From faab17f9cd31841bdc9b77754fe9d62658b5f7c2 Mon Sep 17 00:00:00 2001
From: ralksta <ralksta@users.noreply.github.com>
Date: Sat, 7 Mar 2026 09:42:33 +0100
Subject: [PATCH] fix: increase rate limit and add detailed logging to diagnose
 broken thumbnails

---
 app/api/image/[id]/route.ts | 16 ++++++----------
 lib/env.ts                  |  2 +-
 2 files changed, 7 insertions(+), 11 deletions(-)

diff --git a/app/api/image/[id]/route.ts b/app/api/image/[id]/route.ts
index 0b0df80..0aa861e 100644
--- a/app/api/image/[id]/route.ts
+++ b/app/api/image/[id]/route.ts
@@ -31,16 +31,8 @@ export async function GET(request: NextRequest, { params }: { params: Promise<{
 
   if (!success) {
     const retryAfter = Math.ceil((resetAt - Date.now()) / 1000);
-    return NextResponse.json(
-      { error: 'Too many requests' },
-      {
-        status: 429,
-        headers: {
-          'Retry-After': String(retryAfter),
-          'X-RateLimit-Remaining': '0',
-        },
-      },
-    );
+    console.warn(`[Image API] ⚠️ Rate limit exceeded for IP: ${ip}. Retry after ${retryAfter}s`);
+    return NextResponse.json({ error: 'Too many requests' }, { status: 429 });
   }
 
   const { id: token } = await params;
@@ -48,6 +40,7 @@ export async function GET(request: NextRequest, { params }: { params: Promise<{
   // Decode the opaque token back to an Immich asset ID
   const assetId = decodeAssetId(token);
   if (!assetId) {
+    console.error(`[Image API] ❌ Invalid token: ${token.substring(0, 10)}...`);
     return NextResponse.json({ error: 'Invalid token' }, { status: 400 });
   }
 
@@ -67,9 +60,12 @@ export async function GET(request: NextRequest, { params }: { params: Promise<{
 
   const result = await immich.streamAsset(assetId, size);
   if (!result) {
+    console.error(`[Image API] ❌ Asset not found in Immich: ${assetId} (Size: ${size})`);
     return NextResponse.json({ error: 'Asset not found' }, { status: 404 });
   }
 
+  console.log(`[Image API] ✅ Serving ${assetId} (${size}) - Type: ${result.contentType}`);
+
   const headers: Record<string, string> = {
     'Content-Type': result.contentType,
     // Images are immutable once uploaded to Immich — cache aggressively
diff --git a/lib/env.ts b/lib/env.ts
index e72e355..22b96bf 100644
--- a/lib/env.ts
+++ b/lib/env.ts
@@ -25,7 +25,7 @@ const envSchema = z.object({
   CACHE_TTL: z.coerce.number().int().min(0).default(300),
 
   /** Rate limit: max requests per minute per IP */
-  RATE_LIMIT_RPM: z.coerce.number().int().min(1).default(120),
+  RATE_LIMIT_RPM: z.coerce.number().int().min(1).default(600),
 
   /**
    * Secret used for signing auth cookies and encrypting asset tokens.