinem CSS definiert war — sie fielen auf Browser-Defaults zurück. Jetzt gestylt, gescoped, damit der generische Name nicht ins übrige Panel leckt. * Der Split View ist per Divider verschiebbar (Maus, Tastatur, Doppelklick zum Zurücksetzen), Breite in localStorage. * Das Studio bricht aus der 1120px-Spalte aus, die Preview hat Platz. * Die Preview zeigte für jedes Foto fest 3:2 und log damit über das Layout der veröffentlichten Seite; die echten Verhältnisse werden jetzt an den Thumbnails gemessen. * Blöcke mit alten positionsbasierten Foto-Referenzen werden markiert — die lassen sich auf einer eigenständigen Journal-Seite nicht auflösen und verschwanden bisher stillschweigend. * Blocktyp-Chips als gemeinsame Komponente, monochrom und per Icon unterschieden statt in einer eigenen Blau/Lila/Orange-Palette, die sonst nirgends im Panel vorkommt. * Emojis raus, SVG-Icons rein. * fix(admin): Designsystem-Lücken im Panel schließen Eine systematische Suche nach Klassen, die im TSX benutzt, aber in keinem CSS definiert sind, hat vier Stellen mit demselben Muster gefunden: * `admin-btn-secondary` und `admin-btn-danger` existierten nicht. Sämtliche Löschen-Buttons sahen aus wie normale Buttons — keine Warnwirkung. Als `.admin-btn.admin-btn-danger` geschrieben, weil die Varianten mit den Größenklassen kombiniert werden, die weiter unten ihren eigenen Hintergrund setzen. * `page-progress-fill` fehlte: die Balken im Analytics-Panel waren leere Rinnen, der Wert unsichtbar. Ebenso `analytics-empty` und `admin-loading-container`. * `subpage-drawer-section`, `subpage-drawer-title-group` und `input-with-icon` im PageBuilder waren wirkungslos und teils mit Inline-Styles notdürftig kompensiert. * `grid-card-preview` fehlte, wodurch alle Layout-Vorschauen auf Höhe null kollabierten. Nur "Showcase" war sichtbar — und das aus Versehen, weil sein Tile `hero-tile` hieß und damit die `aspect-ratio` einer fremden PageBuilder-Klasse erbte. Umbenannt. Dazu die Theme-Vorschauen, die praktisch identisch aussahen: alle sieben zeigten dieselben drei quadratischen Kacheln, einziger Unterschied war die Hintergrundfarbe. Sie spiegeln jetzt die echten Preset-Daten aus lib/config/theme.ts — Schriftcharakter, Eckradius, Rasterdichte, Passepartout bzw. Schatten. Die Kopfzeile richtet sich an einer gemeinsamen Steuerhöhe aus. Der "Site"-Link war höher als die Buttons daneben: `.admin-btn` hatte keine explizite line-height, und <button> bekommt box-sizing: border-box vom Browser, <a> nicht. Die Statusanzeige setzte weder Schriftfamilie noch -größe und fiel auf den Browser-Default zurück — sie war nie Teil des Designsystems. Jetzt gleiche Höhe und Typografie, Pillenform als Zustandsanzeige, Trenner zur Aktionsgruppe. Das dauerhafte Pulsieren des grünen Punkts entfällt; Animation bleibt den Zuständen vorbehalten, die Aufmerksamkeit brauchen. Restliche Emojis durch SVG-Icons ersetzt. * feat(admin): add scroll-to-top toggle and SVG arrow The back-to-top button was always on and drew its arrow with the ↑ text character. Add a `scrollToTop` setting (General section in the admin panel, defaults to on so existing sites are unaffected) and replace the glyph with a stroked SVG that inherits currentColor across all presets. Scroll handling is now rAF-throttled, and prefers-reduced-motion turns off both the hover lift and the smooth scroll. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * security(journal): escape author HTML instead of filtering it CodeQL flags 26 high-severity alerts on the release PR; the bulk of them point at sanitizeHtml(), a denylist of three regexes whose output goes into dangerouslySetInnerHTML. I reproduced the bypasses before changing anything — all four pass the old filter: <img src=x onerror=alert(1)> unquoted handler, regex wants quotes <img src=x onerror='alert(1)'> single quotes, same reason <svg onload=alert(1)> not a <script> tag javasjavascript:cript:alert(1) one-pass replace, the rest recombines Plus an attribute breakout in the link renderer, which interpolated the URL into href="${url}" unescaped: [x](" onmouseover=alert(1) x=") -> <a href="" onmouseover=alert(1" ...> Replaced with escaping. Every `&<>"'` in author text becomes an entity before any markdown rule runs, so the only tags in the output are the ones renderInlineMarkdown builds itself and a URL cannot leave its attribute. Link schemes are now an allowlist (http, https, mailto, tel, relative, anchor); anything else renders as plain text. The serializer needed decodeHtmlEntities to match: without it a save would write `&lt;` into the Markdown file and the next parse would escape the `&` again, corrupting the text further on every round trip. A test covers parse -> serialize -> parse stability. Two existing tests asserted the old behaviour and were rewritten rather than deleted: one expected the script tag to be *removed* from the output, the other expected the substring "onerror" to be absent. Both now assert the property that matters — that no tag can form — because `onerror` surviving as inert text is fine. Exploitation required admin access either way: journal and essay text comes from the studio or from content/*.md. This removes the weakness, it does not close an open door. * fix(journal): contain file paths, fix frontmatter escaping, defuse two regexes Follow-up to the CodeQL findings on release PR #432. I went through all 23 alerts individually; this addresses the ones that are worth addressing and documents the ones that are not. Path containment (12 alerts, all false positives). Every path built from a slug goes through isValidSlug(), a strict `/^[a-zA-Z0-9_-]+$/` allowlist — verified against `../../etc/passwd`, `foo/../../bar`, `a/b`, `..` and friends, all rejected. CodeQL cannot see it because the check lives in another module. Added a containedPath() helper that resolves the path and refuses anything landing outside the content directory: a second lock on a door that was already locked, and a barrier the analysis can follow. Also removed the dead `slug.endsWith('.md')` branches — isValidSlug rejects dots, so they could never be taken. Frontmatter escaping (1 alert, a real bug). The serializer escaped `"` but not `\`, and the parser never unescaped anything. A title containing either character gained a backslash on every save/load cycle: Path C:\Users "quoted" -> Path C:\\Users \"quoted\" -> ... Escaping now covers the backslash first and the parser undoes both. A round trip test covers quotes, backslashes, colons and apostrophes. Two of three ReDoS regexes (2 alerts). The heading pattern had `\s+` next to `(.+)`, which overlap, so the engine tried every split of the whitespace run before failing; it is `[ \t]+` and `(\S.*)` now. The quote author pattern wrapped a lazy group around an optional group — the quadratic case — and is an index split on the first separator now. The third regex, the bold/italic pass, is deliberately left alone. Rewriting it with a negated class removes the backtracking but breaks nesting: `**bold *and italic* here**` renders as `*<em>bold </em>and italic<em> here</em>*`. The input is Markdown from an authenticated admin, never a visitor, so the worst case is an author slowing down their own page. The comment in the code says so. Not addressed: 5 js/insufficient-password-hash alerts. They ask for a slow KDF where the code uses SHA-256/HMAC — correct in general, but the admin password comes from an environment variable and is never stored, so a stronger KDF protects nothing that is not already in plaintext in the environment. 399 unit tests pass (18 new), build and tsc clean. * fix(journal): split the quote author by scanning, not by pattern Cleaning up after myself. #439 replaced the quote author regex `/^(.*?)(?:\s+--\s+(.+))?$/` — a lazy group around an optional one, the quadratic case — with `/\s+--\s+/`, and CodeQL promptly flagged the replacement for the same reason. One reported pattern traded for another. splitQuoteAuthor() scans for the first `--` that has whitespace on both sides. Linear, and it needs no reasoning about the regex engine at all. Behaviour is identical to the original regex, checked case by case against it: separator, no separator, several separators, tabs, wide gaps, `a--b` without spaces, leading and trailing separators, empty string. All nine are covered by tests, plus one asserting it stays fast on a 50k whitespace run. * security(admin): derive the session signing key with scrypt getSigningKey() ran the admin password through a single SHA-256 digest. It is key derivation rather than password storage, so it was never a stored-hash problem — but if the derived key ever leaked, one fast hash makes recovering the password by brute force cheap. CodeQL flags it as js/insufficient-password-hash and, for this particular alert, has a point. scrypt now. Two details that matter: The salt has to be stable. A random salt would produce a different key on every call and invalidate every session; it is derived from AUTH_SECRET, which is deployment-specific. Verified across separate processes: same inputs produce a verifying token, so a restart or redeploy does not log everyone out. The result is cached for the process lifetime. scrypt is deliberately slow and getSigningKey() runs on every admin request — deriving per call would add ~24ms to each one. The cache key is a digest of secret plus password, so a rotation misses the cache and derives again, and no extra plaintext copy of the password is kept around. Measured: first derivation 24ms, subsequent calls 0.12ms. Password change and secret change both invalidate an existing token, checked in separate processes. Note the one-time effect: existing admin sessions are invalidated by the change in derivation, so everyone logs in once more. * security(admin): key the signing-key cache on its inputs, not a digest #441 removed the SHA-256 digest of the admin password from the key derivation and introduced a new one three lines above it, as the cache key. Same rule, same file: CodeQL reported it immediately. The comment justifying it was wrong too. It claimed no second plaintext copy of the password was retained, while building the digest input allocates exactly that in order to hash it. The cache now holds the two input strings and compares them directly. They are the same objects the env and install caches already hold, so nothing extra is retained, and no fast hash of the password exists in memory for the life of the process. Re-verified after the change, in separate processes: a token from one process verifies in another with the same inputs, a changed password or secret rejects it, first derivation 24ms, cached calls 0.001ms. That leaves scrypt as the only place the password is hashed here. The two HMACs further down operate on the derived key and on token data, not on the password; the constant-time comparison in verifyAdminPassword is the previously dismissed one. --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
2026-08-14 16:55:07 +02:00
/* Breadcrumb + title stack on the left of the drawer header. */
.subpage-drawer-title-group {
display: flex;
flex-direction: column;
min-width: 0;
}
/* One thematic group of fields inside the drawer body. */
.subpage-drawer-section {
display: flex;
flex-direction: column;
gap: 1rem;
padding: 1rem;
background: var(--admin-bg-raised);
border: 1px solid var(--admin-border);
border-radius: 8px;
}
.subpage-drawer-section > .admin-field:only-child {
margin-bottom: 0;
}
/* Heading + hint at the top of a drawer section. */
.drawer-section-heading h4 {
margin: 0;
font-size: 1rem;
display: flex;
align-items: center;
gap: 8px;
}
.drawer-section-heading p {
margin: 4px 0 0;
font-size: 0.8rem;
color: var(--admin-text-muted);
}
/* Published / hidden marker, replacing the traffic-light emoji. */
/* Named apart from the header badge's .status-dot, which is a different dot. */
.page-status-dot {
width: 8px;
height: 8px;
border-radius: 50%;
flex-shrink: 0;
display: inline-block;
margin-right: 2px;
}
.page-status-dot.is-on {
background: #22c55e;
box-shadow: 0 0 0 3px rgba(34, 197, 94, 0.18);
}
.page-status-dot.is-off {
background: #ef4444;
box-shadow: 0 0 0 3px rgba(239, 68, 68, 0.18);
}
.input-with-icon {
position: relative;
display: flex;
align-items: center;
width: 100%;
}
.input-with-icon > input {
width: 100%;
}
security: add Trivy container scan to Docker publish workflow (#399) * feat(admin): add backup manager UI with 1-click restore * feat(admin): collapse older backup entries by default * fix(theme): isolate admin layout, instant DOM theme updates, and add Light/Dark mode toggle * feat(admin): replace text controls for Photo Frame and Hero Style with visual preview cards * fix(admin): define missing CSS rules for button system (.btn, .preset-btn) * feat(admin): redesign theme settings with segmented mode toggle, accent color swatches, and custom iOS-style toggle cards * feat(admin): upgrade all settings tabs with visual grid previews, Google SEO snippet preview, and toggle cards * feat(admin): overhaul Pages Builder UX with slide-over drawer, card hover badges, real-time search, and floating save bar * fix(admin): remove leftover dangling syntax snippet in PageBuilder.tsx * fix(admin): add position: relative to subpage-tile so hover overlay is contained inside the tile * style(admin): replace all emojis with clean Leica-style vector SVG icons * fix(types): extend IconProps with SVGProps to allow style prop on Leica SVG icons * feat(admin): add subpage live-preview, privacy analytics, and asset protection settings * fix(typecheck): fix AlbumEntry property access in subpage drawer preview mode * fix(types): fix ImmichAlbumInfo property names thumbnailAssetId and albumName in PageBuilder.tsx * fix(types): add protection and watermark optional properties to AppConfig interface * feat(settings): add toggle for disabling analytics tracking (defaults to enabled) * feat(ux): show status banner when analytics tracking is disabled + add live sync indicator * feat(watermark): render customizable watermark overlay on Lightbox images + rename section to Portfolio Features & Modules * fix(types): import type LightboxWatermark in PhotoGrid.tsx * fix(types): destructure watermark prop in PhotoGrid function signature * feat(seo): add configurable subpage title template and metadata descriptions * feat(seo): add generateMetadata to about page for title template support * feat(proofing): add client proofing, favorites selection, compact URL bitmasking, and export modal * feat(essay): add Photo Essay storytelling mode with RSC markdown parser and fullbleed/pair layouts * feat(subpages): add page enabled toggle to deactivate subpages without deleting them * feat(admin): add visual essay block builder for photo essay storytelling pages * security: add Trivy container scan to Docker publish workflow Scans the built image for CRITICAL/HIGH CVEs on every release and uploads results to the GitHub Security tab. Non-blocking for now (exit-code 0) so releases aren't gated on findings. Also documents the scan and existing Dependabot coverage in the README. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-08-07 11:08:04 +02:00
.input-slug-wrapper {
position: relative;
display: flex;
align-items: center;
}
.input-slug-preview {
position: absolute;
right: 12px;
font-size: 0.75rem;
font-family: var(--font-mono, monospace);
color: var(--admin-text-muted);
pointer-events: none;
background: var(--admin-bg-elevated);
padding: 2px 8px;
border-radius: 4px;
}
.password-input-wrapper {
position: relative;
display: flex;
align-items: center;
}
.password-icon {
position: absolute;
left: 12px;
font-size: 0.85rem;
pointer-events: none;
}
.password-input-wrapper input {
padding-left: 2.25rem !important;
}
/* ── Dynamic Floating Save Bar ───────────────────────────────── */
.floating-save-bar {
position: fixed;
bottom: 1.5rem;
left: 50%;
transform: translateX(-50%);
background: var(--admin-bg-raised, #1f1f1f);
border: 1px solid var(--admin-border-hover, #444);
chore(release): v0.10.0 (#400) Photo Essay mode, client proofing, studio-modern preset, admin panel overhaul, watermark, cookieless analytics, subpage toggle, SEO title templates. Analytics API now admin-only, Trivy scan on publish. Album order mirrors the Immich timeline; map theme, admin status panel, lightbox counter and Docker health check fixed. See CHANGELOG.md for the full list and the health-check upgrade note.
2026-08-10 09:56:20 +02:00
box-shadow:
0 10px 30px rgba(0, 0, 0, 0.5),
0 0 0 1px rgba(255, 255, 255, 0.05);
security: add Trivy container scan to Docker publish workflow (#399) * feat(admin): add backup manager UI with 1-click restore * feat(admin): collapse older backup entries by default * fix(theme): isolate admin layout, instant DOM theme updates, and add Light/Dark mode toggle * feat(admin): replace text controls for Photo Frame and Hero Style with visual preview cards * fix(admin): define missing CSS rules for button system (.btn, .preset-btn) * feat(admin): redesign theme settings with segmented mode toggle, accent color swatches, and custom iOS-style toggle cards * feat(admin): upgrade all settings tabs with visual grid previews, Google SEO snippet preview, and toggle cards * feat(admin): overhaul Pages Builder UX with slide-over drawer, card hover badges, real-time search, and floating save bar * fix(admin): remove leftover dangling syntax snippet in PageBuilder.tsx * fix(admin): add position: relative to subpage-tile so hover overlay is contained inside the tile * style(admin): replace all emojis with clean Leica-style vector SVG icons * fix(types): extend IconProps with SVGProps to allow style prop on Leica SVG icons * feat(admin): add subpage live-preview, privacy analytics, and asset protection settings * fix(typecheck): fix AlbumEntry property access in subpage drawer preview mode * fix(types): fix ImmichAlbumInfo property names thumbnailAssetId and albumName in PageBuilder.tsx * fix(types): add protection and watermark optional properties to AppConfig interface * feat(settings): add toggle for disabling analytics tracking (defaults to enabled) * feat(ux): show status banner when analytics tracking is disabled + add live sync indicator * feat(watermark): render customizable watermark overlay on Lightbox images + rename section to Portfolio Features & Modules * fix(types): import type LightboxWatermark in PhotoGrid.tsx * fix(types): destructure watermark prop in PhotoGrid function signature * feat(seo): add configurable subpage title template and metadata descriptions * feat(seo): add generateMetadata to about page for title template support * feat(proofing): add client proofing, favorites selection, compact URL bitmasking, and export modal * feat(essay): add Photo Essay storytelling mode with RSC markdown parser and fullbleed/pair layouts * feat(subpages): add page enabled toggle to deactivate subpages without deleting them * feat(admin): add visual essay block builder for photo essay storytelling pages * security: add Trivy container scan to Docker publish workflow Scans the built image for CRITICAL/HIGH CVEs on every release and uploads results to the GitHub Security tab. Non-blocking for now (exit-code 0) so releases aren't gated on findings. Also documents the scan and existing Dependabot coverage in the README. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-08-07 11:08:04 +02:00
border-radius: 16px;
padding: 0.75rem 1.25rem;
z-index: 900;
display: flex;
align-items: center;
justify-content: space-between;
release: v0.11.0 — journal fixes, admin URLs, design system cleanup (#432) * fix(screenshots): sharp-Typen fuer 0.34 und 0.35 gleichzeitig (#410) sharp 0.35 ist von `export =` auf ESM umgestellt: der Modul-Namespace ist nicht mehr aufrufbar, die Factory sitzt unter .default. Der Type-Check brach damit in scripts/screenshots.ts weg, sobald der Next-Bump (#402) sharp von 0.34.5 auf 0.35.3 mitzieht -- sharp ist hier keine deklarierte Dependency, sondern kommt ueber Next mit. Die Form wird jetzt aus dem installierten Paket abgeleitet statt festgeschrieben, zur Laufzeit wie im Typ. Geprueft mit beiden Versionen: tsc laeuft mit 0.34.5 und mit 0.35.3 fehlerfrei durch. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(deps): bump the nextjs group across 1 directory with 2 updates (#402) Bumps the nextjs group with 2 updates in the / directory: [next](https://github.com/vercel/next.js) and [eslint-config-next](https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next). Updates `next` from 16.2.12 to 16.3.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/compare/v16.2.12...v16.3.0) Updates `eslint-config-next` from 16.2.12 to 16.3.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/commits/v16.3.0/packages/eslint-config-next) --- updated-dependencies: - dependency-name: eslint-config-next dependency-version: 16.3.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: nextjs - dependency-name: next dependency-version: 16.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nextjs ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps-dev): bump prettier from 3.8.3 to 3.9.6 (#405) Bumps [prettier](https://github.com/prettier/prettier) from 3.8.3 to 3.9.6. - [Release notes](https://github.com/prettier/prettier/releases) - [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md) - [Commits](https://github.com/prettier/prettier/compare/3.8.3...3.9.6) --- updated-dependencies: - dependency-name: prettier dependency-version: 3.9.6 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * docs(changelog): Unreleased-Sektion fuer die Bumps nach v0.10.0 (#413) Die Dependency-PRs sind nach dem Release auf dev gelandet, teils auch auf main. Ohne Eintrag waeren sie beim naechsten Release unsichtbar -- inklusive Next 16.3.0, das CVE-2025-13465 mitbringt. Ausserdem im 0.10.0-Abschnitt nachgetragen, dass der Trivy-Scan bis #409 nie gelaufen ist. Der Fix steckt im Tag v0.10.0, fehlte aber in der Aufzaehlung -- und "Images werden bei jedem Publish gescannt" stand im Changelog, waehrend der Job im Action-Setup abbrach. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(gallery): per-album sort order, independent of Immich (#408) (#414) Album order was dictated entirely by Immich: getAlbum() sorted by the album's own asc/desc flag, so a Folio album always mirrored the archive. A curated series has a narrative order that has nothing to do with capture time, and changing the Immich album's sort to fit the website changes it for the archive too. Adds an optional per-album `sort` in gallery.yaml, editable in /admin, defaulting to today's behaviour so every existing config is unchanged: immich (default) | newest | oldest | filename | manual `manual` is a pinned *prefix*: `assetOrder` lists only the photos placed by hand, everything else follows in the album's Immich order. A full permutation of a 2,000-photo album would be ~80 KB of UUIDs in a file that is rewritten and copied to content/.backups/ on every admin save. It also makes drift fall out for free — photos removed in Immich never match, new ones land in the tail rather than being hidden. Sorting is applied after the cache read, not before the cache write, so the LRU keeps one canonical Immich-ordered copy per album. That avoids putting the mode in the cache key, lets a config change take effect without depending on invalidation, and keeps the stale-serving path correct. cache.get() returns the stored object by reference, so withSort() returns a shallow clone with a new array — sorting in place would reorder the shared entry, and under request coalescing every concurrent caller would be sorting the same array. Also fixes a prerequisite bug: /api/admin/albums/[albumId]/assets read album.assets from GET /albums/:id, which Immich 3.x no longer populates (lib/immich.ts:507). The hero picker's "This Album" tab returned nothing and threw outright when the key was absent. It now goes through the client's paginated metadata search, with ?types=all to opt videos in for the reorder editor. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): drop decorative emoji from the sort select labels (#415) An <option> cannot contain markup, so the SVG set in Icons is not reachable there — but a decorative emoji is not a substitute for it. Plain text instead; the album card badge already uses a real icon. The remaining emoji in the admin panel (asset picker tabs, section headings, layout picker options) predate this branch and are left for a separate cleanup. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): replace emoji icons with the shared SVG icon set (#416) The admin panel mixed two icon conventions: inline SVGs from `Icons.tsx` in most components, and decorative emoji in the asset picker and a few PageBuilder labels. Emoji render inconsistently across platforms, ignore the accent colour, and cannot inherit the `.svg-icon` sizing rules. - Icons.tsx: add `IconStar` (filled — it marks a state, not an action) and `IconImage`. - AssetPicker: the three tab labels and the favourite tile badge now use IconFolder / IconStar / IconImage. - PageBuilder: the "Standalone Albums" and "Subpages" headings use the icon set instead of an emoji. - PageBuilder: the layout picker drops its emoji for plain text. An <option> cannot contain markup, so an SVG is impossible there and a decorative glyph is not a substitute. - admin.css: align icon and label in the picker tabs, and swap the favourite badge's text-shadow for drop-shadow, which is what applies to an inline SVG. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): fold PageBuilder's local icons into the shared Icons module (#418) * refactor(admin): fold PageBuilder's local icons into the shared module PageBuilder.tsx carried its own `Icons` object duplicating most of the glyphs already exported by Icons.tsx, with hardcoded sizes and slightly divergent paths. Migrate all 32 call sites to the shared module and delete the local object. Five glyphs had no counterpart and are added to Icons.tsx as 1:1 ports of the local paths: IconX, IconPlus, IconHome, IconCopy, IconImage. The local ExternalLink and Check are dropped rather than ported — both had zero call sites. Two glyphs change shape slightly, which is the point of consolidating: the shared IconCamera includes the viewfinder bump the local copy omitted, and drag handles now use IconGripVertical. IconGripVertical uses the module's square 24x24 viewBox, so `.svg-drag` goes from 12x18 to 18x18 — the old non-square box would letterbox the glyph down to 12x12 and shrink the handle. * fix(admin): resolve icon-module integration after #416 Merging dev brought in #416, which added a second IconImage to Icons.tsx and two <Icons.Camera>/<Icons.Folder> section headers that reference the local Icons object this PR removes. Git merged both cleanly but the result did not type-check. - drop the duplicate IconImage (both copies were byte-identical) - point the two section headers at the imported IconCamera/IconFolder - refresh the SORT_LABELS comment: the icon set is imported now, not declared below --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> * fix(config): allow an empty gallery, guard against a double /api suffix (#421) An empty gallery is now a valid, rendered state instead of a throw: deriveGallery() no longer requires at least one album or subpage, so a deployment with no albums yet renders a bare homepage the owner can fill in via /admin. getConfig() also stops appending /api to an Immich URL that already ends in it, which previously produced .../api/api and broke every upstream request. Includes a restore of the per-album sort test cases, which the branch had lost by being cut before #408/#414. * feat(admin): favicon upload, served from the content volume (#422) Adds a bundled default favicon, an upload widget in admin Settings > General, and a route that serves the icon from the writable content/ volume with a fallback to the bundled default. Raster uploads (PNG/ICO/JPEG) are wrapped in an SVG container; the response carries its own CSP so an uploaded SVG cannot execute script on the origin. The GET route revalidates with an ETag instead of caching immutably, so a newly uploaded icon shows up immediately. Uploads are written via temp file + rename, and a Reset button restores the bundled default. * ci: flag unformatted files in a PR, without blocking it (#424) Prettier is configured as an error rule in eslint.config.mjs but has never run in CI, so part of the tree predates it. A final CI step now diffs against the PR base, runs prettier --list-different over the changed files, and emits a warning annotation per offender plus a job summary. Advisory by design: it never fails the job. Blocking would turn a PR red for merely touching a file that was already unformatted, and normalising the tree in one commit would wreck git blame and conflict with the PRs in flight. Requires fetch-depth: 0, since diffing against the base needs its history. * feat(install): first-run wizard gated by a one-time setup token (#419) Adds /install, a four-step first-run wizard: connect to Immich, optionally pick albums, name the site, finish. It verifies the credentials against the Immich server before writing anything, then writes gallery.yaml, settings.yaml and a content/install.json carrying the Immich credentials and a generated site secret. install.json exists because a running process cannot pick up new env vars — the wizard has to write configuration that takes effect without a restart. getInstallCredentials() merges it under the real environment, so env vars always win and rotation stays a matter of setting one. Both the page and the API routes are gated by a one-time setup token printed to the server log, so a deployment that is reachable before gallery.yaml exists cannot be configured by whoever finds it first. The token is stored in content/.setup-token (0600) rather than a module variable: Next.js bundles the page and each route handler separately, so a module-level token left the page and the API disagreeing inside one process and the wizard stuck on step 1. It is removed once the install completes. The admin password is stored as an scrypt hash using the scheme lib/auth.ts already applies to album passwords; a plaintext ADMIN_PASSWORD env var keeps working. * docs: document the setup wizard, fix the read-only content mount (#425) Quick Start now leads with the /install wizard, with the hand-written YAML route kept alongside it, and a First-Run Setup section covers the setup token, the files the wizard writes, and env-var precedence. Two corrections: both Docker examples mounted content/ as :ro, which silently breaks the wizard, the admin panel and the backup rotation alike — docs/admin-panel.md already said so and the README contradicted it. And nothing documented that content/install.json holds the Immich API key, so a backup of content/ is a backup of credentials. Also adds a Contributors section crediting the people whose work is in the project. * feat(admin): floating save bar pinned to the bottom of the viewport (#426) The save bar was the first, static element inside .admin-main. Since the document itself scrolls, it left the viewport as soon as you scrolled down — editing a subpage section or a settings block far below gave no visible dirty hint and no reachable save button. Replace it with a bottom-pinned floating bar shared by both editors. It only mounts while there is something to act on (unsaved changes, an in-flight save, or a result message), so it never covers content while idle. The success message clears after 5s, which hides the bar again. - new SaveBar component, replacing the duplicated markup in PageBuilder and SettingsEditor - adopt the previously unused .floating-save-bar CSS: slide-in keyframes (carrying translateX(-50%)), dirty border, wrap/gap, mobile variant and a prefers-reduced-motion opt-out; z-index 900 keeps it below modals - .admin-main gains bottom padding so the bar never covers page content - drop the now-unreachable idle hints: the ⌘S hint becomes a button title, the Live Sync note becomes a static line above the settings layout - header "Site" link now bypasses the cache (/?fresh=1), so the preview stays reachable when the bar is hidden Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(admin): themed listbox for the album sort control (#427) The per-album "Photo order" control was a native <select>. Because an <option> cannot contain markup, its choices could not use the admin panel's currentColor SVG set — the reason #415 had to fall back to plain text after dropping the emoji labels. Adds a Listbox component implementing the ARIA combobox/listbox pattern, so options can render a glyph beside their label: - DOM focus stays on the trigger button; the active option is announced through aria-activedescendant, keeping focus management to one element - Keyboard: arrows (clamped at the ends, like a native select), Home/End, Enter/Space to commit, Escape to cancel, Tab commits and moves on, and prefix type-ahead with a repeat-key cycle - Outside dismissal on pointerdown, so a press starting outside closes the popup before the click retargets The sort options now carry an icon each: calendar, arrow-down, arrow-up, an A→Z marker, and the drag glyph for manual — matching the badge the album card already shows. SORT_LABELS stays plain text because the badge feeds it to a title attribute. Closes #417 Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(git): ignore generated design handoff folders * fix(admin): stop the album sort dropdown clipping, and simplify the panel (#428) * fix(admin): render listbox popup in a portal so it escapes modal clipping The sort control's popup was position:absolute inside three clipping ancestors (.album-drawer overflow:hidden > .album-drawer-body overflow-y:auto > .modal-right-column overflow-y:auto), so it was cut off at the bottom of the Edit Album Details modal. z-index could not help: clipping happens before stacking. It also always hung below the trigger, with no flip. Portal the popup to document.body and position it from the trigger's viewport rect, flipping above when there is more room there and capping max-height to the space available so it scrolls internally rather than overflowing. It is dismissed on scroll and resize, since the anchor is only measured on open. The outside-pointerdown handler now also treats the popup as inside; without that the portalled list counts as outside, and a click on an option would close it before the selection commits. * refactor(admin): single-column album details panel The left column spent 1.2fr on a cover thumbnail and three stat rows, two of which (Status, Custom Hero) only restated the form fields opposite them, while the form itself was squeezed into 1.8fr behind a second nested scroller. Stack the drawer in one column instead: cover as a banner, then the form at full width, with the UUID moved into the footer. The body is now the only scroll container, which also removes one of the ancestors that was clipping the sort popup. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> * fix(admin): give the portalled listbox its theme back, lock the page behind modals (#429) Two defects in the album editor. The sort listbox popup painted transparent. Every --admin-* variable is scoped to .admin-layout, and since the popup moved into document.body it sits outside that subtree, so background/border/text all resolved to nothing. It now carries its own copy of the palette in both colour schemes, plus the font it no longer inherits. Scrolling inside a modal also moved the page behind it. No admin modal ever locked body scroll: the overlay covers the page but does not absorb wheel events, so a scroll starting on the backdrop — or continuing past the end of the modal's own scroller — reaches the document. overscroll-behavior cannot cover that case on its own, because it only applies to scroll containers and the backdrop is not one. useScrollLock freezes body while a modal is open and compensates for the width the scrollbar gives up, so nothing shifts underneath. Each lock restores the inline value it found, which makes nesting work without a counter — a picker opened from the drawer restores the drawer's hidden state instead of clearing it. Applied to both drawers and all four picker modals, which share the defect. overscroll-behavior: contain on the scrollers stops the chaining they can handle themselves. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com> * fix(security): allow unsafe-eval in CSP script-src during dev mode * feat(journal): add Journal Studio with split-screen editor, live preview and dedicated routes * fix(build): separate client parser from server journal-service and fix build type errors * fix(journal): Fotos rendern, Layout und Lightbox-Steuerung korrigieren Fünf unabhängige Fehler in der öffentlichen Journal- und Essay-Ansicht: * Foto-Blöcke wurden nie angezeigt. EssayView löst ein Foto über PhotoItem.id auf, und das sind verschlüsselte Tokens — die Blöcke aus dem Markdown tragen aber rohe Asset-UUIDs. Jede Zuordnung lief ins Leere, und nicht auflösbare Blöcke werden still verworfen. Die IDs werden jetzt serverseitig übersetzt; damit verschwinden nebenbei die rohen UUIDs aus dem Client-Payload, die dort laut Projektregel nie auftauchen dürfen. Nicht auflösbare Referenzen werden geloggt. * Überschriften standen weiter links als der Fließtext. Jeder Block hatte einzeln `max-width: 68ch`, und `ch` ist relativ zur Schrift des Elements — die Serif-Überschrift ergab eine breitere Spalte. Ersetzt durch eine gemeinsame, font-unabhängige `--essay-measure`. * Fullbleed-Fotos bluteten nur nach links aus: `.essay-figure` ist `width: 100%`, wodurch die Box überbestimmt ist und der negative rechte Margin verworfen wird. * Foto-Paare stellten beide Bilder gleich breit dar, wodurch ein Hochformat neben einem Querformat doppelt so hoch wurde. Jetzt eine Justified-Reihe: Breite proportional zum Seitenverhältnis, dadurch exakt gleiche Höhen ohne Beschnitt. * Die Lightbox hatte im Journal keine Tastatursteuerung und keine Scroll-Sperre — beides lag in PhotoGrid, also nur im Album-Raster. Verlagert in die Lightbox selbst, der doppelte Handler in PhotoGrid entfernt (sonst wäre pro Pfeildruck zwei Bilder weitergesprungen). Zusätzlich sind Proofing-Herzen und das EXIF-Panel im redaktionellen Modus abschaltbar und im Journal aus: Client-Proofing ist ein Übergabe-Workflow für Alben, keine Funktion einer Reportage. Auf der Übersicht wurde der Untertitel doppelt gerendert, weil extractExcerpt() auf ihn zurückfällt. * feat(admin): eigene URLs für alle Bereiche und überarbeiteter Journal Studio Das Panel war eine einzige Client-Komponente, die ihre Tabs über useState umschaltet: keine Route pro Bereich, kein Deep-Link, kein Zurück-Button, und nach jedem Reload landete man wieder auf "Pages". Auch der Journal-Editor hatte keine eigene URL. Jetzt sieben echte Routen (/admin, /admin/pages, /admin/journal, /admin/journal/<slug>, /admin/settings, /admin/settings/<section>, /admin/analytics). Die Shell mit Auth-Prüfung und Kopfzeile sitzt im Layout und umschließt children — so bleibt die Session-Prüfung über Routenwechsel montiert, statt bei jedem Tab-Wechsel neu zu laufen und den Spinner aufblitzen zu lassen. Unbekannte Settings-Sections fallen auf General zurück. Im selben Zug der Journal Studio, der die Routing-Änderung ohnehin berührt: * Alle Eingabefelder nutzten die Klasse `admin-input`, die in keinem CSS definiert war — sie fielen auf Browser-Defaults zurück. Jetzt gestylt, gescoped, damit der generische Name nicht ins übrige Panel leckt. * Der Split View ist per Divider verschiebbar (Maus, Tastatur, Doppelklick zum Zurücksetzen), Breite in localStorage. * Das Studio bricht aus der 1120px-Spalte aus, die Preview hat Platz. * Die Preview zeigte für jedes Foto fest 3:2 und log damit über das Layout der veröffentlichten Seite; die echten Verhältnisse werden jetzt an den Thumbnails gemessen. * Blöcke mit alten positionsbasierten Foto-Referenzen werden markiert — die lassen sich auf einer eigenständigen Journal-Seite nicht auflösen und verschwanden bisher stillschweigend. * Blocktyp-Chips als gemeinsame Komponente, monochrom und per Icon unterschieden statt in einer eigenen Blau/Lila/Orange-Palette, die sonst nirgends im Panel vorkommt. * Emojis raus, SVG-Icons rein. * fix(admin): Designsystem-Lücken im Panel schließen Eine systematische Suche nach Klassen, die im TSX benutzt, aber in keinem CSS definiert sind, hat vier Stellen mit demselben Muster gefunden: * `admin-btn-secondary` und `admin-btn-danger` existierten nicht. Sämtliche Löschen-Buttons sahen aus wie normale Buttons — keine Warnwirkung. Als `.admin-btn.admin-btn-danger` geschrieben, weil die Varianten mit den Größenklassen kombiniert werden, die weiter unten ihren eigenen Hintergrund setzen. * `page-progress-fill` fehlte: die Balken im Analytics-Panel waren leere Rinnen, der Wert unsichtbar. Ebenso `analytics-empty` und `admin-loading-container`. * `subpage-drawer-section`, `subpage-drawer-title-group` und `input-with-icon` im PageBuilder waren wirkungslos und teils mit Inline-Styles notdürftig kompensiert. * `grid-card-preview` fehlte, wodurch alle Layout-Vorschauen auf Höhe null kollabierten. Nur "Showcase" war sichtbar — und das aus Versehen, weil sein Tile `hero-tile` hieß und damit die `aspect-ratio` einer fremden PageBuilder-Klasse erbte. Umbenannt. Dazu die Theme-Vorschauen, die praktisch identisch aussahen: alle sieben zeigten dieselben drei quadratischen Kacheln, einziger Unterschied war die Hintergrundfarbe. Sie spiegeln jetzt die echten Preset-Daten aus lib/config/theme.ts — Schriftcharakter, Eckradius, Rasterdichte, Passepartout bzw. Schatten. Die Kopfzeile richtet sich an einer gemeinsamen Steuerhöhe aus. Der "Site"-Link war höher als die Buttons daneben: `.admin-btn` hatte keine explizite line-height, und <button> bekommt box-sizing: border-box vom Browser, <a> nicht. Die Statusanzeige setzte weder Schriftfamilie noch -größe und fiel auf den Browser-Default zurück — sie war nie Teil des Designsystems. Jetzt gleiche Höhe und Typografie, Pillenform als Zustandsanzeige, Trenner zur Aktionsgruppe. Das dauerhafte Pulsieren des grünen Punkts entfällt; Animation bleibt den Zuständen vorbehalten, die Aufmerksamkeit brauchen. Restliche Emojis durch SVG-Icons ersetzt. * feat(admin): add scroll-to-top toggle and SVG arrow The back-to-top button was always on and drew its arrow with the ↑ text character. Add a `scrollToTop` setting (General section in the admin panel, defaults to on so existing sites are unaffected) and replace the glyph with a stroked SVG that inherits currentColor across all presets. Scroll handling is now rAF-throttled, and prefers-reduced-motion turns off both the hover lift and the smooth scroll. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * security(journal): escape author HTML instead of filtering it CodeQL flags 26 high-severity alerts on the release PR; the bulk of them point at sanitizeHtml(), a denylist of three regexes whose output goes into dangerouslySetInnerHTML. I reproduced the bypasses before changing anything — all four pass the old filter: <img src=x onerror=alert(1)> unquoted handler, regex wants quotes <img src=x onerror='alert(1)'> single quotes, same reason <svg onload=alert(1)> not a <script> tag javasjavascript:cript:alert(1) one-pass replace, the rest recombines Plus an attribute breakout in the link renderer, which interpolated the URL into href="${url}" unescaped: [x](" onmouseover=alert(1) x=") -> <a href="" onmouseover=alert(1" ...> Replaced with escaping. Every `&<>"'` in author text becomes an entity before any markdown rule runs, so the only tags in the output are the ones renderInlineMarkdown builds itself and a URL cannot leave its attribute. Link schemes are now an allowlist (http, https, mailto, tel, relative, anchor); anything else renders as plain text. The serializer needed decodeHtmlEntities to match: without it a save would write `&lt;` into the Markdown file and the next parse would escape the `&` again, corrupting the text further on every round trip. A test covers parse -> serialize -> parse stability. Two existing tests asserted the old behaviour and were rewritten rather than deleted: one expected the script tag to be *removed* from the output, the other expected the substring "onerror" to be absent. Both now assert the property that matters — that no tag can form — because `onerror` surviving as inert text is fine. Exploitation required admin access either way: journal and essay text comes from the studio or from content/*.md. This removes the weakness, it does not close an open door. * fix(journal): contain file paths, fix frontmatter escaping, defuse two regexes Follow-up to the CodeQL findings on release PR #432. I went through all 23 alerts individually; this addresses the ones that are worth addressing and documents the ones that are not. Path containment (12 alerts, all false positives). Every path built from a slug goes through isValidSlug(), a strict `/^[a-zA-Z0-9_-]+$/` allowlist — verified against `../../etc/passwd`, `foo/../../bar`, `a/b`, `..` and friends, all rejected. CodeQL cannot see it because the check lives in another module. Added a containedPath() helper that resolves the path and refuses anything landing outside the content directory: a second lock on a door that was already locked, and a barrier the analysis can follow. Also removed the dead `slug.endsWith('.md')` branches — isValidSlug rejects dots, so they could never be taken. Frontmatter escaping (1 alert, a real bug). The serializer escaped `"` but not `\`, and the parser never unescaped anything. A title containing either character gained a backslash on every save/load cycle: Path C:\Users "quoted" -> Path C:\\Users \"quoted\" -> ... Escaping now covers the backslash first and the parser undoes both. A round trip test covers quotes, backslashes, colons and apostrophes. Two of three ReDoS regexes (2 alerts). The heading pattern had `\s+` next to `(.+)`, which overlap, so the engine tried every split of the whitespace run before failing; it is `[ \t]+` and `(\S.*)` now. The quote author pattern wrapped a lazy group around an optional group — the quadratic case — and is an index split on the first separator now. The third regex, the bold/italic pass, is deliberately left alone. Rewriting it with a negated class removes the backtracking but breaks nesting: `**bold *and italic* here**` renders as `*<em>bold </em>and italic<em> here</em>*`. The input is Markdown from an authenticated admin, never a visitor, so the worst case is an author slowing down their own page. The comment in the code says so. Not addressed: 5 js/insufficient-password-hash alerts. They ask for a slow KDF where the code uses SHA-256/HMAC — correct in general, but the admin password comes from an environment variable and is never stored, so a stronger KDF protects nothing that is not already in plaintext in the environment. 399 unit tests pass (18 new), build and tsc clean. * fix(journal): split the quote author by scanning, not by pattern Cleaning up after myself. #439 replaced the quote author regex `/^(.*?)(?:\s+--\s+(.+))?$/` — a lazy group around an optional one, the quadratic case — with `/\s+--\s+/`, and CodeQL promptly flagged the replacement for the same reason. One reported pattern traded for another. splitQuoteAuthor() scans for the first `--` that has whitespace on both sides. Linear, and it needs no reasoning about the regex engine at all. Behaviour is identical to the original regex, checked case by case against it: separator, no separator, several separators, tabs, wide gaps, `a--b` without spaces, leading and trailing separators, empty string. All nine are covered by tests, plus one asserting it stays fast on a 50k whitespace run. * security(admin): derive the session signing key with scrypt getSigningKey() ran the admin password through a single SHA-256 digest. It is key derivation rather than password storage, so it was never a stored-hash problem — but if the derived key ever leaked, one fast hash makes recovering the password by brute force cheap. CodeQL flags it as js/insufficient-password-hash and, for this particular alert, has a point. scrypt now. Two details that matter: The salt has to be stable. A random salt would produce a different key on every call and invalidate every session; it is derived from AUTH_SECRET, which is deployment-specific. Verified across separate processes: same inputs produce a verifying token, so a restart or redeploy does not log everyone out. The result is cached for the process lifetime. scrypt is deliberately slow and getSigningKey() runs on every admin request — deriving per call would add ~24ms to each one. The cache key is a digest of secret plus password, so a rotation misses the cache and derives again, and no extra plaintext copy of the password is kept around. Measured: first derivation 24ms, subsequent calls 0.12ms. Password change and secret change both invalidate an existing token, checked in separate processes. Note the one-time effect: existing admin sessions are invalidated by the change in derivation, so everyone logs in once more. * security(admin): key the signing-key cache on its inputs, not a digest #441 removed the SHA-256 digest of the admin password from the key derivation and introduced a new one three lines above it, as the cache key. Same rule, same file: CodeQL reported it immediately. The comment justifying it was wrong too. It claimed no second plaintext copy of the password was retained, while building the digest input allocates exactly that in order to hash it. The cache now holds the two input strings and compares them directly. They are the same objects the env and install caches already hold, so nothing extra is retained, and no fast hash of the password exists in memory for the life of the process. Re-verified after the change, in separate processes: a token from one process verifies in another with the same inputs, a changed password or secret rejects it, first derivation 24ms, cached calls 0.001ms. That leaves scrypt as the only place the password is hashed here. The two HMACs further down operate on the derived key and on token data, not on the password; the constant-time comparison in verifyAdminPassword is the previously dismissed one. --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
2026-08-14 16:55:07 +02:00
flex-wrap: wrap;
gap: 1rem;
security: add Trivy container scan to Docker publish workflow (#399) * feat(admin): add backup manager UI with 1-click restore * feat(admin): collapse older backup entries by default * fix(theme): isolate admin layout, instant DOM theme updates, and add Light/Dark mode toggle * feat(admin): replace text controls for Photo Frame and Hero Style with visual preview cards * fix(admin): define missing CSS rules for button system (.btn, .preset-btn) * feat(admin): redesign theme settings with segmented mode toggle, accent color swatches, and custom iOS-style toggle cards * feat(admin): upgrade all settings tabs with visual grid previews, Google SEO snippet preview, and toggle cards * feat(admin): overhaul Pages Builder UX with slide-over drawer, card hover badges, real-time search, and floating save bar * fix(admin): remove leftover dangling syntax snippet in PageBuilder.tsx * fix(admin): add position: relative to subpage-tile so hover overlay is contained inside the tile * style(admin): replace all emojis with clean Leica-style vector SVG icons * fix(types): extend IconProps with SVGProps to allow style prop on Leica SVG icons * feat(admin): add subpage live-preview, privacy analytics, and asset protection settings * fix(typecheck): fix AlbumEntry property access in subpage drawer preview mode * fix(types): fix ImmichAlbumInfo property names thumbnailAssetId and albumName in PageBuilder.tsx * fix(types): add protection and watermark optional properties to AppConfig interface * feat(settings): add toggle for disabling analytics tracking (defaults to enabled) * feat(ux): show status banner when analytics tracking is disabled + add live sync indicator * feat(watermark): render customizable watermark overlay on Lightbox images + rename section to Portfolio Features & Modules * fix(types): import type LightboxWatermark in PhotoGrid.tsx * fix(types): destructure watermark prop in PhotoGrid function signature * feat(seo): add configurable subpage title template and metadata descriptions * feat(seo): add generateMetadata to about page for title template support * feat(proofing): add client proofing, favorites selection, compact URL bitmasking, and export modal * feat(essay): add Photo Essay storytelling mode with RSC markdown parser and fullbleed/pair layouts * feat(subpages): add page enabled toggle to deactivate subpages without deleting them * feat(admin): add visual essay block builder for photo essay storytelling pages * security: add Trivy container scan to Docker publish workflow Scans the built image for CRITICAL/HIGH CVEs on every release and uploads results to the GitHub Security tab. Non-blocking for now (exit-code 0) so releases aren't gated on findings. Also documents the scan and existing Dependabot coverage in the README. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-08-07 11:08:04 +02:00
width: calc(100% - 3rem);
max-width: 800px;
release: v0.11.0 — journal fixes, admin URLs, design system cleanup (#432) * fix(screenshots): sharp-Typen fuer 0.34 und 0.35 gleichzeitig (#410) sharp 0.35 ist von `export =` auf ESM umgestellt: der Modul-Namespace ist nicht mehr aufrufbar, die Factory sitzt unter .default. Der Type-Check brach damit in scripts/screenshots.ts weg, sobald der Next-Bump (#402) sharp von 0.34.5 auf 0.35.3 mitzieht -- sharp ist hier keine deklarierte Dependency, sondern kommt ueber Next mit. Die Form wird jetzt aus dem installierten Paket abgeleitet statt festgeschrieben, zur Laufzeit wie im Typ. Geprueft mit beiden Versionen: tsc laeuft mit 0.34.5 und mit 0.35.3 fehlerfrei durch. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(deps): bump the nextjs group across 1 directory with 2 updates (#402) Bumps the nextjs group with 2 updates in the / directory: [next](https://github.com/vercel/next.js) and [eslint-config-next](https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next). Updates `next` from 16.2.12 to 16.3.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/compare/v16.2.12...v16.3.0) Updates `eslint-config-next` from 16.2.12 to 16.3.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/commits/v16.3.0/packages/eslint-config-next) --- updated-dependencies: - dependency-name: eslint-config-next dependency-version: 16.3.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: nextjs - dependency-name: next dependency-version: 16.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nextjs ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps-dev): bump prettier from 3.8.3 to 3.9.6 (#405) Bumps [prettier](https://github.com/prettier/prettier) from 3.8.3 to 3.9.6. - [Release notes](https://github.com/prettier/prettier/releases) - [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md) - [Commits](https://github.com/prettier/prettier/compare/3.8.3...3.9.6) --- updated-dependencies: - dependency-name: prettier dependency-version: 3.9.6 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * docs(changelog): Unreleased-Sektion fuer die Bumps nach v0.10.0 (#413) Die Dependency-PRs sind nach dem Release auf dev gelandet, teils auch auf main. Ohne Eintrag waeren sie beim naechsten Release unsichtbar -- inklusive Next 16.3.0, das CVE-2025-13465 mitbringt. Ausserdem im 0.10.0-Abschnitt nachgetragen, dass der Trivy-Scan bis #409 nie gelaufen ist. Der Fix steckt im Tag v0.10.0, fehlte aber in der Aufzaehlung -- und "Images werden bei jedem Publish gescannt" stand im Changelog, waehrend der Job im Action-Setup abbrach. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(gallery): per-album sort order, independent of Immich (#408) (#414) Album order was dictated entirely by Immich: getAlbum() sorted by the album's own asc/desc flag, so a Folio album always mirrored the archive. A curated series has a narrative order that has nothing to do with capture time, and changing the Immich album's sort to fit the website changes it for the archive too. Adds an optional per-album `sort` in gallery.yaml, editable in /admin, defaulting to today's behaviour so every existing config is unchanged: immich (default) | newest | oldest | filename | manual `manual` is a pinned *prefix*: `assetOrder` lists only the photos placed by hand, everything else follows in the album's Immich order. A full permutation of a 2,000-photo album would be ~80 KB of UUIDs in a file that is rewritten and copied to content/.backups/ on every admin save. It also makes drift fall out for free — photos removed in Immich never match, new ones land in the tail rather than being hidden. Sorting is applied after the cache read, not before the cache write, so the LRU keeps one canonical Immich-ordered copy per album. That avoids putting the mode in the cache key, lets a config change take effect without depending on invalidation, and keeps the stale-serving path correct. cache.get() returns the stored object by reference, so withSort() returns a shallow clone with a new array — sorting in place would reorder the shared entry, and under request coalescing every concurrent caller would be sorting the same array. Also fixes a prerequisite bug: /api/admin/albums/[albumId]/assets read album.assets from GET /albums/:id, which Immich 3.x no longer populates (lib/immich.ts:507). The hero picker's "This Album" tab returned nothing and threw outright when the key was absent. It now goes through the client's paginated metadata search, with ?types=all to opt videos in for the reorder editor. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): drop decorative emoji from the sort select labels (#415) An <option> cannot contain markup, so the SVG set in Icons is not reachable there — but a decorative emoji is not a substitute for it. Plain text instead; the album card badge already uses a real icon. The remaining emoji in the admin panel (asset picker tabs, section headings, layout picker options) predate this branch and are left for a separate cleanup. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): replace emoji icons with the shared SVG icon set (#416) The admin panel mixed two icon conventions: inline SVGs from `Icons.tsx` in most components, and decorative emoji in the asset picker and a few PageBuilder labels. Emoji render inconsistently across platforms, ignore the accent colour, and cannot inherit the `.svg-icon` sizing rules. - Icons.tsx: add `IconStar` (filled — it marks a state, not an action) and `IconImage`. - AssetPicker: the three tab labels and the favourite tile badge now use IconFolder / IconStar / IconImage. - PageBuilder: the "Standalone Albums" and "Subpages" headings use the icon set instead of an emoji. - PageBuilder: the layout picker drops its emoji for plain text. An <option> cannot contain markup, so an SVG is impossible there and a decorative glyph is not a substitute. - admin.css: align icon and label in the picker tabs, and swap the favourite badge's text-shadow for drop-shadow, which is what applies to an inline SVG. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): fold PageBuilder's local icons into the shared Icons module (#418) * refactor(admin): fold PageBuilder's local icons into the shared module PageBuilder.tsx carried its own `Icons` object duplicating most of the glyphs already exported by Icons.tsx, with hardcoded sizes and slightly divergent paths. Migrate all 32 call sites to the shared module and delete the local object. Five glyphs had no counterpart and are added to Icons.tsx as 1:1 ports of the local paths: IconX, IconPlus, IconHome, IconCopy, IconImage. The local ExternalLink and Check are dropped rather than ported — both had zero call sites. Two glyphs change shape slightly, which is the point of consolidating: the shared IconCamera includes the viewfinder bump the local copy omitted, and drag handles now use IconGripVertical. IconGripVertical uses the module's square 24x24 viewBox, so `.svg-drag` goes from 12x18 to 18x18 — the old non-square box would letterbox the glyph down to 12x12 and shrink the handle. * fix(admin): resolve icon-module integration after #416 Merging dev brought in #416, which added a second IconImage to Icons.tsx and two <Icons.Camera>/<Icons.Folder> section headers that reference the local Icons object this PR removes. Git merged both cleanly but the result did not type-check. - drop the duplicate IconImage (both copies were byte-identical) - point the two section headers at the imported IconCamera/IconFolder - refresh the SORT_LABELS comment: the icon set is imported now, not declared below --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> * fix(config): allow an empty gallery, guard against a double /api suffix (#421) An empty gallery is now a valid, rendered state instead of a throw: deriveGallery() no longer requires at least one album or subpage, so a deployment with no albums yet renders a bare homepage the owner can fill in via /admin. getConfig() also stops appending /api to an Immich URL that already ends in it, which previously produced .../api/api and broke every upstream request. Includes a restore of the per-album sort test cases, which the branch had lost by being cut before #408/#414. * feat(admin): favicon upload, served from the content volume (#422) Adds a bundled default favicon, an upload widget in admin Settings > General, and a route that serves the icon from the writable content/ volume with a fallback to the bundled default. Raster uploads (PNG/ICO/JPEG) are wrapped in an SVG container; the response carries its own CSP so an uploaded SVG cannot execute script on the origin. The GET route revalidates with an ETag instead of caching immutably, so a newly uploaded icon shows up immediately. Uploads are written via temp file + rename, and a Reset button restores the bundled default. * ci: flag unformatted files in a PR, without blocking it (#424) Prettier is configured as an error rule in eslint.config.mjs but has never run in CI, so part of the tree predates it. A final CI step now diffs against the PR base, runs prettier --list-different over the changed files, and emits a warning annotation per offender plus a job summary. Advisory by design: it never fails the job. Blocking would turn a PR red for merely touching a file that was already unformatted, and normalising the tree in one commit would wreck git blame and conflict with the PRs in flight. Requires fetch-depth: 0, since diffing against the base needs its history. * feat(install): first-run wizard gated by a one-time setup token (#419) Adds /install, a four-step first-run wizard: connect to Immich, optionally pick albums, name the site, finish. It verifies the credentials against the Immich server before writing anything, then writes gallery.yaml, settings.yaml and a content/install.json carrying the Immich credentials and a generated site secret. install.json exists because a running process cannot pick up new env vars — the wizard has to write configuration that takes effect without a restart. getInstallCredentials() merges it under the real environment, so env vars always win and rotation stays a matter of setting one. Both the page and the API routes are gated by a one-time setup token printed to the server log, so a deployment that is reachable before gallery.yaml exists cannot be configured by whoever finds it first. The token is stored in content/.setup-token (0600) rather than a module variable: Next.js bundles the page and each route handler separately, so a module-level token left the page and the API disagreeing inside one process and the wizard stuck on step 1. It is removed once the install completes. The admin password is stored as an scrypt hash using the scheme lib/auth.ts already applies to album passwords; a plaintext ADMIN_PASSWORD env var keeps working. * docs: document the setup wizard, fix the read-only content mount (#425) Quick Start now leads with the /install wizard, with the hand-written YAML route kept alongside it, and a First-Run Setup section covers the setup token, the files the wizard writes, and env-var precedence. Two corrections: both Docker examples mounted content/ as :ro, which silently breaks the wizard, the admin panel and the backup rotation alike — docs/admin-panel.md already said so and the README contradicted it. And nothing documented that content/install.json holds the Immich API key, so a backup of content/ is a backup of credentials. Also adds a Contributors section crediting the people whose work is in the project. * feat(admin): floating save bar pinned to the bottom of the viewport (#426) The save bar was the first, static element inside .admin-main. Since the document itself scrolls, it left the viewport as soon as you scrolled down — editing a subpage section or a settings block far below gave no visible dirty hint and no reachable save button. Replace it with a bottom-pinned floating bar shared by both editors. It only mounts while there is something to act on (unsaved changes, an in-flight save, or a result message), so it never covers content while idle. The success message clears after 5s, which hides the bar again. - new SaveBar component, replacing the duplicated markup in PageBuilder and SettingsEditor - adopt the previously unused .floating-save-bar CSS: slide-in keyframes (carrying translateX(-50%)), dirty border, wrap/gap, mobile variant and a prefers-reduced-motion opt-out; z-index 900 keeps it below modals - .admin-main gains bottom padding so the bar never covers page content - drop the now-unreachable idle hints: the ⌘S hint becomes a button title, the Live Sync note becomes a static line above the settings layout - header "Site" link now bypasses the cache (/?fresh=1), so the preview stays reachable when the bar is hidden Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(admin): themed listbox for the album sort control (#427) The per-album "Photo order" control was a native <select>. Because an <option> cannot contain markup, its choices could not use the admin panel's currentColor SVG set — the reason #415 had to fall back to plain text after dropping the emoji labels. Adds a Listbox component implementing the ARIA combobox/listbox pattern, so options can render a glyph beside their label: - DOM focus stays on the trigger button; the active option is announced through aria-activedescendant, keeping focus management to one element - Keyboard: arrows (clamped at the ends, like a native select), Home/End, Enter/Space to commit, Escape to cancel, Tab commits and moves on, and prefix type-ahead with a repeat-key cycle - Outside dismissal on pointerdown, so a press starting outside closes the popup before the click retargets The sort options now carry an icon each: calendar, arrow-down, arrow-up, an A→Z marker, and the drag glyph for manual — matching the badge the album card already shows. SORT_LABELS stays plain text because the badge feeds it to a title attribute. Closes #417 Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(git): ignore generated design handoff folders * fix(admin): stop the album sort dropdown clipping, and simplify the panel (#428) * fix(admin): render listbox popup in a portal so it escapes modal clipping The sort control's popup was position:absolute inside three clipping ancestors (.album-drawer overflow:hidden > .album-drawer-body overflow-y:auto > .modal-right-column overflow-y:auto), so it was cut off at the bottom of the Edit Album Details modal. z-index could not help: clipping happens before stacking. It also always hung below the trigger, with no flip. Portal the popup to document.body and position it from the trigger's viewport rect, flipping above when there is more room there and capping max-height to the space available so it scrolls internally rather than overflowing. It is dismissed on scroll and resize, since the anchor is only measured on open. The outside-pointerdown handler now also treats the popup as inside; without that the portalled list counts as outside, and a click on an option would close it before the selection commits. * refactor(admin): single-column album details panel The left column spent 1.2fr on a cover thumbnail and three stat rows, two of which (Status, Custom Hero) only restated the form fields opposite them, while the form itself was squeezed into 1.8fr behind a second nested scroller. Stack the drawer in one column instead: cover as a banner, then the form at full width, with the UUID moved into the footer. The body is now the only scroll container, which also removes one of the ancestors that was clipping the sort popup. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> * fix(admin): give the portalled listbox its theme back, lock the page behind modals (#429) Two defects in the album editor. The sort listbox popup painted transparent. Every --admin-* variable is scoped to .admin-layout, and since the popup moved into document.body it sits outside that subtree, so background/border/text all resolved to nothing. It now carries its own copy of the palette in both colour schemes, plus the font it no longer inherits. Scrolling inside a modal also moved the page behind it. No admin modal ever locked body scroll: the overlay covers the page but does not absorb wheel events, so a scroll starting on the backdrop — or continuing past the end of the modal's own scroller — reaches the document. overscroll-behavior cannot cover that case on its own, because it only applies to scroll containers and the backdrop is not one. useScrollLock freezes body while a modal is open and compensates for the width the scrollbar gives up, so nothing shifts underneath. Each lock restores the inline value it found, which makes nesting work without a counter — a picker opened from the drawer restores the drawer's hidden state instead of clearing it. Applied to both drawers and all four picker modals, which share the defect. overscroll-behavior: contain on the scrollers stops the chaining they can handle themselves. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com> * fix(security): allow unsafe-eval in CSP script-src during dev mode * feat(journal): add Journal Studio with split-screen editor, live preview and dedicated routes * fix(build): separate client parser from server journal-service and fix build type errors * fix(journal): Fotos rendern, Layout und Lightbox-Steuerung korrigieren Fünf unabhängige Fehler in der öffentlichen Journal- und Essay-Ansicht: * Foto-Blöcke wurden nie angezeigt. EssayView löst ein Foto über PhotoItem.id auf, und das sind verschlüsselte Tokens — die Blöcke aus dem Markdown tragen aber rohe Asset-UUIDs. Jede Zuordnung lief ins Leere, und nicht auflösbare Blöcke werden still verworfen. Die IDs werden jetzt serverseitig übersetzt; damit verschwinden nebenbei die rohen UUIDs aus dem Client-Payload, die dort laut Projektregel nie auftauchen dürfen. Nicht auflösbare Referenzen werden geloggt. * Überschriften standen weiter links als der Fließtext. Jeder Block hatte einzeln `max-width: 68ch`, und `ch` ist relativ zur Schrift des Elements — die Serif-Überschrift ergab eine breitere Spalte. Ersetzt durch eine gemeinsame, font-unabhängige `--essay-measure`. * Fullbleed-Fotos bluteten nur nach links aus: `.essay-figure` ist `width: 100%`, wodurch die Box überbestimmt ist und der negative rechte Margin verworfen wird. * Foto-Paare stellten beide Bilder gleich breit dar, wodurch ein Hochformat neben einem Querformat doppelt so hoch wurde. Jetzt eine Justified-Reihe: Breite proportional zum Seitenverhältnis, dadurch exakt gleiche Höhen ohne Beschnitt. * Die Lightbox hatte im Journal keine Tastatursteuerung und keine Scroll-Sperre — beides lag in PhotoGrid, also nur im Album-Raster. Verlagert in die Lightbox selbst, der doppelte Handler in PhotoGrid entfernt (sonst wäre pro Pfeildruck zwei Bilder weitergesprungen). Zusätzlich sind Proofing-Herzen und das EXIF-Panel im redaktionellen Modus abschaltbar und im Journal aus: Client-Proofing ist ein Übergabe-Workflow für Alben, keine Funktion einer Reportage. Auf der Übersicht wurde der Untertitel doppelt gerendert, weil extractExcerpt() auf ihn zurückfällt. * feat(admin): eigene URLs für alle Bereiche und überarbeiteter Journal Studio Das Panel war eine einzige Client-Komponente, die ihre Tabs über useState umschaltet: keine Route pro Bereich, kein Deep-Link, kein Zurück-Button, und nach jedem Reload landete man wieder auf "Pages". Auch der Journal-Editor hatte keine eigene URL. Jetzt sieben echte Routen (/admin, /admin/pages, /admin/journal, /admin/journal/<slug>, /admin/settings, /admin/settings/<section>, /admin/analytics). Die Shell mit Auth-Prüfung und Kopfzeile sitzt im Layout und umschließt children — so bleibt die Session-Prüfung über Routenwechsel montiert, statt bei jedem Tab-Wechsel neu zu laufen und den Spinner aufblitzen zu lassen. Unbekannte Settings-Sections fallen auf General zurück. Im selben Zug der Journal Studio, der die Routing-Änderung ohnehin berührt: * Alle Eingabefelder nutzten die Klasse `admin-input`, die in keinem CSS definiert war — sie fielen auf Browser-Defaults zurück. Jetzt gestylt, gescoped, damit der generische Name nicht ins übrige Panel leckt. * Der Split View ist per Divider verschiebbar (Maus, Tastatur, Doppelklick zum Zurücksetzen), Breite in localStorage. * Das Studio bricht aus der 1120px-Spalte aus, die Preview hat Platz. * Die Preview zeigte für jedes Foto fest 3:2 und log damit über das Layout der veröffentlichten Seite; die echten Verhältnisse werden jetzt an den Thumbnails gemessen. * Blöcke mit alten positionsbasierten Foto-Referenzen werden markiert — die lassen sich auf einer eigenständigen Journal-Seite nicht auflösen und verschwanden bisher stillschweigend. * Blocktyp-Chips als gemeinsame Komponente, monochrom und per Icon unterschieden statt in einer eigenen Blau/Lila/Orange-Palette, die sonst nirgends im Panel vorkommt. * Emojis raus, SVG-Icons rein. * fix(admin): Designsystem-Lücken im Panel schließen Eine systematische Suche nach Klassen, die im TSX benutzt, aber in keinem CSS definiert sind, hat vier Stellen mit demselben Muster gefunden: * `admin-btn-secondary` und `admin-btn-danger` existierten nicht. Sämtliche Löschen-Buttons sahen aus wie normale Buttons — keine Warnwirkung. Als `.admin-btn.admin-btn-danger` geschrieben, weil die Varianten mit den Größenklassen kombiniert werden, die weiter unten ihren eigenen Hintergrund setzen. * `page-progress-fill` fehlte: die Balken im Analytics-Panel waren leere Rinnen, der Wert unsichtbar. Ebenso `analytics-empty` und `admin-loading-container`. * `subpage-drawer-section`, `subpage-drawer-title-group` und `input-with-icon` im PageBuilder waren wirkungslos und teils mit Inline-Styles notdürftig kompensiert. * `grid-card-preview` fehlte, wodurch alle Layout-Vorschauen auf Höhe null kollabierten. Nur "Showcase" war sichtbar — und das aus Versehen, weil sein Tile `hero-tile` hieß und damit die `aspect-ratio` einer fremden PageBuilder-Klasse erbte. Umbenannt. Dazu die Theme-Vorschauen, die praktisch identisch aussahen: alle sieben zeigten dieselben drei quadratischen Kacheln, einziger Unterschied war die Hintergrundfarbe. Sie spiegeln jetzt die echten Preset-Daten aus lib/config/theme.ts — Schriftcharakter, Eckradius, Rasterdichte, Passepartout bzw. Schatten. Die Kopfzeile richtet sich an einer gemeinsamen Steuerhöhe aus. Der "Site"-Link war höher als die Buttons daneben: `.admin-btn` hatte keine explizite line-height, und <button> bekommt box-sizing: border-box vom Browser, <a> nicht. Die Statusanzeige setzte weder Schriftfamilie noch -größe und fiel auf den Browser-Default zurück — sie war nie Teil des Designsystems. Jetzt gleiche Höhe und Typografie, Pillenform als Zustandsanzeige, Trenner zur Aktionsgruppe. Das dauerhafte Pulsieren des grünen Punkts entfällt; Animation bleibt den Zuständen vorbehalten, die Aufmerksamkeit brauchen. Restliche Emojis durch SVG-Icons ersetzt. * feat(admin): add scroll-to-top toggle and SVG arrow The back-to-top button was always on and drew its arrow with the ↑ text character. Add a `scrollToTop` setting (General section in the admin panel, defaults to on so existing sites are unaffected) and replace the glyph with a stroked SVG that inherits currentColor across all presets. Scroll handling is now rAF-throttled, and prefers-reduced-motion turns off both the hover lift and the smooth scroll. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * security(journal): escape author HTML instead of filtering it CodeQL flags 26 high-severity alerts on the release PR; the bulk of them point at sanitizeHtml(), a denylist of three regexes whose output goes into dangerouslySetInnerHTML. I reproduced the bypasses before changing anything — all four pass the old filter: <img src=x onerror=alert(1)> unquoted handler, regex wants quotes <img src=x onerror='alert(1)'> single quotes, same reason <svg onload=alert(1)> not a <script> tag javasjavascript:cript:alert(1) one-pass replace, the rest recombines Plus an attribute breakout in the link renderer, which interpolated the URL into href="${url}" unescaped: [x](" onmouseover=alert(1) x=") -> <a href="" onmouseover=alert(1" ...> Replaced with escaping. Every `&<>"'` in author text becomes an entity before any markdown rule runs, so the only tags in the output are the ones renderInlineMarkdown builds itself and a URL cannot leave its attribute. Link schemes are now an allowlist (http, https, mailto, tel, relative, anchor); anything else renders as plain text. The serializer needed decodeHtmlEntities to match: without it a save would write `&lt;` into the Markdown file and the next parse would escape the `&` again, corrupting the text further on every round trip. A test covers parse -> serialize -> parse stability. Two existing tests asserted the old behaviour and were rewritten rather than deleted: one expected the script tag to be *removed* from the output, the other expected the substring "onerror" to be absent. Both now assert the property that matters — that no tag can form — because `onerror` surviving as inert text is fine. Exploitation required admin access either way: journal and essay text comes from the studio or from content/*.md. This removes the weakness, it does not close an open door. * fix(journal): contain file paths, fix frontmatter escaping, defuse two regexes Follow-up to the CodeQL findings on release PR #432. I went through all 23 alerts individually; this addresses the ones that are worth addressing and documents the ones that are not. Path containment (12 alerts, all false positives). Every path built from a slug goes through isValidSlug(), a strict `/^[a-zA-Z0-9_-]+$/` allowlist — verified against `../../etc/passwd`, `foo/../../bar`, `a/b`, `..` and friends, all rejected. CodeQL cannot see it because the check lives in another module. Added a containedPath() helper that resolves the path and refuses anything landing outside the content directory: a second lock on a door that was already locked, and a barrier the analysis can follow. Also removed the dead `slug.endsWith('.md')` branches — isValidSlug rejects dots, so they could never be taken. Frontmatter escaping (1 alert, a real bug). The serializer escaped `"` but not `\`, and the parser never unescaped anything. A title containing either character gained a backslash on every save/load cycle: Path C:\Users "quoted" -> Path C:\\Users \"quoted\" -> ... Escaping now covers the backslash first and the parser undoes both. A round trip test covers quotes, backslashes, colons and apostrophes. Two of three ReDoS regexes (2 alerts). The heading pattern had `\s+` next to `(.+)`, which overlap, so the engine tried every split of the whitespace run before failing; it is `[ \t]+` and `(\S.*)` now. The quote author pattern wrapped a lazy group around an optional group — the quadratic case — and is an index split on the first separator now. The third regex, the bold/italic pass, is deliberately left alone. Rewriting it with a negated class removes the backtracking but breaks nesting: `**bold *and italic* here**` renders as `*<em>bold </em>and italic<em> here</em>*`. The input is Markdown from an authenticated admin, never a visitor, so the worst case is an author slowing down their own page. The comment in the code says so. Not addressed: 5 js/insufficient-password-hash alerts. They ask for a slow KDF where the code uses SHA-256/HMAC — correct in general, but the admin password comes from an environment variable and is never stored, so a stronger KDF protects nothing that is not already in plaintext in the environment. 399 unit tests pass (18 new), build and tsc clean. * fix(journal): split the quote author by scanning, not by pattern Cleaning up after myself. #439 replaced the quote author regex `/^(.*?)(?:\s+--\s+(.+))?$/` — a lazy group around an optional one, the quadratic case — with `/\s+--\s+/`, and CodeQL promptly flagged the replacement for the same reason. One reported pattern traded for another. splitQuoteAuthor() scans for the first `--` that has whitespace on both sides. Linear, and it needs no reasoning about the regex engine at all. Behaviour is identical to the original regex, checked case by case against it: separator, no separator, several separators, tabs, wide gaps, `a--b` without spaces, leading and trailing separators, empty string. All nine are covered by tests, plus one asserting it stays fast on a 50k whitespace run. * security(admin): derive the session signing key with scrypt getSigningKey() ran the admin password through a single SHA-256 digest. It is key derivation rather than password storage, so it was never a stored-hash problem — but if the derived key ever leaked, one fast hash makes recovering the password by brute force cheap. CodeQL flags it as js/insufficient-password-hash and, for this particular alert, has a point. scrypt now. Two details that matter: The salt has to be stable. A random salt would produce a different key on every call and invalidate every session; it is derived from AUTH_SECRET, which is deployment-specific. Verified across separate processes: same inputs produce a verifying token, so a restart or redeploy does not log everyone out. The result is cached for the process lifetime. scrypt is deliberately slow and getSigningKey() runs on every admin request — deriving per call would add ~24ms to each one. The cache key is a digest of secret plus password, so a rotation misses the cache and derives again, and no extra plaintext copy of the password is kept around. Measured: first derivation 24ms, subsequent calls 0.12ms. Password change and secret change both invalidate an existing token, checked in separate processes. Note the one-time effect: existing admin sessions are invalidated by the change in derivation, so everyone logs in once more. * security(admin): key the signing-key cache on its inputs, not a digest #441 removed the SHA-256 digest of the admin password from the key derivation and introduced a new one three lines above it, as the cache key. Same rule, same file: CodeQL reported it immediately. The comment justifying it was wrong too. It claimed no second plaintext copy of the password was retained, while building the digest input allocates exactly that in order to hash it. The cache now holds the two input strings and compares them directly. They are the same objects the env and install caches already hold, so nothing extra is retained, and no fast hash of the password exists in memory for the life of the process. Re-verified after the change, in separate processes: a token from one process verifies in another with the same inputs, a changed password or secret rejects it, first derivation 24ms, cached calls 0.001ms. That leaves scrypt as the only place the password is hashed here. The two HMACs further down operate on the derived key and on token data, not on the password; the constant-time comparison in verifyAdminPassword is the previously dismissed one. --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
2026-08-14 16:55:07 +02:00
transition: border-color 0.2s ease;
animation: save-bar-in 0.2s ease-out;
}
.floating-save-bar.dirty {
border-color: var(--admin-accent);
}
/* Keyframes must carry the translateX(-50%) or the bar jumps horizontally. */
@keyframes save-bar-in {
from {
opacity: 0;
transform: translate(-50%, 1rem);
}
to {
opacity: 1;
transform: translate(-50%, 0);
}
security: add Trivy container scan to Docker publish workflow (#399) * feat(admin): add backup manager UI with 1-click restore * feat(admin): collapse older backup entries by default * fix(theme): isolate admin layout, instant DOM theme updates, and add Light/Dark mode toggle * feat(admin): replace text controls for Photo Frame and Hero Style with visual preview cards * fix(admin): define missing CSS rules for button system (.btn, .preset-btn) * feat(admin): redesign theme settings with segmented mode toggle, accent color swatches, and custom iOS-style toggle cards * feat(admin): upgrade all settings tabs with visual grid previews, Google SEO snippet preview, and toggle cards * feat(admin): overhaul Pages Builder UX with slide-over drawer, card hover badges, real-time search, and floating save bar * fix(admin): remove leftover dangling syntax snippet in PageBuilder.tsx * fix(admin): add position: relative to subpage-tile so hover overlay is contained inside the tile * style(admin): replace all emojis with clean Leica-style vector SVG icons * fix(types): extend IconProps with SVGProps to allow style prop on Leica SVG icons * feat(admin): add subpage live-preview, privacy analytics, and asset protection settings * fix(typecheck): fix AlbumEntry property access in subpage drawer preview mode * fix(types): fix ImmichAlbumInfo property names thumbnailAssetId and albumName in PageBuilder.tsx * fix(types): add protection and watermark optional properties to AppConfig interface * feat(settings): add toggle for disabling analytics tracking (defaults to enabled) * feat(ux): show status banner when analytics tracking is disabled + add live sync indicator * feat(watermark): render customizable watermark overlay on Lightbox images + rename section to Portfolio Features & Modules * fix(types): import type LightboxWatermark in PhotoGrid.tsx * fix(types): destructure watermark prop in PhotoGrid function signature * feat(seo): add configurable subpage title template and metadata descriptions * feat(seo): add generateMetadata to about page for title template support * feat(proofing): add client proofing, favorites selection, compact URL bitmasking, and export modal * feat(essay): add Photo Essay storytelling mode with RSC markdown parser and fullbleed/pair layouts * feat(subpages): add page enabled toggle to deactivate subpages without deleting them * feat(admin): add visual essay block builder for photo essay storytelling pages * security: add Trivy container scan to Docker publish workflow Scans the built image for CRITICAL/HIGH CVEs on every release and uploads results to the GitHub Security tab. Non-blocking for now (exit-code 0) so releases aren't gated on findings. Also documents the scan and existing Dependabot coverage in the README. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-08-07 11:08:04 +02:00
}
.badge-pulse-dot {
width: 8px;
height: 8px;
border-radius: 50%;
background: #ff9800;
display: inline-block;
margin-right: 6px;
animation: pulse 1.5s infinite;
}
@keyframes pulse {
chore(release): v0.10.0 (#400) Photo Essay mode, client proofing, studio-modern preset, admin panel overhaul, watermark, cookieless analytics, subpage toggle, SEO title templates. Analytics API now admin-only, Trivy scan on publish. Album order mirrors the Immich timeline; map theme, admin status panel, lightbox counter and Docker health check fixed. See CHANGELOG.md for the full list and the health-check upgrade note.
2026-08-10 09:56:20 +02:00
0% {
transform: scale(0.95);
box-shadow: 0 0 0 0 rgba(255, 152, 0, 0.7);
}
70% {
transform: scale(1);
box-shadow: 0 0 0 8px rgba(255, 152, 0, 0);
}
100% {
transform: scale(0.95);
box-shadow: 0 0 0 0 rgba(255, 152, 0, 0);
}
security: add Trivy container scan to Docker publish workflow (#399) * feat(admin): add backup manager UI with 1-click restore * feat(admin): collapse older backup entries by default * fix(theme): isolate admin layout, instant DOM theme updates, and add Light/Dark mode toggle * feat(admin): replace text controls for Photo Frame and Hero Style with visual preview cards * fix(admin): define missing CSS rules for button system (.btn, .preset-btn) * feat(admin): redesign theme settings with segmented mode toggle, accent color swatches, and custom iOS-style toggle cards * feat(admin): upgrade all settings tabs with visual grid previews, Google SEO snippet preview, and toggle cards * feat(admin): overhaul Pages Builder UX with slide-over drawer, card hover badges, real-time search, and floating save bar * fix(admin): remove leftover dangling syntax snippet in PageBuilder.tsx * fix(admin): add position: relative to subpage-tile so hover overlay is contained inside the tile * style(admin): replace all emojis with clean Leica-style vector SVG icons * fix(types): extend IconProps with SVGProps to allow style prop on Leica SVG icons * feat(admin): add subpage live-preview, privacy analytics, and asset protection settings * fix(typecheck): fix AlbumEntry property access in subpage drawer preview mode * fix(types): fix ImmichAlbumInfo property names thumbnailAssetId and albumName in PageBuilder.tsx * fix(types): add protection and watermark optional properties to AppConfig interface * feat(settings): add toggle for disabling analytics tracking (defaults to enabled) * feat(ux): show status banner when analytics tracking is disabled + add live sync indicator * feat(watermark): render customizable watermark overlay on Lightbox images + rename section to Portfolio Features & Modules * fix(types): import type LightboxWatermark in PhotoGrid.tsx * fix(types): destructure watermark prop in PhotoGrid function signature * feat(seo): add configurable subpage title template and metadata descriptions * feat(seo): add generateMetadata to about page for title template support * feat(proofing): add client proofing, favorites selection, compact URL bitmasking, and export modal * feat(essay): add Photo Essay storytelling mode with RSC markdown parser and fullbleed/pair layouts * feat(subpages): add page enabled toggle to deactivate subpages without deleting them * feat(admin): add visual essay block builder for photo essay storytelling pages * security: add Trivy container scan to Docker publish workflow Scans the built image for CRITICAL/HIGH CVEs on every release and uploads results to the GitHub Security tab. Non-blocking for now (exit-code 0) so releases aren't gated on findings. Also documents the scan and existing Dependabot coverage in the README. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-08-07 11:08:04 +02:00
}
release: v0.11.0 — journal fixes, admin URLs, design system cleanup (#432) * fix(screenshots): sharp-Typen fuer 0.34 und 0.35 gleichzeitig (#410) sharp 0.35 ist von `export =` auf ESM umgestellt: der Modul-Namespace ist nicht mehr aufrufbar, die Factory sitzt unter .default. Der Type-Check brach damit in scripts/screenshots.ts weg, sobald der Next-Bump (#402) sharp von 0.34.5 auf 0.35.3 mitzieht -- sharp ist hier keine deklarierte Dependency, sondern kommt ueber Next mit. Die Form wird jetzt aus dem installierten Paket abgeleitet statt festgeschrieben, zur Laufzeit wie im Typ. Geprueft mit beiden Versionen: tsc laeuft mit 0.34.5 und mit 0.35.3 fehlerfrei durch. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(deps): bump the nextjs group across 1 directory with 2 updates (#402) Bumps the nextjs group with 2 updates in the / directory: [next](https://github.com/vercel/next.js) and [eslint-config-next](https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next). Updates `next` from 16.2.12 to 16.3.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/compare/v16.2.12...v16.3.0) Updates `eslint-config-next` from 16.2.12 to 16.3.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/commits/v16.3.0/packages/eslint-config-next) --- updated-dependencies: - dependency-name: eslint-config-next dependency-version: 16.3.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: nextjs - dependency-name: next dependency-version: 16.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nextjs ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps-dev): bump prettier from 3.8.3 to 3.9.6 (#405) Bumps [prettier](https://github.com/prettier/prettier) from 3.8.3 to 3.9.6. - [Release notes](https://github.com/prettier/prettier/releases) - [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md) - [Commits](https://github.com/prettier/prettier/compare/3.8.3...3.9.6) --- updated-dependencies: - dependency-name: prettier dependency-version: 3.9.6 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * docs(changelog): Unreleased-Sektion fuer die Bumps nach v0.10.0 (#413) Die Dependency-PRs sind nach dem Release auf dev gelandet, teils auch auf main. Ohne Eintrag waeren sie beim naechsten Release unsichtbar -- inklusive Next 16.3.0, das CVE-2025-13465 mitbringt. Ausserdem im 0.10.0-Abschnitt nachgetragen, dass der Trivy-Scan bis #409 nie gelaufen ist. Der Fix steckt im Tag v0.10.0, fehlte aber in der Aufzaehlung -- und "Images werden bei jedem Publish gescannt" stand im Changelog, waehrend der Job im Action-Setup abbrach. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(gallery): per-album sort order, independent of Immich (#408) (#414) Album order was dictated entirely by Immich: getAlbum() sorted by the album's own asc/desc flag, so a Folio album always mirrored the archive. A curated series has a narrative order that has nothing to do with capture time, and changing the Immich album's sort to fit the website changes it for the archive too. Adds an optional per-album `sort` in gallery.yaml, editable in /admin, defaulting to today's behaviour so every existing config is unchanged: immich (default) | newest | oldest | filename | manual `manual` is a pinned *prefix*: `assetOrder` lists only the photos placed by hand, everything else follows in the album's Immich order. A full permutation of a 2,000-photo album would be ~80 KB of UUIDs in a file that is rewritten and copied to content/.backups/ on every admin save. It also makes drift fall out for free — photos removed in Immich never match, new ones land in the tail rather than being hidden. Sorting is applied after the cache read, not before the cache write, so the LRU keeps one canonical Immich-ordered copy per album. That avoids putting the mode in the cache key, lets a config change take effect without depending on invalidation, and keeps the stale-serving path correct. cache.get() returns the stored object by reference, so withSort() returns a shallow clone with a new array — sorting in place would reorder the shared entry, and under request coalescing every concurrent caller would be sorting the same array. Also fixes a prerequisite bug: /api/admin/albums/[albumId]/assets read album.assets from GET /albums/:id, which Immich 3.x no longer populates (lib/immich.ts:507). The hero picker's "This Album" tab returned nothing and threw outright when the key was absent. It now goes through the client's paginated metadata search, with ?types=all to opt videos in for the reorder editor. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): drop decorative emoji from the sort select labels (#415) An <option> cannot contain markup, so the SVG set in Icons is not reachable there — but a decorative emoji is not a substitute for it. Plain text instead; the album card badge already uses a real icon. The remaining emoji in the admin panel (asset picker tabs, section headings, layout picker options) predate this branch and are left for a separate cleanup. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): replace emoji icons with the shared SVG icon set (#416) The admin panel mixed two icon conventions: inline SVGs from `Icons.tsx` in most components, and decorative emoji in the asset picker and a few PageBuilder labels. Emoji render inconsistently across platforms, ignore the accent colour, and cannot inherit the `.svg-icon` sizing rules. - Icons.tsx: add `IconStar` (filled — it marks a state, not an action) and `IconImage`. - AssetPicker: the three tab labels and the favourite tile badge now use IconFolder / IconStar / IconImage. - PageBuilder: the "Standalone Albums" and "Subpages" headings use the icon set instead of an emoji. - PageBuilder: the layout picker drops its emoji for plain text. An <option> cannot contain markup, so an SVG is impossible there and a decorative glyph is not a substitute. - admin.css: align icon and label in the picker tabs, and swap the favourite badge's text-shadow for drop-shadow, which is what applies to an inline SVG. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): fold PageBuilder's local icons into the shared Icons module (#418) * refactor(admin): fold PageBuilder's local icons into the shared module PageBuilder.tsx carried its own `Icons` object duplicating most of the glyphs already exported by Icons.tsx, with hardcoded sizes and slightly divergent paths. Migrate all 32 call sites to the shared module and delete the local object. Five glyphs had no counterpart and are added to Icons.tsx as 1:1 ports of the local paths: IconX, IconPlus, IconHome, IconCopy, IconImage. The local ExternalLink and Check are dropped rather than ported — both had zero call sites. Two glyphs change shape slightly, which is the point of consolidating: the shared IconCamera includes the viewfinder bump the local copy omitted, and drag handles now use IconGripVertical. IconGripVertical uses the module's square 24x24 viewBox, so `.svg-drag` goes from 12x18 to 18x18 — the old non-square box would letterbox the glyph down to 12x12 and shrink the handle. * fix(admin): resolve icon-module integration after #416 Merging dev brought in #416, which added a second IconImage to Icons.tsx and two <Icons.Camera>/<Icons.Folder> section headers that reference the local Icons object this PR removes. Git merged both cleanly but the result did not type-check. - drop the duplicate IconImage (both copies were byte-identical) - point the two section headers at the imported IconCamera/IconFolder - refresh the SORT_LABELS comment: the icon set is imported now, not declared below --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> * fix(config): allow an empty gallery, guard against a double /api suffix (#421) An empty gallery is now a valid, rendered state instead of a throw: deriveGallery() no longer requires at least one album or subpage, so a deployment with no albums yet renders a bare homepage the owner can fill in via /admin. getConfig() also stops appending /api to an Immich URL that already ends in it, which previously produced .../api/api and broke every upstream request. Includes a restore of the per-album sort test cases, which the branch had lost by being cut before #408/#414. * feat(admin): favicon upload, served from the content volume (#422) Adds a bundled default favicon, an upload widget in admin Settings > General, and a route that serves the icon from the writable content/ volume with a fallback to the bundled default. Raster uploads (PNG/ICO/JPEG) are wrapped in an SVG container; the response carries its own CSP so an uploaded SVG cannot execute script on the origin. The GET route revalidates with an ETag instead of caching immutably, so a newly uploaded icon shows up immediately. Uploads are written via temp file + rename, and a Reset button restores the bundled default. * ci: flag unformatted files in a PR, without blocking it (#424) Prettier is configured as an error rule in eslint.config.mjs but has never run in CI, so part of the tree predates it. A final CI step now diffs against the PR base, runs prettier --list-different over the changed files, and emits a warning annotation per offender plus a job summary. Advisory by design: it never fails the job. Blocking would turn a PR red for merely touching a file that was already unformatted, and normalising the tree in one commit would wreck git blame and conflict with the PRs in flight. Requires fetch-depth: 0, since diffing against the base needs its history. * feat(install): first-run wizard gated by a one-time setup token (#419) Adds /install, a four-step first-run wizard: connect to Immich, optionally pick albums, name the site, finish. It verifies the credentials against the Immich server before writing anything, then writes gallery.yaml, settings.yaml and a content/install.json carrying the Immich credentials and a generated site secret. install.json exists because a running process cannot pick up new env vars — the wizard has to write configuration that takes effect without a restart. getInstallCredentials() merges it under the real environment, so env vars always win and rotation stays a matter of setting one. Both the page and the API routes are gated by a one-time setup token printed to the server log, so a deployment that is reachable before gallery.yaml exists cannot be configured by whoever finds it first. The token is stored in content/.setup-token (0600) rather than a module variable: Next.js bundles the page and each route handler separately, so a module-level token left the page and the API disagreeing inside one process and the wizard stuck on step 1. It is removed once the install completes. The admin password is stored as an scrypt hash using the scheme lib/auth.ts already applies to album passwords; a plaintext ADMIN_PASSWORD env var keeps working. * docs: document the setup wizard, fix the read-only content mount (#425) Quick Start now leads with the /install wizard, with the hand-written YAML route kept alongside it, and a First-Run Setup section covers the setup token, the files the wizard writes, and env-var precedence. Two corrections: both Docker examples mounted content/ as :ro, which silently breaks the wizard, the admin panel and the backup rotation alike — docs/admin-panel.md already said so and the README contradicted it. And nothing documented that content/install.json holds the Immich API key, so a backup of content/ is a backup of credentials. Also adds a Contributors section crediting the people whose work is in the project. * feat(admin): floating save bar pinned to the bottom of the viewport (#426) The save bar was the first, static element inside .admin-main. Since the document itself scrolls, it left the viewport as soon as you scrolled down — editing a subpage section or a settings block far below gave no visible dirty hint and no reachable save button. Replace it with a bottom-pinned floating bar shared by both editors. It only mounts while there is something to act on (unsaved changes, an in-flight save, or a result message), so it never covers content while idle. The success message clears after 5s, which hides the bar again. - new SaveBar component, replacing the duplicated markup in PageBuilder and SettingsEditor - adopt the previously unused .floating-save-bar CSS: slide-in keyframes (carrying translateX(-50%)), dirty border, wrap/gap, mobile variant and a prefers-reduced-motion opt-out; z-index 900 keeps it below modals - .admin-main gains bottom padding so the bar never covers page content - drop the now-unreachable idle hints: the ⌘S hint becomes a button title, the Live Sync note becomes a static line above the settings layout - header "Site" link now bypasses the cache (/?fresh=1), so the preview stays reachable when the bar is hidden Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(admin): themed listbox for the album sort control (#427) The per-album "Photo order" control was a native <select>. Because an <option> cannot contain markup, its choices could not use the admin panel's currentColor SVG set — the reason #415 had to fall back to plain text after dropping the emoji labels. Adds a Listbox component implementing the ARIA combobox/listbox pattern, so options can render a glyph beside their label: - DOM focus stays on the trigger button; the active option is announced through aria-activedescendant, keeping focus management to one element - Keyboard: arrows (clamped at the ends, like a native select), Home/End, Enter/Space to commit, Escape to cancel, Tab commits and moves on, and prefix type-ahead with a repeat-key cycle - Outside dismissal on pointerdown, so a press starting outside closes the popup before the click retargets The sort options now carry an icon each: calendar, arrow-down, arrow-up, an A→Z marker, and the drag glyph for manual — matching the badge the album card already shows. SORT_LABELS stays plain text because the badge feeds it to a title attribute. Closes #417 Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(git): ignore generated design handoff folders * fix(admin): stop the album sort dropdown clipping, and simplify the panel (#428) * fix(admin): render listbox popup in a portal so it escapes modal clipping The sort control's popup was position:absolute inside three clipping ancestors (.album-drawer overflow:hidden > .album-drawer-body overflow-y:auto > .modal-right-column overflow-y:auto), so it was cut off at the bottom of the Edit Album Details modal. z-index could not help: clipping happens before stacking. It also always hung below the trigger, with no flip. Portal the popup to document.body and position it from the trigger's viewport rect, flipping above when there is more room there and capping max-height to the space available so it scrolls internally rather than overflowing. It is dismissed on scroll and resize, since the anchor is only measured on open. The outside-pointerdown handler now also treats the popup as inside; without that the portalled list counts as outside, and a click on an option would close it before the selection commits. * refactor(admin): single-column album details panel The left column spent 1.2fr on a cover thumbnail and three stat rows, two of which (Status, Custom Hero) only restated the form fields opposite them, while the form itself was squeezed into 1.8fr behind a second nested scroller. Stack the drawer in one column instead: cover as a banner, then the form at full width, with the UUID moved into the footer. The body is now the only scroll container, which also removes one of the ancestors that was clipping the sort popup. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> * fix(admin): give the portalled listbox its theme back, lock the page behind modals (#429) Two defects in the album editor. The sort listbox popup painted transparent. Every --admin-* variable is scoped to .admin-layout, and since the popup moved into document.body it sits outside that subtree, so background/border/text all resolved to nothing. It now carries its own copy of the palette in both colour schemes, plus the font it no longer inherits. Scrolling inside a modal also moved the page behind it. No admin modal ever locked body scroll: the overlay covers the page but does not absorb wheel events, so a scroll starting on the backdrop — or continuing past the end of the modal's own scroller — reaches the document. overscroll-behavior cannot cover that case on its own, because it only applies to scroll containers and the backdrop is not one. useScrollLock freezes body while a modal is open and compensates for the width the scrollbar gives up, so nothing shifts underneath. Each lock restores the inline value it found, which makes nesting work without a counter — a picker opened from the drawer restores the drawer's hidden state instead of clearing it. Applied to both drawers and all four picker modals, which share the defect. overscroll-behavior: contain on the scrollers stops the chaining they can handle themselves. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com> * fix(security): allow unsafe-eval in CSP script-src during dev mode * feat(journal): add Journal Studio with split-screen editor, live preview and dedicated routes * fix(build): separate client parser from server journal-service and fix build type errors * fix(journal): Fotos rendern, Layout und Lightbox-Steuerung korrigieren Fünf unabhängige Fehler in der öffentlichen Journal- und Essay-Ansicht: * Foto-Blöcke wurden nie angezeigt. EssayView löst ein Foto über PhotoItem.id auf, und das sind verschlüsselte Tokens — die Blöcke aus dem Markdown tragen aber rohe Asset-UUIDs. Jede Zuordnung lief ins Leere, und nicht auflösbare Blöcke werden still verworfen. Die IDs werden jetzt serverseitig übersetzt; damit verschwinden nebenbei die rohen UUIDs aus dem Client-Payload, die dort laut Projektregel nie auftauchen dürfen. Nicht auflösbare Referenzen werden geloggt. * Überschriften standen weiter links als der Fließtext. Jeder Block hatte einzeln `max-width: 68ch`, und `ch` ist relativ zur Schrift des Elements — die Serif-Überschrift ergab eine breitere Spalte. Ersetzt durch eine gemeinsame, font-unabhängige `--essay-measure`. * Fullbleed-Fotos bluteten nur nach links aus: `.essay-figure` ist `width: 100%`, wodurch die Box überbestimmt ist und der negative rechte Margin verworfen wird. * Foto-Paare stellten beide Bilder gleich breit dar, wodurch ein Hochformat neben einem Querformat doppelt so hoch wurde. Jetzt eine Justified-Reihe: Breite proportional zum Seitenverhältnis, dadurch exakt gleiche Höhen ohne Beschnitt. * Die Lightbox hatte im Journal keine Tastatursteuerung und keine Scroll-Sperre — beides lag in PhotoGrid, also nur im Album-Raster. Verlagert in die Lightbox selbst, der doppelte Handler in PhotoGrid entfernt (sonst wäre pro Pfeildruck zwei Bilder weitergesprungen). Zusätzlich sind Proofing-Herzen und das EXIF-Panel im redaktionellen Modus abschaltbar und im Journal aus: Client-Proofing ist ein Übergabe-Workflow für Alben, keine Funktion einer Reportage. Auf der Übersicht wurde der Untertitel doppelt gerendert, weil extractExcerpt() auf ihn zurückfällt. * feat(admin): eigene URLs für alle Bereiche und überarbeiteter Journal Studio Das Panel war eine einzige Client-Komponente, die ihre Tabs über useState umschaltet: keine Route pro Bereich, kein Deep-Link, kein Zurück-Button, und nach jedem Reload landete man wieder auf "Pages". Auch der Journal-Editor hatte keine eigene URL. Jetzt sieben echte Routen (/admin, /admin/pages, /admin/journal, /admin/journal/<slug>, /admin/settings, /admin/settings/<section>, /admin/analytics). Die Shell mit Auth-Prüfung und Kopfzeile sitzt im Layout und umschließt children — so bleibt die Session-Prüfung über Routenwechsel montiert, statt bei jedem Tab-Wechsel neu zu laufen und den Spinner aufblitzen zu lassen. Unbekannte Settings-Sections fallen auf General zurück. Im selben Zug der Journal Studio, der die Routing-Änderung ohnehin berührt: * Alle Eingabefelder nutzten die Klasse `admin-input`, die in keinem CSS definiert war — sie fielen auf Browser-Defaults zurück. Jetzt gestylt, gescoped, damit der generische Name nicht ins übrige Panel leckt. * Der Split View ist per Divider verschiebbar (Maus, Tastatur, Doppelklick zum Zurücksetzen), Breite in localStorage. * Das Studio bricht aus der 1120px-Spalte aus, die Preview hat Platz. * Die Preview zeigte für jedes Foto fest 3:2 und log damit über das Layout der veröffentlichten Seite; die echten Verhältnisse werden jetzt an den Thumbnails gemessen. * Blöcke mit alten positionsbasierten Foto-Referenzen werden markiert — die lassen sich auf einer eigenständigen Journal-Seite nicht auflösen und verschwanden bisher stillschweigend. * Blocktyp-Chips als gemeinsame Komponente, monochrom und per Icon unterschieden statt in einer eigenen Blau/Lila/Orange-Palette, die sonst nirgends im Panel vorkommt. * Emojis raus, SVG-Icons rein. * fix(admin): Designsystem-Lücken im Panel schließen Eine systematische Suche nach Klassen, die im TSX benutzt, aber in keinem CSS definiert sind, hat vier Stellen mit demselben Muster gefunden: * `admin-btn-secondary` und `admin-btn-danger` existierten nicht. Sämtliche Löschen-Buttons sahen aus wie normale Buttons — keine Warnwirkung. Als `.admin-btn.admin-btn-danger` geschrieben, weil die Varianten mit den Größenklassen kombiniert werden, die weiter unten ihren eigenen Hintergrund setzen. * `page-progress-fill` fehlte: die Balken im Analytics-Panel waren leere Rinnen, der Wert unsichtbar. Ebenso `analytics-empty` und `admin-loading-container`. * `subpage-drawer-section`, `subpage-drawer-title-group` und `input-with-icon` im PageBuilder waren wirkungslos und teils mit Inline-Styles notdürftig kompensiert. * `grid-card-preview` fehlte, wodurch alle Layout-Vorschauen auf Höhe null kollabierten. Nur "Showcase" war sichtbar — und das aus Versehen, weil sein Tile `hero-tile` hieß und damit die `aspect-ratio` einer fremden PageBuilder-Klasse erbte. Umbenannt. Dazu die Theme-Vorschauen, die praktisch identisch aussahen: alle sieben zeigten dieselben drei quadratischen Kacheln, einziger Unterschied war die Hintergrundfarbe. Sie spiegeln jetzt die echten Preset-Daten aus lib/config/theme.ts — Schriftcharakter, Eckradius, Rasterdichte, Passepartout bzw. Schatten. Die Kopfzeile richtet sich an einer gemeinsamen Steuerhöhe aus. Der "Site"-Link war höher als die Buttons daneben: `.admin-btn` hatte keine explizite line-height, und <button> bekommt box-sizing: border-box vom Browser, <a> nicht. Die Statusanzeige setzte weder Schriftfamilie noch -größe und fiel auf den Browser-Default zurück — sie war nie Teil des Designsystems. Jetzt gleiche Höhe und Typografie, Pillenform als Zustandsanzeige, Trenner zur Aktionsgruppe. Das dauerhafte Pulsieren des grünen Punkts entfällt; Animation bleibt den Zuständen vorbehalten, die Aufmerksamkeit brauchen. Restliche Emojis durch SVG-Icons ersetzt. * feat(admin): add scroll-to-top toggle and SVG arrow The back-to-top button was always on and drew its arrow with the ↑ text character. Add a `scrollToTop` setting (General section in the admin panel, defaults to on so existing sites are unaffected) and replace the glyph with a stroked SVG that inherits currentColor across all presets. Scroll handling is now rAF-throttled, and prefers-reduced-motion turns off both the hover lift and the smooth scroll. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * security(journal): escape author HTML instead of filtering it CodeQL flags 26 high-severity alerts on the release PR; the bulk of them point at sanitizeHtml(), a denylist of three regexes whose output goes into dangerouslySetInnerHTML. I reproduced the bypasses before changing anything — all four pass the old filter: <img src=x onerror=alert(1)> unquoted handler, regex wants quotes <img src=x onerror='alert(1)'> single quotes, same reason <svg onload=alert(1)> not a <script> tag javasjavascript:cript:alert(1) one-pass replace, the rest recombines Plus an attribute breakout in the link renderer, which interpolated the URL into href="${url}" unescaped: [x](" onmouseover=alert(1) x=") -> <a href="" onmouseover=alert(1" ...> Replaced with escaping. Every `&<>"'` in author text becomes an entity before any markdown rule runs, so the only tags in the output are the ones renderInlineMarkdown builds itself and a URL cannot leave its attribute. Link schemes are now an allowlist (http, https, mailto, tel, relative, anchor); anything else renders as plain text. The serializer needed decodeHtmlEntities to match: without it a save would write `&lt;` into the Markdown file and the next parse would escape the `&` again, corrupting the text further on every round trip. A test covers parse -> serialize -> parse stability. Two existing tests asserted the old behaviour and were rewritten rather than deleted: one expected the script tag to be *removed* from the output, the other expected the substring "onerror" to be absent. Both now assert the property that matters — that no tag can form — because `onerror` surviving as inert text is fine. Exploitation required admin access either way: journal and essay text comes from the studio or from content/*.md. This removes the weakness, it does not close an open door. * fix(journal): contain file paths, fix frontmatter escaping, defuse two regexes Follow-up to the CodeQL findings on release PR #432. I went through all 23 alerts individually; this addresses the ones that are worth addressing and documents the ones that are not. Path containment (12 alerts, all false positives). Every path built from a slug goes through isValidSlug(), a strict `/^[a-zA-Z0-9_-]+$/` allowlist — verified against `../../etc/passwd`, `foo/../../bar`, `a/b`, `..` and friends, all rejected. CodeQL cannot see it because the check lives in another module. Added a containedPath() helper that resolves the path and refuses anything landing outside the content directory: a second lock on a door that was already locked, and a barrier the analysis can follow. Also removed the dead `slug.endsWith('.md')` branches — isValidSlug rejects dots, so they could never be taken. Frontmatter escaping (1 alert, a real bug). The serializer escaped `"` but not `\`, and the parser never unescaped anything. A title containing either character gained a backslash on every save/load cycle: Path C:\Users "quoted" -> Path C:\\Users \"quoted\" -> ... Escaping now covers the backslash first and the parser undoes both. A round trip test covers quotes, backslashes, colons and apostrophes. Two of three ReDoS regexes (2 alerts). The heading pattern had `\s+` next to `(.+)`, which overlap, so the engine tried every split of the whitespace run before failing; it is `[ \t]+` and `(\S.*)` now. The quote author pattern wrapped a lazy group around an optional group — the quadratic case — and is an index split on the first separator now. The third regex, the bold/italic pass, is deliberately left alone. Rewriting it with a negated class removes the backtracking but breaks nesting: `**bold *and italic* here**` renders as `*<em>bold </em>and italic<em> here</em>*`. The input is Markdown from an authenticated admin, never a visitor, so the worst case is an author slowing down their own page. The comment in the code says so. Not addressed: 5 js/insufficient-password-hash alerts. They ask for a slow KDF where the code uses SHA-256/HMAC — correct in general, but the admin password comes from an environment variable and is never stored, so a stronger KDF protects nothing that is not already in plaintext in the environment. 399 unit tests pass (18 new), build and tsc clean. * fix(journal): split the quote author by scanning, not by pattern Cleaning up after myself. #439 replaced the quote author regex `/^(.*?)(?:\s+--\s+(.+))?$/` — a lazy group around an optional one, the quadratic case — with `/\s+--\s+/`, and CodeQL promptly flagged the replacement for the same reason. One reported pattern traded for another. splitQuoteAuthor() scans for the first `--` that has whitespace on both sides. Linear, and it needs no reasoning about the regex engine at all. Behaviour is identical to the original regex, checked case by case against it: separator, no separator, several separators, tabs, wide gaps, `a--b` without spaces, leading and trailing separators, empty string. All nine are covered by tests, plus one asserting it stays fast on a 50k whitespace run. * security(admin): derive the session signing key with scrypt getSigningKey() ran the admin password through a single SHA-256 digest. It is key derivation rather than password storage, so it was never a stored-hash problem — but if the derived key ever leaked, one fast hash makes recovering the password by brute force cheap. CodeQL flags it as js/insufficient-password-hash and, for this particular alert, has a point. scrypt now. Two details that matter: The salt has to be stable. A random salt would produce a different key on every call and invalidate every session; it is derived from AUTH_SECRET, which is deployment-specific. Verified across separate processes: same inputs produce a verifying token, so a restart or redeploy does not log everyone out. The result is cached for the process lifetime. scrypt is deliberately slow and getSigningKey() runs on every admin request — deriving per call would add ~24ms to each one. The cache key is a digest of secret plus password, so a rotation misses the cache and derives again, and no extra plaintext copy of the password is kept around. Measured: first derivation 24ms, subsequent calls 0.12ms. Password change and secret change both invalidate an existing token, checked in separate processes. Note the one-time effect: existing admin sessions are invalidated by the change in derivation, so everyone logs in once more. * security(admin): key the signing-key cache on its inputs, not a digest #441 removed the SHA-256 digest of the admin password from the key derivation and introduced a new one three lines above it, as the cache key. Same rule, same file: CodeQL reported it immediately. The comment justifying it was wrong too. It claimed no second plaintext copy of the password was retained, while building the digest input allocates exactly that in order to hash it. The cache now holds the two input strings and compares them directly. They are the same objects the env and install caches already hold, so nothing extra is retained, and no fast hash of the password exists in memory for the life of the process. Re-verified after the change, in separate processes: a token from one process verifies in another with the same inputs, a changed password or secret rejects it, first derivation 24ms, cached calls 0.001ms. That leaves scrypt as the only place the password is hashed here. The two HMACs further down operate on the derived key and on token data, not on the password; the constant-time comparison in verifyAdminPassword is the previously dismissed one. --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
2026-08-14 16:55:07 +02:00
@media (prefers-reduced-motion: reduce) {
.floating-save-bar {
animation: none;
}
.badge-pulse-dot {
animation: none;
}
}
security: add Trivy container scan to Docker publish workflow (#399) * feat(admin): add backup manager UI with 1-click restore * feat(admin): collapse older backup entries by default * fix(theme): isolate admin layout, instant DOM theme updates, and add Light/Dark mode toggle * feat(admin): replace text controls for Photo Frame and Hero Style with visual preview cards * fix(admin): define missing CSS rules for button system (.btn, .preset-btn) * feat(admin): redesign theme settings with segmented mode toggle, accent color swatches, and custom iOS-style toggle cards * feat(admin): upgrade all settings tabs with visual grid previews, Google SEO snippet preview, and toggle cards * feat(admin): overhaul Pages Builder UX with slide-over drawer, card hover badges, real-time search, and floating save bar * fix(admin): remove leftover dangling syntax snippet in PageBuilder.tsx * fix(admin): add position: relative to subpage-tile so hover overlay is contained inside the tile * style(admin): replace all emojis with clean Leica-style vector SVG icons * fix(types): extend IconProps with SVGProps to allow style prop on Leica SVG icons * feat(admin): add subpage live-preview, privacy analytics, and asset protection settings * fix(typecheck): fix AlbumEntry property access in subpage drawer preview mode * fix(types): fix ImmichAlbumInfo property names thumbnailAssetId and albumName in PageBuilder.tsx * fix(types): add protection and watermark optional properties to AppConfig interface * feat(settings): add toggle for disabling analytics tracking (defaults to enabled) * feat(ux): show status banner when analytics tracking is disabled + add live sync indicator * feat(watermark): render customizable watermark overlay on Lightbox images + rename section to Portfolio Features & Modules * fix(types): import type LightboxWatermark in PhotoGrid.tsx * fix(types): destructure watermark prop in PhotoGrid function signature * feat(seo): add configurable subpage title template and metadata descriptions * feat(seo): add generateMetadata to about page for title template support * feat(proofing): add client proofing, favorites selection, compact URL bitmasking, and export modal * feat(essay): add Photo Essay storytelling mode with RSC markdown parser and fullbleed/pair layouts * feat(subpages): add page enabled toggle to deactivate subpages without deleting them * feat(admin): add visual essay block builder for photo essay storytelling pages * security: add Trivy container scan to Docker publish workflow Scans the built image for CRITICAL/HIGH CVEs on every release and uploads results to the GitHub Security tab. Non-blocking for now (exit-code 0) so releases aren't gated on findings. Also documents the scan and existing Dependabot coverage in the README. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-08-07 11:08:04 +02:00
/* ── Analytics View ────────────────────────────────────────── */
.analytics-view {
display: flex;
flex-direction: column;
gap: 1.5rem;
max-width: 1100px;
}
.analytics-header {
display: flex;
align-items: center;
justify-content: space-between;
}
.analytics-header h2 {
font-size: 1.25rem;
font-weight: 600;
margin: 0;
display: flex;
align-items: center;
gap: 0.5rem;
}
.analytics-subtitle {
font-size: 0.8rem;
color: var(--admin-text-muted);
margin: 0.25rem 0 0;
}
.analytics-metrics-grid {
display: grid;
grid-template-columns: repeat(auto-fit, minmax(220px, 1fr));
gap: 1rem;
}
.metric-card {
background: var(--admin-bg-raised);
border: 1px solid var(--admin-border);
border-radius: 12px;
padding: 1.25rem;
display: flex;
flex-direction: column;
gap: 0.25rem;
}
.metric-label {
font-size: 0.75rem;
text-transform: uppercase;
letter-spacing: 0.05em;
color: var(--admin-text-muted);
}
.metric-value {
font-size: 1.8rem;
font-weight: 700;
color: var(--admin-text);
font-family: var(--font-mono, monospace);
}
.metric-sub {
font-size: 0.7rem;
color: var(--admin-text-muted);
}
.analytics-panel {
background: var(--admin-bg-raised);
border: 1px solid var(--admin-border);
border-radius: 12px;
padding: 1.5rem;
}
.analytics-section-title h3 {
font-size: 0.95rem;
font-weight: 600;
margin: 0 0 1.25rem;
display: flex;
align-items: center;
gap: 0.5rem;
}
.analytics-bar-chart {
display: flex;
align-items: flex-end;
gap: 0.75rem;
height: 180px;
padding-top: 1.5rem;
}
.bar-col {
flex: 1;
display: flex;
flex-direction: column;
align-items: center;
height: 100%;
}
.bar-wrapper {
flex: 1;
width: 100%;
max-width: 32px;
display: flex;
align-items: flex-end;
background: var(--admin-bg-elevated);
border-radius: 6px;
overflow: hidden;
}
.bar-fill {
width: 100%;
background: var(--admin-primary, #3b82f6);
border-radius: 6px 6px 0 0;
transition: height 0.3s ease;
position: relative;
display: flex;
align-items: flex-start;
justify-content: center;
}
.bar-val {
font-size: 0.65rem;
font-weight: 600;
color: #fff;
margin-top: 4px;
}
.bar-label {
font-size: 0.68rem;
color: var(--admin-text-muted);
margin-top: 0.5rem;
font-family: var(--font-mono, monospace);
}
.analytics-top-pages {
display: flex;
flex-direction: column;
gap: 0.75rem;
}
.top-page-row {
display: flex;
align-items: center;
gap: 1rem;
}
.page-rank {
font-size: 0.8rem;
font-family: var(--font-mono, monospace);
color: var(--admin-text-muted);
width: 24px;
}
.page-info {
flex: 1;
display: flex;
flex-direction: column;
gap: 0.35rem;
}
.page-path-line {
display: flex;
align-items: center;
justify-content: space-between;
font-size: 0.85rem;
}
.page-path {
font-family: var(--font-mono, monospace);
color: var(--admin-text);
}
.page-count {
font-size: 0.75rem;
color: var(--admin-text-muted);
}
.page-progress-bg {
width: 100%;
height: 6px;
background: var(--admin-bg-elevated);
border-radius: 3px;
overflow: hidden;
}
release: v0.11.0 — journal fixes, admin URLs, design system cleanup (#432) * fix(screenshots): sharp-Typen fuer 0.34 und 0.35 gleichzeitig (#410) sharp 0.35 ist von `export =` auf ESM umgestellt: der Modul-Namespace ist nicht mehr aufrufbar, die Factory sitzt unter .default. Der Type-Check brach damit in scripts/screenshots.ts weg, sobald der Next-Bump (#402) sharp von 0.34.5 auf 0.35.3 mitzieht -- sharp ist hier keine deklarierte Dependency, sondern kommt ueber Next mit. Die Form wird jetzt aus dem installierten Paket abgeleitet statt festgeschrieben, zur Laufzeit wie im Typ. Geprueft mit beiden Versionen: tsc laeuft mit 0.34.5 und mit 0.35.3 fehlerfrei durch. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(deps): bump the nextjs group across 1 directory with 2 updates (#402) Bumps the nextjs group with 2 updates in the / directory: [next](https://github.com/vercel/next.js) and [eslint-config-next](https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next). Updates `next` from 16.2.12 to 16.3.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/compare/v16.2.12...v16.3.0) Updates `eslint-config-next` from 16.2.12 to 16.3.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/commits/v16.3.0/packages/eslint-config-next) --- updated-dependencies: - dependency-name: eslint-config-next dependency-version: 16.3.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: nextjs - dependency-name: next dependency-version: 16.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nextjs ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps-dev): bump prettier from 3.8.3 to 3.9.6 (#405) Bumps [prettier](https://github.com/prettier/prettier) from 3.8.3 to 3.9.6. - [Release notes](https://github.com/prettier/prettier/releases) - [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md) - [Commits](https://github.com/prettier/prettier/compare/3.8.3...3.9.6) --- updated-dependencies: - dependency-name: prettier dependency-version: 3.9.6 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * docs(changelog): Unreleased-Sektion fuer die Bumps nach v0.10.0 (#413) Die Dependency-PRs sind nach dem Release auf dev gelandet, teils auch auf main. Ohne Eintrag waeren sie beim naechsten Release unsichtbar -- inklusive Next 16.3.0, das CVE-2025-13465 mitbringt. Ausserdem im 0.10.0-Abschnitt nachgetragen, dass der Trivy-Scan bis #409 nie gelaufen ist. Der Fix steckt im Tag v0.10.0, fehlte aber in der Aufzaehlung -- und "Images werden bei jedem Publish gescannt" stand im Changelog, waehrend der Job im Action-Setup abbrach. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(gallery): per-album sort order, independent of Immich (#408) (#414) Album order was dictated entirely by Immich: getAlbum() sorted by the album's own asc/desc flag, so a Folio album always mirrored the archive. A curated series has a narrative order that has nothing to do with capture time, and changing the Immich album's sort to fit the website changes it for the archive too. Adds an optional per-album `sort` in gallery.yaml, editable in /admin, defaulting to today's behaviour so every existing config is unchanged: immich (default) | newest | oldest | filename | manual `manual` is a pinned *prefix*: `assetOrder` lists only the photos placed by hand, everything else follows in the album's Immich order. A full permutation of a 2,000-photo album would be ~80 KB of UUIDs in a file that is rewritten and copied to content/.backups/ on every admin save. It also makes drift fall out for free — photos removed in Immich never match, new ones land in the tail rather than being hidden. Sorting is applied after the cache read, not before the cache write, so the LRU keeps one canonical Immich-ordered copy per album. That avoids putting the mode in the cache key, lets a config change take effect without depending on invalidation, and keeps the stale-serving path correct. cache.get() returns the stored object by reference, so withSort() returns a shallow clone with a new array — sorting in place would reorder the shared entry, and under request coalescing every concurrent caller would be sorting the same array. Also fixes a prerequisite bug: /api/admin/albums/[albumId]/assets read album.assets from GET /albums/:id, which Immich 3.x no longer populates (lib/immich.ts:507). The hero picker's "This Album" tab returned nothing and threw outright when the key was absent. It now goes through the client's paginated metadata search, with ?types=all to opt videos in for the reorder editor. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): drop decorative emoji from the sort select labels (#415) An <option> cannot contain markup, so the SVG set in Icons is not reachable there — but a decorative emoji is not a substitute for it. Plain text instead; the album card badge already uses a real icon. The remaining emoji in the admin panel (asset picker tabs, section headings, layout picker options) predate this branch and are left for a separate cleanup. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): replace emoji icons with the shared SVG icon set (#416) The admin panel mixed two icon conventions: inline SVGs from `Icons.tsx` in most components, and decorative emoji in the asset picker and a few PageBuilder labels. Emoji render inconsistently across platforms, ignore the accent colour, and cannot inherit the `.svg-icon` sizing rules. - Icons.tsx: add `IconStar` (filled — it marks a state, not an action) and `IconImage`. - AssetPicker: the three tab labels and the favourite tile badge now use IconFolder / IconStar / IconImage. - PageBuilder: the "Standalone Albums" and "Subpages" headings use the icon set instead of an emoji. - PageBuilder: the layout picker drops its emoji for plain text. An <option> cannot contain markup, so an SVG is impossible there and a decorative glyph is not a substitute. - admin.css: align icon and label in the picker tabs, and swap the favourite badge's text-shadow for drop-shadow, which is what applies to an inline SVG. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): fold PageBuilder's local icons into the shared Icons module (#418) * refactor(admin): fold PageBuilder's local icons into the shared module PageBuilder.tsx carried its own `Icons` object duplicating most of the glyphs already exported by Icons.tsx, with hardcoded sizes and slightly divergent paths. Migrate all 32 call sites to the shared module and delete the local object. Five glyphs had no counterpart and are added to Icons.tsx as 1:1 ports of the local paths: IconX, IconPlus, IconHome, IconCopy, IconImage. The local ExternalLink and Check are dropped rather than ported — both had zero call sites. Two glyphs change shape slightly, which is the point of consolidating: the shared IconCamera includes the viewfinder bump the local copy omitted, and drag handles now use IconGripVertical. IconGripVertical uses the module's square 24x24 viewBox, so `.svg-drag` goes from 12x18 to 18x18 — the old non-square box would letterbox the glyph down to 12x12 and shrink the handle. * fix(admin): resolve icon-module integration after #416 Merging dev brought in #416, which added a second IconImage to Icons.tsx and two <Icons.Camera>/<Icons.Folder> section headers that reference the local Icons object this PR removes. Git merged both cleanly but the result did not type-check. - drop the duplicate IconImage (both copies were byte-identical) - point the two section headers at the imported IconCamera/IconFolder - refresh the SORT_LABELS comment: the icon set is imported now, not declared below --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> * fix(config): allow an empty gallery, guard against a double /api suffix (#421) An empty gallery is now a valid, rendered state instead of a throw: deriveGallery() no longer requires at least one album or subpage, so a deployment with no albums yet renders a bare homepage the owner can fill in via /admin. getConfig() also stops appending /api to an Immich URL that already ends in it, which previously produced .../api/api and broke every upstream request. Includes a restore of the per-album sort test cases, which the branch had lost by being cut before #408/#414. * feat(admin): favicon upload, served from the content volume (#422) Adds a bundled default favicon, an upload widget in admin Settings > General, and a route that serves the icon from the writable content/ volume with a fallback to the bundled default. Raster uploads (PNG/ICO/JPEG) are wrapped in an SVG container; the response carries its own CSP so an uploaded SVG cannot execute script on the origin. The GET route revalidates with an ETag instead of caching immutably, so a newly uploaded icon shows up immediately. Uploads are written via temp file + rename, and a Reset button restores the bundled default. * ci: flag unformatted files in a PR, without blocking it (#424) Prettier is configured as an error rule in eslint.config.mjs but has never run in CI, so part of the tree predates it. A final CI step now diffs against the PR base, runs prettier --list-different over the changed files, and emits a warning annotation per offender plus a job summary. Advisory by design: it never fails the job. Blocking would turn a PR red for merely touching a file that was already unformatted, and normalising the tree in one commit would wreck git blame and conflict with the PRs in flight. Requires fetch-depth: 0, since diffing against the base needs its history. * feat(install): first-run wizard gated by a one-time setup token (#419) Adds /install, a four-step first-run wizard: connect to Immich, optionally pick albums, name the site, finish. It verifies the credentials against the Immich server before writing anything, then writes gallery.yaml, settings.yaml and a content/install.json carrying the Immich credentials and a generated site secret. install.json exists because a running process cannot pick up new env vars — the wizard has to write configuration that takes effect without a restart. getInstallCredentials() merges it under the real environment, so env vars always win and rotation stays a matter of setting one. Both the page and the API routes are gated by a one-time setup token printed to the server log, so a deployment that is reachable before gallery.yaml exists cannot be configured by whoever finds it first. The token is stored in content/.setup-token (0600) rather than a module variable: Next.js bundles the page and each route handler separately, so a module-level token left the page and the API disagreeing inside one process and the wizard stuck on step 1. It is removed once the install completes. The admin password is stored as an scrypt hash using the scheme lib/auth.ts already applies to album passwords; a plaintext ADMIN_PASSWORD env var keeps working. * docs: document the setup wizard, fix the read-only content mount (#425) Quick Start now leads with the /install wizard, with the hand-written YAML route kept alongside it, and a First-Run Setup section covers the setup token, the files the wizard writes, and env-var precedence. Two corrections: both Docker examples mounted content/ as :ro, which silently breaks the wizard, the admin panel and the backup rotation alike — docs/admin-panel.md already said so and the README contradicted it. And nothing documented that content/install.json holds the Immich API key, so a backup of content/ is a backup of credentials. Also adds a Contributors section crediting the people whose work is in the project. * feat(admin): floating save bar pinned to the bottom of the viewport (#426) The save bar was the first, static element inside .admin-main. Since the document itself scrolls, it left the viewport as soon as you scrolled down — editing a subpage section or a settings block far below gave no visible dirty hint and no reachable save button. Replace it with a bottom-pinned floating bar shared by both editors. It only mounts while there is something to act on (unsaved changes, an in-flight save, or a result message), so it never covers content while idle. The success message clears after 5s, which hides the bar again. - new SaveBar component, replacing the duplicated markup in PageBuilder and SettingsEditor - adopt the previously unused .floating-save-bar CSS: slide-in keyframes (carrying translateX(-50%)), dirty border, wrap/gap, mobile variant and a prefers-reduced-motion opt-out; z-index 900 keeps it below modals - .admin-main gains bottom padding so the bar never covers page content - drop the now-unreachable idle hints: the ⌘S hint becomes a button title, the Live Sync note becomes a static line above the settings layout - header "Site" link now bypasses the cache (/?fresh=1), so the preview stays reachable when the bar is hidden Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(admin): themed listbox for the album sort control (#427) The per-album "Photo order" control was a native <select>. Because an <option> cannot contain markup, its choices could not use the admin panel's currentColor SVG set — the reason #415 had to fall back to plain text after dropping the emoji labels. Adds a Listbox component implementing the ARIA combobox/listbox pattern, so options can render a glyph beside their label: - DOM focus stays on the trigger button; the active option is announced through aria-activedescendant, keeping focus management to one element - Keyboard: arrows (clamped at the ends, like a native select), Home/End, Enter/Space to commit, Escape to cancel, Tab commits and moves on, and prefix type-ahead with a repeat-key cycle - Outside dismissal on pointerdown, so a press starting outside closes the popup before the click retargets The sort options now carry an icon each: calendar, arrow-down, arrow-up, an A→Z marker, and the drag glyph for manual — matching the badge the album card already shows. SORT_LABELS stays plain text because the badge feeds it to a title attribute. Closes #417 Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(git): ignore generated design handoff folders * fix(admin): stop the album sort dropdown clipping, and simplify the panel (#428) * fix(admin): render listbox popup in a portal so it escapes modal clipping The sort control's popup was position:absolute inside three clipping ancestors (.album-drawer overflow:hidden > .album-drawer-body overflow-y:auto > .modal-right-column overflow-y:auto), so it was cut off at the bottom of the Edit Album Details modal. z-index could not help: clipping happens before stacking. It also always hung below the trigger, with no flip. Portal the popup to document.body and position it from the trigger's viewport rect, flipping above when there is more room there and capping max-height to the space available so it scrolls internally rather than overflowing. It is dismissed on scroll and resize, since the anchor is only measured on open. The outside-pointerdown handler now also treats the popup as inside; without that the portalled list counts as outside, and a click on an option would close it before the selection commits. * refactor(admin): single-column album details panel The left column spent 1.2fr on a cover thumbnail and three stat rows, two of which (Status, Custom Hero) only restated the form fields opposite them, while the form itself was squeezed into 1.8fr behind a second nested scroller. Stack the drawer in one column instead: cover as a banner, then the form at full width, with the UUID moved into the footer. The body is now the only scroll container, which also removes one of the ancestors that was clipping the sort popup. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> * fix(admin): give the portalled listbox its theme back, lock the page behind modals (#429) Two defects in the album editor. The sort listbox popup painted transparent. Every --admin-* variable is scoped to .admin-layout, and since the popup moved into document.body it sits outside that subtree, so background/border/text all resolved to nothing. It now carries its own copy of the palette in both colour schemes, plus the font it no longer inherits. Scrolling inside a modal also moved the page behind it. No admin modal ever locked body scroll: the overlay covers the page but does not absorb wheel events, so a scroll starting on the backdrop — or continuing past the end of the modal's own scroller — reaches the document. overscroll-behavior cannot cover that case on its own, because it only applies to scroll containers and the backdrop is not one. useScrollLock freezes body while a modal is open and compensates for the width the scrollbar gives up, so nothing shifts underneath. Each lock restores the inline value it found, which makes nesting work without a counter — a picker opened from the drawer restores the drawer's hidden state instead of clearing it. Applied to both drawers and all four picker modals, which share the defect. overscroll-behavior: contain on the scrollers stops the chaining they can handle themselves. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com> * fix(security): allow unsafe-eval in CSP script-src during dev mode * feat(journal): add Journal Studio with split-screen editor, live preview and dedicated routes * fix(build): separate client parser from server journal-service and fix build type errors * fix(journal): Fotos rendern, Layout und Lightbox-Steuerung korrigieren Fünf unabhängige Fehler in der öffentlichen Journal- und Essay-Ansicht: * Foto-Blöcke wurden nie angezeigt. EssayView löst ein Foto über PhotoItem.id auf, und das sind verschlüsselte Tokens — die Blöcke aus dem Markdown tragen aber rohe Asset-UUIDs. Jede Zuordnung lief ins Leere, und nicht auflösbare Blöcke werden still verworfen. Die IDs werden jetzt serverseitig übersetzt; damit verschwinden nebenbei die rohen UUIDs aus dem Client-Payload, die dort laut Projektregel nie auftauchen dürfen. Nicht auflösbare Referenzen werden geloggt. * Überschriften standen weiter links als der Fließtext. Jeder Block hatte einzeln `max-width: 68ch`, und `ch` ist relativ zur Schrift des Elements — die Serif-Überschrift ergab eine breitere Spalte. Ersetzt durch eine gemeinsame, font-unabhängige `--essay-measure`. * Fullbleed-Fotos bluteten nur nach links aus: `.essay-figure` ist `width: 100%`, wodurch die Box überbestimmt ist und der negative rechte Margin verworfen wird. * Foto-Paare stellten beide Bilder gleich breit dar, wodurch ein Hochformat neben einem Querformat doppelt so hoch wurde. Jetzt eine Justified-Reihe: Breite proportional zum Seitenverhältnis, dadurch exakt gleiche Höhen ohne Beschnitt. * Die Lightbox hatte im Journal keine Tastatursteuerung und keine Scroll-Sperre — beides lag in PhotoGrid, also nur im Album-Raster. Verlagert in die Lightbox selbst, der doppelte Handler in PhotoGrid entfernt (sonst wäre pro Pfeildruck zwei Bilder weitergesprungen). Zusätzlich sind Proofing-Herzen und das EXIF-Panel im redaktionellen Modus abschaltbar und im Journal aus: Client-Proofing ist ein Übergabe-Workflow für Alben, keine Funktion einer Reportage. Auf der Übersicht wurde der Untertitel doppelt gerendert, weil extractExcerpt() auf ihn zurückfällt. * feat(admin): eigene URLs für alle Bereiche und überarbeiteter Journal Studio Das Panel war eine einzige Client-Komponente, die ihre Tabs über useState umschaltet: keine Route pro Bereich, kein Deep-Link, kein Zurück-Button, und nach jedem Reload landete man wieder auf "Pages". Auch der Journal-Editor hatte keine eigene URL. Jetzt sieben echte Routen (/admin, /admin/pages, /admin/journal, /admin/journal/<slug>, /admin/settings, /admin/settings/<section>, /admin/analytics). Die Shell mit Auth-Prüfung und Kopfzeile sitzt im Layout und umschließt children — so bleibt die Session-Prüfung über Routenwechsel montiert, statt bei jedem Tab-Wechsel neu zu laufen und den Spinner aufblitzen zu lassen. Unbekannte Settings-Sections fallen auf General zurück. Im selben Zug der Journal Studio, der die Routing-Änderung ohnehin berührt: * Alle Eingabefelder nutzten die Klasse `admin-input`, die in keinem CSS definiert war — sie fielen auf Browser-Defaults zurück. Jetzt gestylt, gescoped, damit der generische Name nicht ins übrige Panel leckt. * Der Split View ist per Divider verschiebbar (Maus, Tastatur, Doppelklick zum Zurücksetzen), Breite in localStorage. * Das Studio bricht aus der 1120px-Spalte aus, die Preview hat Platz. * Die Preview zeigte für jedes Foto fest 3:2 und log damit über das Layout der veröffentlichten Seite; die echten Verhältnisse werden jetzt an den Thumbnails gemessen. * Blöcke mit alten positionsbasierten Foto-Referenzen werden markiert — die lassen sich auf einer eigenständigen Journal-Seite nicht auflösen und verschwanden bisher stillschweigend. * Blocktyp-Chips als gemeinsame Komponente, monochrom und per Icon unterschieden statt in einer eigenen Blau/Lila/Orange-Palette, die sonst nirgends im Panel vorkommt. * Emojis raus, SVG-Icons rein. * fix(admin): Designsystem-Lücken im Panel schließen Eine systematische Suche nach Klassen, die im TSX benutzt, aber in keinem CSS definiert sind, hat vier Stellen mit demselben Muster gefunden: * `admin-btn-secondary` und `admin-btn-danger` existierten nicht. Sämtliche Löschen-Buttons sahen aus wie normale Buttons — keine Warnwirkung. Als `.admin-btn.admin-btn-danger` geschrieben, weil die Varianten mit den Größenklassen kombiniert werden, die weiter unten ihren eigenen Hintergrund setzen. * `page-progress-fill` fehlte: die Balken im Analytics-Panel waren leere Rinnen, der Wert unsichtbar. Ebenso `analytics-empty` und `admin-loading-container`. * `subpage-drawer-section`, `subpage-drawer-title-group` und `input-with-icon` im PageBuilder waren wirkungslos und teils mit Inline-Styles notdürftig kompensiert. * `grid-card-preview` fehlte, wodurch alle Layout-Vorschauen auf Höhe null kollabierten. Nur "Showcase" war sichtbar — und das aus Versehen, weil sein Tile `hero-tile` hieß und damit die `aspect-ratio` einer fremden PageBuilder-Klasse erbte. Umbenannt. Dazu die Theme-Vorschauen, die praktisch identisch aussahen: alle sieben zeigten dieselben drei quadratischen Kacheln, einziger Unterschied war die Hintergrundfarbe. Sie spiegeln jetzt die echten Preset-Daten aus lib/config/theme.ts — Schriftcharakter, Eckradius, Rasterdichte, Passepartout bzw. Schatten. Die Kopfzeile richtet sich an einer gemeinsamen Steuerhöhe aus. Der "Site"-Link war höher als die Buttons daneben: `.admin-btn` hatte keine explizite line-height, und <button> bekommt box-sizing: border-box vom Browser, <a> nicht. Die Statusanzeige setzte weder Schriftfamilie noch -größe und fiel auf den Browser-Default zurück — sie war nie Teil des Designsystems. Jetzt gleiche Höhe und Typografie, Pillenform als Zustandsanzeige, Trenner zur Aktionsgruppe. Das dauerhafte Pulsieren des grünen Punkts entfällt; Animation bleibt den Zuständen vorbehalten, die Aufmerksamkeit brauchen. Restliche Emojis durch SVG-Icons ersetzt. * feat(admin): add scroll-to-top toggle and SVG arrow The back-to-top button was always on and drew its arrow with the ↑ text character. Add a `scrollToTop` setting (General section in the admin panel, defaults to on so existing sites are unaffected) and replace the glyph with a stroked SVG that inherits currentColor across all presets. Scroll handling is now rAF-throttled, and prefers-reduced-motion turns off both the hover lift and the smooth scroll. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * security(journal): escape author HTML instead of filtering it CodeQL flags 26 high-severity alerts on the release PR; the bulk of them point at sanitizeHtml(), a denylist of three regexes whose output goes into dangerouslySetInnerHTML. I reproduced the bypasses before changing anything — all four pass the old filter: <img src=x onerror=alert(1)> unquoted handler, regex wants quotes <img src=x onerror='alert(1)'> single quotes, same reason <svg onload=alert(1)> not a <script> tag javasjavascript:cript:alert(1) one-pass replace, the rest recombines Plus an attribute breakout in the link renderer, which interpolated the URL into href="${url}" unescaped: [x](" onmouseover=alert(1) x=") -> <a href="" onmouseover=alert(1" ...> Replaced with escaping. Every `&<>"'` in author text becomes an entity before any markdown rule runs, so the only tags in the output are the ones renderInlineMarkdown builds itself and a URL cannot leave its attribute. Link schemes are now an allowlist (http, https, mailto, tel, relative, anchor); anything else renders as plain text. The serializer needed decodeHtmlEntities to match: without it a save would write `&lt;` into the Markdown file and the next parse would escape the `&` again, corrupting the text further on every round trip. A test covers parse -> serialize -> parse stability. Two existing tests asserted the old behaviour and were rewritten rather than deleted: one expected the script tag to be *removed* from the output, the other expected the substring "onerror" to be absent. Both now assert the property that matters — that no tag can form — because `onerror` surviving as inert text is fine. Exploitation required admin access either way: journal and essay text comes from the studio or from content/*.md. This removes the weakness, it does not close an open door. * fix(journal): contain file paths, fix frontmatter escaping, defuse two regexes Follow-up to the CodeQL findings on release PR #432. I went through all 23 alerts individually; this addresses the ones that are worth addressing and documents the ones that are not. Path containment (12 alerts, all false positives). Every path built from a slug goes through isValidSlug(), a strict `/^[a-zA-Z0-9_-]+$/` allowlist — verified against `../../etc/passwd`, `foo/../../bar`, `a/b`, `..` and friends, all rejected. CodeQL cannot see it because the check lives in another module. Added a containedPath() helper that resolves the path and refuses anything landing outside the content directory: a second lock on a door that was already locked, and a barrier the analysis can follow. Also removed the dead `slug.endsWith('.md')` branches — isValidSlug rejects dots, so they could never be taken. Frontmatter escaping (1 alert, a real bug). The serializer escaped `"` but not `\`, and the parser never unescaped anything. A title containing either character gained a backslash on every save/load cycle: Path C:\Users "quoted" -> Path C:\\Users \"quoted\" -> ... Escaping now covers the backslash first and the parser undoes both. A round trip test covers quotes, backslashes, colons and apostrophes. Two of three ReDoS regexes (2 alerts). The heading pattern had `\s+` next to `(.+)`, which overlap, so the engine tried every split of the whitespace run before failing; it is `[ \t]+` and `(\S.*)` now. The quote author pattern wrapped a lazy group around an optional group — the quadratic case — and is an index split on the first separator now. The third regex, the bold/italic pass, is deliberately left alone. Rewriting it with a negated class removes the backtracking but breaks nesting: `**bold *and italic* here**` renders as `*<em>bold </em>and italic<em> here</em>*`. The input is Markdown from an authenticated admin, never a visitor, so the worst case is an author slowing down their own page. The comment in the code says so. Not addressed: 5 js/insufficient-password-hash alerts. They ask for a slow KDF where the code uses SHA-256/HMAC — correct in general, but the admin password comes from an environment variable and is never stored, so a stronger KDF protects nothing that is not already in plaintext in the environment. 399 unit tests pass (18 new), build and tsc clean. * fix(journal): split the quote author by scanning, not by pattern Cleaning up after myself. #439 replaced the quote author regex `/^(.*?)(?:\s+--\s+(.+))?$/` — a lazy group around an optional one, the quadratic case — with `/\s+--\s+/`, and CodeQL promptly flagged the replacement for the same reason. One reported pattern traded for another. splitQuoteAuthor() scans for the first `--` that has whitespace on both sides. Linear, and it needs no reasoning about the regex engine at all. Behaviour is identical to the original regex, checked case by case against it: separator, no separator, several separators, tabs, wide gaps, `a--b` without spaces, leading and trailing separators, empty string. All nine are covered by tests, plus one asserting it stays fast on a 50k whitespace run. * security(admin): derive the session signing key with scrypt getSigningKey() ran the admin password through a single SHA-256 digest. It is key derivation rather than password storage, so it was never a stored-hash problem — but if the derived key ever leaked, one fast hash makes recovering the password by brute force cheap. CodeQL flags it as js/insufficient-password-hash and, for this particular alert, has a point. scrypt now. Two details that matter: The salt has to be stable. A random salt would produce a different key on every call and invalidate every session; it is derived from AUTH_SECRET, which is deployment-specific. Verified across separate processes: same inputs produce a verifying token, so a restart or redeploy does not log everyone out. The result is cached for the process lifetime. scrypt is deliberately slow and getSigningKey() runs on every admin request — deriving per call would add ~24ms to each one. The cache key is a digest of secret plus password, so a rotation misses the cache and derives again, and no extra plaintext copy of the password is kept around. Measured: first derivation 24ms, subsequent calls 0.12ms. Password change and secret change both invalidate an existing token, checked in separate processes. Note the one-time effect: existing admin sessions are invalidated by the change in derivation, so everyone logs in once more. * security(admin): key the signing-key cache on its inputs, not a digest #441 removed the SHA-256 digest of the admin password from the key derivation and introduced a new one three lines above it, as the cache key. Same rule, same file: CodeQL reported it immediately. The comment justifying it was wrong too. It claimed no second plaintext copy of the password was retained, while building the digest input allocates exactly that in order to hash it. The cache now holds the two input strings and compares them directly. They are the same objects the env and install caches already hold, so nothing extra is retained, and no fast hash of the password exists in memory for the life of the process. Re-verified after the change, in separate processes: a token from one process verifies in another with the same inputs, a changed password or secret rejects it, first derivation 24ms, cached calls 0.001ms. That leaves scrypt as the only place the password is hashed here. The two HMACs further down operate on the derived key and on token data, not on the password; the constant-time comparison in verifyAdminPassword is the previously dismissed one. --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
2026-08-14 16:55:07 +02:00
/* The bar itself. Without this the track stayed empty and the view count had
* no visual weight at all. */
.page-progress-fill {
height: 100%;
min-width: 2px;
border-radius: 3px;
background: var(--admin-accent);
transition: width 0.3s ease;
}
.analytics-empty {
margin: 0;
padding: 2rem 1rem;
text-align: center;
font-size: 0.85rem;
color: var(--admin-text-muted);
}
.admin-loading-container {
display: flex;
align-items: center;
justify-content: center;
min-height: 320px;
}
security: add Trivy container scan to Docker publish workflow (#399) * feat(admin): add backup manager UI with 1-click restore * feat(admin): collapse older backup entries by default * fix(theme): isolate admin layout, instant DOM theme updates, and add Light/Dark mode toggle * feat(admin): replace text controls for Photo Frame and Hero Style with visual preview cards * fix(admin): define missing CSS rules for button system (.btn, .preset-btn) * feat(admin): redesign theme settings with segmented mode toggle, accent color swatches, and custom iOS-style toggle cards * feat(admin): upgrade all settings tabs with visual grid previews, Google SEO snippet preview, and toggle cards * feat(admin): overhaul Pages Builder UX with slide-over drawer, card hover badges, real-time search, and floating save bar * fix(admin): remove leftover dangling syntax snippet in PageBuilder.tsx * fix(admin): add position: relative to subpage-tile so hover overlay is contained inside the tile * style(admin): replace all emojis with clean Leica-style vector SVG icons * fix(types): extend IconProps with SVGProps to allow style prop on Leica SVG icons * feat(admin): add subpage live-preview, privacy analytics, and asset protection settings * fix(typecheck): fix AlbumEntry property access in subpage drawer preview mode * fix(types): fix ImmichAlbumInfo property names thumbnailAssetId and albumName in PageBuilder.tsx * fix(types): add protection and watermark optional properties to AppConfig interface * feat(settings): add toggle for disabling analytics tracking (defaults to enabled) * feat(ux): show status banner when analytics tracking is disabled + add live sync indicator * feat(watermark): render customizable watermark overlay on Lightbox images + rename section to Portfolio Features & Modules * fix(types): import type LightboxWatermark in PhotoGrid.tsx * fix(types): destructure watermark prop in PhotoGrid function signature * feat(seo): add configurable subpage title template and metadata descriptions * feat(seo): add generateMetadata to about page for title template support * feat(proofing): add client proofing, favorites selection, compact URL bitmasking, and export modal * feat(essay): add Photo Essay storytelling mode with RSC markdown parser and fullbleed/pair layouts * feat(subpages): add page enabled toggle to deactivate subpages without deleting them * feat(admin): add visual essay block builder for photo essay storytelling pages * security: add Trivy container scan to Docker publish workflow Scans the built image for CRITICAL/HIGH CVEs on every release and uploads results to the GitHub Security tab. Non-blocking for now (exit-code 0) so releases aren't gated on findings. Also documents the scan and existing Dependabot coverage in the README. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-08-07 11:08:04 +02:00
/* ── Drawer Live Preview ────────────────────────────────────── */
.drawer-live-preview-panel {
display: flex;
flex-direction: column;
gap: 1.5rem;
padding: 0.5rem 0;
}
.preview-hero-banner {
text-align: center;
padding: 1.75rem 1rem;
background: var(--admin-bg-elevated);
border-radius: 12px;
border: 1px dashed var(--admin-border);
}
.preview-hero-title {
font-size: 1.3rem;
font-weight: 700;
margin: 0;
color: var(--admin-text);
}
.preview-hero-sub {
font-size: 0.82rem;
color: var(--admin-text-muted);
margin: 0.35rem 0 0;
}
.preview-section-group {
display: flex;
flex-direction: column;
gap: 0.75rem;
}
.preview-section-title {
font-size: 0.95rem;
font-weight: 600;
margin: 0;
border-bottom: 1px solid var(--admin-border);
padding-bottom: 0.35rem;
}
.preview-section-desc {
font-size: 0.78rem;
color: var(--admin-text-muted);
margin: 0;
}
.preview-albums-grid {
display: grid;
grid-template-columns: repeat(auto-fill, minmax(130px, 1fr));
gap: 0.75rem;
}
.preview-album-tile {
background: var(--admin-bg-raised);
border: 1px solid var(--admin-border);
border-radius: 8px;
overflow: hidden;
display: flex;
flex-direction: column;
}
.preview-album-cover {
width: 100%;
aspect-ratio: 4/3;
background: var(--admin-bg-elevated);
overflow: hidden;
}
.preview-album-cover img {
width: 100%;
height: 100%;
object-fit: cover;
}
.preview-album-title {
font-size: 0.75rem;
font-weight: 500;
padding: 0.4rem 0.5rem;
white-space: nowrap;
overflow: hidden;
text-overflow: ellipsis;
}
chore(release): v0.10.0 (#400) Photo Essay mode, client proofing, studio-modern preset, admin panel overhaul, watermark, cookieless analytics, subpage toggle, SEO title templates. Analytics API now admin-only, Trivy scan on publish. Album order mirrors the Immich timeline; map theme, admin status panel, lightbox counter and Docker health check fixed. See CHANGELOG.md for the full list and the health-check upgrade note.
2026-08-10 09:56:20 +02:00
/* ── Photo Essay & Storytelling Builder ───────────────────────── */
.essay-block-editor {
display: flex;
flex-direction: column;
gap: 1rem;
}
.essay-toolbar-sticky {
display: flex;
flex-wrap: wrap;
align-items: center;
gap: 0.5rem;
padding: 0.75rem 1rem;
background: var(--admin-bg-raised, #1a1a1a);
border: 1px solid var(--admin-border, #2e2e2e);
border-radius: 10px;
backdrop-filter: blur(8px);
}
.essay-toolbar-label {
font-size: 0.8rem;
font-weight: 600;
color: var(--admin-text, #f0f0f0);
margin-right: 0.5rem;
}
.essay-toolbar-divider {
width: 1px;
height: 20px;
background: var(--admin-border, #2e2e2e);
margin: 0 0.25rem;
}
.essay-block-card {
background: var(--admin-bg-raised, #161616);
border: 1px solid var(--admin-border, #2e2e2e);
border-radius: 10px;
padding: 1rem;
display: flex;
flex-direction: column;
gap: 0.75rem;
transition:
border-color 0.15s ease,
box-shadow 0.15s ease;
}
.essay-block-card:hover {
border-color: var(--admin-border-hover, #444444);
}
.essay-block-card-header {
display: flex;
align-items: center;
justify-content: space-between;
padding-bottom: 0.5rem;
border-bottom: 1px solid var(--admin-border, rgba(255, 255, 255, 0.06));
}
.essay-block-badge {
display: inline-flex;
align-items: center;
gap: 0.35rem;
padding: 0.2rem 0.55rem;
border-radius: 9999px;
font-size: 0.7rem;
font-weight: 600;
text-transform: uppercase;
letter-spacing: 0.04em;
background: var(--admin-bg-elevated, #222);
color: var(--admin-text-secondary, #a0a0a0);
border: 1px solid var(--admin-border, #2e2e2e);
}
security: add Trivy container scan to Docker publish workflow (#399) * feat(admin): add backup manager UI with 1-click restore * feat(admin): collapse older backup entries by default * fix(theme): isolate admin layout, instant DOM theme updates, and add Light/Dark mode toggle * feat(admin): replace text controls for Photo Frame and Hero Style with visual preview cards * fix(admin): define missing CSS rules for button system (.btn, .preset-btn) * feat(admin): redesign theme settings with segmented mode toggle, accent color swatches, and custom iOS-style toggle cards * feat(admin): upgrade all settings tabs with visual grid previews, Google SEO snippet preview, and toggle cards * feat(admin): overhaul Pages Builder UX with slide-over drawer, card hover badges, real-time search, and floating save bar * fix(admin): remove leftover dangling syntax snippet in PageBuilder.tsx * fix(admin): add position: relative to subpage-tile so hover overlay is contained inside the tile * style(admin): replace all emojis with clean Leica-style vector SVG icons * fix(types): extend IconProps with SVGProps to allow style prop on Leica SVG icons * feat(admin): add subpage live-preview, privacy analytics, and asset protection settings * fix(typecheck): fix AlbumEntry property access in subpage drawer preview mode * fix(types): fix ImmichAlbumInfo property names thumbnailAssetId and albumName in PageBuilder.tsx * fix(types): add protection and watermark optional properties to AppConfig interface * feat(settings): add toggle for disabling analytics tracking (defaults to enabled) * feat(ux): show status banner when analytics tracking is disabled + add live sync indicator * feat(watermark): render customizable watermark overlay on Lightbox images + rename section to Portfolio Features & Modules * fix(types): import type LightboxWatermark in PhotoGrid.tsx * fix(types): destructure watermark prop in PhotoGrid function signature * feat(seo): add configurable subpage title template and metadata descriptions * feat(seo): add generateMetadata to about page for title template support * feat(proofing): add client proofing, favorites selection, compact URL bitmasking, and export modal * feat(essay): add Photo Essay storytelling mode with RSC markdown parser and fullbleed/pair layouts * feat(subpages): add page enabled toggle to deactivate subpages without deleting them * feat(admin): add visual essay block builder for photo essay storytelling pages * security: add Trivy container scan to Docker publish workflow Scans the built image for CRITICAL/HIGH CVEs on every release and uploads results to the GitHub Security tab. Non-blocking for now (exit-code 0) so releases aren't gated on findings. Also documents the scan and existing Dependabot coverage in the README. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-08-07 11:08:04 +02:00
release: v0.11.0 — journal fixes, admin URLs, design system cleanup (#432) * fix(screenshots): sharp-Typen fuer 0.34 und 0.35 gleichzeitig (#410) sharp 0.35 ist von `export =` auf ESM umgestellt: der Modul-Namespace ist nicht mehr aufrufbar, die Factory sitzt unter .default. Der Type-Check brach damit in scripts/screenshots.ts weg, sobald der Next-Bump (#402) sharp von 0.34.5 auf 0.35.3 mitzieht -- sharp ist hier keine deklarierte Dependency, sondern kommt ueber Next mit. Die Form wird jetzt aus dem installierten Paket abgeleitet statt festgeschrieben, zur Laufzeit wie im Typ. Geprueft mit beiden Versionen: tsc laeuft mit 0.34.5 und mit 0.35.3 fehlerfrei durch. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(deps): bump the nextjs group across 1 directory with 2 updates (#402) Bumps the nextjs group with 2 updates in the / directory: [next](https://github.com/vercel/next.js) and [eslint-config-next](https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next). Updates `next` from 16.2.12 to 16.3.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/compare/v16.2.12...v16.3.0) Updates `eslint-config-next` from 16.2.12 to 16.3.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/commits/v16.3.0/packages/eslint-config-next) --- updated-dependencies: - dependency-name: eslint-config-next dependency-version: 16.3.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: nextjs - dependency-name: next dependency-version: 16.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nextjs ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps-dev): bump prettier from 3.8.3 to 3.9.6 (#405) Bumps [prettier](https://github.com/prettier/prettier) from 3.8.3 to 3.9.6. - [Release notes](https://github.com/prettier/prettier/releases) - [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md) - [Commits](https://github.com/prettier/prettier/compare/3.8.3...3.9.6) --- updated-dependencies: - dependency-name: prettier dependency-version: 3.9.6 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * docs(changelog): Unreleased-Sektion fuer die Bumps nach v0.10.0 (#413) Die Dependency-PRs sind nach dem Release auf dev gelandet, teils auch auf main. Ohne Eintrag waeren sie beim naechsten Release unsichtbar -- inklusive Next 16.3.0, das CVE-2025-13465 mitbringt. Ausserdem im 0.10.0-Abschnitt nachgetragen, dass der Trivy-Scan bis #409 nie gelaufen ist. Der Fix steckt im Tag v0.10.0, fehlte aber in der Aufzaehlung -- und "Images werden bei jedem Publish gescannt" stand im Changelog, waehrend der Job im Action-Setup abbrach. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(gallery): per-album sort order, independent of Immich (#408) (#414) Album order was dictated entirely by Immich: getAlbum() sorted by the album's own asc/desc flag, so a Folio album always mirrored the archive. A curated series has a narrative order that has nothing to do with capture time, and changing the Immich album's sort to fit the website changes it for the archive too. Adds an optional per-album `sort` in gallery.yaml, editable in /admin, defaulting to today's behaviour so every existing config is unchanged: immich (default) | newest | oldest | filename | manual `manual` is a pinned *prefix*: `assetOrder` lists only the photos placed by hand, everything else follows in the album's Immich order. A full permutation of a 2,000-photo album would be ~80 KB of UUIDs in a file that is rewritten and copied to content/.backups/ on every admin save. It also makes drift fall out for free — photos removed in Immich never match, new ones land in the tail rather than being hidden. Sorting is applied after the cache read, not before the cache write, so the LRU keeps one canonical Immich-ordered copy per album. That avoids putting the mode in the cache key, lets a config change take effect without depending on invalidation, and keeps the stale-serving path correct. cache.get() returns the stored object by reference, so withSort() returns a shallow clone with a new array — sorting in place would reorder the shared entry, and under request coalescing every concurrent caller would be sorting the same array. Also fixes a prerequisite bug: /api/admin/albums/[albumId]/assets read album.assets from GET /albums/:id, which Immich 3.x no longer populates (lib/immich.ts:507). The hero picker's "This Album" tab returned nothing and threw outright when the key was absent. It now goes through the client's paginated metadata search, with ?types=all to opt videos in for the reorder editor. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): drop decorative emoji from the sort select labels (#415) An <option> cannot contain markup, so the SVG set in Icons is not reachable there — but a decorative emoji is not a substitute for it. Plain text instead; the album card badge already uses a real icon. The remaining emoji in the admin panel (asset picker tabs, section headings, layout picker options) predate this branch and are left for a separate cleanup. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): replace emoji icons with the shared SVG icon set (#416) The admin panel mixed two icon conventions: inline SVGs from `Icons.tsx` in most components, and decorative emoji in the asset picker and a few PageBuilder labels. Emoji render inconsistently across platforms, ignore the accent colour, and cannot inherit the `.svg-icon` sizing rules. - Icons.tsx: add `IconStar` (filled — it marks a state, not an action) and `IconImage`. - AssetPicker: the three tab labels and the favourite tile badge now use IconFolder / IconStar / IconImage. - PageBuilder: the "Standalone Albums" and "Subpages" headings use the icon set instead of an emoji. - PageBuilder: the layout picker drops its emoji for plain text. An <option> cannot contain markup, so an SVG is impossible there and a decorative glyph is not a substitute. - admin.css: align icon and label in the picker tabs, and swap the favourite badge's text-shadow for drop-shadow, which is what applies to an inline SVG. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): fold PageBuilder's local icons into the shared Icons module (#418) * refactor(admin): fold PageBuilder's local icons into the shared module PageBuilder.tsx carried its own `Icons` object duplicating most of the glyphs already exported by Icons.tsx, with hardcoded sizes and slightly divergent paths. Migrate all 32 call sites to the shared module and delete the local object. Five glyphs had no counterpart and are added to Icons.tsx as 1:1 ports of the local paths: IconX, IconPlus, IconHome, IconCopy, IconImage. The local ExternalLink and Check are dropped rather than ported — both had zero call sites. Two glyphs change shape slightly, which is the point of consolidating: the shared IconCamera includes the viewfinder bump the local copy omitted, and drag handles now use IconGripVertical. IconGripVertical uses the module's square 24x24 viewBox, so `.svg-drag` goes from 12x18 to 18x18 — the old non-square box would letterbox the glyph down to 12x12 and shrink the handle. * fix(admin): resolve icon-module integration after #416 Merging dev brought in #416, which added a second IconImage to Icons.tsx and two <Icons.Camera>/<Icons.Folder> section headers that reference the local Icons object this PR removes. Git merged both cleanly but the result did not type-check. - drop the duplicate IconImage (both copies were byte-identical) - point the two section headers at the imported IconCamera/IconFolder - refresh the SORT_LABELS comment: the icon set is imported now, not declared below --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> * fix(config): allow an empty gallery, guard against a double /api suffix (#421) An empty gallery is now a valid, rendered state instead of a throw: deriveGallery() no longer requires at least one album or subpage, so a deployment with no albums yet renders a bare homepage the owner can fill in via /admin. getConfig() also stops appending /api to an Immich URL that already ends in it, which previously produced .../api/api and broke every upstream request. Includes a restore of the per-album sort test cases, which the branch had lost by being cut before #408/#414. * feat(admin): favicon upload, served from the content volume (#422) Adds a bundled default favicon, an upload widget in admin Settings > General, and a route that serves the icon from the writable content/ volume with a fallback to the bundled default. Raster uploads (PNG/ICO/JPEG) are wrapped in an SVG container; the response carries its own CSP so an uploaded SVG cannot execute script on the origin. The GET route revalidates with an ETag instead of caching immutably, so a newly uploaded icon shows up immediately. Uploads are written via temp file + rename, and a Reset button restores the bundled default. * ci: flag unformatted files in a PR, without blocking it (#424) Prettier is configured as an error rule in eslint.config.mjs but has never run in CI, so part of the tree predates it. A final CI step now diffs against the PR base, runs prettier --list-different over the changed files, and emits a warning annotation per offender plus a job summary. Advisory by design: it never fails the job. Blocking would turn a PR red for merely touching a file that was already unformatted, and normalising the tree in one commit would wreck git blame and conflict with the PRs in flight. Requires fetch-depth: 0, since diffing against the base needs its history. * feat(install): first-run wizard gated by a one-time setup token (#419) Adds /install, a four-step first-run wizard: connect to Immich, optionally pick albums, name the site, finish. It verifies the credentials against the Immich server before writing anything, then writes gallery.yaml, settings.yaml and a content/install.json carrying the Immich credentials and a generated site secret. install.json exists because a running process cannot pick up new env vars — the wizard has to write configuration that takes effect without a restart. getInstallCredentials() merges it under the real environment, so env vars always win and rotation stays a matter of setting one. Both the page and the API routes are gated by a one-time setup token printed to the server log, so a deployment that is reachable before gallery.yaml exists cannot be configured by whoever finds it first. The token is stored in content/.setup-token (0600) rather than a module variable: Next.js bundles the page and each route handler separately, so a module-level token left the page and the API disagreeing inside one process and the wizard stuck on step 1. It is removed once the install completes. The admin password is stored as an scrypt hash using the scheme lib/auth.ts already applies to album passwords; a plaintext ADMIN_PASSWORD env var keeps working. * docs: document the setup wizard, fix the read-only content mount (#425) Quick Start now leads with the /install wizard, with the hand-written YAML route kept alongside it, and a First-Run Setup section covers the setup token, the files the wizard writes, and env-var precedence. Two corrections: both Docker examples mounted content/ as :ro, which silently breaks the wizard, the admin panel and the backup rotation alike — docs/admin-panel.md already said so and the README contradicted it. And nothing documented that content/install.json holds the Immich API key, so a backup of content/ is a backup of credentials. Also adds a Contributors section crediting the people whose work is in the project. * feat(admin): floating save bar pinned to the bottom of the viewport (#426) The save bar was the first, static element inside .admin-main. Since the document itself scrolls, it left the viewport as soon as you scrolled down — editing a subpage section or a settings block far below gave no visible dirty hint and no reachable save button. Replace it with a bottom-pinned floating bar shared by both editors. It only mounts while there is something to act on (unsaved changes, an in-flight save, or a result message), so it never covers content while idle. The success message clears after 5s, which hides the bar again. - new SaveBar component, replacing the duplicated markup in PageBuilder and SettingsEditor - adopt the previously unused .floating-save-bar CSS: slide-in keyframes (carrying translateX(-50%)), dirty border, wrap/gap, mobile variant and a prefers-reduced-motion opt-out; z-index 900 keeps it below modals - .admin-main gains bottom padding so the bar never covers page content - drop the now-unreachable idle hints: the ⌘S hint becomes a button title, the Live Sync note becomes a static line above the settings layout - header "Site" link now bypasses the cache (/?fresh=1), so the preview stays reachable when the bar is hidden Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(admin): themed listbox for the album sort control (#427) The per-album "Photo order" control was a native <select>. Because an <option> cannot contain markup, its choices could not use the admin panel's currentColor SVG set — the reason #415 had to fall back to plain text after dropping the emoji labels. Adds a Listbox component implementing the ARIA combobox/listbox pattern, so options can render a glyph beside their label: - DOM focus stays on the trigger button; the active option is announced through aria-activedescendant, keeping focus management to one element - Keyboard: arrows (clamped at the ends, like a native select), Home/End, Enter/Space to commit, Escape to cancel, Tab commits and moves on, and prefix type-ahead with a repeat-key cycle - Outside dismissal on pointerdown, so a press starting outside closes the popup before the click retargets The sort options now carry an icon each: calendar, arrow-down, arrow-up, an A→Z marker, and the drag glyph for manual — matching the badge the album card already shows. SORT_LABELS stays plain text because the badge feeds it to a title attribute. Closes #417 Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(git): ignore generated design handoff folders * fix(admin): stop the album sort dropdown clipping, and simplify the panel (#428) * fix(admin): render listbox popup in a portal so it escapes modal clipping The sort control's popup was position:absolute inside three clipping ancestors (.album-drawer overflow:hidden > .album-drawer-body overflow-y:auto > .modal-right-column overflow-y:auto), so it was cut off at the bottom of the Edit Album Details modal. z-index could not help: clipping happens before stacking. It also always hung below the trigger, with no flip. Portal the popup to document.body and position it from the trigger's viewport rect, flipping above when there is more room there and capping max-height to the space available so it scrolls internally rather than overflowing. It is dismissed on scroll and resize, since the anchor is only measured on open. The outside-pointerdown handler now also treats the popup as inside; without that the portalled list counts as outside, and a click on an option would close it before the selection commits. * refactor(admin): single-column album details panel The left column spent 1.2fr on a cover thumbnail and three stat rows, two of which (Status, Custom Hero) only restated the form fields opposite them, while the form itself was squeezed into 1.8fr behind a second nested scroller. Stack the drawer in one column instead: cover as a banner, then the form at full width, with the UUID moved into the footer. The body is now the only scroll container, which also removes one of the ancestors that was clipping the sort popup. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> * fix(admin): give the portalled listbox its theme back, lock the page behind modals (#429) Two defects in the album editor. The sort listbox popup painted transparent. Every --admin-* variable is scoped to .admin-layout, and since the popup moved into document.body it sits outside that subtree, so background/border/text all resolved to nothing. It now carries its own copy of the palette in both colour schemes, plus the font it no longer inherits. Scrolling inside a modal also moved the page behind it. No admin modal ever locked body scroll: the overlay covers the page but does not absorb wheel events, so a scroll starting on the backdrop — or continuing past the end of the modal's own scroller — reaches the document. overscroll-behavior cannot cover that case on its own, because it only applies to scroll containers and the backdrop is not one. useScrollLock freezes body while a modal is open and compensates for the width the scrollbar gives up, so nothing shifts underneath. Each lock restores the inline value it found, which makes nesting work without a counter — a picker opened from the drawer restores the drawer's hidden state instead of clearing it. Applied to both drawers and all four picker modals, which share the defect. overscroll-behavior: contain on the scrollers stops the chaining they can handle themselves. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com> * fix(security): allow unsafe-eval in CSP script-src during dev mode * feat(journal): add Journal Studio with split-screen editor, live preview and dedicated routes * fix(build): separate client parser from server journal-service and fix build type errors * fix(journal): Fotos rendern, Layout und Lightbox-Steuerung korrigieren Fünf unabhängige Fehler in der öffentlichen Journal- und Essay-Ansicht: * Foto-Blöcke wurden nie angezeigt. EssayView löst ein Foto über PhotoItem.id auf, und das sind verschlüsselte Tokens — die Blöcke aus dem Markdown tragen aber rohe Asset-UUIDs. Jede Zuordnung lief ins Leere, und nicht auflösbare Blöcke werden still verworfen. Die IDs werden jetzt serverseitig übersetzt; damit verschwinden nebenbei die rohen UUIDs aus dem Client-Payload, die dort laut Projektregel nie auftauchen dürfen. Nicht auflösbare Referenzen werden geloggt. * Überschriften standen weiter links als der Fließtext. Jeder Block hatte einzeln `max-width: 68ch`, und `ch` ist relativ zur Schrift des Elements — die Serif-Überschrift ergab eine breitere Spalte. Ersetzt durch eine gemeinsame, font-unabhängige `--essay-measure`. * Fullbleed-Fotos bluteten nur nach links aus: `.essay-figure` ist `width: 100%`, wodurch die Box überbestimmt ist und der negative rechte Margin verworfen wird. * Foto-Paare stellten beide Bilder gleich breit dar, wodurch ein Hochformat neben einem Querformat doppelt so hoch wurde. Jetzt eine Justified-Reihe: Breite proportional zum Seitenverhältnis, dadurch exakt gleiche Höhen ohne Beschnitt. * Die Lightbox hatte im Journal keine Tastatursteuerung und keine Scroll-Sperre — beides lag in PhotoGrid, also nur im Album-Raster. Verlagert in die Lightbox selbst, der doppelte Handler in PhotoGrid entfernt (sonst wäre pro Pfeildruck zwei Bilder weitergesprungen). Zusätzlich sind Proofing-Herzen und das EXIF-Panel im redaktionellen Modus abschaltbar und im Journal aus: Client-Proofing ist ein Übergabe-Workflow für Alben, keine Funktion einer Reportage. Auf der Übersicht wurde der Untertitel doppelt gerendert, weil extractExcerpt() auf ihn zurückfällt. * feat(admin): eigene URLs für alle Bereiche und überarbeiteter Journal Studio Das Panel war eine einzige Client-Komponente, die ihre Tabs über useState umschaltet: keine Route pro Bereich, kein Deep-Link, kein Zurück-Button, und nach jedem Reload landete man wieder auf "Pages". Auch der Journal-Editor hatte keine eigene URL. Jetzt sieben echte Routen (/admin, /admin/pages, /admin/journal, /admin/journal/<slug>, /admin/settings, /admin/settings/<section>, /admin/analytics). Die Shell mit Auth-Prüfung und Kopfzeile sitzt im Layout und umschließt children — so bleibt die Session-Prüfung über Routenwechsel montiert, statt bei jedem Tab-Wechsel neu zu laufen und den Spinner aufblitzen zu lassen. Unbekannte Settings-Sections fallen auf General zurück. Im selben Zug der Journal Studio, der die Routing-Änderung ohnehin berührt: * Alle Eingabefelder nutzten die Klasse `admin-input`, die in keinem CSS definiert war — sie fielen auf Browser-Defaults zurück. Jetzt gestylt, gescoped, damit der generische Name nicht ins übrige Panel leckt. * Der Split View ist per Divider verschiebbar (Maus, Tastatur, Doppelklick zum Zurücksetzen), Breite in localStorage. * Das Studio bricht aus der 1120px-Spalte aus, die Preview hat Platz. * Die Preview zeigte für jedes Foto fest 3:2 und log damit über das Layout der veröffentlichten Seite; die echten Verhältnisse werden jetzt an den Thumbnails gemessen. * Blöcke mit alten positionsbasierten Foto-Referenzen werden markiert — die lassen sich auf einer eigenständigen Journal-Seite nicht auflösen und verschwanden bisher stillschweigend. * Blocktyp-Chips als gemeinsame Komponente, monochrom und per Icon unterschieden statt in einer eigenen Blau/Lila/Orange-Palette, die sonst nirgends im Panel vorkommt. * Emojis raus, SVG-Icons rein. * fix(admin): Designsystem-Lücken im Panel schließen Eine systematische Suche nach Klassen, die im TSX benutzt, aber in keinem CSS definiert sind, hat vier Stellen mit demselben Muster gefunden: * `admin-btn-secondary` und `admin-btn-danger` existierten nicht. Sämtliche Löschen-Buttons sahen aus wie normale Buttons — keine Warnwirkung. Als `.admin-btn.admin-btn-danger` geschrieben, weil die Varianten mit den Größenklassen kombiniert werden, die weiter unten ihren eigenen Hintergrund setzen. * `page-progress-fill` fehlte: die Balken im Analytics-Panel waren leere Rinnen, der Wert unsichtbar. Ebenso `analytics-empty` und `admin-loading-container`. * `subpage-drawer-section`, `subpage-drawer-title-group` und `input-with-icon` im PageBuilder waren wirkungslos und teils mit Inline-Styles notdürftig kompensiert. * `grid-card-preview` fehlte, wodurch alle Layout-Vorschauen auf Höhe null kollabierten. Nur "Showcase" war sichtbar — und das aus Versehen, weil sein Tile `hero-tile` hieß und damit die `aspect-ratio` einer fremden PageBuilder-Klasse erbte. Umbenannt. Dazu die Theme-Vorschauen, die praktisch identisch aussahen: alle sieben zeigten dieselben drei quadratischen Kacheln, einziger Unterschied war die Hintergrundfarbe. Sie spiegeln jetzt die echten Preset-Daten aus lib/config/theme.ts — Schriftcharakter, Eckradius, Rasterdichte, Passepartout bzw. Schatten. Die Kopfzeile richtet sich an einer gemeinsamen Steuerhöhe aus. Der "Site"-Link war höher als die Buttons daneben: `.admin-btn` hatte keine explizite line-height, und <button> bekommt box-sizing: border-box vom Browser, <a> nicht. Die Statusanzeige setzte weder Schriftfamilie noch -größe und fiel auf den Browser-Default zurück — sie war nie Teil des Designsystems. Jetzt gleiche Höhe und Typografie, Pillenform als Zustandsanzeige, Trenner zur Aktionsgruppe. Das dauerhafte Pulsieren des grünen Punkts entfällt; Animation bleibt den Zuständen vorbehalten, die Aufmerksamkeit brauchen. Restliche Emojis durch SVG-Icons ersetzt. * feat(admin): add scroll-to-top toggle and SVG arrow The back-to-top button was always on and drew its arrow with the ↑ text character. Add a `scrollToTop` setting (General section in the admin panel, defaults to on so existing sites are unaffected) and replace the glyph with a stroked SVG that inherits currentColor across all presets. Scroll handling is now rAF-throttled, and prefers-reduced-motion turns off both the hover lift and the smooth scroll. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * security(journal): escape author HTML instead of filtering it CodeQL flags 26 high-severity alerts on the release PR; the bulk of them point at sanitizeHtml(), a denylist of three regexes whose output goes into dangerouslySetInnerHTML. I reproduced the bypasses before changing anything — all four pass the old filter: <img src=x onerror=alert(1)> unquoted handler, regex wants quotes <img src=x onerror='alert(1)'> single quotes, same reason <svg onload=alert(1)> not a <script> tag javasjavascript:cript:alert(1) one-pass replace, the rest recombines Plus an attribute breakout in the link renderer, which interpolated the URL into href="${url}" unescaped: [x](" onmouseover=alert(1) x=") -> <a href="" onmouseover=alert(1" ...> Replaced with escaping. Every `&<>"'` in author text becomes an entity before any markdown rule runs, so the only tags in the output are the ones renderInlineMarkdown builds itself and a URL cannot leave its attribute. Link schemes are now an allowlist (http, https, mailto, tel, relative, anchor); anything else renders as plain text. The serializer needed decodeHtmlEntities to match: without it a save would write `&lt;` into the Markdown file and the next parse would escape the `&` again, corrupting the text further on every round trip. A test covers parse -> serialize -> parse stability. Two existing tests asserted the old behaviour and were rewritten rather than deleted: one expected the script tag to be *removed* from the output, the other expected the substring "onerror" to be absent. Both now assert the property that matters — that no tag can form — because `onerror` surviving as inert text is fine. Exploitation required admin access either way: journal and essay text comes from the studio or from content/*.md. This removes the weakness, it does not close an open door. * fix(journal): contain file paths, fix frontmatter escaping, defuse two regexes Follow-up to the CodeQL findings on release PR #432. I went through all 23 alerts individually; this addresses the ones that are worth addressing and documents the ones that are not. Path containment (12 alerts, all false positives). Every path built from a slug goes through isValidSlug(), a strict `/^[a-zA-Z0-9_-]+$/` allowlist — verified against `../../etc/passwd`, `foo/../../bar`, `a/b`, `..` and friends, all rejected. CodeQL cannot see it because the check lives in another module. Added a containedPath() helper that resolves the path and refuses anything landing outside the content directory: a second lock on a door that was already locked, and a barrier the analysis can follow. Also removed the dead `slug.endsWith('.md')` branches — isValidSlug rejects dots, so they could never be taken. Frontmatter escaping (1 alert, a real bug). The serializer escaped `"` but not `\`, and the parser never unescaped anything. A title containing either character gained a backslash on every save/load cycle: Path C:\Users "quoted" -> Path C:\\Users \"quoted\" -> ... Escaping now covers the backslash first and the parser undoes both. A round trip test covers quotes, backslashes, colons and apostrophes. Two of three ReDoS regexes (2 alerts). The heading pattern had `\s+` next to `(.+)`, which overlap, so the engine tried every split of the whitespace run before failing; it is `[ \t]+` and `(\S.*)` now. The quote author pattern wrapped a lazy group around an optional group — the quadratic case — and is an index split on the first separator now. The third regex, the bold/italic pass, is deliberately left alone. Rewriting it with a negated class removes the backtracking but breaks nesting: `**bold *and italic* here**` renders as `*<em>bold </em>and italic<em> here</em>*`. The input is Markdown from an authenticated admin, never a visitor, so the worst case is an author slowing down their own page. The comment in the code says so. Not addressed: 5 js/insufficient-password-hash alerts. They ask for a slow KDF where the code uses SHA-256/HMAC — correct in general, but the admin password comes from an environment variable and is never stored, so a stronger KDF protects nothing that is not already in plaintext in the environment. 399 unit tests pass (18 new), build and tsc clean. * fix(journal): split the quote author by scanning, not by pattern Cleaning up after myself. #439 replaced the quote author regex `/^(.*?)(?:\s+--\s+(.+))?$/` — a lazy group around an optional one, the quadratic case — with `/\s+--\s+/`, and CodeQL promptly flagged the replacement for the same reason. One reported pattern traded for another. splitQuoteAuthor() scans for the first `--` that has whitespace on both sides. Linear, and it needs no reasoning about the regex engine at all. Behaviour is identical to the original regex, checked case by case against it: separator, no separator, several separators, tabs, wide gaps, `a--b` without spaces, leading and trailing separators, empty string. All nine are covered by tests, plus one asserting it stays fast on a 50k whitespace run. * security(admin): derive the session signing key with scrypt getSigningKey() ran the admin password through a single SHA-256 digest. It is key derivation rather than password storage, so it was never a stored-hash problem — but if the derived key ever leaked, one fast hash makes recovering the password by brute force cheap. CodeQL flags it as js/insufficient-password-hash and, for this particular alert, has a point. scrypt now. Two details that matter: The salt has to be stable. A random salt would produce a different key on every call and invalidate every session; it is derived from AUTH_SECRET, which is deployment-specific. Verified across separate processes: same inputs produce a verifying token, so a restart or redeploy does not log everyone out. The result is cached for the process lifetime. scrypt is deliberately slow and getSigningKey() runs on every admin request — deriving per call would add ~24ms to each one. The cache key is a digest of secret plus password, so a rotation misses the cache and derives again, and no extra plaintext copy of the password is kept around. Measured: first derivation 24ms, subsequent calls 0.12ms. Password change and secret change both invalidate an existing token, checked in separate processes. Note the one-time effect: existing admin sessions are invalidated by the change in derivation, so everyone logs in once more. * security(admin): key the signing-key cache on its inputs, not a digest #441 removed the SHA-256 digest of the admin password from the key derivation and introduced a new one three lines above it, as the cache key. Same rule, same file: CodeQL reported it immediately. The comment justifying it was wrong too. It claimed no second plaintext copy of the password was retained, while building the digest input allocates exactly that in order to hash it. The cache now holds the two input strings and compares them directly. They are the same objects the env and install caches already hold, so nothing extra is retained, and no fast hash of the password exists in memory for the life of the process. Re-verified after the change, in separate processes: a token from one process verifies in another with the same inputs, a changed password or secret rejects it, first derivation 24ms, cached calls 0.001ms. That leaves scrypt as the only place the password is hashed here. The two HMACs further down operate on the derived key and on token data, not on the password; the constant-time comparison in verifyAdminPassword is the previously dismissed one. --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
2026-08-14 16:55:07 +02:00
/* Position prefix inside the chip, e.g. "3 · Quote". */
.essay-block-badge-index {
color: var(--admin-text-muted);
font-variant-numeric: tabular-nums;
chore(release): v0.10.0 (#400) Photo Essay mode, client proofing, studio-modern preset, admin panel overhaul, watermark, cookieless analytics, subpage toggle, SEO title templates. Analytics API now admin-only, Trivy scan on publish. Album order mirrors the Immich timeline; map theme, admin status panel, lightbox counter and Docker health check fixed. See CHANGELOG.md for the full list and the health-check upgrade note.
2026-08-10 09:56:20 +02:00
}
security: add Trivy container scan to Docker publish workflow (#399) * feat(admin): add backup manager UI with 1-click restore * feat(admin): collapse older backup entries by default * fix(theme): isolate admin layout, instant DOM theme updates, and add Light/Dark mode toggle * feat(admin): replace text controls for Photo Frame and Hero Style with visual preview cards * fix(admin): define missing CSS rules for button system (.btn, .preset-btn) * feat(admin): redesign theme settings with segmented mode toggle, accent color swatches, and custom iOS-style toggle cards * feat(admin): upgrade all settings tabs with visual grid previews, Google SEO snippet preview, and toggle cards * feat(admin): overhaul Pages Builder UX with slide-over drawer, card hover badges, real-time search, and floating save bar * fix(admin): remove leftover dangling syntax snippet in PageBuilder.tsx * fix(admin): add position: relative to subpage-tile so hover overlay is contained inside the tile * style(admin): replace all emojis with clean Leica-style vector SVG icons * fix(types): extend IconProps with SVGProps to allow style prop on Leica SVG icons * feat(admin): add subpage live-preview, privacy analytics, and asset protection settings * fix(typecheck): fix AlbumEntry property access in subpage drawer preview mode * fix(types): fix ImmichAlbumInfo property names thumbnailAssetId and albumName in PageBuilder.tsx * fix(types): add protection and watermark optional properties to AppConfig interface * feat(settings): add toggle for disabling analytics tracking (defaults to enabled) * feat(ux): show status banner when analytics tracking is disabled + add live sync indicator * feat(watermark): render customizable watermark overlay on Lightbox images + rename section to Portfolio Features & Modules * fix(types): import type LightboxWatermark in PhotoGrid.tsx * fix(types): destructure watermark prop in PhotoGrid function signature * feat(seo): add configurable subpage title template and metadata descriptions * feat(seo): add generateMetadata to about page for title template support * feat(proofing): add client proofing, favorites selection, compact URL bitmasking, and export modal * feat(essay): add Photo Essay storytelling mode with RSC markdown parser and fullbleed/pair layouts * feat(subpages): add page enabled toggle to deactivate subpages without deleting them * feat(admin): add visual essay block builder for photo essay storytelling pages * security: add Trivy container scan to Docker publish workflow Scans the built image for CRITICAL/HIGH CVEs on every release and uploads results to the GitHub Security tab. Non-blocking for now (exit-code 0) so releases aren't gated on findings. Also documents the scan and existing Dependabot coverage in the README. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-08-07 11:08:04 +02:00
release: v0.11.0 — journal fixes, admin URLs, design system cleanup (#432) * fix(screenshots): sharp-Typen fuer 0.34 und 0.35 gleichzeitig (#410) sharp 0.35 ist von `export =` auf ESM umgestellt: der Modul-Namespace ist nicht mehr aufrufbar, die Factory sitzt unter .default. Der Type-Check brach damit in scripts/screenshots.ts weg, sobald der Next-Bump (#402) sharp von 0.34.5 auf 0.35.3 mitzieht -- sharp ist hier keine deklarierte Dependency, sondern kommt ueber Next mit. Die Form wird jetzt aus dem installierten Paket abgeleitet statt festgeschrieben, zur Laufzeit wie im Typ. Geprueft mit beiden Versionen: tsc laeuft mit 0.34.5 und mit 0.35.3 fehlerfrei durch. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(deps): bump the nextjs group across 1 directory with 2 updates (#402) Bumps the nextjs group with 2 updates in the / directory: [next](https://github.com/vercel/next.js) and [eslint-config-next](https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next). Updates `next` from 16.2.12 to 16.3.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/compare/v16.2.12...v16.3.0) Updates `eslint-config-next` from 16.2.12 to 16.3.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/commits/v16.3.0/packages/eslint-config-next) --- updated-dependencies: - dependency-name: eslint-config-next dependency-version: 16.3.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: nextjs - dependency-name: next dependency-version: 16.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nextjs ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps-dev): bump prettier from 3.8.3 to 3.9.6 (#405) Bumps [prettier](https://github.com/prettier/prettier) from 3.8.3 to 3.9.6. - [Release notes](https://github.com/prettier/prettier/releases) - [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md) - [Commits](https://github.com/prettier/prettier/compare/3.8.3...3.9.6) --- updated-dependencies: - dependency-name: prettier dependency-version: 3.9.6 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * docs(changelog): Unreleased-Sektion fuer die Bumps nach v0.10.0 (#413) Die Dependency-PRs sind nach dem Release auf dev gelandet, teils auch auf main. Ohne Eintrag waeren sie beim naechsten Release unsichtbar -- inklusive Next 16.3.0, das CVE-2025-13465 mitbringt. Ausserdem im 0.10.0-Abschnitt nachgetragen, dass der Trivy-Scan bis #409 nie gelaufen ist. Der Fix steckt im Tag v0.10.0, fehlte aber in der Aufzaehlung -- und "Images werden bei jedem Publish gescannt" stand im Changelog, waehrend der Job im Action-Setup abbrach. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(gallery): per-album sort order, independent of Immich (#408) (#414) Album order was dictated entirely by Immich: getAlbum() sorted by the album's own asc/desc flag, so a Folio album always mirrored the archive. A curated series has a narrative order that has nothing to do with capture time, and changing the Immich album's sort to fit the website changes it for the archive too. Adds an optional per-album `sort` in gallery.yaml, editable in /admin, defaulting to today's behaviour so every existing config is unchanged: immich (default) | newest | oldest | filename | manual `manual` is a pinned *prefix*: `assetOrder` lists only the photos placed by hand, everything else follows in the album's Immich order. A full permutation of a 2,000-photo album would be ~80 KB of UUIDs in a file that is rewritten and copied to content/.backups/ on every admin save. It also makes drift fall out for free — photos removed in Immich never match, new ones land in the tail rather than being hidden. Sorting is applied after the cache read, not before the cache write, so the LRU keeps one canonical Immich-ordered copy per album. That avoids putting the mode in the cache key, lets a config change take effect without depending on invalidation, and keeps the stale-serving path correct. cache.get() returns the stored object by reference, so withSort() returns a shallow clone with a new array — sorting in place would reorder the shared entry, and under request coalescing every concurrent caller would be sorting the same array. Also fixes a prerequisite bug: /api/admin/albums/[albumId]/assets read album.assets from GET /albums/:id, which Immich 3.x no longer populates (lib/immich.ts:507). The hero picker's "This Album" tab returned nothing and threw outright when the key was absent. It now goes through the client's paginated metadata search, with ?types=all to opt videos in for the reorder editor. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): drop decorative emoji from the sort select labels (#415) An <option> cannot contain markup, so the SVG set in Icons is not reachable there — but a decorative emoji is not a substitute for it. Plain text instead; the album card badge already uses a real icon. The remaining emoji in the admin panel (asset picker tabs, section headings, layout picker options) predate this branch and are left for a separate cleanup. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): replace emoji icons with the shared SVG icon set (#416) The admin panel mixed two icon conventions: inline SVGs from `Icons.tsx` in most components, and decorative emoji in the asset picker and a few PageBuilder labels. Emoji render inconsistently across platforms, ignore the accent colour, and cannot inherit the `.svg-icon` sizing rules. - Icons.tsx: add `IconStar` (filled — it marks a state, not an action) and `IconImage`. - AssetPicker: the three tab labels and the favourite tile badge now use IconFolder / IconStar / IconImage. - PageBuilder: the "Standalone Albums" and "Subpages" headings use the icon set instead of an emoji. - PageBuilder: the layout picker drops its emoji for plain text. An <option> cannot contain markup, so an SVG is impossible there and a decorative glyph is not a substitute. - admin.css: align icon and label in the picker tabs, and swap the favourite badge's text-shadow for drop-shadow, which is what applies to an inline SVG. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): fold PageBuilder's local icons into the shared Icons module (#418) * refactor(admin): fold PageBuilder's local icons into the shared module PageBuilder.tsx carried its own `Icons` object duplicating most of the glyphs already exported by Icons.tsx, with hardcoded sizes and slightly divergent paths. Migrate all 32 call sites to the shared module and delete the local object. Five glyphs had no counterpart and are added to Icons.tsx as 1:1 ports of the local paths: IconX, IconPlus, IconHome, IconCopy, IconImage. The local ExternalLink and Check are dropped rather than ported — both had zero call sites. Two glyphs change shape slightly, which is the point of consolidating: the shared IconCamera includes the viewfinder bump the local copy omitted, and drag handles now use IconGripVertical. IconGripVertical uses the module's square 24x24 viewBox, so `.svg-drag` goes from 12x18 to 18x18 — the old non-square box would letterbox the glyph down to 12x12 and shrink the handle. * fix(admin): resolve icon-module integration after #416 Merging dev brought in #416, which added a second IconImage to Icons.tsx and two <Icons.Camera>/<Icons.Folder> section headers that reference the local Icons object this PR removes. Git merged both cleanly but the result did not type-check. - drop the duplicate IconImage (both copies were byte-identical) - point the two section headers at the imported IconCamera/IconFolder - refresh the SORT_LABELS comment: the icon set is imported now, not declared below --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> * fix(config): allow an empty gallery, guard against a double /api suffix (#421) An empty gallery is now a valid, rendered state instead of a throw: deriveGallery() no longer requires at least one album or subpage, so a deployment with no albums yet renders a bare homepage the owner can fill in via /admin. getConfig() also stops appending /api to an Immich URL that already ends in it, which previously produced .../api/api and broke every upstream request. Includes a restore of the per-album sort test cases, which the branch had lost by being cut before #408/#414. * feat(admin): favicon upload, served from the content volume (#422) Adds a bundled default favicon, an upload widget in admin Settings > General, and a route that serves the icon from the writable content/ volume with a fallback to the bundled default. Raster uploads (PNG/ICO/JPEG) are wrapped in an SVG container; the response carries its own CSP so an uploaded SVG cannot execute script on the origin. The GET route revalidates with an ETag instead of caching immutably, so a newly uploaded icon shows up immediately. Uploads are written via temp file + rename, and a Reset button restores the bundled default. * ci: flag unformatted files in a PR, without blocking it (#424) Prettier is configured as an error rule in eslint.config.mjs but has never run in CI, so part of the tree predates it. A final CI step now diffs against the PR base, runs prettier --list-different over the changed files, and emits a warning annotation per offender plus a job summary. Advisory by design: it never fails the job. Blocking would turn a PR red for merely touching a file that was already unformatted, and normalising the tree in one commit would wreck git blame and conflict with the PRs in flight. Requires fetch-depth: 0, since diffing against the base needs its history. * feat(install): first-run wizard gated by a one-time setup token (#419) Adds /install, a four-step first-run wizard: connect to Immich, optionally pick albums, name the site, finish. It verifies the credentials against the Immich server before writing anything, then writes gallery.yaml, settings.yaml and a content/install.json carrying the Immich credentials and a generated site secret. install.json exists because a running process cannot pick up new env vars — the wizard has to write configuration that takes effect without a restart. getInstallCredentials() merges it under the real environment, so env vars always win and rotation stays a matter of setting one. Both the page and the API routes are gated by a one-time setup token printed to the server log, so a deployment that is reachable before gallery.yaml exists cannot be configured by whoever finds it first. The token is stored in content/.setup-token (0600) rather than a module variable: Next.js bundles the page and each route handler separately, so a module-level token left the page and the API disagreeing inside one process and the wizard stuck on step 1. It is removed once the install completes. The admin password is stored as an scrypt hash using the scheme lib/auth.ts already applies to album passwords; a plaintext ADMIN_PASSWORD env var keeps working. * docs: document the setup wizard, fix the read-only content mount (#425) Quick Start now leads with the /install wizard, with the hand-written YAML route kept alongside it, and a First-Run Setup section covers the setup token, the files the wizard writes, and env-var precedence. Two corrections: both Docker examples mounted content/ as :ro, which silently breaks the wizard, the admin panel and the backup rotation alike — docs/admin-panel.md already said so and the README contradicted it. And nothing documented that content/install.json holds the Immich API key, so a backup of content/ is a backup of credentials. Also adds a Contributors section crediting the people whose work is in the project. * feat(admin): floating save bar pinned to the bottom of the viewport (#426) The save bar was the first, static element inside .admin-main. Since the document itself scrolls, it left the viewport as soon as you scrolled down — editing a subpage section or a settings block far below gave no visible dirty hint and no reachable save button. Replace it with a bottom-pinned floating bar shared by both editors. It only mounts while there is something to act on (unsaved changes, an in-flight save, or a result message), so it never covers content while idle. The success message clears after 5s, which hides the bar again. - new SaveBar component, replacing the duplicated markup in PageBuilder and SettingsEditor - adopt the previously unused .floating-save-bar CSS: slide-in keyframes (carrying translateX(-50%)), dirty border, wrap/gap, mobile variant and a prefers-reduced-motion opt-out; z-index 900 keeps it below modals - .admin-main gains bottom padding so the bar never covers page content - drop the now-unreachable idle hints: the ⌘S hint becomes a button title, the Live Sync note becomes a static line above the settings layout - header "Site" link now bypasses the cache (/?fresh=1), so the preview stays reachable when the bar is hidden Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(admin): themed listbox for the album sort control (#427) The per-album "Photo order" control was a native <select>. Because an <option> cannot contain markup, its choices could not use the admin panel's currentColor SVG set — the reason #415 had to fall back to plain text after dropping the emoji labels. Adds a Listbox component implementing the ARIA combobox/listbox pattern, so options can render a glyph beside their label: - DOM focus stays on the trigger button; the active option is announced through aria-activedescendant, keeping focus management to one element - Keyboard: arrows (clamped at the ends, like a native select), Home/End, Enter/Space to commit, Escape to cancel, Tab commits and moves on, and prefix type-ahead with a repeat-key cycle - Outside dismissal on pointerdown, so a press starting outside closes the popup before the click retargets The sort options now carry an icon each: calendar, arrow-down, arrow-up, an A→Z marker, and the drag glyph for manual — matching the badge the album card already shows. SORT_LABELS stays plain text because the badge feeds it to a title attribute. Closes #417 Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(git): ignore generated design handoff folders * fix(admin): stop the album sort dropdown clipping, and simplify the panel (#428) * fix(admin): render listbox popup in a portal so it escapes modal clipping The sort control's popup was position:absolute inside three clipping ancestors (.album-drawer overflow:hidden > .album-drawer-body overflow-y:auto > .modal-right-column overflow-y:auto), so it was cut off at the bottom of the Edit Album Details modal. z-index could not help: clipping happens before stacking. It also always hung below the trigger, with no flip. Portal the popup to document.body and position it from the trigger's viewport rect, flipping above when there is more room there and capping max-height to the space available so it scrolls internally rather than overflowing. It is dismissed on scroll and resize, since the anchor is only measured on open. The outside-pointerdown handler now also treats the popup as inside; without that the portalled list counts as outside, and a click on an option would close it before the selection commits. * refactor(admin): single-column album details panel The left column spent 1.2fr on a cover thumbnail and three stat rows, two of which (Status, Custom Hero) only restated the form fields opposite them, while the form itself was squeezed into 1.8fr behind a second nested scroller. Stack the drawer in one column instead: cover as a banner, then the form at full width, with the UUID moved into the footer. The body is now the only scroll container, which also removes one of the ancestors that was clipping the sort popup. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> * fix(admin): give the portalled listbox its theme back, lock the page behind modals (#429) Two defects in the album editor. The sort listbox popup painted transparent. Every --admin-* variable is scoped to .admin-layout, and since the popup moved into document.body it sits outside that subtree, so background/border/text all resolved to nothing. It now carries its own copy of the palette in both colour schemes, plus the font it no longer inherits. Scrolling inside a modal also moved the page behind it. No admin modal ever locked body scroll: the overlay covers the page but does not absorb wheel events, so a scroll starting on the backdrop — or continuing past the end of the modal's own scroller — reaches the document. overscroll-behavior cannot cover that case on its own, because it only applies to scroll containers and the backdrop is not one. useScrollLock freezes body while a modal is open and compensates for the width the scrollbar gives up, so nothing shifts underneath. Each lock restores the inline value it found, which makes nesting work without a counter — a picker opened from the drawer restores the drawer's hidden state instead of clearing it. Applied to both drawers and all four picker modals, which share the defect. overscroll-behavior: contain on the scrollers stops the chaining they can handle themselves. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com> * fix(security): allow unsafe-eval in CSP script-src during dev mode * feat(journal): add Journal Studio with split-screen editor, live preview and dedicated routes * fix(build): separate client parser from server journal-service and fix build type errors * fix(journal): Fotos rendern, Layout und Lightbox-Steuerung korrigieren Fünf unabhängige Fehler in der öffentlichen Journal- und Essay-Ansicht: * Foto-Blöcke wurden nie angezeigt. EssayView löst ein Foto über PhotoItem.id auf, und das sind verschlüsselte Tokens — die Blöcke aus dem Markdown tragen aber rohe Asset-UUIDs. Jede Zuordnung lief ins Leere, und nicht auflösbare Blöcke werden still verworfen. Die IDs werden jetzt serverseitig übersetzt; damit verschwinden nebenbei die rohen UUIDs aus dem Client-Payload, die dort laut Projektregel nie auftauchen dürfen. Nicht auflösbare Referenzen werden geloggt. * Überschriften standen weiter links als der Fließtext. Jeder Block hatte einzeln `max-width: 68ch`, und `ch` ist relativ zur Schrift des Elements — die Serif-Überschrift ergab eine breitere Spalte. Ersetzt durch eine gemeinsame, font-unabhängige `--essay-measure`. * Fullbleed-Fotos bluteten nur nach links aus: `.essay-figure` ist `width: 100%`, wodurch die Box überbestimmt ist und der negative rechte Margin verworfen wird. * Foto-Paare stellten beide Bilder gleich breit dar, wodurch ein Hochformat neben einem Querformat doppelt so hoch wurde. Jetzt eine Justified-Reihe: Breite proportional zum Seitenverhältnis, dadurch exakt gleiche Höhen ohne Beschnitt. * Die Lightbox hatte im Journal keine Tastatursteuerung und keine Scroll-Sperre — beides lag in PhotoGrid, also nur im Album-Raster. Verlagert in die Lightbox selbst, der doppelte Handler in PhotoGrid entfernt (sonst wäre pro Pfeildruck zwei Bilder weitergesprungen). Zusätzlich sind Proofing-Herzen und das EXIF-Panel im redaktionellen Modus abschaltbar und im Journal aus: Client-Proofing ist ein Übergabe-Workflow für Alben, keine Funktion einer Reportage. Auf der Übersicht wurde der Untertitel doppelt gerendert, weil extractExcerpt() auf ihn zurückfällt. * feat(admin): eigene URLs für alle Bereiche und überarbeiteter Journal Studio Das Panel war eine einzige Client-Komponente, die ihre Tabs über useState umschaltet: keine Route pro Bereich, kein Deep-Link, kein Zurück-Button, und nach jedem Reload landete man wieder auf "Pages". Auch der Journal-Editor hatte keine eigene URL. Jetzt sieben echte Routen (/admin, /admin/pages, /admin/journal, /admin/journal/<slug>, /admin/settings, /admin/settings/<section>, /admin/analytics). Die Shell mit Auth-Prüfung und Kopfzeile sitzt im Layout und umschließt children — so bleibt die Session-Prüfung über Routenwechsel montiert, statt bei jedem Tab-Wechsel neu zu laufen und den Spinner aufblitzen zu lassen. Unbekannte Settings-Sections fallen auf General zurück. Im selben Zug der Journal Studio, der die Routing-Änderung ohnehin berührt: * Alle Eingabefelder nutzten die Klasse `admin-input`, die in keinem CSS definiert war — sie fielen auf Browser-Defaults zurück. Jetzt gestylt, gescoped, damit der generische Name nicht ins übrige Panel leckt. * Der Split View ist per Divider verschiebbar (Maus, Tastatur, Doppelklick zum Zurücksetzen), Breite in localStorage. * Das Studio bricht aus der 1120px-Spalte aus, die Preview hat Platz. * Die Preview zeigte für jedes Foto fest 3:2 und log damit über das Layout der veröffentlichten Seite; die echten Verhältnisse werden jetzt an den Thumbnails gemessen. * Blöcke mit alten positionsbasierten Foto-Referenzen werden markiert — die lassen sich auf einer eigenständigen Journal-Seite nicht auflösen und verschwanden bisher stillschweigend. * Blocktyp-Chips als gemeinsame Komponente, monochrom und per Icon unterschieden statt in einer eigenen Blau/Lila/Orange-Palette, die sonst nirgends im Panel vorkommt. * Emojis raus, SVG-Icons rein. * fix(admin): Designsystem-Lücken im Panel schließen Eine systematische Suche nach Klassen, die im TSX benutzt, aber in keinem CSS definiert sind, hat vier Stellen mit demselben Muster gefunden: * `admin-btn-secondary` und `admin-btn-danger` existierten nicht. Sämtliche Löschen-Buttons sahen aus wie normale Buttons — keine Warnwirkung. Als `.admin-btn.admin-btn-danger` geschrieben, weil die Varianten mit den Größenklassen kombiniert werden, die weiter unten ihren eigenen Hintergrund setzen. * `page-progress-fill` fehlte: die Balken im Analytics-Panel waren leere Rinnen, der Wert unsichtbar. Ebenso `analytics-empty` und `admin-loading-container`. * `subpage-drawer-section`, `subpage-drawer-title-group` und `input-with-icon` im PageBuilder waren wirkungslos und teils mit Inline-Styles notdürftig kompensiert. * `grid-card-preview` fehlte, wodurch alle Layout-Vorschauen auf Höhe null kollabierten. Nur "Showcase" war sichtbar — und das aus Versehen, weil sein Tile `hero-tile` hieß und damit die `aspect-ratio` einer fremden PageBuilder-Klasse erbte. Umbenannt. Dazu die Theme-Vorschauen, die praktisch identisch aussahen: alle sieben zeigten dieselben drei quadratischen Kacheln, einziger Unterschied war die Hintergrundfarbe. Sie spiegeln jetzt die echten Preset-Daten aus lib/config/theme.ts — Schriftcharakter, Eckradius, Rasterdichte, Passepartout bzw. Schatten. Die Kopfzeile richtet sich an einer gemeinsamen Steuerhöhe aus. Der "Site"-Link war höher als die Buttons daneben: `.admin-btn` hatte keine explizite line-height, und <button> bekommt box-sizing: border-box vom Browser, <a> nicht. Die Statusanzeige setzte weder Schriftfamilie noch -größe und fiel auf den Browser-Default zurück — sie war nie Teil des Designsystems. Jetzt gleiche Höhe und Typografie, Pillenform als Zustandsanzeige, Trenner zur Aktionsgruppe. Das dauerhafte Pulsieren des grünen Punkts entfällt; Animation bleibt den Zuständen vorbehalten, die Aufmerksamkeit brauchen. Restliche Emojis durch SVG-Icons ersetzt. * feat(admin): add scroll-to-top toggle and SVG arrow The back-to-top button was always on and drew its arrow with the ↑ text character. Add a `scrollToTop` setting (General section in the admin panel, defaults to on so existing sites are unaffected) and replace the glyph with a stroked SVG that inherits currentColor across all presets. Scroll handling is now rAF-throttled, and prefers-reduced-motion turns off both the hover lift and the smooth scroll. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * security(journal): escape author HTML instead of filtering it CodeQL flags 26 high-severity alerts on the release PR; the bulk of them point at sanitizeHtml(), a denylist of three regexes whose output goes into dangerouslySetInnerHTML. I reproduced the bypasses before changing anything — all four pass the old filter: <img src=x onerror=alert(1)> unquoted handler, regex wants quotes <img src=x onerror='alert(1)'> single quotes, same reason <svg onload=alert(1)> not a <script> tag javasjavascript:cript:alert(1) one-pass replace, the rest recombines Plus an attribute breakout in the link renderer, which interpolated the URL into href="${url}" unescaped: [x](" onmouseover=alert(1) x=") -> <a href="" onmouseover=alert(1" ...> Replaced with escaping. Every `&<>"'` in author text becomes an entity before any markdown rule runs, so the only tags in the output are the ones renderInlineMarkdown builds itself and a URL cannot leave its attribute. Link schemes are now an allowlist (http, https, mailto, tel, relative, anchor); anything else renders as plain text. The serializer needed decodeHtmlEntities to match: without it a save would write `&lt;` into the Markdown file and the next parse would escape the `&` again, corrupting the text further on every round trip. A test covers parse -> serialize -> parse stability. Two existing tests asserted the old behaviour and were rewritten rather than deleted: one expected the script tag to be *removed* from the output, the other expected the substring "onerror" to be absent. Both now assert the property that matters — that no tag can form — because `onerror` surviving as inert text is fine. Exploitation required admin access either way: journal and essay text comes from the studio or from content/*.md. This removes the weakness, it does not close an open door. * fix(journal): contain file paths, fix frontmatter escaping, defuse two regexes Follow-up to the CodeQL findings on release PR #432. I went through all 23 alerts individually; this addresses the ones that are worth addressing and documents the ones that are not. Path containment (12 alerts, all false positives). Every path built from a slug goes through isValidSlug(), a strict `/^[a-zA-Z0-9_-]+$/` allowlist — verified against `../../etc/passwd`, `foo/../../bar`, `a/b`, `..` and friends, all rejected. CodeQL cannot see it because the check lives in another module. Added a containedPath() helper that resolves the path and refuses anything landing outside the content directory: a second lock on a door that was already locked, and a barrier the analysis can follow. Also removed the dead `slug.endsWith('.md')` branches — isValidSlug rejects dots, so they could never be taken. Frontmatter escaping (1 alert, a real bug). The serializer escaped `"` but not `\`, and the parser never unescaped anything. A title containing either character gained a backslash on every save/load cycle: Path C:\Users "quoted" -> Path C:\\Users \"quoted\" -> ... Escaping now covers the backslash first and the parser undoes both. A round trip test covers quotes, backslashes, colons and apostrophes. Two of three ReDoS regexes (2 alerts). The heading pattern had `\s+` next to `(.+)`, which overlap, so the engine tried every split of the whitespace run before failing; it is `[ \t]+` and `(\S.*)` now. The quote author pattern wrapped a lazy group around an optional group — the quadratic case — and is an index split on the first separator now. The third regex, the bold/italic pass, is deliberately left alone. Rewriting it with a negated class removes the backtracking but breaks nesting: `**bold *and italic* here**` renders as `*<em>bold </em>and italic<em> here</em>*`. The input is Markdown from an authenticated admin, never a visitor, so the worst case is an author slowing down their own page. The comment in the code says so. Not addressed: 5 js/insufficient-password-hash alerts. They ask for a slow KDF where the code uses SHA-256/HMAC — correct in general, but the admin password comes from an environment variable and is never stored, so a stronger KDF protects nothing that is not already in plaintext in the environment. 399 unit tests pass (18 new), build and tsc clean. * fix(journal): split the quote author by scanning, not by pattern Cleaning up after myself. #439 replaced the quote author regex `/^(.*?)(?:\s+--\s+(.+))?$/` — a lazy group around an optional one, the quadratic case — with `/\s+--\s+/`, and CodeQL promptly flagged the replacement for the same reason. One reported pattern traded for another. splitQuoteAuthor() scans for the first `--` that has whitespace on both sides. Linear, and it needs no reasoning about the regex engine at all. Behaviour is identical to the original regex, checked case by case against it: separator, no separator, several separators, tabs, wide gaps, `a--b` without spaces, leading and trailing separators, empty string. All nine are covered by tests, plus one asserting it stays fast on a 50k whitespace run. * security(admin): derive the session signing key with scrypt getSigningKey() ran the admin password through a single SHA-256 digest. It is key derivation rather than password storage, so it was never a stored-hash problem — but if the derived key ever leaked, one fast hash makes recovering the password by brute force cheap. CodeQL flags it as js/insufficient-password-hash and, for this particular alert, has a point. scrypt now. Two details that matter: The salt has to be stable. A random salt would produce a different key on every call and invalidate every session; it is derived from AUTH_SECRET, which is deployment-specific. Verified across separate processes: same inputs produce a verifying token, so a restart or redeploy does not log everyone out. The result is cached for the process lifetime. scrypt is deliberately slow and getSigningKey() runs on every admin request — deriving per call would add ~24ms to each one. The cache key is a digest of secret plus password, so a rotation misses the cache and derives again, and no extra plaintext copy of the password is kept around. Measured: first derivation 24ms, subsequent calls 0.12ms. Password change and secret change both invalidate an existing token, checked in separate processes. Note the one-time effect: existing admin sessions are invalidated by the change in derivation, so everyone logs in once more. * security(admin): key the signing-key cache on its inputs, not a digest #441 removed the SHA-256 digest of the admin password from the key derivation and introduced a new one three lines above it, as the cache key. Same rule, same file: CodeQL reported it immediately. The comment justifying it was wrong too. It claimed no second plaintext copy of the password was retained, while building the digest input allocates exactly that in order to hash it. The cache now holds the two input strings and compares them directly. They are the same objects the env and install caches already hold, so nothing extra is retained, and no fast hash of the password exists in memory for the life of the process. Re-verified after the change, in separate processes: a token from one process verifies in another with the same inputs, a changed password or secret rejects it, first derivation 24ms, cached calls 0.001ms. That leaves scrypt as the only place the password is hashed here. The two HMACs further down operate on the derived key and on token data, not on the password; the constant-time comparison in verifyAdminPassword is the previously dismissed one. --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
2026-08-14 16:55:07 +02:00
.essay-block-badge-index::after {
content: ' ·';
chore(release): v0.10.0 (#400) Photo Essay mode, client proofing, studio-modern preset, admin panel overhaul, watermark, cookieless analytics, subpage toggle, SEO title templates. Analytics API now admin-only, Trivy scan on publish. Album order mirrors the Immich timeline; map theme, admin status panel, lightbox counter and Docker health check fixed. See CHANGELOG.md for the full list and the health-check upgrade note.
2026-08-10 09:56:20 +02:00
}
security: add Trivy container scan to Docker publish workflow (#399) * feat(admin): add backup manager UI with 1-click restore * feat(admin): collapse older backup entries by default * fix(theme): isolate admin layout, instant DOM theme updates, and add Light/Dark mode toggle * feat(admin): replace text controls for Photo Frame and Hero Style with visual preview cards * fix(admin): define missing CSS rules for button system (.btn, .preset-btn) * feat(admin): redesign theme settings with segmented mode toggle, accent color swatches, and custom iOS-style toggle cards * feat(admin): upgrade all settings tabs with visual grid previews, Google SEO snippet preview, and toggle cards * feat(admin): overhaul Pages Builder UX with slide-over drawer, card hover badges, real-time search, and floating save bar * fix(admin): remove leftover dangling syntax snippet in PageBuilder.tsx * fix(admin): add position: relative to subpage-tile so hover overlay is contained inside the tile * style(admin): replace all emojis with clean Leica-style vector SVG icons * fix(types): extend IconProps with SVGProps to allow style prop on Leica SVG icons * feat(admin): add subpage live-preview, privacy analytics, and asset protection settings * fix(typecheck): fix AlbumEntry property access in subpage drawer preview mode * fix(types): fix ImmichAlbumInfo property names thumbnailAssetId and albumName in PageBuilder.tsx * fix(types): add protection and watermark optional properties to AppConfig interface * feat(settings): add toggle for disabling analytics tracking (defaults to enabled) * feat(ux): show status banner when analytics tracking is disabled + add live sync indicator * feat(watermark): render customizable watermark overlay on Lightbox images + rename section to Portfolio Features & Modules * fix(types): import type LightboxWatermark in PhotoGrid.tsx * fix(types): destructure watermark prop in PhotoGrid function signature * feat(seo): add configurable subpage title template and metadata descriptions * feat(seo): add generateMetadata to about page for title template support * feat(proofing): add client proofing, favorites selection, compact URL bitmasking, and export modal * feat(essay): add Photo Essay storytelling mode with RSC markdown parser and fullbleed/pair layouts * feat(subpages): add page enabled toggle to deactivate subpages without deleting them * feat(admin): add visual essay block builder for photo essay storytelling pages * security: add Trivy container scan to Docker publish workflow Scans the built image for CRITICAL/HIGH CVEs on every release and uploads results to the GitHub Security tab. Non-blocking for now (exit-code 0) so releases aren't gated on findings. Also documents the scan and existing Dependabot coverage in the README. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-08-07 11:08:04 +02:00
release: v0.11.0 — journal fixes, admin URLs, design system cleanup (#432) * fix(screenshots): sharp-Typen fuer 0.34 und 0.35 gleichzeitig (#410) sharp 0.35 ist von `export =` auf ESM umgestellt: der Modul-Namespace ist nicht mehr aufrufbar, die Factory sitzt unter .default. Der Type-Check brach damit in scripts/screenshots.ts weg, sobald der Next-Bump (#402) sharp von 0.34.5 auf 0.35.3 mitzieht -- sharp ist hier keine deklarierte Dependency, sondern kommt ueber Next mit. Die Form wird jetzt aus dem installierten Paket abgeleitet statt festgeschrieben, zur Laufzeit wie im Typ. Geprueft mit beiden Versionen: tsc laeuft mit 0.34.5 und mit 0.35.3 fehlerfrei durch. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(deps): bump the nextjs group across 1 directory with 2 updates (#402) Bumps the nextjs group with 2 updates in the / directory: [next](https://github.com/vercel/next.js) and [eslint-config-next](https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next). Updates `next` from 16.2.12 to 16.3.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/compare/v16.2.12...v16.3.0) Updates `eslint-config-next` from 16.2.12 to 16.3.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/commits/v16.3.0/packages/eslint-config-next) --- updated-dependencies: - dependency-name: eslint-config-next dependency-version: 16.3.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: nextjs - dependency-name: next dependency-version: 16.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nextjs ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps-dev): bump prettier from 3.8.3 to 3.9.6 (#405) Bumps [prettier](https://github.com/prettier/prettier) from 3.8.3 to 3.9.6. - [Release notes](https://github.com/prettier/prettier/releases) - [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md) - [Commits](https://github.com/prettier/prettier/compare/3.8.3...3.9.6) --- updated-dependencies: - dependency-name: prettier dependency-version: 3.9.6 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * docs(changelog): Unreleased-Sektion fuer die Bumps nach v0.10.0 (#413) Die Dependency-PRs sind nach dem Release auf dev gelandet, teils auch auf main. Ohne Eintrag waeren sie beim naechsten Release unsichtbar -- inklusive Next 16.3.0, das CVE-2025-13465 mitbringt. Ausserdem im 0.10.0-Abschnitt nachgetragen, dass der Trivy-Scan bis #409 nie gelaufen ist. Der Fix steckt im Tag v0.10.0, fehlte aber in der Aufzaehlung -- und "Images werden bei jedem Publish gescannt" stand im Changelog, waehrend der Job im Action-Setup abbrach. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(gallery): per-album sort order, independent of Immich (#408) (#414) Album order was dictated entirely by Immich: getAlbum() sorted by the album's own asc/desc flag, so a Folio album always mirrored the archive. A curated series has a narrative order that has nothing to do with capture time, and changing the Immich album's sort to fit the website changes it for the archive too. Adds an optional per-album `sort` in gallery.yaml, editable in /admin, defaulting to today's behaviour so every existing config is unchanged: immich (default) | newest | oldest | filename | manual `manual` is a pinned *prefix*: `assetOrder` lists only the photos placed by hand, everything else follows in the album's Immich order. A full permutation of a 2,000-photo album would be ~80 KB of UUIDs in a file that is rewritten and copied to content/.backups/ on every admin save. It also makes drift fall out for free — photos removed in Immich never match, new ones land in the tail rather than being hidden. Sorting is applied after the cache read, not before the cache write, so the LRU keeps one canonical Immich-ordered copy per album. That avoids putting the mode in the cache key, lets a config change take effect without depending on invalidation, and keeps the stale-serving path correct. cache.get() returns the stored object by reference, so withSort() returns a shallow clone with a new array — sorting in place would reorder the shared entry, and under request coalescing every concurrent caller would be sorting the same array. Also fixes a prerequisite bug: /api/admin/albums/[albumId]/assets read album.assets from GET /albums/:id, which Immich 3.x no longer populates (lib/immich.ts:507). The hero picker's "This Album" tab returned nothing and threw outright when the key was absent. It now goes through the client's paginated metadata search, with ?types=all to opt videos in for the reorder editor. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): drop decorative emoji from the sort select labels (#415) An <option> cannot contain markup, so the SVG set in Icons is not reachable there — but a decorative emoji is not a substitute for it. Plain text instead; the album card badge already uses a real icon. The remaining emoji in the admin panel (asset picker tabs, section headings, layout picker options) predate this branch and are left for a separate cleanup. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): replace emoji icons with the shared SVG icon set (#416) The admin panel mixed two icon conventions: inline SVGs from `Icons.tsx` in most components, and decorative emoji in the asset picker and a few PageBuilder labels. Emoji render inconsistently across platforms, ignore the accent colour, and cannot inherit the `.svg-icon` sizing rules. - Icons.tsx: add `IconStar` (filled — it marks a state, not an action) and `IconImage`. - AssetPicker: the three tab labels and the favourite tile badge now use IconFolder / IconStar / IconImage. - PageBuilder: the "Standalone Albums" and "Subpages" headings use the icon set instead of an emoji. - PageBuilder: the layout picker drops its emoji for plain text. An <option> cannot contain markup, so an SVG is impossible there and a decorative glyph is not a substitute. - admin.css: align icon and label in the picker tabs, and swap the favourite badge's text-shadow for drop-shadow, which is what applies to an inline SVG. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): fold PageBuilder's local icons into the shared Icons module (#418) * refactor(admin): fold PageBuilder's local icons into the shared module PageBuilder.tsx carried its own `Icons` object duplicating most of the glyphs already exported by Icons.tsx, with hardcoded sizes and slightly divergent paths. Migrate all 32 call sites to the shared module and delete the local object. Five glyphs had no counterpart and are added to Icons.tsx as 1:1 ports of the local paths: IconX, IconPlus, IconHome, IconCopy, IconImage. The local ExternalLink and Check are dropped rather than ported — both had zero call sites. Two glyphs change shape slightly, which is the point of consolidating: the shared IconCamera includes the viewfinder bump the local copy omitted, and drag handles now use IconGripVertical. IconGripVertical uses the module's square 24x24 viewBox, so `.svg-drag` goes from 12x18 to 18x18 — the old non-square box would letterbox the glyph down to 12x12 and shrink the handle. * fix(admin): resolve icon-module integration after #416 Merging dev brought in #416, which added a second IconImage to Icons.tsx and two <Icons.Camera>/<Icons.Folder> section headers that reference the local Icons object this PR removes. Git merged both cleanly but the result did not type-check. - drop the duplicate IconImage (both copies were byte-identical) - point the two section headers at the imported IconCamera/IconFolder - refresh the SORT_LABELS comment: the icon set is imported now, not declared below --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> * fix(config): allow an empty gallery, guard against a double /api suffix (#421) An empty gallery is now a valid, rendered state instead of a throw: deriveGallery() no longer requires at least one album or subpage, so a deployment with no albums yet renders a bare homepage the owner can fill in via /admin. getConfig() also stops appending /api to an Immich URL that already ends in it, which previously produced .../api/api and broke every upstream request. Includes a restore of the per-album sort test cases, which the branch had lost by being cut before #408/#414. * feat(admin): favicon upload, served from the content volume (#422) Adds a bundled default favicon, an upload widget in admin Settings > General, and a route that serves the icon from the writable content/ volume with a fallback to the bundled default. Raster uploads (PNG/ICO/JPEG) are wrapped in an SVG container; the response carries its own CSP so an uploaded SVG cannot execute script on the origin. The GET route revalidates with an ETag instead of caching immutably, so a newly uploaded icon shows up immediately. Uploads are written via temp file + rename, and a Reset button restores the bundled default. * ci: flag unformatted files in a PR, without blocking it (#424) Prettier is configured as an error rule in eslint.config.mjs but has never run in CI, so part of the tree predates it. A final CI step now diffs against the PR base, runs prettier --list-different over the changed files, and emits a warning annotation per offender plus a job summary. Advisory by design: it never fails the job. Blocking would turn a PR red for merely touching a file that was already unformatted, and normalising the tree in one commit would wreck git blame and conflict with the PRs in flight. Requires fetch-depth: 0, since diffing against the base needs its history. * feat(install): first-run wizard gated by a one-time setup token (#419) Adds /install, a four-step first-run wizard: connect to Immich, optionally pick albums, name the site, finish. It verifies the credentials against the Immich server before writing anything, then writes gallery.yaml, settings.yaml and a content/install.json carrying the Immich credentials and a generated site secret. install.json exists because a running process cannot pick up new env vars — the wizard has to write configuration that takes effect without a restart. getInstallCredentials() merges it under the real environment, so env vars always win and rotation stays a matter of setting one. Both the page and the API routes are gated by a one-time setup token printed to the server log, so a deployment that is reachable before gallery.yaml exists cannot be configured by whoever finds it first. The token is stored in content/.setup-token (0600) rather than a module variable: Next.js bundles the page and each route handler separately, so a module-level token left the page and the API disagreeing inside one process and the wizard stuck on step 1. It is removed once the install completes. The admin password is stored as an scrypt hash using the scheme lib/auth.ts already applies to album passwords; a plaintext ADMIN_PASSWORD env var keeps working. * docs: document the setup wizard, fix the read-only content mount (#425) Quick Start now leads with the /install wizard, with the hand-written YAML route kept alongside it, and a First-Run Setup section covers the setup token, the files the wizard writes, and env-var precedence. Two corrections: both Docker examples mounted content/ as :ro, which silently breaks the wizard, the admin panel and the backup rotation alike — docs/admin-panel.md already said so and the README contradicted it. And nothing documented that content/install.json holds the Immich API key, so a backup of content/ is a backup of credentials. Also adds a Contributors section crediting the people whose work is in the project. * feat(admin): floating save bar pinned to the bottom of the viewport (#426) The save bar was the first, static element inside .admin-main. Since the document itself scrolls, it left the viewport as soon as you scrolled down — editing a subpage section or a settings block far below gave no visible dirty hint and no reachable save button. Replace it with a bottom-pinned floating bar shared by both editors. It only mounts while there is something to act on (unsaved changes, an in-flight save, or a result message), so it never covers content while idle. The success message clears after 5s, which hides the bar again. - new SaveBar component, replacing the duplicated markup in PageBuilder and SettingsEditor - adopt the previously unused .floating-save-bar CSS: slide-in keyframes (carrying translateX(-50%)), dirty border, wrap/gap, mobile variant and a prefers-reduced-motion opt-out; z-index 900 keeps it below modals - .admin-main gains bottom padding so the bar never covers page content - drop the now-unreachable idle hints: the ⌘S hint becomes a button title, the Live Sync note becomes a static line above the settings layout - header "Site" link now bypasses the cache (/?fresh=1), so the preview stays reachable when the bar is hidden Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(admin): themed listbox for the album sort control (#427) The per-album "Photo order" control was a native <select>. Because an <option> cannot contain markup, its choices could not use the admin panel's currentColor SVG set — the reason #415 had to fall back to plain text after dropping the emoji labels. Adds a Listbox component implementing the ARIA combobox/listbox pattern, so options can render a glyph beside their label: - DOM focus stays on the trigger button; the active option is announced through aria-activedescendant, keeping focus management to one element - Keyboard: arrows (clamped at the ends, like a native select), Home/End, Enter/Space to commit, Escape to cancel, Tab commits and moves on, and prefix type-ahead with a repeat-key cycle - Outside dismissal on pointerdown, so a press starting outside closes the popup before the click retargets The sort options now carry an icon each: calendar, arrow-down, arrow-up, an A→Z marker, and the drag glyph for manual — matching the badge the album card already shows. SORT_LABELS stays plain text because the badge feeds it to a title attribute. Closes #417 Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(git): ignore generated design handoff folders * fix(admin): stop the album sort dropdown clipping, and simplify the panel (#428) * fix(admin): render listbox popup in a portal so it escapes modal clipping The sort control's popup was position:absolute inside three clipping ancestors (.album-drawer overflow:hidden > .album-drawer-body overflow-y:auto > .modal-right-column overflow-y:auto), so it was cut off at the bottom of the Edit Album Details modal. z-index could not help: clipping happens before stacking. It also always hung below the trigger, with no flip. Portal the popup to document.body and position it from the trigger's viewport rect, flipping above when there is more room there and capping max-height to the space available so it scrolls internally rather than overflowing. It is dismissed on scroll and resize, since the anchor is only measured on open. The outside-pointerdown handler now also treats the popup as inside; without that the portalled list counts as outside, and a click on an option would close it before the selection commits. * refactor(admin): single-column album details panel The left column spent 1.2fr on a cover thumbnail and three stat rows, two of which (Status, Custom Hero) only restated the form fields opposite them, while the form itself was squeezed into 1.8fr behind a second nested scroller. Stack the drawer in one column instead: cover as a banner, then the form at full width, with the UUID moved into the footer. The body is now the only scroll container, which also removes one of the ancestors that was clipping the sort popup. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> * fix(admin): give the portalled listbox its theme back, lock the page behind modals (#429) Two defects in the album editor. The sort listbox popup painted transparent. Every --admin-* variable is scoped to .admin-layout, and since the popup moved into document.body it sits outside that subtree, so background/border/text all resolved to nothing. It now carries its own copy of the palette in both colour schemes, plus the font it no longer inherits. Scrolling inside a modal also moved the page behind it. No admin modal ever locked body scroll: the overlay covers the page but does not absorb wheel events, so a scroll starting on the backdrop — or continuing past the end of the modal's own scroller — reaches the document. overscroll-behavior cannot cover that case on its own, because it only applies to scroll containers and the backdrop is not one. useScrollLock freezes body while a modal is open and compensates for the width the scrollbar gives up, so nothing shifts underneath. Each lock restores the inline value it found, which makes nesting work without a counter — a picker opened from the drawer restores the drawer's hidden state instead of clearing it. Applied to both drawers and all four picker modals, which share the defect. overscroll-behavior: contain on the scrollers stops the chaining they can handle themselves. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com> * fix(security): allow unsafe-eval in CSP script-src during dev mode * feat(journal): add Journal Studio with split-screen editor, live preview and dedicated routes * fix(build): separate client parser from server journal-service and fix build type errors * fix(journal): Fotos rendern, Layout und Lightbox-Steuerung korrigieren Fünf unabhängige Fehler in der öffentlichen Journal- und Essay-Ansicht: * Foto-Blöcke wurden nie angezeigt. EssayView löst ein Foto über PhotoItem.id auf, und das sind verschlüsselte Tokens — die Blöcke aus dem Markdown tragen aber rohe Asset-UUIDs. Jede Zuordnung lief ins Leere, und nicht auflösbare Blöcke werden still verworfen. Die IDs werden jetzt serverseitig übersetzt; damit verschwinden nebenbei die rohen UUIDs aus dem Client-Payload, die dort laut Projektregel nie auftauchen dürfen. Nicht auflösbare Referenzen werden geloggt. * Überschriften standen weiter links als der Fließtext. Jeder Block hatte einzeln `max-width: 68ch`, und `ch` ist relativ zur Schrift des Elements — die Serif-Überschrift ergab eine breitere Spalte. Ersetzt durch eine gemeinsame, font-unabhängige `--essay-measure`. * Fullbleed-Fotos bluteten nur nach links aus: `.essay-figure` ist `width: 100%`, wodurch die Box überbestimmt ist und der negative rechte Margin verworfen wird. * Foto-Paare stellten beide Bilder gleich breit dar, wodurch ein Hochformat neben einem Querformat doppelt so hoch wurde. Jetzt eine Justified-Reihe: Breite proportional zum Seitenverhältnis, dadurch exakt gleiche Höhen ohne Beschnitt. * Die Lightbox hatte im Journal keine Tastatursteuerung und keine Scroll-Sperre — beides lag in PhotoGrid, also nur im Album-Raster. Verlagert in die Lightbox selbst, der doppelte Handler in PhotoGrid entfernt (sonst wäre pro Pfeildruck zwei Bilder weitergesprungen). Zusätzlich sind Proofing-Herzen und das EXIF-Panel im redaktionellen Modus abschaltbar und im Journal aus: Client-Proofing ist ein Übergabe-Workflow für Alben, keine Funktion einer Reportage. Auf der Übersicht wurde der Untertitel doppelt gerendert, weil extractExcerpt() auf ihn zurückfällt. * feat(admin): eigene URLs für alle Bereiche und überarbeiteter Journal Studio Das Panel war eine einzige Client-Komponente, die ihre Tabs über useState umschaltet: keine Route pro Bereich, kein Deep-Link, kein Zurück-Button, und nach jedem Reload landete man wieder auf "Pages". Auch der Journal-Editor hatte keine eigene URL. Jetzt sieben echte Routen (/admin, /admin/pages, /admin/journal, /admin/journal/<slug>, /admin/settings, /admin/settings/<section>, /admin/analytics). Die Shell mit Auth-Prüfung und Kopfzeile sitzt im Layout und umschließt children — so bleibt die Session-Prüfung über Routenwechsel montiert, statt bei jedem Tab-Wechsel neu zu laufen und den Spinner aufblitzen zu lassen. Unbekannte Settings-Sections fallen auf General zurück. Im selben Zug der Journal Studio, der die Routing-Änderung ohnehin berührt: * Alle Eingabefelder nutzten die Klasse `admin-input`, die in keinem CSS definiert war — sie fielen auf Browser-Defaults zurück. Jetzt gestylt, gescoped, damit der generische Name nicht ins übrige Panel leckt. * Der Split View ist per Divider verschiebbar (Maus, Tastatur, Doppelklick zum Zurücksetzen), Breite in localStorage. * Das Studio bricht aus der 1120px-Spalte aus, die Preview hat Platz. * Die Preview zeigte für jedes Foto fest 3:2 und log damit über das Layout der veröffentlichten Seite; die echten Verhältnisse werden jetzt an den Thumbnails gemessen. * Blöcke mit alten positionsbasierten Foto-Referenzen werden markiert — die lassen sich auf einer eigenständigen Journal-Seite nicht auflösen und verschwanden bisher stillschweigend. * Blocktyp-Chips als gemeinsame Komponente, monochrom und per Icon unterschieden statt in einer eigenen Blau/Lila/Orange-Palette, die sonst nirgends im Panel vorkommt. * Emojis raus, SVG-Icons rein. * fix(admin): Designsystem-Lücken im Panel schließen Eine systematische Suche nach Klassen, die im TSX benutzt, aber in keinem CSS definiert sind, hat vier Stellen mit demselben Muster gefunden: * `admin-btn-secondary` und `admin-btn-danger` existierten nicht. Sämtliche Löschen-Buttons sahen aus wie normale Buttons — keine Warnwirkung. Als `.admin-btn.admin-btn-danger` geschrieben, weil die Varianten mit den Größenklassen kombiniert werden, die weiter unten ihren eigenen Hintergrund setzen. * `page-progress-fill` fehlte: die Balken im Analytics-Panel waren leere Rinnen, der Wert unsichtbar. Ebenso `analytics-empty` und `admin-loading-container`. * `subpage-drawer-section`, `subpage-drawer-title-group` und `input-with-icon` im PageBuilder waren wirkungslos und teils mit Inline-Styles notdürftig kompensiert. * `grid-card-preview` fehlte, wodurch alle Layout-Vorschauen auf Höhe null kollabierten. Nur "Showcase" war sichtbar — und das aus Versehen, weil sein Tile `hero-tile` hieß und damit die `aspect-ratio` einer fremden PageBuilder-Klasse erbte. Umbenannt. Dazu die Theme-Vorschauen, die praktisch identisch aussahen: alle sieben zeigten dieselben drei quadratischen Kacheln, einziger Unterschied war die Hintergrundfarbe. Sie spiegeln jetzt die echten Preset-Daten aus lib/config/theme.ts — Schriftcharakter, Eckradius, Rasterdichte, Passepartout bzw. Schatten. Die Kopfzeile richtet sich an einer gemeinsamen Steuerhöhe aus. Der "Site"-Link war höher als die Buttons daneben: `.admin-btn` hatte keine explizite line-height, und <button> bekommt box-sizing: border-box vom Browser, <a> nicht. Die Statusanzeige setzte weder Schriftfamilie noch -größe und fiel auf den Browser-Default zurück — sie war nie Teil des Designsystems. Jetzt gleiche Höhe und Typografie, Pillenform als Zustandsanzeige, Trenner zur Aktionsgruppe. Das dauerhafte Pulsieren des grünen Punkts entfällt; Animation bleibt den Zuständen vorbehalten, die Aufmerksamkeit brauchen. Restliche Emojis durch SVG-Icons ersetzt. * feat(admin): add scroll-to-top toggle and SVG arrow The back-to-top button was always on and drew its arrow with the ↑ text character. Add a `scrollToTop` setting (General section in the admin panel, defaults to on so existing sites are unaffected) and replace the glyph with a stroked SVG that inherits currentColor across all presets. Scroll handling is now rAF-throttled, and prefers-reduced-motion turns off both the hover lift and the smooth scroll. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * security(journal): escape author HTML instead of filtering it CodeQL flags 26 high-severity alerts on the release PR; the bulk of them point at sanitizeHtml(), a denylist of three regexes whose output goes into dangerouslySetInnerHTML. I reproduced the bypasses before changing anything — all four pass the old filter: <img src=x onerror=alert(1)> unquoted handler, regex wants quotes <img src=x onerror='alert(1)'> single quotes, same reason <svg onload=alert(1)> not a <script> tag javasjavascript:cript:alert(1) one-pass replace, the rest recombines Plus an attribute breakout in the link renderer, which interpolated the URL into href="${url}" unescaped: [x](" onmouseover=alert(1) x=") -> <a href="" onmouseover=alert(1" ...> Replaced with escaping. Every `&<>"'` in author text becomes an entity before any markdown rule runs, so the only tags in the output are the ones renderInlineMarkdown builds itself and a URL cannot leave its attribute. Link schemes are now an allowlist (http, https, mailto, tel, relative, anchor); anything else renders as plain text. The serializer needed decodeHtmlEntities to match: without it a save would write `&lt;` into the Markdown file and the next parse would escape the `&` again, corrupting the text further on every round trip. A test covers parse -> serialize -> parse stability. Two existing tests asserted the old behaviour and were rewritten rather than deleted: one expected the script tag to be *removed* from the output, the other expected the substring "onerror" to be absent. Both now assert the property that matters — that no tag can form — because `onerror` surviving as inert text is fine. Exploitation required admin access either way: journal and essay text comes from the studio or from content/*.md. This removes the weakness, it does not close an open door. * fix(journal): contain file paths, fix frontmatter escaping, defuse two regexes Follow-up to the CodeQL findings on release PR #432. I went through all 23 alerts individually; this addresses the ones that are worth addressing and documents the ones that are not. Path containment (12 alerts, all false positives). Every path built from a slug goes through isValidSlug(), a strict `/^[a-zA-Z0-9_-]+$/` allowlist — verified against `../../etc/passwd`, `foo/../../bar`, `a/b`, `..` and friends, all rejected. CodeQL cannot see it because the check lives in another module. Added a containedPath() helper that resolves the path and refuses anything landing outside the content directory: a second lock on a door that was already locked, and a barrier the analysis can follow. Also removed the dead `slug.endsWith('.md')` branches — isValidSlug rejects dots, so they could never be taken. Frontmatter escaping (1 alert, a real bug). The serializer escaped `"` but not `\`, and the parser never unescaped anything. A title containing either character gained a backslash on every save/load cycle: Path C:\Users "quoted" -> Path C:\\Users \"quoted\" -> ... Escaping now covers the backslash first and the parser undoes both. A round trip test covers quotes, backslashes, colons and apostrophes. Two of three ReDoS regexes (2 alerts). The heading pattern had `\s+` next to `(.+)`, which overlap, so the engine tried every split of the whitespace run before failing; it is `[ \t]+` and `(\S.*)` now. The quote author pattern wrapped a lazy group around an optional group — the quadratic case — and is an index split on the first separator now. The third regex, the bold/italic pass, is deliberately left alone. Rewriting it with a negated class removes the backtracking but breaks nesting: `**bold *and italic* here**` renders as `*<em>bold </em>and italic<em> here</em>*`. The input is Markdown from an authenticated admin, never a visitor, so the worst case is an author slowing down their own page. The comment in the code says so. Not addressed: 5 js/insufficient-password-hash alerts. They ask for a slow KDF where the code uses SHA-256/HMAC — correct in general, but the admin password comes from an environment variable and is never stored, so a stronger KDF protects nothing that is not already in plaintext in the environment. 399 unit tests pass (18 new), build and tsc clean. * fix(journal): split the quote author by scanning, not by pattern Cleaning up after myself. #439 replaced the quote author regex `/^(.*?)(?:\s+--\s+(.+))?$/` — a lazy group around an optional one, the quadratic case — with `/\s+--\s+/`, and CodeQL promptly flagged the replacement for the same reason. One reported pattern traded for another. splitQuoteAuthor() scans for the first `--` that has whitespace on both sides. Linear, and it needs no reasoning about the regex engine at all. Behaviour is identical to the original regex, checked case by case against it: separator, no separator, several separators, tabs, wide gaps, `a--b` without spaces, leading and trailing separators, empty string. All nine are covered by tests, plus one asserting it stays fast on a 50k whitespace run. * security(admin): derive the session signing key with scrypt getSigningKey() ran the admin password through a single SHA-256 digest. It is key derivation rather than password storage, so it was never a stored-hash problem — but if the derived key ever leaked, one fast hash makes recovering the password by brute force cheap. CodeQL flags it as js/insufficient-password-hash and, for this particular alert, has a point. scrypt now. Two details that matter: The salt has to be stable. A random salt would produce a different key on every call and invalidate every session; it is derived from AUTH_SECRET, which is deployment-specific. Verified across separate processes: same inputs produce a verifying token, so a restart or redeploy does not log everyone out. The result is cached for the process lifetime. scrypt is deliberately slow and getSigningKey() runs on every admin request — deriving per call would add ~24ms to each one. The cache key is a digest of secret plus password, so a rotation misses the cache and derives again, and no extra plaintext copy of the password is kept around. Measured: first derivation 24ms, subsequent calls 0.12ms. Password change and secret change both invalidate an existing token, checked in separate processes. Note the one-time effect: existing admin sessions are invalidated by the change in derivation, so everyone logs in once more. * security(admin): key the signing-key cache on its inputs, not a digest #441 removed the SHA-256 digest of the admin password from the key derivation and introduced a new one three lines above it, as the cache key. Same rule, same file: CodeQL reported it immediately. The comment justifying it was wrong too. It claimed no second plaintext copy of the password was retained, while building the digest input allocates exactly that in order to hash it. The cache now holds the two input strings and compares them directly. They are the same objects the env and install caches already hold, so nothing extra is retained, and no fast hash of the password exists in memory for the life of the process. Re-verified after the change, in separate processes: a token from one process verifies in another with the same inputs, a changed password or secret rejects it, first derivation 24ms, cached calls 0.001ms. That leaves scrypt as the only place the password is hashed here. The two HMACs further down operate on the derived key and on token data, not on the password; the constant-time comparison in verifyAdminPassword is the previously dismissed one. --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
2026-08-14 16:55:07 +02:00
/* The card's own hover state is enough of a highlight; the chip stays quiet. */
.essay-block-card:hover .essay-block-badge {
border-color: var(--admin-border-hover);
color: var(--admin-text);
chore(release): v0.10.0 (#400) Photo Essay mode, client proofing, studio-modern preset, admin panel overhaul, watermark, cookieless analytics, subpage toggle, SEO title templates. Analytics API now admin-only, Trivy scan on publish. Album order mirrors the Immich timeline; map theme, admin status panel, lightbox counter and Docker health check fixed. See CHANGELOG.md for the full list and the health-check upgrade note.
2026-08-10 09:56:20 +02:00
}
security: add Trivy container scan to Docker publish workflow (#399) * feat(admin): add backup manager UI with 1-click restore * feat(admin): collapse older backup entries by default * fix(theme): isolate admin layout, instant DOM theme updates, and add Light/Dark mode toggle * feat(admin): replace text controls for Photo Frame and Hero Style with visual preview cards * fix(admin): define missing CSS rules for button system (.btn, .preset-btn) * feat(admin): redesign theme settings with segmented mode toggle, accent color swatches, and custom iOS-style toggle cards * feat(admin): upgrade all settings tabs with visual grid previews, Google SEO snippet preview, and toggle cards * feat(admin): overhaul Pages Builder UX with slide-over drawer, card hover badges, real-time search, and floating save bar * fix(admin): remove leftover dangling syntax snippet in PageBuilder.tsx * fix(admin): add position: relative to subpage-tile so hover overlay is contained inside the tile * style(admin): replace all emojis with clean Leica-style vector SVG icons * fix(types): extend IconProps with SVGProps to allow style prop on Leica SVG icons * feat(admin): add subpage live-preview, privacy analytics, and asset protection settings * fix(typecheck): fix AlbumEntry property access in subpage drawer preview mode * fix(types): fix ImmichAlbumInfo property names thumbnailAssetId and albumName in PageBuilder.tsx * fix(types): add protection and watermark optional properties to AppConfig interface * feat(settings): add toggle for disabling analytics tracking (defaults to enabled) * feat(ux): show status banner when analytics tracking is disabled + add live sync indicator * feat(watermark): render customizable watermark overlay on Lightbox images + rename section to Portfolio Features & Modules * fix(types): import type LightboxWatermark in PhotoGrid.tsx * fix(types): destructure watermark prop in PhotoGrid function signature * feat(seo): add configurable subpage title template and metadata descriptions * feat(seo): add generateMetadata to about page for title template support * feat(proofing): add client proofing, favorites selection, compact URL bitmasking, and export modal * feat(essay): add Photo Essay storytelling mode with RSC markdown parser and fullbleed/pair layouts * feat(subpages): add page enabled toggle to deactivate subpages without deleting them * feat(admin): add visual essay block builder for photo essay storytelling pages * security: add Trivy container scan to Docker publish workflow Scans the built image for CRITICAL/HIGH CVEs on every release and uploads results to the GitHub Security tab. Non-blocking for now (exit-code 0) so releases aren't gated on findings. Also documents the scan and existing Dependabot coverage in the README. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-08-07 11:08:04 +02:00
chore(release): v0.10.0 (#400) Photo Essay mode, client proofing, studio-modern preset, admin panel overhaul, watermark, cookieless analytics, subpage toggle, SEO title templates. Analytics API now admin-only, Trivy scan on publish. Album order mirrors the Immich timeline; map theme, admin status panel, lightbox counter and Docker health check fixed. See CHANGELOG.md for the full list and the health-check upgrade note.
2026-08-10 09:56:20 +02:00
.essay-block-actions {
display: flex;
align-items: center;
gap: 0.25rem;
}
security: add Trivy container scan to Docker publish workflow (#399) * feat(admin): add backup manager UI with 1-click restore * feat(admin): collapse older backup entries by default * fix(theme): isolate admin layout, instant DOM theme updates, and add Light/Dark mode toggle * feat(admin): replace text controls for Photo Frame and Hero Style with visual preview cards * fix(admin): define missing CSS rules for button system (.btn, .preset-btn) * feat(admin): redesign theme settings with segmented mode toggle, accent color swatches, and custom iOS-style toggle cards * feat(admin): upgrade all settings tabs with visual grid previews, Google SEO snippet preview, and toggle cards * feat(admin): overhaul Pages Builder UX with slide-over drawer, card hover badges, real-time search, and floating save bar * fix(admin): remove leftover dangling syntax snippet in PageBuilder.tsx * fix(admin): add position: relative to subpage-tile so hover overlay is contained inside the tile * style(admin): replace all emojis with clean Leica-style vector SVG icons * fix(types): extend IconProps with SVGProps to allow style prop on Leica SVG icons * feat(admin): add subpage live-preview, privacy analytics, and asset protection settings * fix(typecheck): fix AlbumEntry property access in subpage drawer preview mode * fix(types): fix ImmichAlbumInfo property names thumbnailAssetId and albumName in PageBuilder.tsx * fix(types): add protection and watermark optional properties to AppConfig interface * feat(settings): add toggle for disabling analytics tracking (defaults to enabled) * feat(ux): show status banner when analytics tracking is disabled + add live sync indicator * feat(watermark): render customizable watermark overlay on Lightbox images + rename section to Portfolio Features & Modules * fix(types): import type LightboxWatermark in PhotoGrid.tsx * fix(types): destructure watermark prop in PhotoGrid function signature * feat(seo): add configurable subpage title template and metadata descriptions * feat(seo): add generateMetadata to about page for title template support * feat(proofing): add client proofing, favorites selection, compact URL bitmasking, and export modal * feat(essay): add Photo Essay storytelling mode with RSC markdown parser and fullbleed/pair layouts * feat(subpages): add page enabled toggle to deactivate subpages without deleting them * feat(admin): add visual essay block builder for photo essay storytelling pages * security: add Trivy container scan to Docker publish workflow Scans the built image for CRITICAL/HIGH CVEs on every release and uploads results to the GitHub Security tab. Non-blocking for now (exit-code 0) so releases aren't gated on findings. Also documents the scan and existing Dependabot coverage in the README. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-08-07 11:08:04 +02:00
chore(release): v0.10.0 (#400) Photo Essay mode, client proofing, studio-modern preset, admin panel overhaul, watermark, cookieless analytics, subpage toggle, SEO title templates. Analytics API now admin-only, Trivy scan on publish. Album order mirrors the Immich timeline; map theme, admin status panel, lightbox counter and Docker health check fixed. See CHANGELOG.md for the full list and the health-check upgrade note.
2026-08-10 09:56:20 +02:00
/* Polished dark inputs for Essay Editor */
.essay-block-editor input[type='text'],
.essay-block-editor textarea,
.essay-block-editor select {
background: var(--admin-bg-input, #111111) !important;
border: 1px solid var(--admin-border, #2e2e2e) !important;
border-radius: 6px !important;
color: var(--admin-text, #f0f0f0) !important;
font-size: 0.85rem !important;
padding: 0.55rem 0.75rem !important;
outline: none !important;
transition: border-color 0.15s !important;
}
security: add Trivy container scan to Docker publish workflow (#399) * feat(admin): add backup manager UI with 1-click restore * feat(admin): collapse older backup entries by default * fix(theme): isolate admin layout, instant DOM theme updates, and add Light/Dark mode toggle * feat(admin): replace text controls for Photo Frame and Hero Style with visual preview cards * fix(admin): define missing CSS rules for button system (.btn, .preset-btn) * feat(admin): redesign theme settings with segmented mode toggle, accent color swatches, and custom iOS-style toggle cards * feat(admin): upgrade all settings tabs with visual grid previews, Google SEO snippet preview, and toggle cards * feat(admin): overhaul Pages Builder UX with slide-over drawer, card hover badges, real-time search, and floating save bar * fix(admin): remove leftover dangling syntax snippet in PageBuilder.tsx * fix(admin): add position: relative to subpage-tile so hover overlay is contained inside the tile * style(admin): replace all emojis with clean Leica-style vector SVG icons * fix(types): extend IconProps with SVGProps to allow style prop on Leica SVG icons * feat(admin): add subpage live-preview, privacy analytics, and asset protection settings * fix(typecheck): fix AlbumEntry property access in subpage drawer preview mode * fix(types): fix ImmichAlbumInfo property names thumbnailAssetId and albumName in PageBuilder.tsx * fix(types): add protection and watermark optional properties to AppConfig interface * feat(settings): add toggle for disabling analytics tracking (defaults to enabled) * feat(ux): show status banner when analytics tracking is disabled + add live sync indicator * feat(watermark): render customizable watermark overlay on Lightbox images + rename section to Portfolio Features & Modules * fix(types): import type LightboxWatermark in PhotoGrid.tsx * fix(types): destructure watermark prop in PhotoGrid function signature * feat(seo): add configurable subpage title template and metadata descriptions * feat(seo): add generateMetadata to about page for title template support * feat(proofing): add client proofing, favorites selection, compact URL bitmasking, and export modal * feat(essay): add Photo Essay storytelling mode with RSC markdown parser and fullbleed/pair layouts * feat(subpages): add page enabled toggle to deactivate subpages without deleting them * feat(admin): add visual essay block builder for photo essay storytelling pages * security: add Trivy container scan to Docker publish workflow Scans the built image for CRITICAL/HIGH CVEs on every release and uploads results to the GitHub Security tab. Non-blocking for now (exit-code 0) so releases aren't gated on findings. Also documents the scan and existing Dependabot coverage in the README. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com>
2026-08-07 11:08:04 +02:00
chore(release): v0.10.0 (#400) Photo Essay mode, client proofing, studio-modern preset, admin panel overhaul, watermark, cookieless analytics, subpage toggle, SEO title templates. Analytics API now admin-only, Trivy scan on publish. Album order mirrors the Immich timeline; map theme, admin status panel, lightbox counter and Docker health check fixed. See CHANGELOG.md for the full list and the health-check upgrade note.
2026-08-10 09:56:20 +02:00
.essay-block-editor input[type='text']:focus,
.essay-block-editor textarea:focus,
.essay-block-editor select:focus {
border-color: var(--admin-border-focus, #888888) !important;
}
.essay-photo-card {
display: flex;
flex-direction: column;
gap: 0.75rem;
background: var(--admin-bg, #111111);
padding: 0.85rem;
border-radius: 8px;
border: 1px solid var(--admin-border, #2e2e2e);
}
.essay-photo-preview-container {
display: flex;
gap: 1rem;
align-items: flex-start;
}
.essay-photo-thumbnail {
width: 120px;
height: 80px;
border-radius: 6px;
background: var(--admin-bg-elevated, #222);
object-fit: cover;
border: 1px solid var(--admin-border, #333);
flex-shrink: 0;
}
.essay-photo-empty {
width: 120px;
height: 80px;
border-radius: 6px;
background: var(--admin-bg-elevated, #1a1a1a);
border: 1px dashed var(--admin-border, #333);
display: flex;
flex-direction: column;
align-items: center;
justify-content: center;
color: var(--admin-text-muted, #707070);
font-size: 0.75rem;
gap: 4px;
flex-shrink: 0;
}
.essay-photo-meta {
flex: 1;
display: flex;
flex-direction: column;
gap: 0.5rem;
}
.essay-pill-selector {
display: inline-flex;
background: var(--admin-bg-input, #000);
padding: 2px;
border-radius: 6px;
border: 1px solid var(--admin-border, #2e2e2e);
}
.essay-pill-btn {
padding: 0.25rem 0.65rem;
border-radius: 4px;
font-size: 0.75rem;
font-weight: 500;
border: none;
background: transparent;
color: var(--admin-text-muted, #888);
cursor: pointer;
transition: all 0.15s ease;
}
.essay-pill-btn.active {
background: var(--admin-btn-primary-bg, #ffffff);
color: var(--admin-btn-primary-text, #000000);
}
🛡️ Sentinel: [HIGH] Fix timingSafeEqual DoS Vulnerability (#423) * Fix timingSafeEqual DoS Vulnerability in Webhook Co-authored-by: ralksta <16941050+ralksta@users.noreply.github.com> * Fix memory exhaustion DoS in token decoding Co-authored-by: ralksta <16941050+ralksta@users.noreply.github.com> --------- Co-authored-by: google-labs-jules[bot] <161369871+google-labs-jules[bot]@users.noreply.github.com>
2026-08-14 11:10:42 +02:00
/* ── Per-album photo order (sort: manual) ────────────────────── */
.admin-field-hint {
display: block;
margin-top: 0.35rem;
font-size: 0.75rem;
line-height: 1.4;
color: var(--admin-text-muted);
}
.order-editor-body {
flex: 1;
min-height: 0;
overflow-y: auto;
release: v0.11.0 — journal fixes, admin URLs, design system cleanup (#432) * fix(screenshots): sharp-Typen fuer 0.34 und 0.35 gleichzeitig (#410) sharp 0.35 ist von `export =` auf ESM umgestellt: der Modul-Namespace ist nicht mehr aufrufbar, die Factory sitzt unter .default. Der Type-Check brach damit in scripts/screenshots.ts weg, sobald der Next-Bump (#402) sharp von 0.34.5 auf 0.35.3 mitzieht -- sharp ist hier keine deklarierte Dependency, sondern kommt ueber Next mit. Die Form wird jetzt aus dem installierten Paket abgeleitet statt festgeschrieben, zur Laufzeit wie im Typ. Geprueft mit beiden Versionen: tsc laeuft mit 0.34.5 und mit 0.35.3 fehlerfrei durch. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(deps): bump the nextjs group across 1 directory with 2 updates (#402) Bumps the nextjs group with 2 updates in the / directory: [next](https://github.com/vercel/next.js) and [eslint-config-next](https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next). Updates `next` from 16.2.12 to 16.3.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/compare/v16.2.12...v16.3.0) Updates `eslint-config-next` from 16.2.12 to 16.3.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/commits/v16.3.0/packages/eslint-config-next) --- updated-dependencies: - dependency-name: eslint-config-next dependency-version: 16.3.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: nextjs - dependency-name: next dependency-version: 16.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nextjs ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps-dev): bump prettier from 3.8.3 to 3.9.6 (#405) Bumps [prettier](https://github.com/prettier/prettier) from 3.8.3 to 3.9.6. - [Release notes](https://github.com/prettier/prettier/releases) - [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md) - [Commits](https://github.com/prettier/prettier/compare/3.8.3...3.9.6) --- updated-dependencies: - dependency-name: prettier dependency-version: 3.9.6 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * docs(changelog): Unreleased-Sektion fuer die Bumps nach v0.10.0 (#413) Die Dependency-PRs sind nach dem Release auf dev gelandet, teils auch auf main. Ohne Eintrag waeren sie beim naechsten Release unsichtbar -- inklusive Next 16.3.0, das CVE-2025-13465 mitbringt. Ausserdem im 0.10.0-Abschnitt nachgetragen, dass der Trivy-Scan bis #409 nie gelaufen ist. Der Fix steckt im Tag v0.10.0, fehlte aber in der Aufzaehlung -- und "Images werden bei jedem Publish gescannt" stand im Changelog, waehrend der Job im Action-Setup abbrach. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(gallery): per-album sort order, independent of Immich (#408) (#414) Album order was dictated entirely by Immich: getAlbum() sorted by the album's own asc/desc flag, so a Folio album always mirrored the archive. A curated series has a narrative order that has nothing to do with capture time, and changing the Immich album's sort to fit the website changes it for the archive too. Adds an optional per-album `sort` in gallery.yaml, editable in /admin, defaulting to today's behaviour so every existing config is unchanged: immich (default) | newest | oldest | filename | manual `manual` is a pinned *prefix*: `assetOrder` lists only the photos placed by hand, everything else follows in the album's Immich order. A full permutation of a 2,000-photo album would be ~80 KB of UUIDs in a file that is rewritten and copied to content/.backups/ on every admin save. It also makes drift fall out for free — photos removed in Immich never match, new ones land in the tail rather than being hidden. Sorting is applied after the cache read, not before the cache write, so the LRU keeps one canonical Immich-ordered copy per album. That avoids putting the mode in the cache key, lets a config change take effect without depending on invalidation, and keeps the stale-serving path correct. cache.get() returns the stored object by reference, so withSort() returns a shallow clone with a new array — sorting in place would reorder the shared entry, and under request coalescing every concurrent caller would be sorting the same array. Also fixes a prerequisite bug: /api/admin/albums/[albumId]/assets read album.assets from GET /albums/:id, which Immich 3.x no longer populates (lib/immich.ts:507). The hero picker's "This Album" tab returned nothing and threw outright when the key was absent. It now goes through the client's paginated metadata search, with ?types=all to opt videos in for the reorder editor. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): drop decorative emoji from the sort select labels (#415) An <option> cannot contain markup, so the SVG set in Icons is not reachable there — but a decorative emoji is not a substitute for it. Plain text instead; the album card badge already uses a real icon. The remaining emoji in the admin panel (asset picker tabs, section headings, layout picker options) predate this branch and are left for a separate cleanup. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): replace emoji icons with the shared SVG icon set (#416) The admin panel mixed two icon conventions: inline SVGs from `Icons.tsx` in most components, and decorative emoji in the asset picker and a few PageBuilder labels. Emoji render inconsistently across platforms, ignore the accent colour, and cannot inherit the `.svg-icon` sizing rules. - Icons.tsx: add `IconStar` (filled — it marks a state, not an action) and `IconImage`. - AssetPicker: the three tab labels and the favourite tile badge now use IconFolder / IconStar / IconImage. - PageBuilder: the "Standalone Albums" and "Subpages" headings use the icon set instead of an emoji. - PageBuilder: the layout picker drops its emoji for plain text. An <option> cannot contain markup, so an SVG is impossible there and a decorative glyph is not a substitute. - admin.css: align icon and label in the picker tabs, and swap the favourite badge's text-shadow for drop-shadow, which is what applies to an inline SVG. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): fold PageBuilder's local icons into the shared Icons module (#418) * refactor(admin): fold PageBuilder's local icons into the shared module PageBuilder.tsx carried its own `Icons` object duplicating most of the glyphs already exported by Icons.tsx, with hardcoded sizes and slightly divergent paths. Migrate all 32 call sites to the shared module and delete the local object. Five glyphs had no counterpart and are added to Icons.tsx as 1:1 ports of the local paths: IconX, IconPlus, IconHome, IconCopy, IconImage. The local ExternalLink and Check are dropped rather than ported — both had zero call sites. Two glyphs change shape slightly, which is the point of consolidating: the shared IconCamera includes the viewfinder bump the local copy omitted, and drag handles now use IconGripVertical. IconGripVertical uses the module's square 24x24 viewBox, so `.svg-drag` goes from 12x18 to 18x18 — the old non-square box would letterbox the glyph down to 12x12 and shrink the handle. * fix(admin): resolve icon-module integration after #416 Merging dev brought in #416, which added a second IconImage to Icons.tsx and two <Icons.Camera>/<Icons.Folder> section headers that reference the local Icons object this PR removes. Git merged both cleanly but the result did not type-check. - drop the duplicate IconImage (both copies were byte-identical) - point the two section headers at the imported IconCamera/IconFolder - refresh the SORT_LABELS comment: the icon set is imported now, not declared below --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> * fix(config): allow an empty gallery, guard against a double /api suffix (#421) An empty gallery is now a valid, rendered state instead of a throw: deriveGallery() no longer requires at least one album or subpage, so a deployment with no albums yet renders a bare homepage the owner can fill in via /admin. getConfig() also stops appending /api to an Immich URL that already ends in it, which previously produced .../api/api and broke every upstream request. Includes a restore of the per-album sort test cases, which the branch had lost by being cut before #408/#414. * feat(admin): favicon upload, served from the content volume (#422) Adds a bundled default favicon, an upload widget in admin Settings > General, and a route that serves the icon from the writable content/ volume with a fallback to the bundled default. Raster uploads (PNG/ICO/JPEG) are wrapped in an SVG container; the response carries its own CSP so an uploaded SVG cannot execute script on the origin. The GET route revalidates with an ETag instead of caching immutably, so a newly uploaded icon shows up immediately. Uploads are written via temp file + rename, and a Reset button restores the bundled default. * ci: flag unformatted files in a PR, without blocking it (#424) Prettier is configured as an error rule in eslint.config.mjs but has never run in CI, so part of the tree predates it. A final CI step now diffs against the PR base, runs prettier --list-different over the changed files, and emits a warning annotation per offender plus a job summary. Advisory by design: it never fails the job. Blocking would turn a PR red for merely touching a file that was already unformatted, and normalising the tree in one commit would wreck git blame and conflict with the PRs in flight. Requires fetch-depth: 0, since diffing against the base needs its history. * feat(install): first-run wizard gated by a one-time setup token (#419) Adds /install, a four-step first-run wizard: connect to Immich, optionally pick albums, name the site, finish. It verifies the credentials against the Immich server before writing anything, then writes gallery.yaml, settings.yaml and a content/install.json carrying the Immich credentials and a generated site secret. install.json exists because a running process cannot pick up new env vars — the wizard has to write configuration that takes effect without a restart. getInstallCredentials() merges it under the real environment, so env vars always win and rotation stays a matter of setting one. Both the page and the API routes are gated by a one-time setup token printed to the server log, so a deployment that is reachable before gallery.yaml exists cannot be configured by whoever finds it first. The token is stored in content/.setup-token (0600) rather than a module variable: Next.js bundles the page and each route handler separately, so a module-level token left the page and the API disagreeing inside one process and the wizard stuck on step 1. It is removed once the install completes. The admin password is stored as an scrypt hash using the scheme lib/auth.ts already applies to album passwords; a plaintext ADMIN_PASSWORD env var keeps working. * docs: document the setup wizard, fix the read-only content mount (#425) Quick Start now leads with the /install wizard, with the hand-written YAML route kept alongside it, and a First-Run Setup section covers the setup token, the files the wizard writes, and env-var precedence. Two corrections: both Docker examples mounted content/ as :ro, which silently breaks the wizard, the admin panel and the backup rotation alike — docs/admin-panel.md already said so and the README contradicted it. And nothing documented that content/install.json holds the Immich API key, so a backup of content/ is a backup of credentials. Also adds a Contributors section crediting the people whose work is in the project. * feat(admin): floating save bar pinned to the bottom of the viewport (#426) The save bar was the first, static element inside .admin-main. Since the document itself scrolls, it left the viewport as soon as you scrolled down — editing a subpage section or a settings block far below gave no visible dirty hint and no reachable save button. Replace it with a bottom-pinned floating bar shared by both editors. It only mounts while there is something to act on (unsaved changes, an in-flight save, or a result message), so it never covers content while idle. The success message clears after 5s, which hides the bar again. - new SaveBar component, replacing the duplicated markup in PageBuilder and SettingsEditor - adopt the previously unused .floating-save-bar CSS: slide-in keyframes (carrying translateX(-50%)), dirty border, wrap/gap, mobile variant and a prefers-reduced-motion opt-out; z-index 900 keeps it below modals - .admin-main gains bottom padding so the bar never covers page content - drop the now-unreachable idle hints: the ⌘S hint becomes a button title, the Live Sync note becomes a static line above the settings layout - header "Site" link now bypasses the cache (/?fresh=1), so the preview stays reachable when the bar is hidden Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(admin): themed listbox for the album sort control (#427) The per-album "Photo order" control was a native <select>. Because an <option> cannot contain markup, its choices could not use the admin panel's currentColor SVG set — the reason #415 had to fall back to plain text after dropping the emoji labels. Adds a Listbox component implementing the ARIA combobox/listbox pattern, so options can render a glyph beside their label: - DOM focus stays on the trigger button; the active option is announced through aria-activedescendant, keeping focus management to one element - Keyboard: arrows (clamped at the ends, like a native select), Home/End, Enter/Space to commit, Escape to cancel, Tab commits and moves on, and prefix type-ahead with a repeat-key cycle - Outside dismissal on pointerdown, so a press starting outside closes the popup before the click retargets The sort options now carry an icon each: calendar, arrow-down, arrow-up, an A→Z marker, and the drag glyph for manual — matching the badge the album card already shows. SORT_LABELS stays plain text because the badge feeds it to a title attribute. Closes #417 Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(git): ignore generated design handoff folders * fix(admin): stop the album sort dropdown clipping, and simplify the panel (#428) * fix(admin): render listbox popup in a portal so it escapes modal clipping The sort control's popup was position:absolute inside three clipping ancestors (.album-drawer overflow:hidden > .album-drawer-body overflow-y:auto > .modal-right-column overflow-y:auto), so it was cut off at the bottom of the Edit Album Details modal. z-index could not help: clipping happens before stacking. It also always hung below the trigger, with no flip. Portal the popup to document.body and position it from the trigger's viewport rect, flipping above when there is more room there and capping max-height to the space available so it scrolls internally rather than overflowing. It is dismissed on scroll and resize, since the anchor is only measured on open. The outside-pointerdown handler now also treats the popup as inside; without that the portalled list counts as outside, and a click on an option would close it before the selection commits. * refactor(admin): single-column album details panel The left column spent 1.2fr on a cover thumbnail and three stat rows, two of which (Status, Custom Hero) only restated the form fields opposite them, while the form itself was squeezed into 1.8fr behind a second nested scroller. Stack the drawer in one column instead: cover as a banner, then the form at full width, with the UUID moved into the footer. The body is now the only scroll container, which also removes one of the ancestors that was clipping the sort popup. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> * fix(admin): give the portalled listbox its theme back, lock the page behind modals (#429) Two defects in the album editor. The sort listbox popup painted transparent. Every --admin-* variable is scoped to .admin-layout, and since the popup moved into document.body it sits outside that subtree, so background/border/text all resolved to nothing. It now carries its own copy of the palette in both colour schemes, plus the font it no longer inherits. Scrolling inside a modal also moved the page behind it. No admin modal ever locked body scroll: the overlay covers the page but does not absorb wheel events, so a scroll starting on the backdrop — or continuing past the end of the modal's own scroller — reaches the document. overscroll-behavior cannot cover that case on its own, because it only applies to scroll containers and the backdrop is not one. useScrollLock freezes body while a modal is open and compensates for the width the scrollbar gives up, so nothing shifts underneath. Each lock restores the inline value it found, which makes nesting work without a counter — a picker opened from the drawer restores the drawer's hidden state instead of clearing it. Applied to both drawers and all four picker modals, which share the defect. overscroll-behavior: contain on the scrollers stops the chaining they can handle themselves. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com> * fix(security): allow unsafe-eval in CSP script-src during dev mode * feat(journal): add Journal Studio with split-screen editor, live preview and dedicated routes * fix(build): separate client parser from server journal-service and fix build type errors * fix(journal): Fotos rendern, Layout und Lightbox-Steuerung korrigieren Fünf unabhängige Fehler in der öffentlichen Journal- und Essay-Ansicht: * Foto-Blöcke wurden nie angezeigt. EssayView löst ein Foto über PhotoItem.id auf, und das sind verschlüsselte Tokens — die Blöcke aus dem Markdown tragen aber rohe Asset-UUIDs. Jede Zuordnung lief ins Leere, und nicht auflösbare Blöcke werden still verworfen. Die IDs werden jetzt serverseitig übersetzt; damit verschwinden nebenbei die rohen UUIDs aus dem Client-Payload, die dort laut Projektregel nie auftauchen dürfen. Nicht auflösbare Referenzen werden geloggt. * Überschriften standen weiter links als der Fließtext. Jeder Block hatte einzeln `max-width: 68ch`, und `ch` ist relativ zur Schrift des Elements — die Serif-Überschrift ergab eine breitere Spalte. Ersetzt durch eine gemeinsame, font-unabhängige `--essay-measure`. * Fullbleed-Fotos bluteten nur nach links aus: `.essay-figure` ist `width: 100%`, wodurch die Box überbestimmt ist und der negative rechte Margin verworfen wird. * Foto-Paare stellten beide Bilder gleich breit dar, wodurch ein Hochformat neben einem Querformat doppelt so hoch wurde. Jetzt eine Justified-Reihe: Breite proportional zum Seitenverhältnis, dadurch exakt gleiche Höhen ohne Beschnitt. * Die Lightbox hatte im Journal keine Tastatursteuerung und keine Scroll-Sperre — beides lag in PhotoGrid, also nur im Album-Raster. Verlagert in die Lightbox selbst, der doppelte Handler in PhotoGrid entfernt (sonst wäre pro Pfeildruck zwei Bilder weitergesprungen). Zusätzlich sind Proofing-Herzen und das EXIF-Panel im redaktionellen Modus abschaltbar und im Journal aus: Client-Proofing ist ein Übergabe-Workflow für Alben, keine Funktion einer Reportage. Auf der Übersicht wurde der Untertitel doppelt gerendert, weil extractExcerpt() auf ihn zurückfällt. * feat(admin): eigene URLs für alle Bereiche und überarbeiteter Journal Studio Das Panel war eine einzige Client-Komponente, die ihre Tabs über useState umschaltet: keine Route pro Bereich, kein Deep-Link, kein Zurück-Button, und nach jedem Reload landete man wieder auf "Pages". Auch der Journal-Editor hatte keine eigene URL. Jetzt sieben echte Routen (/admin, /admin/pages, /admin/journal, /admin/journal/<slug>, /admin/settings, /admin/settings/<section>, /admin/analytics). Die Shell mit Auth-Prüfung und Kopfzeile sitzt im Layout und umschließt children — so bleibt die Session-Prüfung über Routenwechsel montiert, statt bei jedem Tab-Wechsel neu zu laufen und den Spinner aufblitzen zu lassen. Unbekannte Settings-Sections fallen auf General zurück. Im selben Zug der Journal Studio, der die Routing-Änderung ohnehin berührt: * Alle Eingabefelder nutzten die Klasse `admin-input`, die in keinem CSS definiert war — sie fielen auf Browser-Defaults zurück. Jetzt gestylt, gescoped, damit der generische Name nicht ins übrige Panel leckt. * Der Split View ist per Divider verschiebbar (Maus, Tastatur, Doppelklick zum Zurücksetzen), Breite in localStorage. * Das Studio bricht aus der 1120px-Spalte aus, die Preview hat Platz. * Die Preview zeigte für jedes Foto fest 3:2 und log damit über das Layout der veröffentlichten Seite; die echten Verhältnisse werden jetzt an den Thumbnails gemessen. * Blöcke mit alten positionsbasierten Foto-Referenzen werden markiert — die lassen sich auf einer eigenständigen Journal-Seite nicht auflösen und verschwanden bisher stillschweigend. * Blocktyp-Chips als gemeinsame Komponente, monochrom und per Icon unterschieden statt in einer eigenen Blau/Lila/Orange-Palette, die sonst nirgends im Panel vorkommt. * Emojis raus, SVG-Icons rein. * fix(admin): Designsystem-Lücken im Panel schließen Eine systematische Suche nach Klassen, die im TSX benutzt, aber in keinem CSS definiert sind, hat vier Stellen mit demselben Muster gefunden: * `admin-btn-secondary` und `admin-btn-danger` existierten nicht. Sämtliche Löschen-Buttons sahen aus wie normale Buttons — keine Warnwirkung. Als `.admin-btn.admin-btn-danger` geschrieben, weil die Varianten mit den Größenklassen kombiniert werden, die weiter unten ihren eigenen Hintergrund setzen. * `page-progress-fill` fehlte: die Balken im Analytics-Panel waren leere Rinnen, der Wert unsichtbar. Ebenso `analytics-empty` und `admin-loading-container`. * `subpage-drawer-section`, `subpage-drawer-title-group` und `input-with-icon` im PageBuilder waren wirkungslos und teils mit Inline-Styles notdürftig kompensiert. * `grid-card-preview` fehlte, wodurch alle Layout-Vorschauen auf Höhe null kollabierten. Nur "Showcase" war sichtbar — und das aus Versehen, weil sein Tile `hero-tile` hieß und damit die `aspect-ratio` einer fremden PageBuilder-Klasse erbte. Umbenannt. Dazu die Theme-Vorschauen, die praktisch identisch aussahen: alle sieben zeigten dieselben drei quadratischen Kacheln, einziger Unterschied war die Hintergrundfarbe. Sie spiegeln jetzt die echten Preset-Daten aus lib/config/theme.ts — Schriftcharakter, Eckradius, Rasterdichte, Passepartout bzw. Schatten. Die Kopfzeile richtet sich an einer gemeinsamen Steuerhöhe aus. Der "Site"-Link war höher als die Buttons daneben: `.admin-btn` hatte keine explizite line-height, und <button> bekommt box-sizing: border-box vom Browser, <a> nicht. Die Statusanzeige setzte weder Schriftfamilie noch -größe und fiel auf den Browser-Default zurück — sie war nie Teil des Designsystems. Jetzt gleiche Höhe und Typografie, Pillenform als Zustandsanzeige, Trenner zur Aktionsgruppe. Das dauerhafte Pulsieren des grünen Punkts entfällt; Animation bleibt den Zuständen vorbehalten, die Aufmerksamkeit brauchen. Restliche Emojis durch SVG-Icons ersetzt. * feat(admin): add scroll-to-top toggle and SVG arrow The back-to-top button was always on and drew its arrow with the ↑ text character. Add a `scrollToTop` setting (General section in the admin panel, defaults to on so existing sites are unaffected) and replace the glyph with a stroked SVG that inherits currentColor across all presets. Scroll handling is now rAF-throttled, and prefers-reduced-motion turns off both the hover lift and the smooth scroll. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * security(journal): escape author HTML instead of filtering it CodeQL flags 26 high-severity alerts on the release PR; the bulk of them point at sanitizeHtml(), a denylist of three regexes whose output goes into dangerouslySetInnerHTML. I reproduced the bypasses before changing anything — all four pass the old filter: <img src=x onerror=alert(1)> unquoted handler, regex wants quotes <img src=x onerror='alert(1)'> single quotes, same reason <svg onload=alert(1)> not a <script> tag javasjavascript:cript:alert(1) one-pass replace, the rest recombines Plus an attribute breakout in the link renderer, which interpolated the URL into href="${url}" unescaped: [x](" onmouseover=alert(1) x=") -> <a href="" onmouseover=alert(1" ...> Replaced with escaping. Every `&<>"'` in author text becomes an entity before any markdown rule runs, so the only tags in the output are the ones renderInlineMarkdown builds itself and a URL cannot leave its attribute. Link schemes are now an allowlist (http, https, mailto, tel, relative, anchor); anything else renders as plain text. The serializer needed decodeHtmlEntities to match: without it a save would write `&lt;` into the Markdown file and the next parse would escape the `&` again, corrupting the text further on every round trip. A test covers parse -> serialize -> parse stability. Two existing tests asserted the old behaviour and were rewritten rather than deleted: one expected the script tag to be *removed* from the output, the other expected the substring "onerror" to be absent. Both now assert the property that matters — that no tag can form — because `onerror` surviving as inert text is fine. Exploitation required admin access either way: journal and essay text comes from the studio or from content/*.md. This removes the weakness, it does not close an open door. * fix(journal): contain file paths, fix frontmatter escaping, defuse two regexes Follow-up to the CodeQL findings on release PR #432. I went through all 23 alerts individually; this addresses the ones that are worth addressing and documents the ones that are not. Path containment (12 alerts, all false positives). Every path built from a slug goes through isValidSlug(), a strict `/^[a-zA-Z0-9_-]+$/` allowlist — verified against `../../etc/passwd`, `foo/../../bar`, `a/b`, `..` and friends, all rejected. CodeQL cannot see it because the check lives in another module. Added a containedPath() helper that resolves the path and refuses anything landing outside the content directory: a second lock on a door that was already locked, and a barrier the analysis can follow. Also removed the dead `slug.endsWith('.md')` branches — isValidSlug rejects dots, so they could never be taken. Frontmatter escaping (1 alert, a real bug). The serializer escaped `"` but not `\`, and the parser never unescaped anything. A title containing either character gained a backslash on every save/load cycle: Path C:\Users "quoted" -> Path C:\\Users \"quoted\" -> ... Escaping now covers the backslash first and the parser undoes both. A round trip test covers quotes, backslashes, colons and apostrophes. Two of three ReDoS regexes (2 alerts). The heading pattern had `\s+` next to `(.+)`, which overlap, so the engine tried every split of the whitespace run before failing; it is `[ \t]+` and `(\S.*)` now. The quote author pattern wrapped a lazy group around an optional group — the quadratic case — and is an index split on the first separator now. The third regex, the bold/italic pass, is deliberately left alone. Rewriting it with a negated class removes the backtracking but breaks nesting: `**bold *and italic* here**` renders as `*<em>bold </em>and italic<em> here</em>*`. The input is Markdown from an authenticated admin, never a visitor, so the worst case is an author slowing down their own page. The comment in the code says so. Not addressed: 5 js/insufficient-password-hash alerts. They ask for a slow KDF where the code uses SHA-256/HMAC — correct in general, but the admin password comes from an environment variable and is never stored, so a stronger KDF protects nothing that is not already in plaintext in the environment. 399 unit tests pass (18 new), build and tsc clean. * fix(journal): split the quote author by scanning, not by pattern Cleaning up after myself. #439 replaced the quote author regex `/^(.*?)(?:\s+--\s+(.+))?$/` — a lazy group around an optional one, the quadratic case — with `/\s+--\s+/`, and CodeQL promptly flagged the replacement for the same reason. One reported pattern traded for another. splitQuoteAuthor() scans for the first `--` that has whitespace on both sides. Linear, and it needs no reasoning about the regex engine at all. Behaviour is identical to the original regex, checked case by case against it: separator, no separator, several separators, tabs, wide gaps, `a--b` without spaces, leading and trailing separators, empty string. All nine are covered by tests, plus one asserting it stays fast on a 50k whitespace run. * security(admin): derive the session signing key with scrypt getSigningKey() ran the admin password through a single SHA-256 digest. It is key derivation rather than password storage, so it was never a stored-hash problem — but if the derived key ever leaked, one fast hash makes recovering the password by brute force cheap. CodeQL flags it as js/insufficient-password-hash and, for this particular alert, has a point. scrypt now. Two details that matter: The salt has to be stable. A random salt would produce a different key on every call and invalidate every session; it is derived from AUTH_SECRET, which is deployment-specific. Verified across separate processes: same inputs produce a verifying token, so a restart or redeploy does not log everyone out. The result is cached for the process lifetime. scrypt is deliberately slow and getSigningKey() runs on every admin request — deriving per call would add ~24ms to each one. The cache key is a digest of secret plus password, so a rotation misses the cache and derives again, and no extra plaintext copy of the password is kept around. Measured: first derivation 24ms, subsequent calls 0.12ms. Password change and secret change both invalidate an existing token, checked in separate processes. Note the one-time effect: existing admin sessions are invalidated by the change in derivation, so everyone logs in once more. * security(admin): key the signing-key cache on its inputs, not a digest #441 removed the SHA-256 digest of the admin password from the key derivation and introduced a new one three lines above it, as the cache key. Same rule, same file: CodeQL reported it immediately. The comment justifying it was wrong too. It claimed no second plaintext copy of the password was retained, while building the digest input allocates exactly that in order to hash it. The cache now holds the two input strings and compares them directly. They are the same objects the env and install caches already hold, so nothing extra is retained, and no fast hash of the password exists in memory for the life of the process. Re-verified after the change, in separate processes: a token from one process verifies in another with the same inputs, a changed password or secret rejects it, first derivation 24ms, cached calls 0.001ms. That leaves scrypt as the only place the password is hashed here. The two HMACs further down operate on the derived key and on token data, not on the password; the constant-time comparison in verifyAdminPassword is the previously dismissed one. --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
2026-08-14 16:55:07 +02:00
overscroll-behavior: contain;
🛡️ Sentinel: [HIGH] Fix timingSafeEqual DoS Vulnerability (#423) * Fix timingSafeEqual DoS Vulnerability in Webhook Co-authored-by: ralksta <16941050+ralksta@users.noreply.github.com> * Fix memory exhaustion DoS in token decoding Co-authored-by: ralksta <16941050+ralksta@users.noreply.github.com> --------- Co-authored-by: google-labs-jules[bot] <161369871+google-labs-jules[bot]@users.noreply.github.com>
2026-08-14 11:10:42 +02:00
padding: 0.75rem;
}
.order-editor-notice {
margin: 0 0 0.75rem;
padding: 0.5rem 0.7rem;
border-radius: 6px;
font-size: 0.78rem;
line-height: 1.4;
color: var(--admin-accent);
border: 1px solid rgba(245, 158, 11, 0.3);
background: rgba(245, 158, 11, 0.05);
}
.order-editor-section + .order-editor-section {
margin-top: 1.25rem;
padding-top: 1rem;
border-top: 1px solid var(--admin-border);
}
.order-editor-section-head {
display: flex;
align-items: center;
justify-content: space-between;
gap: 0.75rem;
margin-bottom: 0.5rem;
}
.order-editor-section-head h4 {
margin: 0;
font-size: 0.85rem;
font-weight: 600;
color: var(--admin-text);
}
.order-editor-grid {
display: grid;
grid-template-columns: repeat(auto-fill, minmax(104px, 1fr));
gap: 0.5rem;
margin-top: 0.5rem;
}
.order-tile {
position: relative;
aspect-ratio: 1;
border-radius: 8px;
overflow: hidden;
background: var(--admin-bg-elevated);
border: 2px solid transparent;
cursor: pointer;
transition:
border-color 0.15s,
opacity 0.15s;
}
.order-tile img {
width: 100%;
height: 100%;
object-fit: cover;
/* The whole tile is a drag handle; without this the browser's native image
drag wins and dnd-kit never sees the gesture. */
-webkit-user-drag: none;
user-select: none;
}
.order-tile-pinned {
border-color: var(--admin-accent);
cursor: grab;
}
.order-tile-pinned:active {
cursor: grabbing;
}
.order-tile-unpinned {
opacity: 0.55;
}
.order-tile-unpinned:hover {
opacity: 1;
border-color: var(--admin-border);
}
.order-tile-index {
position: absolute;
bottom: 4px;
left: 4px;
min-width: 18px;
padding: 0 4px;
border-radius: 4px;
font-size: 0.68rem;
font-weight: 700;
text-align: center;
color: #000;
background: var(--admin-accent);
}
.order-tile-action {
position: absolute;
top: 4px;
right: 4px;
width: 20px;
height: 20px;
display: flex;
align-items: center;
justify-content: center;
border: none;
border-radius: 50%;
font-size: 0.85rem;
line-height: 1;
cursor: pointer;
color: var(--admin-text);
background: var(--admin-overlay, rgba(0, 0, 0, 0.6));
}
.order-editor-footer {
display: flex;
justify-content: flex-end;
gap: 0.5rem;
padding: 0.75rem;
border-top: 1px solid var(--admin-border);
}
release: v0.11.0 — journal fixes, admin URLs, design system cleanup (#432) * fix(screenshots): sharp-Typen fuer 0.34 und 0.35 gleichzeitig (#410) sharp 0.35 ist von `export =` auf ESM umgestellt: der Modul-Namespace ist nicht mehr aufrufbar, die Factory sitzt unter .default. Der Type-Check brach damit in scripts/screenshots.ts weg, sobald der Next-Bump (#402) sharp von 0.34.5 auf 0.35.3 mitzieht -- sharp ist hier keine deklarierte Dependency, sondern kommt ueber Next mit. Die Form wird jetzt aus dem installierten Paket abgeleitet statt festgeschrieben, zur Laufzeit wie im Typ. Geprueft mit beiden Versionen: tsc laeuft mit 0.34.5 und mit 0.35.3 fehlerfrei durch. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(deps): bump the nextjs group across 1 directory with 2 updates (#402) Bumps the nextjs group with 2 updates in the / directory: [next](https://github.com/vercel/next.js) and [eslint-config-next](https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next). Updates `next` from 16.2.12 to 16.3.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/compare/v16.2.12...v16.3.0) Updates `eslint-config-next` from 16.2.12 to 16.3.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/commits/v16.3.0/packages/eslint-config-next) --- updated-dependencies: - dependency-name: eslint-config-next dependency-version: 16.3.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: nextjs - dependency-name: next dependency-version: 16.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nextjs ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps-dev): bump prettier from 3.8.3 to 3.9.6 (#405) Bumps [prettier](https://github.com/prettier/prettier) from 3.8.3 to 3.9.6. - [Release notes](https://github.com/prettier/prettier/releases) - [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md) - [Commits](https://github.com/prettier/prettier/compare/3.8.3...3.9.6) --- updated-dependencies: - dependency-name: prettier dependency-version: 3.9.6 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * docs(changelog): Unreleased-Sektion fuer die Bumps nach v0.10.0 (#413) Die Dependency-PRs sind nach dem Release auf dev gelandet, teils auch auf main. Ohne Eintrag waeren sie beim naechsten Release unsichtbar -- inklusive Next 16.3.0, das CVE-2025-13465 mitbringt. Ausserdem im 0.10.0-Abschnitt nachgetragen, dass der Trivy-Scan bis #409 nie gelaufen ist. Der Fix steckt im Tag v0.10.0, fehlte aber in der Aufzaehlung -- und "Images werden bei jedem Publish gescannt" stand im Changelog, waehrend der Job im Action-Setup abbrach. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(gallery): per-album sort order, independent of Immich (#408) (#414) Album order was dictated entirely by Immich: getAlbum() sorted by the album's own asc/desc flag, so a Folio album always mirrored the archive. A curated series has a narrative order that has nothing to do with capture time, and changing the Immich album's sort to fit the website changes it for the archive too. Adds an optional per-album `sort` in gallery.yaml, editable in /admin, defaulting to today's behaviour so every existing config is unchanged: immich (default) | newest | oldest | filename | manual `manual` is a pinned *prefix*: `assetOrder` lists only the photos placed by hand, everything else follows in the album's Immich order. A full permutation of a 2,000-photo album would be ~80 KB of UUIDs in a file that is rewritten and copied to content/.backups/ on every admin save. It also makes drift fall out for free — photos removed in Immich never match, new ones land in the tail rather than being hidden. Sorting is applied after the cache read, not before the cache write, so the LRU keeps one canonical Immich-ordered copy per album. That avoids putting the mode in the cache key, lets a config change take effect without depending on invalidation, and keeps the stale-serving path correct. cache.get() returns the stored object by reference, so withSort() returns a shallow clone with a new array — sorting in place would reorder the shared entry, and under request coalescing every concurrent caller would be sorting the same array. Also fixes a prerequisite bug: /api/admin/albums/[albumId]/assets read album.assets from GET /albums/:id, which Immich 3.x no longer populates (lib/immich.ts:507). The hero picker's "This Album" tab returned nothing and threw outright when the key was absent. It now goes through the client's paginated metadata search, with ?types=all to opt videos in for the reorder editor. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): drop decorative emoji from the sort select labels (#415) An <option> cannot contain markup, so the SVG set in Icons is not reachable there — but a decorative emoji is not a substitute for it. Plain text instead; the album card badge already uses a real icon. The remaining emoji in the admin panel (asset picker tabs, section headings, layout picker options) predate this branch and are left for a separate cleanup. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): replace emoji icons with the shared SVG icon set (#416) The admin panel mixed two icon conventions: inline SVGs from `Icons.tsx` in most components, and decorative emoji in the asset picker and a few PageBuilder labels. Emoji render inconsistently across platforms, ignore the accent colour, and cannot inherit the `.svg-icon` sizing rules. - Icons.tsx: add `IconStar` (filled — it marks a state, not an action) and `IconImage`. - AssetPicker: the three tab labels and the favourite tile badge now use IconFolder / IconStar / IconImage. - PageBuilder: the "Standalone Albums" and "Subpages" headings use the icon set instead of an emoji. - PageBuilder: the layout picker drops its emoji for plain text. An <option> cannot contain markup, so an SVG is impossible there and a decorative glyph is not a substitute. - admin.css: align icon and label in the picker tabs, and swap the favourite badge's text-shadow for drop-shadow, which is what applies to an inline SVG. Co-authored-by: ralksta <ralksta@users.noreply.github.com> * refactor(admin): fold PageBuilder's local icons into the shared Icons module (#418) * refactor(admin): fold PageBuilder's local icons into the shared module PageBuilder.tsx carried its own `Icons` object duplicating most of the glyphs already exported by Icons.tsx, with hardcoded sizes and slightly divergent paths. Migrate all 32 call sites to the shared module and delete the local object. Five glyphs had no counterpart and are added to Icons.tsx as 1:1 ports of the local paths: IconX, IconPlus, IconHome, IconCopy, IconImage. The local ExternalLink and Check are dropped rather than ported — both had zero call sites. Two glyphs change shape slightly, which is the point of consolidating: the shared IconCamera includes the viewfinder bump the local copy omitted, and drag handles now use IconGripVertical. IconGripVertical uses the module's square 24x24 viewBox, so `.svg-drag` goes from 12x18 to 18x18 — the old non-square box would letterbox the glyph down to 12x12 and shrink the handle. * fix(admin): resolve icon-module integration after #416 Merging dev brought in #416, which added a second IconImage to Icons.tsx and two <Icons.Camera>/<Icons.Folder> section headers that reference the local Icons object this PR removes. Git merged both cleanly but the result did not type-check. - drop the duplicate IconImage (both copies were byte-identical) - point the two section headers at the imported IconCamera/IconFolder - refresh the SORT_LABELS comment: the icon set is imported now, not declared below --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> * fix(config): allow an empty gallery, guard against a double /api suffix (#421) An empty gallery is now a valid, rendered state instead of a throw: deriveGallery() no longer requires at least one album or subpage, so a deployment with no albums yet renders a bare homepage the owner can fill in via /admin. getConfig() also stops appending /api to an Immich URL that already ends in it, which previously produced .../api/api and broke every upstream request. Includes a restore of the per-album sort test cases, which the branch had lost by being cut before #408/#414. * feat(admin): favicon upload, served from the content volume (#422) Adds a bundled default favicon, an upload widget in admin Settings > General, and a route that serves the icon from the writable content/ volume with a fallback to the bundled default. Raster uploads (PNG/ICO/JPEG) are wrapped in an SVG container; the response carries its own CSP so an uploaded SVG cannot execute script on the origin. The GET route revalidates with an ETag instead of caching immutably, so a newly uploaded icon shows up immediately. Uploads are written via temp file + rename, and a Reset button restores the bundled default. * ci: flag unformatted files in a PR, without blocking it (#424) Prettier is configured as an error rule in eslint.config.mjs but has never run in CI, so part of the tree predates it. A final CI step now diffs against the PR base, runs prettier --list-different over the changed files, and emits a warning annotation per offender plus a job summary. Advisory by design: it never fails the job. Blocking would turn a PR red for merely touching a file that was already unformatted, and normalising the tree in one commit would wreck git blame and conflict with the PRs in flight. Requires fetch-depth: 0, since diffing against the base needs its history. * feat(install): first-run wizard gated by a one-time setup token (#419) Adds /install, a four-step first-run wizard: connect to Immich, optionally pick albums, name the site, finish. It verifies the credentials against the Immich server before writing anything, then writes gallery.yaml, settings.yaml and a content/install.json carrying the Immich credentials and a generated site secret. install.json exists because a running process cannot pick up new env vars — the wizard has to write configuration that takes effect without a restart. getInstallCredentials() merges it under the real environment, so env vars always win and rotation stays a matter of setting one. Both the page and the API routes are gated by a one-time setup token printed to the server log, so a deployment that is reachable before gallery.yaml exists cannot be configured by whoever finds it first. The token is stored in content/.setup-token (0600) rather than a module variable: Next.js bundles the page and each route handler separately, so a module-level token left the page and the API disagreeing inside one process and the wizard stuck on step 1. It is removed once the install completes. The admin password is stored as an scrypt hash using the scheme lib/auth.ts already applies to album passwords; a plaintext ADMIN_PASSWORD env var keeps working. * docs: document the setup wizard, fix the read-only content mount (#425) Quick Start now leads with the /install wizard, with the hand-written YAML route kept alongside it, and a First-Run Setup section covers the setup token, the files the wizard writes, and env-var precedence. Two corrections: both Docker examples mounted content/ as :ro, which silently breaks the wizard, the admin panel and the backup rotation alike — docs/admin-panel.md already said so and the README contradicted it. And nothing documented that content/install.json holds the Immich API key, so a backup of content/ is a backup of credentials. Also adds a Contributors section crediting the people whose work is in the project. * feat(admin): floating save bar pinned to the bottom of the viewport (#426) The save bar was the first, static element inside .admin-main. Since the document itself scrolls, it left the viewport as soon as you scrolled down — editing a subpage section or a settings block far below gave no visible dirty hint and no reachable save button. Replace it with a bottom-pinned floating bar shared by both editors. It only mounts while there is something to act on (unsaved changes, an in-flight save, or a result message), so it never covers content while idle. The success message clears after 5s, which hides the bar again. - new SaveBar component, replacing the duplicated markup in PageBuilder and SettingsEditor - adopt the previously unused .floating-save-bar CSS: slide-in keyframes (carrying translateX(-50%)), dirty border, wrap/gap, mobile variant and a prefers-reduced-motion opt-out; z-index 900 keeps it below modals - .admin-main gains bottom padding so the bar never covers page content - drop the now-unreachable idle hints: the ⌘S hint becomes a button title, the Live Sync note becomes a static line above the settings layout - header "Site" link now bypasses the cache (/?fresh=1), so the preview stays reachable when the bar is hidden Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(admin): themed listbox for the album sort control (#427) The per-album "Photo order" control was a native <select>. Because an <option> cannot contain markup, its choices could not use the admin panel's currentColor SVG set — the reason #415 had to fall back to plain text after dropping the emoji labels. Adds a Listbox component implementing the ARIA combobox/listbox pattern, so options can render a glyph beside their label: - DOM focus stays on the trigger button; the active option is announced through aria-activedescendant, keeping focus management to one element - Keyboard: arrows (clamped at the ends, like a native select), Home/End, Enter/Space to commit, Escape to cancel, Tab commits and moves on, and prefix type-ahead with a repeat-key cycle - Outside dismissal on pointerdown, so a press starting outside closes the popup before the click retargets The sort options now carry an icon each: calendar, arrow-down, arrow-up, an A→Z marker, and the drag glyph for manual — matching the badge the album card already shows. SORT_LABELS stays plain text because the badge feeds it to a title attribute. Closes #417 Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(git): ignore generated design handoff folders * fix(admin): stop the album sort dropdown clipping, and simplify the panel (#428) * fix(admin): render listbox popup in a portal so it escapes modal clipping The sort control's popup was position:absolute inside three clipping ancestors (.album-drawer overflow:hidden > .album-drawer-body overflow-y:auto > .modal-right-column overflow-y:auto), so it was cut off at the bottom of the Edit Album Details modal. z-index could not help: clipping happens before stacking. It also always hung below the trigger, with no flip. Portal the popup to document.body and position it from the trigger's viewport rect, flipping above when there is more room there and capping max-height to the space available so it scrolls internally rather than overflowing. It is dismissed on scroll and resize, since the anchor is only measured on open. The outside-pointerdown handler now also treats the popup as inside; without that the portalled list counts as outside, and a click on an option would close it before the selection commits. * refactor(admin): single-column album details panel The left column spent 1.2fr on a cover thumbnail and three stat rows, two of which (Status, Custom Hero) only restated the form fields opposite them, while the form itself was squeezed into 1.8fr behind a second nested scroller. Stack the drawer in one column instead: cover as a banner, then the form at full width, with the UUID moved into the footer. The body is now the only scroll container, which also removes one of the ancestors that was clipping the sort popup. --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> * fix(admin): give the portalled listbox its theme back, lock the page behind modals (#429) Two defects in the album editor. The sort listbox popup painted transparent. Every --admin-* variable is scoped to .admin-layout, and since the popup moved into document.body it sits outside that subtree, so background/border/text all resolved to nothing. It now carries its own copy of the palette in both colour schemes, plus the font it no longer inherits. Scrolling inside a modal also moved the page behind it. No admin modal ever locked body scroll: the overlay covers the page but does not absorb wheel events, so a scroll starting on the backdrop — or continuing past the end of the modal's own scroller — reaches the document. overscroll-behavior cannot cover that case on its own, because it only applies to scroll containers and the backdrop is not one. useScrollLock freezes body while a modal is open and compensates for the width the scrollbar gives up, so nothing shifts underneath. Each lock restores the inline value it found, which makes nesting work without a counter — a picker opened from the drawer restores the drawer's hidden state instead of clearing it. Applied to both drawers and all four picker modals, which share the defect. overscroll-behavior: contain on the scrollers stops the chaining they can handle themselves. Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com> * fix(security): allow unsafe-eval in CSP script-src during dev mode * feat(journal): add Journal Studio with split-screen editor, live preview and dedicated routes * fix(build): separate client parser from server journal-service and fix build type errors * fix(journal): Fotos rendern, Layout und Lightbox-Steuerung korrigieren Fünf unabhängige Fehler in der öffentlichen Journal- und Essay-Ansicht: * Foto-Blöcke wurden nie angezeigt. EssayView löst ein Foto über PhotoItem.id auf, und das sind verschlüsselte Tokens — die Blöcke aus dem Markdown tragen aber rohe Asset-UUIDs. Jede Zuordnung lief ins Leere, und nicht auflösbare Blöcke werden still verworfen. Die IDs werden jetzt serverseitig übersetzt; damit verschwinden nebenbei die rohen UUIDs aus dem Client-Payload, die dort laut Projektregel nie auftauchen dürfen. Nicht auflösbare Referenzen werden geloggt. * Überschriften standen weiter links als der Fließtext. Jeder Block hatte einzeln `max-width: 68ch`, und `ch` ist relativ zur Schrift des Elements — die Serif-Überschrift ergab eine breitere Spalte. Ersetzt durch eine gemeinsame, font-unabhängige `--essay-measure`. * Fullbleed-Fotos bluteten nur nach links aus: `.essay-figure` ist `width: 100%`, wodurch die Box überbestimmt ist und der negative rechte Margin verworfen wird. * Foto-Paare stellten beide Bilder gleich breit dar, wodurch ein Hochformat neben einem Querformat doppelt so hoch wurde. Jetzt eine Justified-Reihe: Breite proportional zum Seitenverhältnis, dadurch exakt gleiche Höhen ohne Beschnitt. * Die Lightbox hatte im Journal keine Tastatursteuerung und keine Scroll-Sperre — beides lag in PhotoGrid, also nur im Album-Raster. Verlagert in die Lightbox selbst, der doppelte Handler in PhotoGrid entfernt (sonst wäre pro Pfeildruck zwei Bilder weitergesprungen). Zusätzlich sind Proofing-Herzen und das EXIF-Panel im redaktionellen Modus abschaltbar und im Journal aus: Client-Proofing ist ein Übergabe-Workflow für Alben, keine Funktion einer Reportage. Auf der Übersicht wurde der Untertitel doppelt gerendert, weil extractExcerpt() auf ihn zurückfällt. * feat(admin): eigene URLs für alle Bereiche und überarbeiteter Journal Studio Das Panel war eine einzige Client-Komponente, die ihre Tabs über useState umschaltet: keine Route pro Bereich, kein Deep-Link, kein Zurück-Button, und nach jedem Reload landete man wieder auf "Pages". Auch der Journal-Editor hatte keine eigene URL. Jetzt sieben echte Routen (/admin, /admin/pages, /admin/journal, /admin/journal/<slug>, /admin/settings, /admin/settings/<section>, /admin/analytics). Die Shell mit Auth-Prüfung und Kopfzeile sitzt im Layout und umschließt children — so bleibt die Session-Prüfung über Routenwechsel montiert, statt bei jedem Tab-Wechsel neu zu laufen und den Spinner aufblitzen zu lassen. Unbekannte Settings-Sections fallen auf General zurück. Im selben Zug der Journal Studio, der die Routing-Änderung ohnehin berührt: * Alle Eingabefelder nutzten die Klasse `admin-input`, die in keinem CSS definiert war — sie fielen auf Browser-Defaults zurück. Jetzt gestylt, gescoped, damit der generische Name nicht ins übrige Panel leckt. * Der Split View ist per Divider verschiebbar (Maus, Tastatur, Doppelklick zum Zurücksetzen), Breite in localStorage. * Das Studio bricht aus der 1120px-Spalte aus, die Preview hat Platz. * Die Preview zeigte für jedes Foto fest 3:2 und log damit über das Layout der veröffentlichten Seite; die echten Verhältnisse werden jetzt an den Thumbnails gemessen. * Blöcke mit alten positionsbasierten Foto-Referenzen werden markiert — die lassen sich auf einer eigenständigen Journal-Seite nicht auflösen und verschwanden bisher stillschweigend. * Blocktyp-Chips als gemeinsame Komponente, monochrom und per Icon unterschieden statt in einer eigenen Blau/Lila/Orange-Palette, die sonst nirgends im Panel vorkommt. * Emojis raus, SVG-Icons rein. * fix(admin): Designsystem-Lücken im Panel schließen Eine systematische Suche nach Klassen, die im TSX benutzt, aber in keinem CSS definiert sind, hat vier Stellen mit demselben Muster gefunden: * `admin-btn-secondary` und `admin-btn-danger` existierten nicht. Sämtliche Löschen-Buttons sahen aus wie normale Buttons — keine Warnwirkung. Als `.admin-btn.admin-btn-danger` geschrieben, weil die Varianten mit den Größenklassen kombiniert werden, die weiter unten ihren eigenen Hintergrund setzen. * `page-progress-fill` fehlte: die Balken im Analytics-Panel waren leere Rinnen, der Wert unsichtbar. Ebenso `analytics-empty` und `admin-loading-container`. * `subpage-drawer-section`, `subpage-drawer-title-group` und `input-with-icon` im PageBuilder waren wirkungslos und teils mit Inline-Styles notdürftig kompensiert. * `grid-card-preview` fehlte, wodurch alle Layout-Vorschauen auf Höhe null kollabierten. Nur "Showcase" war sichtbar — und das aus Versehen, weil sein Tile `hero-tile` hieß und damit die `aspect-ratio` einer fremden PageBuilder-Klasse erbte. Umbenannt. Dazu die Theme-Vorschauen, die praktisch identisch aussahen: alle sieben zeigten dieselben drei quadratischen Kacheln, einziger Unterschied war die Hintergrundfarbe. Sie spiegeln jetzt die echten Preset-Daten aus lib/config/theme.ts — Schriftcharakter, Eckradius, Rasterdichte, Passepartout bzw. Schatten. Die Kopfzeile richtet sich an einer gemeinsamen Steuerhöhe aus. Der "Site"-Link war höher als die Buttons daneben: `.admin-btn` hatte keine explizite line-height, und <button> bekommt box-sizing: border-box vom Browser, <a> nicht. Die Statusanzeige setzte weder Schriftfamilie noch -größe und fiel auf den Browser-Default zurück — sie war nie Teil des Designsystems. Jetzt gleiche Höhe und Typografie, Pillenform als Zustandsanzeige, Trenner zur Aktionsgruppe. Das dauerhafte Pulsieren des grünen Punkts entfällt; Animation bleibt den Zuständen vorbehalten, die Aufmerksamkeit brauchen. Restliche Emojis durch SVG-Icons ersetzt. * feat(admin): add scroll-to-top toggle and SVG arrow The back-to-top button was always on and drew its arrow with the ↑ text character. Add a `scrollToTop` setting (General section in the admin panel, defaults to on so existing sites are unaffected) and replace the glyph with a stroked SVG that inherits currentColor across all presets. Scroll handling is now rAF-throttled, and prefers-reduced-motion turns off both the hover lift and the smooth scroll. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * security(journal): escape author HTML instead of filtering it CodeQL flags 26 high-severity alerts on the release PR; the bulk of them point at sanitizeHtml(), a denylist of three regexes whose output goes into dangerouslySetInnerHTML. I reproduced the bypasses before changing anything — all four pass the old filter: <img src=x onerror=alert(1)> unquoted handler, regex wants quotes <img src=x onerror='alert(1)'> single quotes, same reason <svg onload=alert(1)> not a <script> tag javasjavascript:cript:alert(1) one-pass replace, the rest recombines Plus an attribute breakout in the link renderer, which interpolated the URL into href="${url}" unescaped: [x](" onmouseover=alert(1) x=") -> <a href="" onmouseover=alert(1" ...> Replaced with escaping. Every `&<>"'` in author text becomes an entity before any markdown rule runs, so the only tags in the output are the ones renderInlineMarkdown builds itself and a URL cannot leave its attribute. Link schemes are now an allowlist (http, https, mailto, tel, relative, anchor); anything else renders as plain text. The serializer needed decodeHtmlEntities to match: without it a save would write `&lt;` into the Markdown file and the next parse would escape the `&` again, corrupting the text further on every round trip. A test covers parse -> serialize -> parse stability. Two existing tests asserted the old behaviour and were rewritten rather than deleted: one expected the script tag to be *removed* from the output, the other expected the substring "onerror" to be absent. Both now assert the property that matters — that no tag can form — because `onerror` surviving as inert text is fine. Exploitation required admin access either way: journal and essay text comes from the studio or from content/*.md. This removes the weakness, it does not close an open door. * fix(journal): contain file paths, fix frontmatter escaping, defuse two regexes Follow-up to the CodeQL findings on release PR #432. I went through all 23 alerts individually; this addresses the ones that are worth addressing and documents the ones that are not. Path containment (12 alerts, all false positives). Every path built from a slug goes through isValidSlug(), a strict `/^[a-zA-Z0-9_-]+$/` allowlist — verified against `../../etc/passwd`, `foo/../../bar`, `a/b`, `..` and friends, all rejected. CodeQL cannot see it because the check lives in another module. Added a containedPath() helper that resolves the path and refuses anything landing outside the content directory: a second lock on a door that was already locked, and a barrier the analysis can follow. Also removed the dead `slug.endsWith('.md')` branches — isValidSlug rejects dots, so they could never be taken. Frontmatter escaping (1 alert, a real bug). The serializer escaped `"` but not `\`, and the parser never unescaped anything. A title containing either character gained a backslash on every save/load cycle: Path C:\Users "quoted" -> Path C:\\Users \"quoted\" -> ... Escaping now covers the backslash first and the parser undoes both. A round trip test covers quotes, backslashes, colons and apostrophes. Two of three ReDoS regexes (2 alerts). The heading pattern had `\s+` next to `(.+)`, which overlap, so the engine tried every split of the whitespace run before failing; it is `[ \t]+` and `(\S.*)` now. The quote author pattern wrapped a lazy group around an optional group — the quadratic case — and is an index split on the first separator now. The third regex, the bold/italic pass, is deliberately left alone. Rewriting it with a negated class removes the backtracking but breaks nesting: `**bold *and italic* here**` renders as `*<em>bold </em>and italic<em> here</em>*`. The input is Markdown from an authenticated admin, never a visitor, so the worst case is an author slowing down their own page. The comment in the code says so. Not addressed: 5 js/insufficient-password-hash alerts. They ask for a slow KDF where the code uses SHA-256/HMAC — correct in general, but the admin password comes from an environment variable and is never stored, so a stronger KDF protects nothing that is not already in plaintext in the environment. 399 unit tests pass (18 new), build and tsc clean. * fix(journal): split the quote author by scanning, not by pattern Cleaning up after myself. #439 replaced the quote author regex `/^(.*?)(?:\s+--\s+(.+))?$/` — a lazy group around an optional one, the quadratic case — with `/\s+--\s+/`, and CodeQL promptly flagged the replacement for the same reason. One reported pattern traded for another. splitQuoteAuthor() scans for the first `--` that has whitespace on both sides. Linear, and it needs no reasoning about the regex engine at all. Behaviour is identical to the original regex, checked case by case against it: separator, no separator, several separators, tabs, wide gaps, `a--b` without spaces, leading and trailing separators, empty string. All nine are covered by tests, plus one asserting it stays fast on a 50k whitespace run. * security(admin): derive the session signing key with scrypt getSigningKey() ran the admin password through a single SHA-256 digest. It is key derivation rather than password storage, so it was never a stored-hash problem — but if the derived key ever leaked, one fast hash makes recovering the password by brute force cheap. CodeQL flags it as js/insufficient-password-hash and, for this particular alert, has a point. scrypt now. Two details that matter: The salt has to be stable. A random salt would produce a different key on every call and invalidate every session; it is derived from AUTH_SECRET, which is deployment-specific. Verified across separate processes: same inputs produce a verifying token, so a restart or redeploy does not log everyone out. The result is cached for the process lifetime. scrypt is deliberately slow and getSigningKey() runs on every admin request — deriving per call would add ~24ms to each one. The cache key is a digest of secret plus password, so a rotation misses the cache and derives again, and no extra plaintext copy of the password is kept around. Measured: first derivation 24ms, subsequent calls 0.12ms. Password change and secret change both invalidate an existing token, checked in separate processes. Note the one-time effect: existing admin sessions are invalidated by the change in derivation, so everyone logs in once more. * security(admin): key the signing-key cache on its inputs, not a digest #441 removed the SHA-256 digest of the admin password from the key derivation and introduced a new one three lines above it, as the cache key. Same rule, same file: CodeQL reported it immediately. The comment justifying it was wrong too. It claimed no second plaintext copy of the password was retained, while building the digest input allocates exactly that in order to hash it. The cache now holds the two input strings and compares them directly. They are the same objects the env and install caches already hold, so nothing extra is retained, and no fast hash of the password exists in memory for the life of the process. Re-verified after the change, in separate processes: a token from one process verifies in another with the same inputs, a changed password or secret rejects it, first derivation 24ms, cached calls 0.001ms. That leaves scrypt as the only place the password is hashed here. The two HMACs further down operate on the derived key and on token data, not on the password; the constant-time comparison in verifyAdminPassword is the previously dismissed one. --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
2026-08-14 16:55:07 +02:00
/* ── Favicon upload (Settings › General) ─────────────────────── */
.favicon-field {
margin-top: 1rem;
}
.favicon-row {
display: flex;
align-items: center;
gap: 0.5rem;
}
.favicon-row input[type='file'] {
font-size: 0.8rem;
}
Reference in New Issue Copy Permalink