81ce886b0140121f691d33d1fa91a5373dcdd6bf
13 Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
Ralksta
|
ad8b09700b |
release: v0.19.0
Release v0.19.0. See the `## [0.19.0] — 2026-09-29` section of [CHANGELOG.md](https://github.com/ralksta/immich-folio/blob/dev/CHANGELOG.md) for the full list. Highlights: client proofing links (#683), custom content pages (#738), asset picker search (#740), concurrent-edit detection (#742), env-locked settings (#739), an accessibility baseline (#741), three security fixes with advisories (#737, #755, #759), and a pre-release quality pass (#780–#797). --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com> Co-authored-by: Ralf <rohlenbo79@gmail.com> Co-authored-by: Paul Thies <110185070+ImScheinox@users.noreply.github.com> Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com> Co-authored-by: Lance Martin <lancetaylor95@gmail.com> |
||
|
Ralksta
|
3193c500e4 |
release: v0.18.0 (#725)
Release v0.18.0 — merges `dev` into `main`. ## Thanks - [@lancetm714](https://github.com/lancetm714) for the accent-contrast fix (#680 → #724). - [@RichKidsDev](https://github.com/RichKidsDev) for reporting the outdated Impressum (#697). ### Security - **Journal drafts and password-protected entries no longer render publicly as a subpage essay** ([#684](https://github.com/ralksta/immich-folio/pull/684), [GHSA-987w-cpwm-c9g9](https://github.com/ralksta/immich-folio/security/advisories/GHSA-987w-cpwm-c9g9), medium). A subpage's `essayFile` read the journal entry straight from disk, skipping the draft and password rules `/journal/<slug>` applies. It now resolves through the same rules: a draft reads as missing for visitors, and a protected entry shows its password gate, sharing the `lb_auth_journal_<slug>` cookie. - **Immich descriptions are escaped in generated subpage essays** ([#684](https://github.com/ralksta/immich-folio/pull/684), [GHSA-8ppx-39jv-q5xm](https://github.com/ralksta/immich-folio/security/advisories/GHSA-8ppx-39jv-q5xm), low). The essay built from a subpage's albums (`layout: essay` without markdown) put each asset's Immich description into the page as raw HTML. Captions are now HTML-escaped, and they go through `assetCaption()`, so `exif.caption: false` is respected there as well. Tracked in [#689](https://github.com/ralksta/immich-folio/issues/689). - **Admin drafts no longer keep a typed password, and the contact form's email check runs in linear time** ([#727](https://github.com/ralksta/immich-folio/pull/727)). The admin's session drafts wrote a password as typed to `sessionStorage`; a draft holding a plaintext password is now not kept (the unsaved-changes guard still warns). The email pattern could backtrack polynomially on a crafted domain; its labels now exclude the dot and the length is checked first. Both found by CodeQL before release. ### Added - **A built-in contact form with an inbox in the admin** ([#703](https://github.com/ralksta/immich-folio/pull/703), closes [#702](https://github.com/ralksta/immich-folio/issues/702)). `/contact` needs neither SMTP nor a form service: each message is one file in `content/messages/` (mode `0600`), read under the new _Messages_ tab, where _Reply by email_ opens the owner's mail client with the message quoted. Messages older than `contact.retentionDays` (default 90) are deleted. An optional ntfy push goes to `contact.notifyUrl` or `CONTACT_NOTIFY_URL`, and since [#709](https://github.com/ralksta/immich-folio/pull/709) it carries a fixed "new message" line and nothing about the sender — no name, no address, no text. Spam is kept out without a captcha: an off-screen honeypot, a minimum fill time, three submissions a minute per IP and a cap of 500 stored messages. With the Impressum on and no `legal.contactUrl`, the Impressum links the form as its second contact channel. A new doctor check warns when the form is on but nobody is notified. - **A privacy policy page, next to a list of what the site processes** ([#708](https://github.com/ralksta/immich-folio/pull/708)). `/privacy` renders `content/privacy.md`, edited under Settings → Legal, and the footer links it once the file has text; `privacy.enabled: false` hides it. Folio writes no legal text. Beside the editor it lists what _this_ installation does, read off the configuration — the map, statistics, contact form, password cookies, CDN — and marks every entry that involves a third party. _Insert headings_ adds the matching section headings and nothing else. The doctor warns while the Impressum is on and there is no policy. - **French, Spanish, Italian and Dutch interface translations** ([#681](https://github.com/ralksta/immich-folio/pull/681)), selected with `settings.yaml: lang` as before. The admin panel stays English. - **CDN mode for photos and videos** ([#681](https://github.com/ralksta/immich-folio/pull/681)). With `CDN_URL` set, image and video URLs point at a pull CDN whose origin is this server, so repeat views reach neither the server nor Immich. A site password switches the mode off, since a CDN would hand out cached photos without checking the unlock cookie. The CDN origin is added to the CSP, and a doctor check covers the password and `TRUSTED_PROXY_HOPS` cases. See `docs/deployment.md#cdn-mode`. - **A reworked admin panel** ([#712](https://github.com/ralksta/immich-folio/pull/712), [#713](https://github.com/ralksta/immich-folio/pull/713), [#714](https://github.com/ralksta/immich-folio/pull/714), [#716](https://github.com/ralksta/immich-folio/pull/716), [#717](https://github.com/ralksta/immich-folio/pull/717), [#718](https://github.com/ralksta/immich-folio/pull/718), [#719](https://github.com/ralksta/immich-folio/pull/719), [#721](https://github.com/ralksta/immich-folio/pull/721)): - **A sidebar instead of the header row**, grouped by task, with an unread count on Messages and a dot on Diagnostics while Immich is down. It collapses to an icon rail, with names shown on hover and focus, and remembers that per browser. - **`/admin` is an overview**: what needs attention (unread messages, doctor warnings), published pages, journal entries and recent views. - **The site's own visual language** — the preset's fonts, hairline borders, the square marker — and one page header on every screen. The accent is kept for the current place and the primary action; switches are now pills reading ON or OFF, in green rather than the accent, so Studio Modern's red no longer makes an enabled setting look like an error. - **The page builder is a structure list and a panel.** Hero, subpages and standalone albums sit in one list on the left, subpages drag-sorted in place; the selected entry is edited on the right instead of in an overlay. - **Dialogs only where a change is permanent.** Deleting a message or a journal entry, and resetting the favicon (which used to delete the file without asking), go through one confirm dialog in the admin's own look. Removals in the page builder, which only touch unsaved state, happen at once and offer _Undo_. No `window.confirm()` is left. - **Feature switches are grouped by meaning** as one-line rows under Settings → General; page transitions and scroll-to-top moved to Theme → Look & motion. No setting keys changed. ### Changed - **Fonts and the Leaflet stylesheet are served from the site itself** ([#700](https://github.com/ralksta/immich-folio/pull/700)). Every page used to link `fonts.googleapis.com`, which sends each visitor's IP address to Google. The server now fetches a theme's Google fonts once, rewrites the stylesheet and caches the files in `content/.fonts/`; custom fonts in `theme.fonts` keep working. If Google cannot be reached before a font is cached, the page falls back to the theme's system fonts. `leaflet.css` comes from the npm package instead of unpkg. The CSP drops `fonts.googleapis.com`, `fonts.gstatic.com` and `unpkg.com`. - **Email addresses are kept out of the served HTML** ([#705](https://github.com/ralksta/immich-folio/pull/705)). The Impressum and footer render the address only after hydration, from an encoded form, so harvesters reading raw HTML find nothing. Without JavaScript the Impressum shows `name [at] example [dot] de`. This defeats bulk harvesting, not a person with a browser. - **The Impressum cites § 5 DDG and links its contacts** ([#698](https://github.com/ralksta/immich-folio/pull/698), reported in [#697](https://github.com/ralksta/immich-folio/issues/697) by [@RichKidsDev](https://github.com/RichKidsDev)). The TMG was replaced by the DDG in May 2024; `legal.heading` replaces the line for other laws (e.g. § 5 ECG in Austria). `legal.contactUrl` and `legal.contactLabel` add a contact form as the second channel, so a phone number stays optional. Email, phone and contact URL are now links, and the "Created with the Impressum generator by eRecht24" line, shown on every site whether true or not, is gone. Settings → Legal gains fields for heading, contact URL, VAT ID and tax number, and a doctor check flags missing details. - **Missing pages answer `404`** ([#704](https://github.com/ralksta/immich-folio/pull/704)). Every missing page used to answer `200`, because streaming had started before `notFound()` ran. `/contact`, `/impressum`, `/map` and `/privacy` while switched off, and `/journal/<slug>` without an entry, now return a real 404 with the same not-found page. Album and subpage slugs still depend on Immich and stay soft 404s. - **Passwords set in the admin are stored as scrypt hashes** ([#706](https://github.com/ralksta/immich-folio/pull/706), closes [#690](https://github.com/ralksta/immich-folio/issues/690)). Subpage, album, journal-entry and site passwords were written as typed. The save routes now hash them; a stored hash reads _Protected_ with _Change_ and _Remove_ and is never put into an input. Visitors who unlocked a page stay signed in across unrelated saves. Existing plaintext passwords are hashed the next time their file is saved in the admin. - **One notification surface in the admin** ([#707](https://github.com/ralksta/immich-folio/pull/707)) replaces every `alert()`: errors stay until dismissed, successes clear themselves, and screen readers announce both. ### Fixed - **Map tiles load again** ([#701](https://github.com/ralksta/immich-folio/pull/701)). CARTO started answering every tile with an "API KEY REQUIRED" image, leaving `/map` and journal map blocks as a grey grid. Tiles now come from OpenStreetMap; the dark look is a CSS filter, so the map now follows the colour mode. - **The page builder no longer drops a subpage's `proofing:` flag on save** ([#711](https://github.com/ralksta/immich-folio/pull/711)). A page switched off for proofing by hand reverted after any unrelated edit. - **Unsaved edits in Settings and About survive switching admin tabs, and a backup restore is no longer overwritten by the next save** ([#687](https://github.com/ralksta/immich-folio/pull/687)). Editors that were open during a restore now reload and offer unsaved edits back as a conflict. Also: "Restore my changes" after a conflict found nothing, removing an album left its drawer showing the next album, and the journal saved (rotating a backup) without changes. - **Accent-backed buttons stay readable with a light or malformed accent** ([#724](https://github.com/ralksta/immich-folio/pull/724), supersedes [#680](https://github.com/ralksta/immich-folio/pull/680)) — contributed by [@lancetm714](https://github.com/lancetm714). A white accent made the proofing dialog's _Download selected (.zip)_ button white on white. `theme.accent` is now accepted as hex only and normalised to `#rrggbb`, anything else falls back to the preset, and the proofing dialog and filter pills use the mode-aware `--on-accent` text colour from #688. - **Every preset's accent is visible in both colour modes** ([#688](https://github.com/ralksta/immich-folio/pull/688)). Presets had one accent for both modes; minimal's dark mode drew black buttons on black. Presets now carry a light and a dark accent, and text on accent-filled buttons picks black or white for contrast. A custom accent stays the owner's choice in both modes. - **Visitor-side inconsistencies** ([#685](https://github.com/ralksta/immich-folio/pull/685)): after visiting `/impressum`, every subpage header turned centred and uppercase; back links announced "Back to Back to …"; the hero EXIF chip ignored `exif.location`/`camera`/`settings`; videos in journal entries opened as stills; the setup screen named a non-existent `.env.example`. - **An essay's lightbox walks only the photos the story shows** ([#686](https://github.com/ralksta/immich-folio/pull/686)), not every photo of the subpage's albums, and the proofing bar in essays shows the selection count instead of a filter button that did nothing. - **The page panel scrolls with the mouse wheel** ([#720](https://github.com/ralksta/immich-folio/pull/720)). - **The journal editor's top bar wraps on phones** ([#723](https://github.com/ralksta/immich-folio/pull/723), closes [#675](https://github.com/ralksta/immich-folio/issues/675)), so the title stays editable and Save stays on screen. - **Every admin form field has a name for assistive technology** ([#715](https://github.com/ralksta/immich-folio/pull/715)). Only two inputs had a linked label; 47 are linked now, and clicking a label focuses its field. ### Internal - **`SettingsEditor` and `PageBuilder` are split up** ([#710](https://github.com/ralksta/immich-folio/pull/710), [#711](https://github.com/ralksta/immich-folio/pull/711)). The 2,200-line settings editor is a shell with one file per section; the page builder's YAML handling and edits are pure functions under test. Both were checked side by side against `dev` for identical output. - **`useAdminFetch()`** ([#707](https://github.com/ralksta/immich-folio/pull/707)) gives Analytics, Messages, Backups and the journal list one loading and error pattern. - README brought up to v0.17.0 ([#678](https://github.com/ralksta/immich-folio/pull/678), [#679](https://github.com/ralksta/immich-folio/pull/679)). ### Upgrade notes **`content/` gains two directories the app writes to:** `content/.fonts/` for the cached fonts and `content/messages/` for contact-form messages. Both are created on demand, so a writable `content/` is enough, as before. **The server needs outbound HTTPS to Google once per font** to fill the font cache. Until then pages fall back to the theme's system fonts. Visitors' browsers no longer contact Google. **A custom CSP or reverse-proxy allowlist** must now allow `tile.openstreetmap.org` for images instead of `*.basemaps.cartocdn.com`, and no longer needs `fonts.googleapis.com`, `fonts.gstatic.com` or `unpkg.com`. The built-in CSP is updated. **`theme.accent` must be hex** (`#rgb`, `#rrggbb` or `#rrggbbaa`). Anything else, including a value without `#`, falls back to the preset's accent. **Plaintext passwords in `gallery.yaml`, `settings.yaml` or journal entries** are hashed the next time that file is saved in the admin; one save clears the doctor's warning. **New, optional settings:** `contact.*` (the form is off by default), `privacy.enabled`, `legal.heading`, `legal.contactUrl`, `legal.contactLabel`, and the `CDN_URL` and `CONTACT_NOTIFY_URL` environment variables. See `content/settings.yaml.example` and `.env.local.example`. In the example file, `vatId` and `taxId` had swapped sample values; check yours if you copied them. No `IMAGE_CACHE_VERSION` bump is needed this time. --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com> Co-authored-by: Ralf <rohlenbo79@gmail.com> Co-authored-by: Paul Thies <110185070+ImScheinox@users.noreply.github.com> Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com> Co-authored-by: Lance Martin <lancetaylor95@gmail.com> |
||
|
Ralksta
|
89a8fac564 |
release: v0.17.0 (#677)
See CHANGELOG.md, section [0.17.0] — 2026-09-23. |
||
|
Ralksta
|
a813433891 |
release: v0.13.0 (#535)
Twenty-nine commits since v0.12.0. See CHANGELOG.md for the full list and the upgrade notes. Ten additions — the SEO package (site URL, robots.txt, sitemap.xml, JSON-LD), slideshow mode, opt-in original downloads, copy-link, previous/next album navigation, alt text from the Immich description, per-album location precision, the update notice, a Help tab, and a subpage cover grid separate from its photo grid. Two fixes: CJK album slugs, and the lightbox control bar. Photo of the Day (#476) was built on `dev` and reverted as not planned; it never appears in a release. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01DmsHVRL9yQvckUB1ZpVWre --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com> |
||
|
Ralksta
|
10ec68f493 |
release: v0.12.0 (#520)
Forty-one commits since v0.11.0. See CHANGELOG.md for the full list and the upgrade notes. |
||
|
Ralksta
|
716ae14b0f |
Close the gaps left after v0.9.2's outage handling: route tests, stale cache, loading states (#397)
* docs: brainstorm resilience/adoption features and plan follow-up work
Brainstorm and deep-dive on where Immich Folio breaks under Immich
outages and what blocks self-hosted adoption, plus an implementation
plan for the remaining gaps after v0.9.2 (route-handler tests,
stale-while-error caching, loading skeletons).
* test: enable route-handler tests and cover admin guards and image content-type
vitest.config.ts only ran lib/__tests__/**, so route handlers were
structurally untestable. Two mechanisms live only at the route level and
cannot be extracted the way lib/imageSize.ts was: the admin auth guards
and the image proxy's Content-Type sanitisation (the stored-XSS fix from
|
||
|
Ralksta
|
300a031445 |
fix: Immich outage handling, image tiers, admin save safety (#394)
* fix: migrate deprecated middleware convention to proxy Next.js 16 deprecated the `middleware` file convention in favour of `proxy`. The build warned on every run, and the convention is slated for removal in a future major — at which point Next.js would silently stop invoking this file. That is not a cosmetic failure: proxy.ts owns the Content-Security-Policy and the per-request nonce, so an uninvoked file means every document response ships with no CSP at all, with nothing in the build output to catch it. Renames middleware.ts to proxy.ts and the exported middleware() to proxy(), per the official migration. The config.matcher export is unchanged, so route coverage is identical. Adds lib/__tests__/proxy.test.ts, which pins the export name and verifies the behaviour a silent regression would take out: a CSP is set, the nonce in the policy matches the one forwarded to pages via x-nonce, nonces differ per request, x-pathname still reaches the root layout, and the matcher continues to cover /admin. Verified: tsc 0 errors, 105 unit tests passing (98 before), production build succeeds with 0 deprecation warnings. * fix: stop reporting Immich outages as missing albums lib/immich.ts request() returned null for every failure mode: a 5xx, a rejected API key, a network error, and a non-JSON body all looked exactly like "Immich answered and said this does not exist". Callers had no way to tell the two apart, and app/[...path]/page.tsx calls notFound() on a null album in five places. The result was that while Immich was down or returning 5xx, every album URL served a hard 404 — for albums that exist. Visitors saw "not found", and crawlers were free to de-index real content over a transient outage. request() now throws ImmichUnavailableError for anything that is not a definitive answer about the resource, and reserves null for 404 and 410. Pages let that propagate, so an outage surfaces as a 500 rather than a 404. Two callers must not propagate and are handled explicitly: - ping() catches and returns false — it answers "is Immich reachable", and both callers (/api/health, /api/admin/status) render that as a status field. - /api/exif and /api/map return 503 with Retry-After instead of 404 and an empty marker list respectively. An empty map is otherwise indistinguishable from a gallery with no GPS data. Adds 10 tests: each failure mode maps to the right outcome, getAlbum and getAlbums propagate rather than reporting empty, ping stays non-throwing, and a failed request leaves no stale entry in the in-flight coalescing map — which would otherwise replay the failure after Immich recovered. Verified: tsc 0 errors, 115 unit tests passing (105 before), production build exit 0, eslint 0 errors on all touched files. * fix: bound how long Immich requests may hang lib/immich.ts set no timeout on any of its three fetch call sites, so the only ceiling was undici's built-in default, measured in minutes. Every page is force-dynamic, which means an Immich that accepts connections but never answers held each visitor's render open for that whole window — and since nothing caches the failure, load kept arriving. Adds IMMICH_TIMEOUT_MS (default 15000, floored at 1000 so a stray 0 cannot mean "no timeout"), threaded through env.ts and AppConfig like CACHE_TTL. The two kinds of call need different treatment: - request() carries a whole-exchange AbortSignal.timeout(). JSON payloads are small, so one budget can cover headers and body. - streamAsset()/streamVideo() use an AbortController whose timer is cleared in a finally the moment response headers arrive. A large original photo or a long video is legitimately slow to transfer; a whole-request timeout would truncate playback and break seeking, since every range request would restart the clock. A timed-out request surfaces as ImmichUnavailableError naming the budget, so a misconfigured value is diagnosable from the log line alone. Adds 5 tests, including the two that pin the distinction: a stream whose headers have arrived is not aborted an hour later, while a stream that never sends headers still is. Verified: tsc 0 errors, 120 unit tests passing (115 before), production build exit 0, no new eslint errors (the one error in env.ts is pre-existing — confirmed against a clean tree). * fix: stop caching Immich outages as permanently missing media f3 split "gone" from "unavailable" in request(), but streamAsset() and streamVideo() have their own fetch calls and were left returning null for every failure. Both proxy routes turn null into a 404. That 404 carried no Cache-Control, and a 404 is heuristically cacheable per RFC 9111 — on URLs the success path serves as `immutable`. So a transient outage, or a timeout introduced in 370e668, could pin a broken image or an unplayable video in the visitor's browser cache well after Immich recovered. Both stream methods now throw ImmichUnavailableError for transport failures, timeouts, and any error status other than 404/410, and reserve null for genuinely absent media. A 200 with no body counts as unavailable, not as missing. The routes translate that into 503 with Retry-After, and both error responses — the 503 and the real 404 — now send Cache-Control: no-store. streamVideo keeps accepting 206, so range requests and seeking are unaffected. Adds 7 tests covering each failure mode for both methods plus the 206 path, and updates the F4 timeout test, which asserted the old null return. Verified: tsc 0 errors, 127 unit tests passing (120 before), production build exit 0, eslint 0 errors on touched files. * perf: cache "does not exist" answers from Immich getAlbum() and getAssetInfo() cached successes but discarded a definitive "not found", so a missing resource was re-queried upstream on every call. Measured before: 5 sequential lookups of a missing asset produced 5 upstream fetches. After: 1. This is not hypothetical. app/page.tsx resolves every gallery.yaml hero ID through getAssetInfo() on each render, and the homepage is force-dynamic — so a hero photo deleted from Immich but still listed in gallery.yaml cost one 404 round-trip per page view, indefinitely. Absence is stored as a frozen MISSING sentinel because the cache cannot distinguish a miss from a stored null; both read back as null. Only definitive 404/410 answers are cached. An outage throws ImmichUnavailableError and is deliberately never stored — caching one would keep the gallery broken after Immich recovered. A test pins that: a 503 followed by a healthy response must reach Immich the second time. Stored under the normal cacheTtl rather than a separate shorter negative TTL, because the reason for a shorter one no longer applies: outages are not cached at all now, and both invalidation paths (the Immich webhook and the admin save/reload) clear the entry immediately, so a corrected asset ID takes effect at once rather than waiting out a TTL. Also raises the test config's cacheTtl from 0, which expired entries in the same millisecond they were written and would have made any caching assertion flaky. Test isolation comes from cache.clear() in beforeEach. Verified: tsc 0 errors, 131 unit tests passing (127 before), production build exit 0, eslint 0 errors on touched files. * fix: add themed error and not-found pages The app had no app/error.tsx, app/not-found.tsx or global-error.tsx, so every failure fell through to Next.js's unstyled default page. That gap became visible with 253ade0, which made an Immich outage produce a 500 instead of a false 404 — correct, but what a visitor saw was a bare framework error screen with none of the site's theming. The two pages also carry the distinction the error split was for, and they carry it structurally rather than by inspecting the error: notFound() renders not-found.tsx, a throw renders error.tsx. That matters because Next.js strips error messages in production and replaces them with a digest — this component genuinely cannot tell an Immich outage from any other server error, so it does not claim to. It frames the failure as temporary and offers reset(); not-found.tsx deliberately does not, since a real 404 is not transient. The digest is shown so a user report can be traced to a log line. The raw error message is never rendered — it can carry an upstream URL, a header or a config value. Both pages reuse .empty-state, which existed in globals.css but was unreferenced anywhere in the app; extended with title, actions and button elements matching the PasswordGate button, the only other action button in the codebase. Tested by server-rendering both components (react-dom/server, no new dependencies) — 8 tests covering the styling hook, the retry and home affordances, digest handling, and that a message containing an API key or host address does not reach the markup. Note vitest.config.ts only includes lib/__tests__/**/*.test.ts, so the test uses createElement rather than JSX; a .tsx file there would never run. Not verified in a browser: this worktree has no .env.local and only .example content files, so the app boots into setup mode and neither Playwright nor a dev server can exercise these routes here. Verified: tsc 0 errors, 139 unit tests passing (131 before), production build exit 0 with /_not-found registered, eslint 0 errors. * perf: drop the unused originalUrl from every photo item PhotoItem declared originalUrl and toPhotoItems computed it for every asset, but a repo-wide grep found exactly two references: the field declaration and the assignment. Nothing ever read it — the grid uses thumbUrl, the lightbox uses previewUrl. The cost was not the encryption. PhotoItem is a server-to-client prop, so the dead field was serialized into the RSC payload and shipped to the browser for every photo. Measured: 137 bytes per asset once serialized, so 6.7 KB for a 50-photo album and 66.9 KB for a 500-photo one — transferred and parsed on every page view, never read. Removed rather than wired up to a "view original" affordance. Exposing full-size originals is a bandwidth and privacy decision for the project to make deliberately, not something to infer from a dangling field. No unit test: this is a deletion whose correctness is exactly "nothing referenced it", which tsc and a repo-wide grep already establish. A test asserting the absence of a field would restate the type checker. Verified: tsc 0 errors, 139 unit tests passing, production build exit 0, eslint unchanged at 4 pre-existing errors on the touched files (unused imports, confirmed identical against a stashed clean tree). * chore: remove four orphaned imports from the catch-all route Link, Image, PhotoGrid and BackLink were imported by app/[...path]/page.tsx and never used — 4 of the 6 no-unused-vars errors in the repo baseline. Verified they are leftovers, not a dropped render path: PhotoGrid and BackLink are both rendered by AlbumDetailView, which imports them itself, and BackLink is also used by the impressum and map pages. Rendering was extracted out of page.tsx into AlbumDetailView/SubpageGridView at some point and the imports stayed behind. `type PhotoItem` is still needed by toPhotoItems, so that import narrows to a type-only import rather than disappearing. No bundle win, measured: .next/static is 1084 KB across 20 JS chunks both before and after, byte-identical. Turbopack already tree-shook them. The backlog note that predicted unused client-component imports would hold them in the client graph was wrong, and has been corrected there. The value is readability and lint: repo errors drop from 54 to 50, and page.tsx no longer reads as though it renders the grid itself. chore: rather than fix:/perf: — nothing behaves differently and the measurement showed no performance change, so either of those labels would misdescribe it. CLAUDE.md lists chore: as a valid prefix. Verified: tsc 0 errors, 139 unit tests passing, production build exit 0, eslint 0 errors on the touched file. * fix: make ?w= able to narrow the image tier instead of being ignored The image proxy resolved its Immich rendition with `?size=` winning whenever present, falling back to `?w=` otherwise. lib/urls.ts always writes `?size=`, so for every URL this app generates the width branch was unreachable and widthToSize() was dead code — while CLAUDE.md documented the width mapping as the actual behaviour. `?size=` is now a ceiling rather than an override: when both are present the smaller tier wins, so a width can narrow the request but never widen it. That asymmetry is the point. Letting width win outright — the obvious reading of the docs — would have been a real regression: next/image emits widths up to 3840 and widthToSize(1920) is 'original', so every large display would have started downloading full-size originals in place of previews. A test pins that specific case. No measured change today. The only URLs carrying both parameters are ?size=preview with next/image widths, whose smallest vw-based deviceSize is 640 — already preview either way. This is a correctness fix that makes the documented contract true and testable, not a performance win. Moved the logic to lib/imageSize.ts so it can be tested at all: vitest.config.ts only collects lib/__tests__, so nothing inside a route file is reachable from the suite. 9 tests cover the tier boundaries, both single-parameter paths, malformed input, and the ceiling behaviour. CLAUDE.md updated to describe the ceiling rule rather than a plain width mapping. Verified: tsc 0 errors, 148 unit tests passing (139 before), production build exit 0, eslint 0 errors on touched files. * fix: validate the per-album heroImage UUID from gallery.yaml Every asset ID in gallery.yaml is routed through validateUuid before it can reach encodeAssetId, which encrypts whatever it is handed. One was not: for a per-album entry the album ID (the map key) was validated while the heroImage value was stored raw. A typo there produced a perfectly well-formed image URL that 404s forever, with nothing in the log naming the cause — the failure surfaced as a broken hero image on an album page, far from the line that caused it. This is narrower than the finding that prompted it, which proposed guarding encodeAssetId itself. Validation belongs at config load, where it runs once and can name the file and the album; a guard in encodeAssetId would run on every render and duplicate validateUuid at the wrong layer. The heroImage path was the only unvalidated route into it. validateUuid warns and substitutes the nil UUID rather than throwing, so a bad ID still degrades to a missing image instead of taking the page down — and since f511e62 that 404 is negative-cached, so it costs one upstream request rather than one per render. Adds 4 tests. The two that pin the wiring were mutation-checked: both fail against the unfixed code and pass with it. Verified: tsc 0 errors, 152 unit tests passing (148 before), production build exit 0, eslint 0 errors on touched files. * fix: keep /admin reachable when gallery.yaml cannot be derived getConfig() throws on three shapes the admin page builder is able to write: a gallery with neither albums nor subpages, a subpage with no name, and a subpage with neither albums nor sections. RootLayout called it unguarded, and a throw in a *layout* is not caught by app/error.tsx — that needs a global-error boundary, which this app does not have. /admin renders inside that same layout, so one bad save took down the site together with the only tool that could undo it. Recovery meant editing content/gallery.yaml on the host, or exec'ing into the container. This is issue #326's failure mode reached through an invalid config instead of a missing one. Adds getConfigOrNull(), which returns null rather than throwing and logs the underlying error plus the path to content/.backups/. The layout treats null exactly like needsSetup: setup screen for visitors, children rendered for admin paths so the panel still loads. generateMetadata() is guarded too — it also calls getConfig(), and it also runs before any error boundary. This is the half of the finding that makes every broken config recoverable, including ones this app never wrote: a hand-edited file, a restored backup, a config from an older version. The other half — validating in the admin PUT so the bad state is never written — is filed separately; it prevents new breakage but cannot repair existing breakage, so it was not the one to do first. Adds 10 tests. Three pin the premise by asserting getConfig() really does throw on each shape, so the fallback cannot quietly become dead weight. One asserts the needsSetup path still returns a config rather than null, since missing and invalid are different states that must not collapse. Not verified in a browser: this worktree has no .env.local and only .example content files, so the layout/error-boundary interaction is reasoned from Next.js semantics and covered at the getConfig level only. Verified: tsc 0 errors, 162 unit tests passing (152 before), production build exit 0, eslint 0 errors on touched files. * fix: reject an admin save the site would not be able to load The admin PUT validated only the shape of the hero field, then wrote. None of getConfig()'s three throw conditions was checked, so the page builder could persist a gallery.yaml that cannot be loaded — and the user got "Saved successfully" for it. Since 95877af that no longer locks anyone out, but the public site still drops to the setup screen until someone notices. Extracts the gallery half of getConfig() into deriveGallery(), which the route now runs against the proposed gallery before writing. Two alternatives were rejected on purpose: - Re-checking the three conditions in the route would put a second copy of the rules next to the first, and the two would drift. - Write-then-verify-then-roll-back leaves a window in which other requests read the broken config. The extraction is a pure move: no logic changed inside it, and all 162 pre-existing tests pass untouched, which is what makes that claim checkable rather than asserted. The 400 carries the derivation's own message, so the admin UI names the offending subpage instead of saying "invalid gallery" — a builder with a dozen subpages needs to know which one. A test pins that the message identifies it. Adds 8 tests: each rejected shape, the named-subpage message, and the valid structures (standalone albums, subpage membership, sections, per-album overrides and hero images) so the extraction cannot silently lose behaviour. Verified: tsc 0 errors, 170 unit tests passing (162 before), production build exit 0, eslint 0 errors on touched files. * fix: hash subpage passwords off the main thread verifyScrypt used crypto.scryptSync, measured at 22.8ms per call — 22.8ms during which the Node process serves nothing else, because the sync variant runs on the main thread rather than the libuv threadpool. The /api/auth rate limit does not contain this. It allows 10 attempts per minute, but the bucket key is the client IP, and with the default TRUSTED_PROXY_HOPS=0 that IP is read from x-real-ip / x-forwarded-for — both attacker-controlled. lib/rate-limit.ts already documents that those headers are spoofable at hops=0; what followed from it was not written down anywhere: one attacker rotating a header gets unlimited buckets, and each request buys 22.8ms of dead process. Roughly 44 requests per second saturates it. Switches verifyScrypt and generateScryptHash to the async crypto.scrypt, which runs on the threadpool. This does not stop the spoofing — that is inherent to hops=0 and already documented — it removes the amplification that made spoofing worth doing. authenticate() becomes async. It had exactly one caller (app/api/auth/route.ts). isAuthenticated() is deliberately left synchronous: it only computes an HMAC, and it is called from server components. Adds 4 tests, two of which pin the fix and were mutation-checked against the old implementation — both fail with scryptSync and pass with scrypt. One asserts scryptSync is never called; the other asserts a 2ms interval still fires during a hash, which is the property that actually matters. A slower machine lengthens the hash and yields more ticks, so that test fails on a blocked loop rather than on a busy one. Also adds a scrypt-hashed fixture subpage, so the suite exercises verifyScrypt rather than only the deprecated plaintext fallback. Verified: tsc 0 errors, 174 unit tests passing (170 before), production build exit 0, eslint 0 errors on touched files. * fix: warn when TRUSTED_PROXY_HOPS cannot identify a client getClientIp falls back to a shared 'unknown' bucket whenever the X-Forwarded-For chain is shorter than the configured hop count, or the header is absent with hops > 1. That fallback is correct — the alternative is trusting a spoofable entry — but it was silent, and silence is the problem. Every unidentified request shares one bucket per endpoint, and this is an image proxy: a single 50-photo grid issues ~50 /api/image requests, so the default RATE_LIMIT_RPM=1500 is collectively spent by roughly 30 page loads a minute. Someone who sets TRUSTED_PROXY_HOPS=2 for Cloudflare-plus-nginx and then reaches nginx directly gets a site that 429s everyone, with nothing in the log pointing at the cause. Warns once per process, naming the configured hop count and what was actually seen — the chain length, or which header was missing. Once, not per request: enough to diagnose without flooding the log. The fallback itself is unchanged. Trusting a shorter chain would hand every client its own bucket key and defeat the limiter entirely. No warning at hops=0, where the shared bucket is the documented consequence of not declaring a proxy rather than a misconfiguration. Adds 6 tests covering each fall-through path, the once-per-process behaviour, and both silence cases. The once-per-process flag needs a test seam to re-arm, hence the __resetProxyWarningForTests export. Verified: tsc 0 errors, 180 unit tests passing (174 before), production build exit 0, eslint 0 errors on touched files. * fix: send Retry-After on every rate-limited response /api/image, /api/video and /api/exif each computed the retry delay, interpolated it into a console.warn, and then returned a 429 without it — the number was calculated and thrown away. /api/og did not compute it at all. Only /api/auth and /api/map sent the header. This matters more for an image proxy than for a typical API: one gallery page issues around fifty /api/image requests, so a burst that trips the limit produces fifty rejections carrying no back-off signal. The browser and next/image then retry on their own schedule — a retry storm against a server that just reported it was overloaded. Adds Retry-After and Cache-Control: no-store to all four. no-store because the success path serves these same URLs as `immutable`. The delay now comes from a shared retryAfterSeconds() helper rather than an inline Math.ceil in each route, which also fixes an edge every copy shared: a window on the point of expiring yields 0, and Retry-After: 0 tells the client to retry immediately, which is the opposite of what a 429 means. A resetAt already in the past yields a negative number, which is not valid HTTP. The helper floors at 1. The three routes that already sent the header (/api/auth, /api/map, /api/admin/auth) and /api/health now use the helper too — leaving four copies of the buggy arithmetic behind while centralising the rest would have been worse than not centralising at all. Adds 2 tests, one of them specifically for the zero-and-negative edge. Verified: tsc 0 errors, 182 unit tests passing (180 before), production build exit 0, eslint 0 errors on all ten touched files. * fix: add an escape hatch for stale browser image caches Image and video responses are served `Cache-Control: public, max-age=31536000, immutable`, so a browser does not revalidate them for a year — the ETag is not even consulted. When Immich regenerates thumbnails after a job re-run, or a photo is rotated, the asset ID does not change, so neither does the deterministic token or the URL. Visitors keep the old rendition, and the webhook that clears the server-side caches cannot reach a browser. The only existing remedy was rotating AUTH_SECRET, which invalidates every token on the site. Corrects the framing this started from. The finding described it as an ETag problem, but `immutable` means the ETag is never reached in the case that matters. The URL is the only lever a browser cache responds to, so the buster belongs there. It is also mixed into the ETag, since a matching ETag across two different URLs would be wrong regardless. Adds IMAGE_CACHE_VERSION, empty by default. Unset, the generated URLs are byte-identical to before — a test asserts exactly that, because a cache-busting feature that changes URLs when nobody asked for it would silently discard every visitor's cache on deploy. The value is URL-encoded at parse time; an unescaped one could otherwise inject query parameters into every image URL on the site. Deliberately not done: shortening max-age or dropping `immutable`. Both trade a large, real bandwidth win for a rare correctness case, and the cost is not measurable from this worktree. The aggressive caching stays the default; this only adds a way out. Adds 6 tests: default-unchanged, whitespace treated as unset, both URL shapes, escaping, and that a bump changes the query while leaving the token intact. Verified: tsc 0 errors, 188 unit tests passing (182 before), production build exit 0, eslint unchanged (the one error in env.ts is pre-existing, confirmed against a stashed tree). * security: validate the backup filename before restoring from it restoreBackup() joined its argument straight into a path and copied the result over a content file. path.join resolves `..`, so restoreBackup('../../../../etc/passwd') would have written any readable file over content/settings.yaml — whose contents the admin GET endpoints hand straight back. The destination was chosen by backupFilename.includes('gallery.yaml'), which is substring matching on the same attacker-supplied string, so the caller picked that too. Not exploitable today: the function has zero callers. That is precisely why it was worth fixing rather than leaving — it is an exported function carrying a traversal bug, waiting for whoever wires up the restore button the admin panel does not yet have. Hardened rather than deleted. The status endpoint already reports backup counts, so restore is plainly intended; removing a half-built feature is the maintainer's call, not a side effect of a security fix. The name must now match the pattern this service itself produces, and the destination is derived from the matched group rather than a substring search. The redundant basename check is kept on purpose: it preserves the guarantee if that pattern is ever loosened. Adds 12 tests. Nine of them fail against the unguarded version — mutation-checked by removing the guard and confirming, rather than assuming they would. Verified: tsc 0 errors, 200 unit tests passing (188 before), production build exit 0, eslint 0 errors on touched files. * fix: give each admin save its own temp file writeYamlFile wrote to a constant `${filePath}.tmp` before renaming. The rename is what makes the write atomic; the temp filename was not. Two saves of the same file in flight at once shared that path, so the second writeFile could interleave with the first's rename — publishing one save's bytes under the other's, or a truncated mix of both. A double-clicked Save in the page builder is enough to reach it. The temp name now carries the pid and a per-process counter, so concurrent writers cannot collide either within a process or across workers. Also wraps the write and rename so a failure unlinks the temp file instead of leaving it in content/. The cleanup swallows its own errors: failing to tidy up must not replace the real error with a misleading one. Adds 7 tests, and both halves were mutation-checked independently — reverting to the fixed temp path fails two of them, removing the cleanup fails two others. Two of the tests exist to pin properties that are easy to regress silently: that the rename targets the temp file just written, and that the happy path issues no unlink. Verified: tsc 0 errors, 207 unit tests passing (200 before), production build exit 0, eslint 0 errors on touched files. * fix: await the stream-timeout rejection before advancing timers `npm run test:unit` exited 1 even though all 207 tests passed. The timeout test started `streamAsset`, advanced the fake timers past the 15s budget, and only then attached the rejection expectation. The abort fires *during* `advanceTimersByTimeAsync`, so for one microtask turn the promise was rejected with no handler attached — Node reports that as an unhandled rejection, and vitest fails the whole run on it regardless of test outcomes. CI would have blocked on a green suite. Attaching the assertion before advancing the timers fixes the ordering without weakening it: the same rejection and the same `captured.aborted` check still run, just awaited after the advance rather than created after it. Verified: vitest exit 0, 207/207 passing, tsc 0 errors, prettier clean. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> --------- Co-authored-by: ralksta <ralksta@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> |
||
|
Ralksta
|
37f7f62157 |
security: fix pre-auth bypasses and restore Immich 3.x compatibility (#378)
Seven security issues from an audit, plus album pages and the map coming up empty against Immich 3.x. Verified against a real Immich 3.0.3 instance in a production build. Security: - Admin session forgery via a hardcoded 'dev-fallback-secret' signing key that bypassed the production AUTH_SECRET guard - /api/map ignored album passwords and returned working asset tokens; rewriting ?size=thumbnail to ?size=original downloaded full-resolution originals from protected albums - Admin login had no rate limit, and the client IP came from a spoofable header, so rotating it bypassed every limit in the app - Raw Immich asset UUIDs were serialized into the RSC payload - Album tokens never expired server-side; a captured token replayed forever - Path traversal into the Immich API via an unvalidated album id - /admin ran with no enforced CSP (only Report-Only reached it) TRUSTED_PROXIES is replaced by TRUSTED_PROXY_HOPS. The old variable matched proxy IPs against the socket peer address, which self-hosted Next.js never exposes, so the check could never pass: unset, the limiter read a spoofable header; set, every request shared one bucket and a single client could rate-limit the whole site. Migrates automatically. Immich 3.x: GET /albums/:id no longer embeds assets. Assets now come from POST /search/metadata with withExif: true — without that flag EXIF is omitted and grid aspect ratios, the lightbox panel and map markers stay empty. Drops support for Immich below 3.0, which now logs a warning. Upgrade: requires Immich 3.0+; set TRUSTED_PROXY_HOPS (nginx = 1); visitors of protected areas and admin sessions must log in once more. 91 unit tests (25 new); the new admin-auth and rate-limit cases were confirmed to fail against the pre-fix code. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> |
||
|
ralksta
|
9e52d7a0b8 |
feat: add visual admin panel with page builder and settings editor
- Add /admin route with password-protected visual page builder
- Page Builder: manage hero images, standalone albums, subpages, and sections
- Album Picker: browse all shared Immich albums with search and filtering
- Settings Editor: theme, grid, footer, legal, SEO configuration
- YAML service with atomic writes and automatic backups (content/.backups/)
- HMAC-signed admin sessions (24h expiry, HttpOnly cookies)
- API endpoints: /api/admin/{auth,gallery,settings,albums,reload}
- Enable with ADMIN_PASSWORD env var; disabled by default
- invalidateConfigCache() export for hot-reload after saves
|
||
|
ralksta
|
771cee517a | security: implement secure IP retrieval with TRUSTED_PROXIES support (closes #139) | ||
|
ralksta
|
e394fe84a0 | security: implement AUTH_SECRET and secure map/exif API routes | ||
|
ralksta
|
52fa16c1c8 |
feat: visual polish & UX — fade-in, theme toggle, scroll-to-top, footer, cursor, badge
- Add FadeIn component (IntersectionObserver scroll-reveal + load animation) - Add dark/light theme toggle (useSyncExternalStore + localStorage) - Add scroll-to-top button (appears after 300px scroll) - Add configurable footer with social links (gallery.yaml) - Add crosshair cursor on photo grid items - Add 'X photos' count badge on subpage cover images - Add light theme color palette in tokens.css |
||
|
ralksta
|
86d2bb87e2 | fix: unignore .env.local.example so it ships with the repo |