release: v0.20.0

app/api/image/[id]/route.ts

@@ -33,6 +33,9 @@ const STRIP_VERSION = 's1';
  */
 const MAX_STRIP_BYTES = 64 * 1024 * 1024;
 
+/** The shape of lib/urls.ts editMarker(): a base-36 timestamp. */
+const EDIT_MARKER = /^[0-9a-z]{1,16}$/;
+
 export async function GET(request: NextRequest, { params }: { params: Promise<{ id: string }> }) {
   // ── Rate limiting ──────────────────────────────────
   const ip = getClientIp(request);
@@ -86,6 +89,18 @@ export async function GET(request: NextRequest, { params }: { params: Promise<{
     request.nextUrl.searchParams.get('w'),
   );
 
+  // Photos edited in Immich (#831) are always served as edited: the server
+  // asks for `edited=true` on every request, whatever the URL says, so a URL
+  // stripped of its marker cannot bring back what a crop removed. For a photo
+  // that is not edited Immich returns the same bytes (measured on 3.2), and
+  // the parameter exists in every supported Immich (since 2.5; Folio needs
+  // 3.0). The marker `e` that lib/urls.ts writes for edited photos is only a
+  // cache key: it gives the edited rendition a URL (and ETag) of its own, so
+  // an `immutable` copy of the unedited one is never reused. A value outside
+  // the marker's shape is ignored, so it cannot carry anything into the ETag.
+  const editParam = request.nextUrl.searchParams.get('e');
+  const edit = editParam && EDIT_MARKER.test(editParam) ? editParam : null;
+
   // ── Browser Cache Optimization ─────────────────────
   // Use the opaque token to generate a safe ETag without leaking Immich UUIDs.
   // IMAGE_CACHE_VERSION participates so that a bump is not defeated by a client
@@ -93,7 +108,7 @@ export async function GET(request: NextRequest, { params }: { params: Promise<{
   // `immutable`, so this only matters after expiry or a cache eviction, but a
   // matching ETag across two different URLs would be wrong either way.
   const cacheVersion = request.nextUrl.searchParams.get('v') ?? '';
-  const etag = `W/"${token}-${size}-${STRIP_VERSION}${cacheVersion ? `-${cacheVersion}` : ''}"`;
+  const etag = `W/"${token}-${size}-${STRIP_VERSION}${edit ? `-e${edit}` : ''}${cacheVersion ? `-${cacheVersion}` : ''}"`;
   if (request.headers.get('if-none-match') === etag) {
     return new NextResponse(null, {
       status: 304,
@@ -107,7 +122,7 @@ export async function GET(request: NextRequest, { params }: { params: Promise<{
 
   let result;
   try {
-    result = await immich.streamAsset(assetId, size);
+    result = await immich.streamAsset(assetId, size, true);
   } catch (error) {
     // An outage must not look like a deleted photo. These URLs are served with
     // `immutable` on success, and a bare 404 is heuristically cacheable — so
@@ -177,7 +192,7 @@ export async function GET(request: NextRequest, { params }: { params: Promise<{
       console.warn(
         `[Image API] Original von ${assetId} (${contentType}) nicht strippbar — liefere Preview.`,
       );
-      const preview = await immich.streamAsset(assetId, 'preview');
+      const preview = await immich.streamAsset(assetId, 'preview', true);
       if (!preview) {
         return NextResponse.json(
           { error: 'Asset not found' },

app/api/image/__tests__/image-route.test.ts

@@ -4,9 +4,12 @@ import { GET } from '../[id]/route';
 import { encodeAssetId } from '@/lib/tokens';
 import { immich, ImmichUnavailableError } from '@/lib/immich';
 
-const published = vi.hoisted(() => ({ value: true }));
+const published = vi.hoisted(() => ({ value: true, asked: [] as string[] }));
 vi.mock('@/lib/publishedAssets', () => ({
-  isPublishedAsset: async () => published.value,
+  isPublishedAsset: async (id: string) => {
+    published.asked.push(id);
+    return published.value;
+  },
 }));
 vi.mock('@/lib/admin/auth', () => ({
   isAdminAuthenticated: async () => false,
@@ -77,7 +80,72 @@ describe('GET /api/image/[id]', () => {
     mockStream.mockResolvedValue(fakeBody('image/jpeg'));
     const res = await call(encodeAssetId(ASSET_ID));
     expect(res.status).toBe(200);
-    expect(mockStream).toHaveBeenCalledWith(ASSET_ID, 'preview');
+    expect(mockStream).toHaveBeenCalledWith(ASSET_ID, 'preview', true);
+  });
+
+  describe('photos edited in Immich (#831)', () => {
+    beforeEach(() => {
+      published.asked = [];
+    });
+
+    it('asks Immich for the edit when the URL carries the edit marker', async () => {
+      mockStream.mockResolvedValue(fakeBody('image/jpeg'));
+      const res = await call(encodeAssetId(ASSET_ID), '?size=preview&e=mf3k2abc');
+      expect(res.status).toBe(200);
+      expect(mockStream).toHaveBeenCalledWith(ASSET_ID, 'preview', true);
+    });
+
+    it('asks for the edited thumbnail too', async () => {
+      mockStream.mockResolvedValue(fakeBody('image/webp'));
+      await call(encodeAssetId(ASSET_ID), '?size=thumbnail&e=mf3k2abc');
+      expect(mockStream).toHaveBeenCalledWith(ASSET_ID, 'thumbnail', true);
+    });
+
+    it('shows the edit to a URL stripped of its marker: the server decides, not the URL', async () => {
+      // Review of #832: with the marker as the switch, dropping `&e=` from a
+      // URL brought back what the photographer had cropped out.
+      mockStream.mockResolvedValue(fakeBody('image/jpeg'));
+      await call(encodeAssetId(ASSET_ID), '?size=preview&w=1440');
+      expect(mockStream).toHaveBeenCalledWith(ASSET_ID, 'preview', true);
+      mockStream.mockResolvedValue(fakeBody('image/webp'));
+      await call(encodeAssetId(ASSET_ID), '?size=thumbnail');
+      expect(mockStream).toHaveBeenCalledWith(ASSET_ID, 'thumbnail', true);
+      expect(mockStream).not.toHaveBeenCalledWith(ASSET_ID, expect.anything(), false);
+    });
+
+    it('is still gated by the published-asset check, which goes by the asset alone', async () => {
+      mockStream.mockResolvedValue(fakeBody('image/jpeg'));
+      const res = await call(encodeAssetId(ASSET_ID), '?size=preview&e=mf3k2abc&w=1440');
+      expect(res.status).toBe(200);
+      expect(published.asked).toEqual([ASSET_ID]);
+
+      published.value = false;
+      try {
+        const refused = await call(encodeAssetId(ASSET_ID), '?size=preview&e=mf3k2abc');
+        expect(refused.status).toBe(404);
+      } finally {
+        published.value = true;
+      }
+    });
+
+    it('gives the edited rendition its own ETag', async () => {
+      mockStream.mockResolvedValue(fakeBody('image/jpeg'));
+      const token = encodeAssetId(ASSET_ID);
+      const plain = (await call(token, '?size=preview')).headers.get('ETag');
+      mockStream.mockResolvedValue(fakeBody('image/jpeg'));
+      const edited = (await call(token, '?size=preview&e=mf3k2abc')).headers.get('ETag');
+      mockStream.mockResolvedValue(fakeBody('image/jpeg'));
+      const reEdited = (await call(token, '?size=preview&e=mf9zz001')).headers.get('ETag');
+      expect(new Set([plain, edited, reEdited]).size).toBe(3);
+    });
+
+    it('ignores a marker that is not one, and keeps it out of the ETag', async () => {
+      mockStream.mockResolvedValue(fakeBody('image/jpeg'));
+      const token = encodeAssetId(ASSET_ID);
+      const res = await call(token, `?size=preview&e=${encodeURIComponent('"x", W/"y')}`);
+      expect(mockStream).toHaveBeenCalledWith(ASSET_ID, 'preview', true);
+      expect(res.headers.get('ETag')).not.toContain('y');
+    });
   });
 
   // Regression guard for the stored-XSS fix in c2fa8e7. An SVG served as