security: fix pre-auth bypasses and restore Immich 3.x compatibility (#378)

Seven security issues from an audit, plus album pages and the map coming
up empty against Immich 3.x. Verified against a real Immich 3.0.3
instance in a production build.

Security:
- Admin session forgery via a hardcoded 'dev-fallback-secret' signing key
  that bypassed the production AUTH_SECRET guard
- /api/map ignored album passwords and returned working asset tokens;
  rewriting ?size=thumbnail to ?size=original downloaded full-resolution
  originals from protected albums
- Admin login had no rate limit, and the client IP came from a spoofable
  header, so rotating it bypassed every limit in the app
- Raw Immich asset UUIDs were serialized into the RSC payload
- Album tokens never expired server-side; a captured token replayed forever
- Path traversal into the Immich API via an unvalidated album id
- /admin ran with no enforced CSP (only Report-Only reached it)

TRUSTED_PROXIES is replaced by TRUSTED_PROXY_HOPS. The old variable
matched proxy IPs against the socket peer address, which self-hosted
Next.js never exposes, so the check could never pass: unset, the limiter
read a spoofable header; set, every request shared one bucket and a single
client could rate-limit the whole site. Migrates automatically.

Immich 3.x: GET /albums/:id no longer embeds assets. Assets now come from
POST /search/metadata with withExif: true — without that flag EXIF is
omitted and grid aspect ratios, the lightbox panel and map markers stay
empty. Drops support for Immich below 3.0, which now logs a warning.

Upgrade: requires Immich 3.0+; set TRUSTED_PROXY_HOPS (nginx = 1);
visitors of protected areas and admin sessions must log in once more.

91 unit tests (25 new); the new admin-auth and rate-limit cases were
confirmed to fail against the pre-fix code.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

lib/__tests__/immich.test.ts

@@ -1,6 +1,7 @@
 import { describe, it, expect, vi, beforeEach } from 'vitest';
 import { immich } from '../immich';
 import * as config from '../config';
+import { cache } from '../cache';
 
 // Mock the config by wrapping it in a factory
 vi.mock('../config', async () => {
@@ -28,6 +29,9 @@ describe('ImmichClient', () => {
 
   beforeEach(() => {
     vi.clearAllMocks();
+    // getAlbum() memoises into the module-level LRU; without this, later tests
+    // read a previous test's album and never reach the mocked fetch.
+    cache.clear();
   });
 
   describe('request()', () => {
@@ -80,23 +84,105 @@ describe('ImmichClient', () => {
       expect(album).toBeNull();
     });
 
-    it('returns album data and filters trashed assets', async () => {
-      mockFetch.mockResolvedValueOnce({
+    /**
+     * Immich 3.x returns an empty `assets` array from GET /albums/:id, so
+     * assets come from a separate POST /search/metadata call. Route the mock by
+     * URL rather than by call order — the two run concurrently.
+     */
+    function mockAlbumApi(options: {
+      order?: 'asc' | 'desc';
+      pages?: Array<{ items: unknown[]; nextPage: string | null }>;
+    }) {
+      const pages = options.pages ?? [];
+      const json = (body: unknown) => ({
         ok: true,
         headers: { get: () => 'application/json' },
-        json: async () => ({
+        json: async () => body,
+      });
+
+      mockFetch.mockImplementation(async (url: string, init?: { body?: string }) => {
+        if (url.includes('/search/metadata')) {
+          const page = JSON.parse(init?.body ?? '{}').page ?? 1;
+          const p = pages[page - 1] ?? { items: [], nextPage: null };
+          return json({ assets: { items: p.items, nextPage: p.nextPage, total: p.items.length } });
+        }
+        // Mirrors the real 3.x response: assetCount set, assets empty.
+        return json({
           id: 'album-1',
           albumName: 'Name',
-          assets: [
-            { id: 'asset-1', isTrashed: false },
-            { id: 'asset-2', isTrashed: true },
-          ],
-        }),
+          assetCount: 2,
+          assets: [],
+          order: options.order ?? 'desc',
+        });
+      });
+    }
+
+    const asset = (id: string, date: string, isTrashed = false) => ({
+      id,
+      isTrashed,
+      fileCreatedAt: date,
+    });
+
+    it('loads assets via metadata search and filters trashed ones', async () => {
+      mockAlbumApi({
+        pages: [
+          {
+            items: [
+              asset('asset-1', '2024-01-02T00:00:00Z'),
+              asset('asset-2', '2024-01-03T00:00:00Z', true),
+            ],
+            nextPage: null,
+          },
+        ],
       });
 
       const album = await immich.getAlbum('album-1');
       expect(album?.assets).toHaveLength(1);
       expect(album?.assets[0].id).toBe('asset-1');
     });
+
+    it('requests EXIF data — without it the grid, lightbox and map go blank', async () => {
+      mockAlbumApi({ pages: [{ items: [], nextPage: null }] });
+      await immich.getAlbum('album-1');
+
+      const search = mockFetch.mock.calls.find((c: unknown[]) =>
+        String(c[0]).includes('/search/metadata'),
+      );
+      expect(search).toBeDefined();
+      const body = JSON.parse((search[1] as { body: string }).body);
+      expect(body.withExif).toBe(true);
+      expect(body.albumIds).toEqual(['album-1']);
+      expect(search[1].method).toBe('POST');
+    });
+
+    it('follows pagination until nextPage is null', async () => {
+      mockAlbumApi({
+        pages: [
+          { items: [asset('a', '2024-01-01T00:00:00Z')], nextPage: '2' },
+          { items: [asset('b', '2024-01-02T00:00:00Z')], nextPage: '3' },
+          { items: [asset('c', '2024-01-03T00:00:00Z')], nextPage: null },
+        ],
+      });
+
+      const album = await immich.getAlbum('album-1');
+      expect(album?.assets.map((a) => a.id)).toEqual(['c', 'b', 'a']); // desc by fileCreatedAt
+    });
+
+    it('honours the album sort order', async () => {
+      const items = [
+        asset('old', '2024-01-01T00:00:00Z'),
+        asset('new', '2024-06-01T00:00:00Z'),
+        asset('mid', '2024-03-01T00:00:00Z'),
+      ];
+
+      mockAlbumApi({ order: 'asc', pages: [{ items, nextPage: null }] });
+      let album = await immich.getAlbum('album-1');
+      expect(album?.assets.map((a) => a.id)).toEqual(['old', 'mid', 'new']);
+
+      cache.clear(); // same album id — otherwise the asc result is reused
+      mockAlbumApi({ order: 'desc', pages: [{ items, nextPage: null }] });
+      album = await immich.getAlbum('album-1');
+      expect(album?.assets.map((a) => a.id)).toEqual(['new', 'mid', 'old']);
+    });
   });
 });