release: v0.13.0 (#535)

Twenty-nine commits since v0.12.0. See CHANGELOG.md for the full list
and the upgrade notes.

Ten additions — the SEO package (site URL, robots.txt, sitemap.xml,
JSON-LD), slideshow mode, opt-in original downloads, copy-link,
previous/next album navigation, alt text from the Immich description,
per-album location precision, the update notice, a Help tab, and a
subpage cover grid separate from its photo grid. Two fixes: CJK album
slugs, and the lightbox control bar.

Photo of the Day (#476) was built on `dev` and reverted as not planned;
it never appears in a release.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

https://claude.ai/code/session_01DmsHVRL9yQvckUB1ZpVWre

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>

app/api/admin/settings/route.ts

@@ -2,7 +2,7 @@ import { NextResponse } from 'next/server';
 import { revalidatePath } from 'next/cache';
 import { isAdminAuthenticated, isAdminEnabled } from '@/lib/admin/auth';
 import { readSettingsYaml, writeSettingsYaml } from '@/lib/admin/yaml-service';
-import { invalidateConfigCache } from '@/lib/config';
+import { invalidateConfigCache, getConfigOrNull } from '@/lib/config';
 import { immich } from '@/lib/immich';
 import type { SettingsYaml } from '@/lib/config/schema';
 
@@ -16,7 +16,16 @@ export async function GET() {
   }
 
   const settings = await readSettingsYaml();
-  return NextResponse.json({ settings: settings || {} });
+  const config = getConfigOrNull();
+  return NextResponse.json({
+    settings: settings || {},
+    // The resolved value and its origin, so the panel can say when what it
+    // shows came from SITE_URL rather than from the field itself (#472).
+    siteUrl: {
+      effective: config?.siteUrl ?? null,
+      source: config?.siteUrlSource ?? 'none',
+    },
+  });
 }
 
 /** PUT: Write settings.yaml config. */

app/api/admin/status/route.ts

@@ -4,6 +4,7 @@ import { immich } from '@/lib/immich';
 import { getConfig } from '@/lib/config';
 import { cache } from '@/lib/cache';
 import { listBackups, readGalleryYaml, readSettingsYaml } from '@/lib/admin/yaml-service';
+import { getUpdateStatus } from '@/lib/updateCheck';
 
 export async function GET() {
   if (!isAdminEnabled()) {
@@ -68,6 +69,10 @@ export async function GET() {
 
   const config = getConfig();
 
+  // Answered from a day-long cache and never throws, so a blocked or offline
+  // instance still gets the rest of its status.
+  const update = await getUpdateStatus();
+
   return NextResponse.json({
     immich: {
       status: immichOk ? 'connected' : 'disconnected',
@@ -89,5 +94,6 @@ export async function GET() {
       count: backupCount,
       lastBackup,
     },
+    update,
   });
 }

app/api/download/[album]/[id]/route.ts

@@ -0,0 +1,130 @@
+/**
+ * Download route for original files (#475).
+ *
+ * Deliberately separate from the image proxy. That route treats the opaque
+ * asset token as the capability: holding one means you saw the page it was
+ * rendered on, and it serves previews. Originals are the deliverable a client
+ * pays for, so this route re-checks everything rather than inheriting that
+ * assumption:
+ *
+ *   - the album must be on the allowlist,
+ *   - the album must have opted in with `download: true`,
+ *   - every password gate on a route to it must be satisfied — the album's own
+ *     and, where that is the only way to it, the subpage's, and
+ *   - the asset must actually belong to that album.
+ *
+ * The last one is what stops one enabled album's URL being edited into a
+ * download of any asset in the Immich instance.
+ */
+
+import { NextRequest, NextResponse } from 'next/server';
+import { cookies } from 'next/headers';
+import { immich, ImmichUnavailableError } from '@/lib/immich';
+import { decodeAssetId } from '@/lib/tokens';
+import { getConfig } from '@/lib/config';
+import { checkRateLimit, getClientIp, retryAfterSeconds } from '@/lib/rate-limit';
+import { isAlbumReachable, siteLockResponse } from '@/lib/auth';
+import { contentDisposition } from '@/lib/downloadName';
+
+export const dynamic = 'force-dynamic';
+
+/**
+ * Far below the image limit. A gallery page fires dozens of image requests;
+ * a download is one deliberate click, and each one is a full-size file off
+ * the Immich server.
+ */
+const DOWNLOAD_RPM = 30;
+
+/** One 404 for every refusal, so the response never says which check failed. */
+const notFound = () =>
+  NextResponse.json(
+    { error: 'Not found' },
+    { status: 404, headers: { 'Cache-Control': 'no-store' } },
+  );
+
+export async function GET(
+  request: NextRequest,
+  { params }: { params: Promise<{ album: string; id: string }> },
+) {
+  const ip = getClientIp(request);
+  const rl = checkRateLimit(`download:${ip}`, DOWNLOAD_RPM);
+  if (!rl.success) {
+    return NextResponse.json(
+      { error: 'Too many requests' },
+      {
+        status: 429,
+        headers: {
+          'Retry-After': String(retryAfterSeconds(rl.resetAt)),
+          'Cache-Control': 'no-store',
+        },
+      },
+    );
+  }
+
+  const locked = siteLockResponse(request);
+  if (locked) return locked;
+
+  const { album: albumToken, id: assetToken } = await params;
+  const albumId = decodeAssetId(albumToken);
+  const assetId = decodeAssetId(assetToken);
+  if (!albumId || !assetId) return notFound();
+
+  const config = getConfig();
+
+  // On the allowlist, and opted in.
+  if (!config.albums.includes(albumId)) return notFound();
+  if (!config.albumDownloads[albumId]) return notFound();
+
+  // Every gate on every route to the album, not just its own: an album with no
+  // password of its own, reachable only through a subpage that has one, was
+  // downloadable without that subpage ever being unlocked. The page checks
+  // this before rendering; a route handler is reached without passing through
+  // the page at all.
+  const cookieStore = await cookies();
+  const getCookie = (name: string) => cookieStore.get(name)?.value;
+  if (!isAlbumReachable(albumId, getCookie)) return notFound();
+
+  let album;
+  try {
+    album = await immich.getAlbum(albumId);
+  } catch (error) {
+    if (error instanceof ImmichUnavailableError) {
+      return NextResponse.json(
+        { error: 'Immich is currently unavailable' },
+        { status: 503, headers: { 'Retry-After': '30', 'Cache-Control': 'no-store' } },
+      );
+    }
+    throw error;
+  }
+  if (!album) return notFound();
+
+  // The asset has to be in the album that authorised the download.
+  const asset = album.assets.find((candidate) => candidate.id === assetId);
+  if (!asset) return notFound();
+
+  let result;
+  try {
+    result = await immich.streamAsset(assetId, 'original');
+  } catch (error) {
+    if (error instanceof ImmichUnavailableError) {
+      return NextResponse.json(
+        { error: 'Immich is currently unavailable' },
+        { status: 503, headers: { 'Retry-After': '30', 'Cache-Control': 'no-store' } },
+      );
+    }
+    throw error;
+  }
+  if (!result) return notFound();
+
+  const headers: Record<string, string> = {
+    'Content-Type': result.contentType || 'application/octet-stream',
+    'Content-Disposition': contentDisposition(asset.originalFileName),
+    // Private: a download is authorised per visitor, so a shared cache must
+    // not hand the file to the next one.
+    'Cache-Control': 'private, no-store',
+    'X-Content-Type-Options': 'nosniff',
+  };
+  if (result.contentLength) headers['Content-Length'] = result.contentLength;
+
+  return new NextResponse(result.stream, { headers });
+}

app/api/exif/[id]/route.ts

@@ -11,6 +11,8 @@ import { decodeAssetId } from '@/lib/tokens';
 import { getConfig } from '@/lib/config';
 import { checkRateLimit, getClientIp, retryAfterSeconds } from '@/lib/rate-limit';
 import { siteLockResponse } from '@/lib/auth';
+import { assetLocationPrecision } from '@/lib/assetLocation';
+import { placeLabel } from '@/lib/mapPrecision';
 
 export async function GET(request: NextRequest, { params }: { params: Promise<{ id: string }> }) {
   const config = getConfig();
@@ -73,6 +75,13 @@ export async function GET(request: NextRequest, { params }: { params: Promise<{
   const exif = asset.exifInfo;
   const caption = show.caption ? exif.description?.trim() || undefined : undefined;
 
+  const place = show.location
+    ? placeLabel(await assetLocationPrecision(assetId), {
+        city: exif.city ?? '',
+        country: exif.country ?? '',
+      })
+    : { city: '', country: '' };
+
   const payload = {
     ...(show.camera
       ? {
@@ -89,7 +98,15 @@ export async function GET(request: NextRequest, { params }: { params: Promise<{
           iso: exif.iso,
         }
       : {}),
-    ...(show.location ? { city: exif.city, country: exif.country } : {}),
+    // Two gates, not one. `exifDisplay.location` decides whether this site
+    // publishes places at all; the album's `location:` decides how precisely
+    // this photograph may be placed — the same setting the map obeys, which
+    // used to stop at the map (#469).
+    // Emitted only when there is something to say. An empty string is not
+    // null, so keeping the keys would defeat the "no data" check below and
+    // render the blank panel it exists to prevent.
+    ...(place.city ? { city: place.city } : {}),
+    ...(place.country ? { country: place.country } : {}),
     ...(caption ? { description: caption } : {}),
   };
 

app/api/exif/__tests__/exif-route.test.ts

@@ -13,7 +13,7 @@ vi.mock('@/lib/config', () => ({
 }));
 
 vi.mock('@/lib/immich', () => ({
-  immich: { getAssetInfo: vi.fn() },
+  immich: { getAssetInfo: vi.fn(), getAlbum: vi.fn() },
   ImmichUnavailableError: class ImmichUnavailableError extends Error {},
 }));
 
@@ -36,6 +36,7 @@ import { NextRequest } from 'next/server';
 
 const mockConfig = getConfig as unknown as ReturnType<typeof vi.fn>;
 const mockAssetInfo = immich.getAssetInfo as unknown as ReturnType<typeof vi.fn>;
+const mockGetAlbum = immich.getAlbum as unknown as ReturnType<typeof vi.fn>;
 
 const EXIF_ASSET = {
   exifInfo: {
@@ -64,6 +65,9 @@ function configWith(raw?: ExifDisplayYaml, exifOnHover?: boolean) {
     exifOnHover: exifOnHover !== false,
     exif: resolveExifDisplay(raw, exifOnHover),
     rateLimitRpm: 120,
+    // No album restricts its location, so the place comes through as the
+    // asset carries it — the shape getConfig() always builds (#469).
+    albumLocationPrecision: {},
   };
 }
 
@@ -152,3 +156,40 @@ describe('GET /api/exif/[id] captions', () => {
     expect(res.status).toBe(404);
   });
 });
+
+/**
+ * `location:` used to govern the map and nothing else, so an album asking to
+ * be absent from it still named its city here (#469).
+ */
+describe('GET /api/exif/[id] album location precision', () => {
+  /** The album that carries the asset the mocked token decodes to. */
+  const carrying = { id: 'album-a', assets: [{ id: 'asset-uuid' }] };
+
+  async function respond(precision: Record<string, string>) {
+    mockConfig.mockReturnValue({ ...configWith(), albumLocationPrecision: precision });
+    mockAssetInfo.mockResolvedValue(EXIF_ASSET);
+    mockGetAlbum.mockResolvedValue(carrying);
+    const res = await GET(new NextRequest('http://localhost/api/exif/token'), {
+      params: Promise.resolve({ id: 'token' }),
+    });
+    return res.json();
+  }
+
+  it('names the city when nothing restricts it', async () => {
+    expect(await respond({})).toMatchObject({ city: 'Vienna', country: 'Austria' });
+  });
+
+  it('drops the city but keeps the country at country precision', async () => {
+    const body = await respond({ 'album-a': 'country' });
+    expect(body.country).toBe('Austria');
+    expect(body).not.toHaveProperty('city');
+  });
+
+  it('names no place at all when the album is hidden', async () => {
+    const body = await respond({ 'album-a': 'hidden' });
+    expect(body).not.toHaveProperty('city');
+    expect(body).not.toHaveProperty('country');
+    // The rest of the panel is untouched.
+    expect(body.model).toBe('X-T5');
+  });
+});

app/api/map/route.ts

@@ -10,6 +10,12 @@ import { getConfig } from '@/lib/config';
 import { imageUrl } from '@/lib/urls';
 import { isAuthenticated, siteLockResponse } from '@/lib/auth';
 import { getMapData } from '@/lib/mapService';
+import {
+  applyPrecision,
+  placeLabel,
+  strictestPrecision,
+  type LocationPrecision,
+} from '@/lib/mapPrecision';
 import { ImmichUnavailableError } from '@/lib/immich';
 import { checkRateLimit, getClientIp, retryAfterSeconds } from '@/lib/rate-limit';
 
@@ -88,11 +94,17 @@ export async function GET(request: NextRequest) {
     return result;
   };
 
+  const precisionOf = (albumId: string): LocationPrecision =>
+    config.albumLocationPrecision[albumId] ?? 'exact';
+
   const publicLocations = locations
     .map((loc) => {
-      const allowedAlbums = loc.albums.filter(
-        (a) => (!a.subpageSlug || isSubpageAllowed(a.subpageSlug)) && isAlbumAllowed(a.id),
-      );
+      const allowedAlbums = loc.albums
+        .filter((a) => (!a.subpageSlug || isSubpageAllowed(a.subpageSlug)) && isAlbumAllowed(a.id))
+        // `location: hidden` drops the album from the map entirely, before it
+        // can contribute. Withholding only its coordinates would still let the
+        // photo count and the cover name a place it asked to be absent from.
+        .filter((a) => precisionOf(a.id) !== 'hidden');
 
       if (allowedAlbums.length === 0) return null;
 
@@ -102,11 +114,31 @@ export async function GET(request: NextRequest) {
       const latSum = allowedAlbums.reduce((sum, a) => sum + a.latSum, 0);
       const lngSum = allowedAlbums.reduce((sum, a) => sum + a.lngSum, 0);
 
+      /*
+       * One marker merges several albums, so the most cautious of them governs
+       * the whole marker. Splitting it instead would itself announce that one
+       * album is set more carefully — which is the thing being hidden.
+       *
+       * Quantised here, server-side: coordinates are never sent exact for the
+       * client to round.
+       */
+      const level = strictestPrecision(allowedAlbums.map((a) => precisionOf(a.id)));
+      const position = applyPrecision(
+        { lat: latSum / photoCount, lng: lngSum / photoCount },
+        level,
+      );
+      if (!position) return null;
+
+      // The name has to follow the coordinates down. Rounding the position to
+      // a 100 km cell while still calling the marker "Chorin" left the label
+      // more precise than the position it was meant to blur.
+      const place = placeLabel(level, { city: loc.city, country: loc.country });
+
       return {
-        city: loc.city,
-        country: loc.country,
-        lat: latSum / photoCount,
-        lng: lngSum / photoCount,
+        city: place.city,
+        country: place.country,
+        lat: position.lat,
+        lng: position.lng,
         photoCount,
         coverUrl: imageUrl(allowedAlbums[0].coverAssetId, 'thumbnail'),
         albums: allowedAlbums.map((a) => ({