Koko210/immich-folio
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

release: v0.19.0

Browse Source 
Release v0.19.0. See the `## [0.19.0] — 2026-09-29` section of
[CHANGELOG.md](https://github.com/ralksta/immich-folio/blob/dev/CHANGELOG.md)
for the full list.

Highlights: client proofing links (#683), custom content pages (#738),
asset picker search (#740), concurrent-edit detection (#742), env-locked
settings (#739), an accessibility baseline (#741), three security fixes
with advisories (#737, #755, #759), and a pre-release quality pass
(#780–#797).

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
Co-authored-by: Ralf <rohlenbo79@gmail.com>
Co-authored-by: Paul Thies <110185070+ImScheinox@users.noreply.github.com>
Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
Co-authored-by: Lance Martin <lancetaylor95@gmail.com>
This commit is contained in:
Ralksta
2026-09-29 22:50:30 +02:00
committed by GitHub
parent 5f251923f0
commit ad8b09700b
297 changed files with 19398 additions and 1800 deletions
Download Patch File Download Diff File Expand all files Collapse all files

68
app/api/admin/settings/route.ts
View File

@@ -1,28 +1,48 @@
import { NextResponse } from 'next/server';
import { withAdmin } from '@/lib/admin/withAdmin';
import { revalidatePath } from 'next/cache';
import { readSettingsYaml, writeSettingsYaml } from '@/lib/admin/yaml-service';
import {
readSettingsYaml,
readSettingsYamlVersioned,
writeSettingsYaml,
} from '@/lib/admin/yaml-service';
import {
VersionConflictError,
baseVersionFrom,
conflictResponse,
etag,
} from '@/lib/admin/contentVersion';
import { invalidateConfigCache, getConfigOrNull } from '@/lib/config';
import { immich } from '@/lib/immich';
import { validateSettings } from '@/lib/config/settingsSchema';
import { hashPasswordKeys } from '@/lib/admin/passwordHashing';
import { keepLockedValues, resolveEnvLocks } from '@/lib/admin/envLocks';
import { env } from '@/lib/env';
import { validateSettingValues } from '@/lib/config/settingValues';
const SITE_PASSWORD_KEY = new Set(['sitePassword']);
import type { SettingsYaml } from '@/lib/config/schema';
/** GET: Read current settings.yaml config. */
export const GET = withAdmin(async () => {
const settings = await readSettingsYaml();
const { data: settings, version } = await readSettingsYamlVersioned();
const config = getConfigOrNull();
return NextResponse.json({
settings: settings || {},
// The resolved value and its origin, so the panel can say when what it
// shows came from SITE_URL rather than from the field itself (#472).
siteUrl: {
effective: config?.siteUrl ?? null,
source: config?.siteUrlSource ?? 'none',
return NextResponse.json(
{
settings: settings || {},
// Sent back in If-Match on save (#601).
version,
// The resolved value and its origin, so the panel can say when what it
// shows came from SITE_URL rather than from the field itself (#472).
siteUrl: {
effective: config?.siteUrl ?? null,
source: config?.siteUrlSource ?? 'none',
},
// Fields an environment variable overrides, as path → variable name. Only
// the names: the values are secrets (a password, an ntfy topic) (#605).
envLocks: resolveEnvLocks(env),
},
});
{ headers: { ETag: etag(version) } },
);
});
/** PUT: Write settings.yaml config. */
@@ -34,12 +54,15 @@ export const PUT = withAdmin(async (request: Request) => {
// Checked before the write, not after: settings.yaml is read by every public
// page, so a malformed save is discovered by visitors rather than here.
// Then the values the site would silently ignore — an accent that is not
// hex, nine columns — which used to be saved with a success message.
const validation = validateSettings(body.settings);
if (!validation.ok) {
const fields = validation.ok ? validateSettingValues(body.settings) : validation.errors;
if (fields.length > 0) {
return NextResponse.json(
{
error: 'These settings could not be saved.',
fields: validation.errors,
fields,
},
{ status: 400 },
);
@@ -47,22 +70,27 @@ export const PUT = withAdmin(async (request: Request) => {
try {
// Only the top-level site password: settings.yaml has no other password.
const settings = await hashPasswordKeys(
body.settings as SettingsYaml,
SITE_PASSWORD_KEY,
await readSettingsYaml().catch(() => null),
);
await writeSettingsYaml(settings);
const stored = await readSettingsYaml().catch(() => null);
// A locked field keeps what the file holds: the environment wins anyway,
// so a changed value would be saved and then silently ignored (#605).
const incoming = keepLockedValues(body.settings as SettingsYaml, stored, resolveEnvLocks(env));
const settings = await hashPasswordKeys(incoming, SITE_PASSWORD_KEY, stored);
const version = await writeSettingsYaml(settings, baseVersionFrom(request));
invalidateConfigCache();
immich.invalidateAll();
// No immich.invalidateAll(): the Immich cache holds Immich's data only, and
// the gallery.yaml side (allowlist, titles, order) is applied per request
// from the new config. Clearing it made the next visitor refetch every
// album although nothing in Immich had changed.
revalidatePath('/', 'layout');
return NextResponse.json({
success: true,
message: 'Saved successfully. Backup of previous version created.',
// The stored site password, hashed, so the field can read "Protected".
sitePassword: settings.sitePassword,
version,
});
} catch (err) {
if (err instanceof VersionConflictError) return conflictResponse(err.currentVersion);
console.error('[Admin] Failed to write settings.yaml:', err);
return NextResponse.json({ error: 'Failed to save settings' }, { status: 500 });
}