Koko210/immich-folio
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
255 Commits 1 Branch 0 Tags
81ce886b0140121f691d33d1fa91a5373dcdd6bf
Commit Graph

59 Commits

Author SHA1 Message Date
Ralksta
ad8b09700b release: v0.19.0 
Release v0.19.0. See the `## [0.19.0] — 2026-09-29` section of
[CHANGELOG.md](https://github.com/ralksta/immich-folio/blob/dev/CHANGELOG.md)
for the full list.

Highlights: client proofing links (#683), custom content pages (#738),
asset picker search (#740), concurrent-edit detection (#742), env-locked
settings (#739), an accessibility baseline (#741), three security fixes
with advisories (#737, #755, #759), and a pre-release quality pass
(#780–#797).

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
Co-authored-by: Ralf <rohlenbo79@gmail.com>
Co-authored-by: Paul Thies <110185070+ImScheinox@users.noreply.github.com>
Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
Co-authored-by: Lance Martin <lancetaylor95@gmail.com>
 2026-09-29 22:50:30 +02:00
Ralksta
3193c500e4 release: v0.18.0 (#725) 
Release v0.18.0 — merges `dev` into `main`.

## Thanks

- [@lancetm714](https://github.com/lancetm714) for the accent-contrast
fix (#680 → #724).
- [@RichKidsDev](https://github.com/RichKidsDev) for reporting the
outdated Impressum (#697).

### Security

- **Journal drafts and password-protected entries no longer render
publicly
  as a subpage essay**
  ([#684](https://github.com/ralksta/immich-folio/pull/684),

[GHSA-987w-cpwm-c9g9](https://github.com/ralksta/immich-folio/security/advisories/GHSA-987w-cpwm-c9g9),
medium). A subpage's `essayFile` read the journal entry straight from
disk,
skipping the draft and password rules `/journal/<slug>` applies. It now
resolves through the same rules: a draft reads as missing for visitors,
and
  a protected entry shows its password gate, sharing the
  `lb_auth_journal_<slug>` cookie.

- **Immich descriptions are escaped in generated subpage essays**
  ([#684](https://github.com/ralksta/immich-folio/pull/684),

[GHSA-8ppx-39jv-q5xm](https://github.com/ralksta/immich-folio/security/advisories/GHSA-8ppx-39jv-q5xm),
  low). The essay built from a subpage's albums (`layout: essay` without
markdown) put each asset's Immich description into the page as raw HTML.
Captions are now HTML-escaped, and they go through `assetCaption()`, so
  `exif.caption: false` is respected there as well. Tracked in
  [#689](https://github.com/ralksta/immich-folio/issues/689).

- **Admin drafts no longer keep a typed password, and the contact form's
  email check runs in linear time**
([#727](https://github.com/ralksta/immich-folio/pull/727)). The admin's
  session drafts wrote a password as typed to `sessionStorage`; a draft
holding a plaintext password is now not kept (the unsaved-changes guard
still warns). The email pattern could backtrack polynomially on a
crafted
domain; its labels now exclude the dot and the length is checked first.
  Both found by CodeQL before release.

### Added

- **A built-in contact form with an inbox in the admin**
  ([#703](https://github.com/ralksta/immich-folio/pull/703), closes
[#702](https://github.com/ralksta/immich-folio/issues/702)). `/contact`
  needs neither SMTP nor a form service: each message is one file in
`content/messages/` (mode `0600`), read under the new _Messages_ tab,
where
_Reply by email_ opens the owner's mail client with the message quoted.
Messages older than `contact.retentionDays` (default 90) are deleted. An
optional ntfy push goes to `contact.notifyUrl` or `CONTACT_NOTIFY_URL`,
and
since [#709](https://github.com/ralksta/immich-folio/pull/709) it
carries a
  fixed "new message" line and nothing about the sender — no name, no
  address, no text. Spam is kept out without a captcha: an off-screen
honeypot, a minimum fill time, three submissions a minute per IP and a
cap
of 500 stored messages. With the Impressum on and no `legal.contactUrl`,
the Impressum links the form as its second contact channel. A new doctor
  check warns when the form is on but nobody is notified.

- **A privacy policy page, next to a list of what the site processes**
  ([#708](https://github.com/ralksta/immich-folio/pull/708)). `/privacy`
renders `content/privacy.md`, edited under Settings → Legal, and the
footer
links it once the file has text; `privacy.enabled: false` hides it.
Folio
writes no legal text. Beside the editor it lists what _this_
installation
  does, read off the configuration — the map, statistics, contact form,
password cookies, CDN — and marks every entry that involves a third
party.
_Insert headings_ adds the matching section headings and nothing else.
The
  doctor warns while the Impressum is on and there is no policy.

- **French, Spanish, Italian and Dutch interface translations**
([#681](https://github.com/ralksta/immich-folio/pull/681)), selected
with
  `settings.yaml: lang` as before. The admin panel stays English.

- **CDN mode for photos and videos**
([#681](https://github.com/ralksta/immich-folio/pull/681)). With
`CDN_URL`
set, image and video URLs point at a pull CDN whose origin is this
server,
  so repeat views reach neither the server nor Immich. A site password
switches the mode off, since a CDN would hand out cached photos without
  checking the unlock cookie. The CDN origin is added to the CSP, and a
  doctor check covers the password and `TRUSTED_PROXY_HOPS` cases. See
  `docs/deployment.md#cdn-mode`.

- **A reworked admin panel**
  ([#712](https://github.com/ralksta/immich-folio/pull/712),
  [#713](https://github.com/ralksta/immich-folio/pull/713),
  [#714](https://github.com/ralksta/immich-folio/pull/714),
  [#716](https://github.com/ralksta/immich-folio/pull/716),
  [#717](https://github.com/ralksta/immich-folio/pull/717),
  [#718](https://github.com/ralksta/immich-folio/pull/718),
  [#719](https://github.com/ralksta/immich-folio/pull/719),
  [#721](https://github.com/ralksta/immich-folio/pull/721)):
- **A sidebar instead of the header row**, grouped by task, with an
unread
    count on Messages and a dot on Diagnostics while Immich is down. It
    collapses to an icon rail, with names shown on hover and focus, and
    remembers that per browser.
  - **`/admin` is an overview**: what needs attention (unread messages,
    doctor warnings), published pages, journal entries and recent views.
  - **The site's own visual language** — the preset's fonts, hairline
borders, the square marker — and one page header on every screen. The
accent is kept for the current place and the primary action; switches
    are now pills reading ON or OFF, in green rather than the accent, so
    Studio Modern's red no longer makes an enabled setting look like an
    error.
- **The page builder is a structure list and a panel.** Hero, subpages
and
standalone albums sit in one list on the left, subpages drag-sorted in
    place; the selected entry is edited on the right instead of in an
    overlay.
- **Dialogs only where a change is permanent.** Deleting a message or a
journal entry, and resetting the favicon (which used to delete the file
without asking), go through one confirm dialog in the admin's own look.
Removals in the page builder, which only touch unsaved state, happen at
    once and offer _Undo_. No `window.confirm()` is left.
  - **Feature switches are grouped by meaning** as one-line rows under
Settings → General; page transitions and scroll-to-top moved to Theme →
    Look & motion. No setting keys changed.

### Changed

- **Fonts and the Leaflet stylesheet are served from the site itself**
([#700](https://github.com/ralksta/immich-folio/pull/700)). Every page
used
to link `fonts.googleapis.com`, which sends each visitor's IP address to
Google. The server now fetches a theme's Google fonts once, rewrites the
  stylesheet and caches the files in `content/.fonts/`; custom fonts in
`theme.fonts` keep working. If Google cannot be reached before a font is
  cached, the page falls back to the theme's system fonts. `leaflet.css`
  comes from the npm package instead of unpkg. The CSP drops
  `fonts.googleapis.com`, `fonts.gstatic.com` and `unpkg.com`.

- **Email addresses are kept out of the served HTML**
([#705](https://github.com/ralksta/immich-folio/pull/705)). The
Impressum
and footer render the address only after hydration, from an encoded
form,
  so harvesters reading raw HTML find nothing. Without JavaScript the
Impressum shows `name [at] example [dot] de`. This defeats bulk
harvesting,
  not a person with a browser.

- **The Impressum cites § 5 DDG and links its contacts**
  ([#698](https://github.com/ralksta/immich-folio/pull/698), reported in
  [#697](https://github.com/ralksta/immich-folio/issues/697) by
[@RichKidsDev](https://github.com/RichKidsDev)). The TMG was replaced by
the
DDG in May 2024; `legal.heading` replaces the line for other laws (e.g.
  § 5 ECG in Austria). `legal.contactUrl` and `legal.contactLabel` add a
  contact form as the second channel, so a phone number stays optional.
  Email, phone and contact URL are now links, and the "Created with the
Impressum generator by eRecht24" line, shown on every site whether true
or
not, is gone. Settings → Legal gains fields for heading, contact URL,
VAT
  ID and tax number, and a doctor check flags missing details.

- **Missing pages answer `404`**
([#704](https://github.com/ralksta/immich-folio/pull/704)). Every
missing
  page used to answer `200`, because streaming had started before
`notFound()` ran. `/contact`, `/impressum`, `/map` and `/privacy` while
switched off, and `/journal/<slug>` without an entry, now return a real
404 with the same not-found page. Album and subpage slugs still depend
on
  Immich and stay soft 404s.

- **Passwords set in the admin are stored as scrypt hashes**
  ([#706](https://github.com/ralksta/immich-folio/pull/706), closes
  [#690](https://github.com/ralksta/immich-folio/issues/690)). Subpage,
album, journal-entry and site passwords were written as typed. The save
routes now hash them; a stored hash reads _Protected_ with _Change_ and
_Remove_ and is never put into an input. Visitors who unlocked a page
stay
signed in across unrelated saves. Existing plaintext passwords are
hashed
  the next time their file is saved in the admin.

- **One notification surface in the admin**
([#707](https://github.com/ralksta/immich-folio/pull/707)) replaces
every
`alert()`: errors stay until dismissed, successes clear themselves, and
  screen readers announce both.

### Fixed

- **Map tiles load again**
([#701](https://github.com/ralksta/immich-folio/pull/701)). CARTO
started
answering every tile with an "API KEY REQUIRED" image, leaving `/map`
and
journal map blocks as a grey grid. Tiles now come from OpenStreetMap;
the
  dark look is a CSS filter, so the map now follows the colour mode.

- **The page builder no longer drops a subpage's `proofing:` flag on
save**
([#711](https://github.com/ralksta/immich-folio/pull/711)). A page
switched
  off for proofing by hand reverted after any unrelated edit.

- **Unsaved edits in Settings and About survive switching admin tabs,
and a
  backup restore is no longer overwritten by the next save**
([#687](https://github.com/ralksta/immich-folio/pull/687)). Editors that
were open during a restore now reload and offer unsaved edits back as a
  conflict. Also: "Restore my changes" after a conflict found nothing,
removing an album left its drawer showing the next album, and the
journal
  saved (rotating a backup) without changes.

- **Accent-backed buttons stay readable with a light or malformed
accent**
  ([#724](https://github.com/ralksta/immich-folio/pull/724), supersedes
[#680](https://github.com/ralksta/immich-folio/pull/680)) — contributed
by
  [@lancetm714](https://github.com/lancetm714). A white accent made the
  proofing dialog's _Download selected (.zip)_ button white on white.
`theme.accent` is now accepted as hex only and normalised to `#rrggbb`,
anything else falls back to the preset, and the proofing dialog and
filter
  pills use the mode-aware `--on-accent` text colour from #688.

- **Every preset's accent is visible in both colour modes**
([#688](https://github.com/ralksta/immich-folio/pull/688)). Presets had
one
accent for both modes; minimal's dark mode drew black buttons on black.
  Presets now carry a light and a dark accent, and text on accent-filled
  buttons picks black or white for contrast. A custom accent stays the
  owner's choice in both modes.

- **Visitor-side inconsistencies**
([#685](https://github.com/ralksta/immich-folio/pull/685)): after
visiting
`/impressum`, every subpage header turned centred and uppercase; back
links
  announced "Back to Back to …"; the hero EXIF chip ignored
`exif.location`/`camera`/`settings`; videos in journal entries opened as
  stills; the setup screen named a non-existent `.env.example`.

- **An essay's lightbox walks only the photos the story shows**
([#686](https://github.com/ralksta/immich-folio/pull/686)), not every
photo
of the subpage's albums, and the proofing bar in essays shows the
selection
  count instead of a filter button that did nothing.

- **The page panel scrolls with the mouse wheel**
  ([#720](https://github.com/ralksta/immich-folio/pull/720)).

- **The journal editor's top bar wraps on phones**
  ([#723](https://github.com/ralksta/immich-folio/pull/723), closes
[#675](https://github.com/ralksta/immich-folio/issues/675)), so the
title
  stays editable and Save stays on screen.

- **Every admin form field has a name for assistive technology**
([#715](https://github.com/ralksta/immich-folio/pull/715)). Only two
inputs
had a linked label; 47 are linked now, and clicking a label focuses its
  field.

### Internal

- **`SettingsEditor` and `PageBuilder` are split up**
  ([#710](https://github.com/ralksta/immich-folio/pull/710),
[#711](https://github.com/ralksta/immich-folio/pull/711)). The
2,200-line
settings editor is a shell with one file per section; the page builder's
YAML handling and edits are pure functions under test. Both were checked
  side by side against `dev` for identical output.
- **`useAdminFetch()`**
([#707](https://github.com/ralksta/immich-folio/pull/707))
gives Analytics, Messages, Backups and the journal list one loading and
  error pattern.
- README brought up to v0.17.0
  ([#678](https://github.com/ralksta/immich-folio/pull/678),
  [#679](https://github.com/ralksta/immich-folio/pull/679)).

### Upgrade notes

**`content/` gains two directories the app writes to:**
`content/.fonts/`
for the cached fonts and `content/messages/` for contact-form messages.
Both
are created on demand, so a writable `content/` is enough, as before.

**The server needs outbound HTTPS to Google once per font** to fill the
font
cache. Until then pages fall back to the theme's system fonts. Visitors'
browsers no longer contact Google.

**A custom CSP or reverse-proxy allowlist** must now allow
`tile.openstreetmap.org` for images instead of
`*.basemaps.cartocdn.com`,
and no longer needs `fonts.googleapis.com`, `fonts.gstatic.com` or
`unpkg.com`. The built-in CSP is updated.

**`theme.accent` must be hex** (`#rgb`, `#rrggbb` or `#rrggbbaa`).
Anything
else, including a value without `#`, falls back to the preset's accent.

**Plaintext passwords in `gallery.yaml`, `settings.yaml` or journal
entries**
are hashed the next time that file is saved in the admin; one save
clears the
doctor's warning.

**New, optional settings:** `contact.*` (the form is off by default),
`privacy.enabled`, `legal.heading`, `legal.contactUrl`,
`legal.contactLabel`,
and the `CDN_URL` and `CONTACT_NOTIFY_URL` environment variables. See
`content/settings.yaml.example` and `.env.local.example`. In the example
file,
`vatId` and `taxId` had swapped sample values; check yours if you copied
them.

No `IMAGE_CACHE_VERSION` bump is needed this time.

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
Co-authored-by: Ralf <rohlenbo79@gmail.com>
Co-authored-by: Paul Thies <110185070+ImScheinox@users.noreply.github.com>
Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
Co-authored-by: Lance Martin <lancetaylor95@gmail.com>
 2026-09-27 14:43:38 +02:00
Ralksta
89a8fac564 release: v0.17.0 (#677) 
See CHANGELOG.md, section [0.17.0] — 2026-09-23.
 2026-09-23 12:09:08 +02:00
Ralksta
a3a6319c29 release: v0.16.0 
See CHANGELOG.md for the full v0.16.0 entry.

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
Co-authored-by: Ralf <rohlenbo79@gmail.com>
Co-authored-by: Paul Thies <110185070+ImScheinox@users.noreply.github.com>
Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
 2026-09-22 14:12:13 +02:00
Ralksta
c3f92ca4ec release: v0.15.0 (#585) 
Eighteen changes since v0.14.0. See CHANGELOG.md for the full list and the upgrade notes (bump IMAGE_CACHE_VERSION).
 2026-09-19 22:24:10 +02:00
Ralksta
a813433891 release: v0.13.0 (#535) 
Twenty-nine commits since v0.12.0. See CHANGELOG.md for the full list
and the upgrade notes.

Ten additions — the SEO package (site URL, robots.txt, sitemap.xml,
JSON-LD), slideshow mode, opt-in original downloads, copy-link,
previous/next album navigation, alt text from the Immich description,
per-album location precision, the update notice, a Help tab, and a
subpage cover grid separate from its photo grid. Two fixes: CJK album
slugs, and the lightbox control bar.

Photo of the Day (#476) was built on `dev` and reverted as not planned;
it never appears in a release.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

https://claude.ai/code/session_01DmsHVRL9yQvckUB1ZpVWre

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
 2026-08-25 10:08:12 +02:00
Ralksta
10ec68f493 release: v0.12.0 (#520) 
Forty-one commits since v0.11.0. See CHANGELOG.md for the full list and the upgrade notes.
 2026-08-23 23:18:14 +02:00
Ralksta
2f546f440d release: v0.11.0 (#459) 
Ships `dev` as **v0.11.0**. `main` contains nothing that `dev` does not,
so this is a clean sync.

## Headline changes since v0.10.0

- **Journal & Journal Studio** — photo essays at `/journal`,
split-screen block editor with live preview, drafts, per-entry
passwords, cover images
- **First-run setup wizard at `/install`** — configure a fresh
deployment from the browser; credentials are verified against Immich
before anything is written, and the wizard is gated by a one-time token
- **About page editor and toggle** in the admin panel
- **Per-album photo order** independent of Immich, with a drag & drop
editor
- **Custom favicon upload**
- **Experimental portfolio features** — justified grid, `cover` hero,
unlisted subpages, per-album grid overrides, cover focal points,
external nav links
- **Security** — asset tokens length-capped before decoding (#423),
journal author markdown escaped rather than filtered, journal file paths
contained, admin session key derived with scrypt (#432), Next.js 16.3.0
for CVE-2025-13465
- **Fixed** — client proofing honours its own configuration again
(#454); journal photo rendering (#432)

Full detail in [CHANGELOG.md](CHANGELOG.md#0110--2026-08-15).

## Verified

`npx tsc --noEmit` clean · `npx vitest run` 435 tests pass · `npm run
build` succeeds · lint 0 errors · `prettier --check` clean · local
`docker build` of the release tree.

## After merge

Tag `v0.11.0` on `main` and publish the release — that triggers
`docker-publish.yml`, which pushes the image and moves `latest`.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
 2026-08-15 09:09:18 +02:00
Ralksta
6eda34cc50 release: sync main with dev (about editor, journal template, icon cleanup) (#449) 
Brings `main` up to `dev` after #448 realigned the two branches.

`main` had #431 (portfolio features) but was missing everything that
landed on `dev` since:

- #443 — journal sample story ships as a template, not a live entry
- #445 — last emojis in the public frontend replaced with SVG icons
- #446 — About page toggle + content editor in the admin (@lancetm714's
work, rebased)
- #448 — the merge of `main` into `dev`, resolving the `Icons.tsx` split
and porting `IconEyeOff` into the shared icon file

After this merge both branches carry the same tree. CI on #448
(type-check + tests) passed on the merged state.

---------

Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
 2026-08-14 21:19:54 +02:00
Ralksta
84c7eeef40 experimental: portfolio features (justified layout, unlisted pages, captions, per-album grid, focal point, nav links, cover hero) (#431) 
## Was ist das?

Sieben neue Portfolio-Features, alle als **experimental** gekennzeichnet
— in YAML-Kommentaren, Admin-Panel-Labels und Commit-Scopes, damit sie
einzeln nachvollziehbar und revertierbar bleiben.

## Features (je ein Commit)

| Commit | Feature |
| --- | --- |
| `justified rows gallery layout` | Neues Grid-Layout `justified`:
zeilenbasiert, gleiche Höhen, volle Breite — Flexbox ohne JS-Messung,
letzte Zeile bleibt natürlich klein |
| `hide subpages from navigation` | `hidden: true`: Seite aus
Nav/Homepage raus, per Direktlink erreichbar — im Gegensatz zu `enabled:
false` (404) |
| `lightbox captions` | Immich-Asset-Description als Bildunterschrift im
Info-Panel; EXIF-Route liefert bei `exifOnHover: false` jetzt nur noch
die Caption statt 403 |
| `per-album grid overrides` | `grid:` pro Album-Eintrag, Präzedenz
global < Subpage < Album |
| `per-album cover focal point` | `coverPosition:` → `object-position`
auf Cover-Karten, strikt validiert |
| `external links in header navigation` | `navLinks:` in settings.yaml,
nur http(s), sanitisiert |
| `cover splash hero style` | `heroStyle: cover`: Fullscreen-Splash mit
Enter-Link ins Portfolio |

Alle Optionen sind im Admin-Panel editierbar (PageBuilder /
SettingsEditor).

## Tests

- 356 Unit-Tests grün (13 neue: deriveGallery hidden/grid/coverPosition,
sanitizeNavLinks, EXIF-Route-Captions, justified-Layout-Validierung)
- `npx tsc --noEmit`: 0 Fehler
- `npm run build`: sauber
- Justified-Zeilenmathematik und Cover-Splash per Browser-Harness
visuell/numerisch verifiziert (volle Zeilen enden exakt an der
Containerkante, letzte Zeile bleibt natürlich)

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
 2026-08-14 17:56:22 +02:00
Ralksta
2fe1157a5d release: v0.11.0 — journal fixes, admin URLs, design system cleanup (#432) 
* fix(screenshots): sharp-Typen fuer 0.34 und 0.35 gleichzeitig (#410)

sharp 0.35 ist von `export =` auf ESM umgestellt: der Modul-Namespace
ist nicht mehr aufrufbar, die Factory sitzt unter .default. Der
Type-Check brach damit in scripts/screenshots.ts weg, sobald der
Next-Bump (#402) sharp von 0.34.5 auf 0.35.3 mitzieht -- sharp ist hier
keine deklarierte Dependency, sondern kommt ueber Next mit.

Die Form wird jetzt aus dem installierten Paket abgeleitet statt
festgeschrieben, zur Laufzeit wie im Typ. Geprueft mit beiden
Versionen: tsc laeuft mit 0.34.5 und mit 0.35.3 fehlerfrei durch.

Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>

* chore(deps): bump the nextjs group across 1 directory with 2 updates (#402)

Bumps the nextjs group with 2 updates in the / directory: [next](https://github.com/vercel/next.js) and [eslint-config-next](https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next).


Updates `next` from 16.2.12 to 16.3.0
- [Release notes](https://github.com/vercel/next.js/releases)
- [Commits](https://github.com/vercel/next.js/compare/v16.2.12...v16.3.0)

Updates `eslint-config-next` from 16.2.12 to 16.3.0
- [Release notes](https://github.com/vercel/next.js/releases)
- [Commits](https://github.com/vercel/next.js/commits/v16.3.0/packages/eslint-config-next)

---
updated-dependencies:
- dependency-name: eslint-config-next
  dependency-version: 16.3.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: nextjs
- dependency-name: next
  dependency-version: 16.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nextjs
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* chore(deps-dev): bump prettier from 3.8.3 to 3.9.6 (#405)

Bumps [prettier](https://github.com/prettier/prettier) from 3.8.3 to 3.9.6.
- [Release notes](https://github.com/prettier/prettier/releases)
- [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md)
- [Commits](https://github.com/prettier/prettier/compare/3.8.3...3.9.6)

---
updated-dependencies:
- dependency-name: prettier
  dependency-version: 3.9.6
  dependency-type: direct:development
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* docs(changelog): Unreleased-Sektion fuer die Bumps nach v0.10.0 (#413)

Die Dependency-PRs sind nach dem Release auf dev gelandet, teils auch
auf main. Ohne Eintrag waeren sie beim naechsten Release unsichtbar --
inklusive Next 16.3.0, das CVE-2025-13465 mitbringt.

Ausserdem im 0.10.0-Abschnitt nachgetragen, dass der Trivy-Scan bis
#409 nie gelaufen ist. Der Fix steckt im Tag v0.10.0, fehlte aber in der
Aufzaehlung -- und "Images werden bei jedem Publish gescannt" stand im
Changelog, waehrend der Job im Action-Setup abbrach.

Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>

* feat(gallery): per-album sort order, independent of Immich (#408) (#414)

Album order was dictated entirely by Immich: getAlbum() sorted by the
album's own asc/desc flag, so a Folio album always mirrored the archive.
A curated series has a narrative order that has nothing to do with
capture time, and changing the Immich album's sort to fit the website
changes it for the archive too.

Adds an optional per-album `sort` in gallery.yaml, editable in /admin,
defaulting to today's behaviour so every existing config is unchanged:

  immich (default) | newest | oldest | filename | manual

`manual` is a pinned *prefix*: `assetOrder` lists only the photos placed
by hand, everything else follows in the album's Immich order. A full
permutation of a 2,000-photo album would be ~80 KB of UUIDs in a file
that is rewritten and copied to content/.backups/ on every admin save.
It also makes drift fall out for free — photos removed in Immich never
match, new ones land in the tail rather than being hidden.

Sorting is applied after the cache read, not before the cache write, so
the LRU keeps one canonical Immich-ordered copy per album. That avoids
putting the mode in the cache key, lets a config change take effect
without depending on invalidation, and keeps the stale-serving path
correct. cache.get() returns the stored object by reference, so
withSort() returns a shallow clone with a new array — sorting in place
would reorder the shared entry, and under request coalescing every
concurrent caller would be sorting the same array.

Also fixes a prerequisite bug: /api/admin/albums/[albumId]/assets read
album.assets from GET /albums/:id, which Immich 3.x no longer populates
(lib/immich.ts:507). The hero picker's "This Album" tab returned nothing
and threw outright when the key was absent. It now goes through the
client's paginated metadata search, with ?types=all to opt videos in for
the reorder editor.

Co-authored-by: ralksta <ralksta@users.noreply.github.com>

* refactor(admin): drop decorative emoji from the sort select labels (#415)

An <option> cannot contain markup, so the SVG set in Icons is not
reachable there — but a decorative emoji is not a substitute for it.
Plain text instead; the album card badge already uses a real icon.

The remaining emoji in the admin panel (asset picker tabs, section
headings, layout picker options) predate this branch and are left for a
separate cleanup.

Co-authored-by: ralksta <ralksta@users.noreply.github.com>

* refactor(admin): replace emoji icons with the shared SVG icon set (#416)

The admin panel mixed two icon conventions: inline SVGs from
`Icons.tsx` in most components, and decorative emoji in the asset
picker and a few PageBuilder labels. Emoji render inconsistently
across platforms, ignore the accent colour, and cannot inherit the
`.svg-icon` sizing rules.

- Icons.tsx: add `IconStar` (filled — it marks a state, not an
  action) and `IconImage`.
- AssetPicker: the three tab labels and the favourite tile badge now
  use IconFolder / IconStar / IconImage.
- PageBuilder: the "Standalone Albums" and "Subpages" headings use
  the icon set instead of an emoji.
- PageBuilder: the layout picker drops its emoji for plain text. An
  <option> cannot contain markup, so an SVG is impossible there and a
  decorative glyph is not a substitute.
- admin.css: align icon and label in the picker tabs, and swap the
  favourite badge's text-shadow for drop-shadow, which is what
  applies to an inline SVG.

Co-authored-by: ralksta <ralksta@users.noreply.github.com>

* refactor(admin): fold PageBuilder's local icons into the shared Icons module (#418)

* refactor(admin): fold PageBuilder's local icons into the shared module

PageBuilder.tsx carried its own `Icons` object duplicating most of the
glyphs already exported by Icons.tsx, with hardcoded sizes and slightly
divergent paths. Migrate all 32 call sites to the shared module and
delete the local object.

Five glyphs had no counterpart and are added to Icons.tsx as 1:1 ports
of the local paths: IconX, IconPlus, IconHome, IconCopy, IconImage.
The local ExternalLink and Check are dropped rather than ported — both
had zero call sites.

Two glyphs change shape slightly, which is the point of consolidating:
the shared IconCamera includes the viewfinder bump the local copy
omitted, and drag handles now use IconGripVertical.

IconGripVertical uses the module's square 24x24 viewBox, so `.svg-drag`
goes from 12x18 to 18x18 — the old non-square box would letterbox the
glyph down to 12x12 and shrink the handle.

* fix(admin): resolve icon-module integration after #416

Merging dev brought in #416, which added a second IconImage to Icons.tsx
and two <Icons.Camera>/<Icons.Folder> section headers that reference the
local Icons object this PR removes. Git merged both cleanly but the result
did not type-check.

- drop the duplicate IconImage (both copies were byte-identical)
- point the two section headers at the imported IconCamera/IconFolder
- refresh the SORT_LABELS comment: the icon set is imported now, not
  declared below

---------

Co-authored-by: ralksta <ralksta@users.noreply.github.com>

* fix(config): allow an empty gallery, guard against a double /api suffix (#421)

An empty gallery is now a valid, rendered state instead of a throw: deriveGallery() no longer requires at least one album or subpage, so a deployment with no albums yet renders a bare homepage the owner can fill in via /admin.

getConfig() also stops appending /api to an Immich URL that already ends in it, which previously produced .../api/api and broke every upstream request.

Includes a restore of the per-album sort test cases, which the branch had lost by being cut before #408/#414.

* feat(admin): favicon upload, served from the content volume (#422)

Adds a bundled default favicon, an upload widget in admin Settings > General, and a route that serves the icon from the writable content/ volume with a fallback to the bundled default. Raster uploads (PNG/ICO/JPEG) are wrapped in an SVG container; the response carries its own CSP so an uploaded SVG cannot execute script on the origin.

The GET route revalidates with an ETag instead of caching immutably, so a newly uploaded icon shows up immediately. Uploads are written via temp file + rename, and a Reset button restores the bundled default.

* ci: flag unformatted files in a PR, without blocking it (#424)

Prettier is configured as an error rule in eslint.config.mjs but has never run in CI, so part of the tree predates it. A final CI step now diffs against the PR base, runs prettier --list-different over the changed files, and emits a warning annotation per offender plus a job summary.

Advisory by design: it never fails the job. Blocking would turn a PR red for merely touching a file that was already unformatted, and normalising the tree in one commit would wreck git blame and conflict with the PRs in flight.

Requires fetch-depth: 0, since diffing against the base needs its history.

* feat(install): first-run wizard gated by a one-time setup token (#419)

Adds /install, a four-step first-run wizard: connect to Immich, optionally pick albums, name the site, finish. It verifies the credentials against the Immich server before writing anything, then writes gallery.yaml, settings.yaml and a content/install.json carrying the Immich credentials and a generated site secret.

install.json exists because a running process cannot pick up new env vars — the wizard has to write configuration that takes effect without a restart. getInstallCredentials() merges it under the real environment, so env vars always win and rotation stays a matter of setting one.

Both the page and the API routes are gated by a one-time setup token printed to the server log, so a deployment that is reachable before gallery.yaml exists cannot be configured by whoever finds it first. The token is stored in content/.setup-token (0600) rather than a module variable: Next.js bundles the page and each route handler separately, so a module-level token left the page and the API disagreeing inside one process and the wizard stuck on step 1. It is removed once the install completes.

The admin password is stored as an scrypt hash using the scheme lib/auth.ts already applies to album passwords; a plaintext ADMIN_PASSWORD env var keeps working.

* docs: document the setup wizard, fix the read-only content mount (#425)

Quick Start now leads with the /install wizard, with the hand-written YAML route kept alongside it, and a First-Run Setup section covers the setup token, the files the wizard writes, and env-var precedence.

Two corrections: both Docker examples mounted content/ as :ro, which silently breaks the wizard, the admin panel and the backup rotation alike — docs/admin-panel.md already said so and the README contradicted it. And nothing documented that content/install.json holds the Immich API key, so a backup of content/ is a backup of credentials.

Also adds a Contributors section crediting the people whose work is in the project.

* feat(admin): floating save bar pinned to the bottom of the viewport (#426)

The save bar was the first, static element inside .admin-main. Since the
document itself scrolls, it left the viewport as soon as you scrolled down
— editing a subpage section or a settings block far below gave no visible
dirty hint and no reachable save button.

Replace it with a bottom-pinned floating bar shared by both editors. It
only mounts while there is something to act on (unsaved changes, an
in-flight save, or a result message), so it never covers content while
idle. The success message clears after 5s, which hides the bar again.

- new SaveBar component, replacing the duplicated markup in PageBuilder
  and SettingsEditor
- adopt the previously unused .floating-save-bar CSS: slide-in keyframes
  (carrying translateX(-50%)), dirty border, wrap/gap, mobile variant and
  a prefers-reduced-motion opt-out; z-index 900 keeps it below modals
- .admin-main gains bottom padding so the bar never covers page content
- drop the now-unreachable idle hints: the ⌘S hint becomes a button title,
  the Live Sync note becomes a static line above the settings layout
- header "Site" link now bypasses the cache (/?fresh=1), so the preview
  stays reachable when the bar is hidden

Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>

* feat(admin): themed listbox for the album sort control (#427)

The per-album "Photo order" control was a native <select>. Because an
<option> cannot contain markup, its choices could not use the admin
panel's currentColor SVG set — the reason #415 had to fall back to plain
text after dropping the emoji labels.

Adds a Listbox component implementing the ARIA combobox/listbox pattern,
so options can render a glyph beside their label:

- DOM focus stays on the trigger button; the active option is announced
  through aria-activedescendant, keeping focus management to one element
- Keyboard: arrows (clamped at the ends, like a native select),
  Home/End, Enter/Space to commit, Escape to cancel, Tab commits and
  moves on, and prefix type-ahead with a repeat-key cycle
- Outside dismissal on pointerdown, so a press starting outside closes
  the popup before the click retargets

The sort options now carry an icon each: calendar, arrow-down, arrow-up,
an A→Z marker, and the drag glyph for manual — matching the badge the
album card already shows. SORT_LABELS stays plain text because the badge
feeds it to a title attribute.

Closes #417

Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>

* chore(git): ignore generated design handoff folders

* fix(admin): stop the album sort dropdown clipping, and simplify the panel (#428)

* fix(admin): render listbox popup in a portal so it escapes modal clipping

The sort control's popup was position:absolute inside three clipping ancestors
(.album-drawer overflow:hidden > .album-drawer-body overflow-y:auto >
.modal-right-column overflow-y:auto), so it was cut off at the bottom of the
Edit Album Details modal. z-index could not help: clipping happens before
stacking. It also always hung below the trigger, with no flip.

Portal the popup to document.body and position it from the trigger's viewport
rect, flipping above when there is more room there and capping max-height to the
space available so it scrolls internally rather than overflowing. It is
dismissed on scroll and resize, since the anchor is only measured on open.

The outside-pointerdown handler now also treats the popup as inside; without
that the portalled list counts as outside, and a click on an option would close
it before the selection commits.

* refactor(admin): single-column album details panel

The left column spent 1.2fr on a cover thumbnail and three stat rows, two of
which (Status, Custom Hero) only restated the form fields opposite them, while
the form itself was squeezed into 1.8fr behind a second nested scroller.

Stack the drawer in one column instead: cover as a banner, then the form at full
width, with the UUID moved into the footer. The body is now the only scroll
container, which also removes one of the ancestors that was clipping the sort
popup.

---------

Co-authored-by: ralksta <ralksta@users.noreply.github.com>

* fix(admin): give the portalled listbox its theme back, lock the page behind modals (#429)

Two defects in the album editor.

The sort listbox popup painted transparent. Every --admin-* variable is
scoped to .admin-layout, and since the popup moved into document.body it
sits outside that subtree, so background/border/text all resolved to
nothing. It now carries its own copy of the palette in both colour
schemes, plus the font it no longer inherits.

Scrolling inside a modal also moved the page behind it. No admin modal
ever locked body scroll: the overlay covers the page but does not absorb
wheel events, so a scroll starting on the backdrop — or continuing past
the end of the modal's own scroller — reaches the document.
overscroll-behavior cannot cover that case on its own, because it only
applies to scroll containers and the backdrop is not one.

useScrollLock freezes body while a modal is open and compensates for the
width the scrollbar gives up, so nothing shifts underneath. Each lock
restores the inline value it found, which makes nesting work without a
counter — a picker opened from the drawer restores the drawer's hidden
state instead of clearing it. Applied to both drawers and all four
picker modals, which share the defect. overscroll-behavior: contain on
the scrollers stops the chaining they can handle themselves.

Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>

* fix(security): allow unsafe-eval in CSP script-src during dev mode

* feat(journal): add Journal Studio with split-screen editor, live preview and dedicated routes

* fix(build): separate client parser from server journal-service and fix build type errors

* fix(journal): Fotos rendern, Layout und Lightbox-Steuerung korrigieren

Fünf unabhängige Fehler in der öffentlichen Journal- und Essay-Ansicht:

* Foto-Blöcke wurden nie angezeigt. EssayView löst ein Foto über
  PhotoItem.id auf, und das sind verschlüsselte Tokens — die Blöcke aus
  dem Markdown tragen aber rohe Asset-UUIDs. Jede Zuordnung lief ins
  Leere, und nicht auflösbare Blöcke werden still verworfen. Die IDs
  werden jetzt serverseitig übersetzt; damit verschwinden nebenbei die
  rohen UUIDs aus dem Client-Payload, die dort laut Projektregel nie
  auftauchen dürfen. Nicht auflösbare Referenzen werden geloggt.

* Überschriften standen weiter links als der Fließtext. Jeder Block
  hatte einzeln `max-width: 68ch`, und `ch` ist relativ zur Schrift des
  Elements — die Serif-Überschrift ergab eine breitere Spalte. Ersetzt
  durch eine gemeinsame, font-unabhängige `--essay-measure`.

* Fullbleed-Fotos bluteten nur nach links aus: `.essay-figure` ist
  `width: 100%`, wodurch die Box überbestimmt ist und der negative
  rechte Margin verworfen wird.

* Foto-Paare stellten beide Bilder gleich breit dar, wodurch ein
  Hochformat neben einem Querformat doppelt so hoch wurde. Jetzt eine
  Justified-Reihe: Breite proportional zum Seitenverhältnis, dadurch
  exakt gleiche Höhen ohne Beschnitt.

* Die Lightbox hatte im Journal keine Tastatursteuerung und keine
  Scroll-Sperre — beides lag in PhotoGrid, also nur im Album-Raster.
  Verlagert in die Lightbox selbst, der doppelte Handler in PhotoGrid
  entfernt (sonst wäre pro Pfeildruck zwei Bilder weitergesprungen).

Zusätzlich sind Proofing-Herzen und das EXIF-Panel im redaktionellen
Modus abschaltbar und im Journal aus: Client-Proofing ist ein
Übergabe-Workflow für Alben, keine Funktion einer Reportage. Auf der
Übersicht wurde der Untertitel doppelt gerendert, weil extractExcerpt()
auf ihn zurückfällt.

* feat(admin): eigene URLs für alle Bereiche und überarbeiteter Journal Studio

Das Panel war eine einzige Client-Komponente, die ihre Tabs über
useState umschaltet: keine Route pro Bereich, kein Deep-Link, kein
Zurück-Button, und nach jedem Reload landete man wieder auf "Pages".
Auch der Journal-Editor hatte keine eigene URL.

Jetzt sieben echte Routen (/admin, /admin/pages, /admin/journal,
/admin/journal/<slug>, /admin/settings, /admin/settings/<section>,
/admin/analytics). Die Shell mit Auth-Prüfung und Kopfzeile sitzt im
Layout und umschließt children — so bleibt die Session-Prüfung über
Routenwechsel montiert, statt bei jedem Tab-Wechsel neu zu laufen und
den Spinner aufblitzen zu lassen. Unbekannte Settings-Sections fallen
auf General zurück.

Im selben Zug der Journal Studio, der die Routing-Änderung ohnehin
berührt:

* Alle Eingabefelder nutzten die Klasse `admin-input`, die in keinem
  CSS definiert war — sie fielen auf Browser-Defaults zurück. Jetzt
  gestylt, gescoped, damit der generische Name nicht ins übrige Panel
  leckt.
* Der Split View ist per Divider verschiebbar (Maus, Tastatur,
  Doppelklick zum Zurücksetzen), Breite in localStorage.
* Das Studio bricht aus der 1120px-Spalte aus, die Preview hat Platz.
* Die Preview zeigte für jedes Foto fest 3:2 und log damit über das
  Layout der veröffentlichten Seite; die echten Verhältnisse werden
  jetzt an den Thumbnails gemessen.
* Blöcke mit alten positionsbasierten Foto-Referenzen werden markiert —
  die lassen sich auf einer eigenständigen Journal-Seite nicht auflösen
  und verschwanden bisher stillschweigend.
* Blocktyp-Chips als gemeinsame Komponente, monochrom und per Icon
  unterschieden statt in einer eigenen Blau/Lila/Orange-Palette, die
  sonst nirgends im Panel vorkommt.
* Emojis raus, SVG-Icons rein.

* fix(admin): Designsystem-Lücken im Panel schließen

Eine systematische Suche nach Klassen, die im TSX benutzt, aber in
keinem CSS definiert sind, hat vier Stellen mit demselben Muster
gefunden:

* `admin-btn-secondary` und `admin-btn-danger` existierten nicht.
  Sämtliche Löschen-Buttons sahen aus wie normale Buttons — keine
  Warnwirkung. Als `.admin-btn.admin-btn-danger` geschrieben, weil die
  Varianten mit den Größenklassen kombiniert werden, die weiter unten
  ihren eigenen Hintergrund setzen.
* `page-progress-fill` fehlte: die Balken im Analytics-Panel waren
  leere Rinnen, der Wert unsichtbar. Ebenso `analytics-empty` und
  `admin-loading-container`.
* `subpage-drawer-section`, `subpage-drawer-title-group` und
  `input-with-icon` im PageBuilder waren wirkungslos und teils mit
  Inline-Styles notdürftig kompensiert.
* `grid-card-preview` fehlte, wodurch alle Layout-Vorschauen auf Höhe
  null kollabierten. Nur "Showcase" war sichtbar — und das aus Versehen,
  weil sein Tile `hero-tile` hieß und damit die `aspect-ratio` einer
  fremden PageBuilder-Klasse erbte. Umbenannt.

Dazu die Theme-Vorschauen, die praktisch identisch aussahen: alle
sieben zeigten dieselben drei quadratischen Kacheln, einziger
Unterschied war die Hintergrundfarbe. Sie spiegeln jetzt die echten
Preset-Daten aus lib/config/theme.ts — Schriftcharakter, Eckradius,
Rasterdichte, Passepartout bzw. Schatten.

Die Kopfzeile richtet sich an einer gemeinsamen Steuerhöhe aus. Der
"Site"-Link war höher als die Buttons daneben: `.admin-btn` hatte keine
explizite line-height, und <button> bekommt box-sizing: border-box vom
Browser, <a> nicht. Die Statusanzeige setzte weder Schriftfamilie noch
-größe und fiel auf den Browser-Default zurück — sie war nie Teil des
Designsystems. Jetzt gleiche Höhe und Typografie, Pillenform als
Zustandsanzeige, Trenner zur Aktionsgruppe. Das dauerhafte Pulsieren
des grünen Punkts entfällt; Animation bleibt den Zuständen vorbehalten,
die Aufmerksamkeit brauchen.

Restliche Emojis durch SVG-Icons ersetzt.

* feat(admin): add scroll-to-top toggle and SVG arrow

The back-to-top button was always on and drew its arrow with the ↑ text
character. Add a `scrollToTop` setting (General section in the admin
panel, defaults to on so existing sites are unaffected) and replace the
glyph with a stroked SVG that inherits currentColor across all presets.

Scroll handling is now rAF-throttled, and prefers-reduced-motion turns
off both the hover lift and the smooth scroll.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* security(journal): escape author HTML instead of filtering it

CodeQL flags 26 high-severity alerts on the release PR; the bulk of them
point at sanitizeHtml(), a denylist of three regexes whose output goes
into dangerouslySetInnerHTML. I reproduced the bypasses before changing
anything — all four pass the old filter:

  <img src=x onerror=alert(1)>        unquoted handler, regex wants quotes
  <img src=x onerror='alert(1)'>      single quotes, same reason
  <svg onload=alert(1)>               not a <script> tag
  javasjavascript:cript:alert(1)      one-pass replace, the rest recombines

Plus an attribute breakout in the link renderer, which interpolated the
URL into href="${url}" unescaped:

  [x](" onmouseover=alert(1) x=")  ->  <a href="" onmouseover=alert(1" ...>

Replaced with escaping. Every `&<>"'` in author text becomes an entity
before any markdown rule runs, so the only tags in the output are the
ones renderInlineMarkdown builds itself and a URL cannot leave its
attribute. Link schemes are now an allowlist (http, https, mailto, tel,
relative, anchor); anything else renders as plain text.

The serializer needed decodeHtmlEntities to match: without it a save
would write `&lt;` into the Markdown file and the next parse would
escape the `&` again, corrupting the text further on every round trip.
A test covers parse -> serialize -> parse stability.

Two existing tests asserted the old behaviour and were rewritten rather
than deleted: one expected the script tag to be *removed* from the
output, the other expected the substring "onerror" to be absent. Both
now assert the property that matters — that no tag can form — because
`onerror` surviving as inert text is fine.

Exploitation required admin access either way: journal and essay text
comes from the studio or from content/*.md. This removes the weakness,
it does not close an open door.

* fix(journal): contain file paths, fix frontmatter escaping, defuse two regexes

Follow-up to the CodeQL findings on release PR #432. I went through all 23
alerts individually; this addresses the ones that are worth addressing and
documents the ones that are not.

Path containment (12 alerts, all false positives). Every path built from a
slug goes through isValidSlug(), a strict `/^[a-zA-Z0-9_-]+$/` allowlist —
verified against `../../etc/passwd`, `foo/../../bar`, `a/b`, `..` and
friends, all rejected. CodeQL cannot see it because the check lives in
another module. Added a containedPath() helper that resolves the path and
refuses anything landing outside the content directory: a second lock on a
door that was already locked, and a barrier the analysis can follow. Also
removed the dead `slug.endsWith('.md')` branches — isValidSlug rejects
dots, so they could never be taken.

Frontmatter escaping (1 alert, a real bug). The serializer escaped `"` but
not `\`, and the parser never unescaped anything. A title containing either
character gained a backslash on every save/load cycle:

  Path C:\Users "quoted"  ->  Path C:\\Users \"quoted\"  ->  ...

Escaping now covers the backslash first and the parser undoes both. A round
trip test covers quotes, backslashes, colons and apostrophes.

Two of three ReDoS regexes (2 alerts). The heading pattern had `\s+` next to
`(.+)`, which overlap, so the engine tried every split of the whitespace run
before failing; it is `[ \t]+` and `(\S.*)` now. The quote author pattern
wrapped a lazy group around an optional group — the quadratic case — and is
an index split on the first separator now.

The third regex, the bold/italic pass, is deliberately left alone. Rewriting
it with a negated class removes the backtracking but breaks nesting:
`**bold *and italic* here**` renders as `*<em>bold </em>and italic<em> here</em>*`.
The input is Markdown from an authenticated admin, never a visitor, so the
worst case is an author slowing down their own page. The comment in the code
says so.

Not addressed: 5 js/insufficient-password-hash alerts. They ask for a slow
KDF where the code uses SHA-256/HMAC — correct in general, but the admin
password comes from an environment variable and is never stored, so a
stronger KDF protects nothing that is not already in plaintext in the
environment.

399 unit tests pass (18 new), build and tsc clean.

* fix(journal): split the quote author by scanning, not by pattern

Cleaning up after myself. #439 replaced the quote author regex
`/^(.*?)(?:\s+--\s+(.+))?$/` — a lazy group around an optional one, the
quadratic case — with `/\s+--\s+/`, and CodeQL promptly flagged the
replacement for the same reason. One reported pattern traded for another.

splitQuoteAuthor() scans for the first `--` that has whitespace on both
sides. Linear, and it needs no reasoning about the regex engine at all.

Behaviour is identical to the original regex, checked case by case
against it: separator, no separator, several separators, tabs, wide gaps,
`a--b` without spaces, leading and trailing separators, empty string. All
nine are covered by tests, plus one asserting it stays fast on a 50k
whitespace run.

* security(admin): derive the session signing key with scrypt

getSigningKey() ran the admin password through a single SHA-256 digest.
It is key derivation rather than password storage, so it was never a
stored-hash problem — but if the derived key ever leaked, one fast hash
makes recovering the password by brute force cheap. CodeQL flags it as
js/insufficient-password-hash and, for this particular alert, has a
point.

scrypt now. Two details that matter:

The salt has to be stable. A random salt would produce a different key on
every call and invalidate every session; it is derived from AUTH_SECRET,
which is deployment-specific. Verified across separate processes: same
inputs produce a verifying token, so a restart or redeploy does not log
everyone out.

The result is cached for the process lifetime. scrypt is deliberately
slow and getSigningKey() runs on every admin request — deriving per call
would add ~24ms to each one. The cache key is a digest of secret plus
password, so a rotation misses the cache and derives again, and no extra
plaintext copy of the password is kept around.

Measured: first derivation 24ms, subsequent calls 0.12ms. Password
change and secret change both invalidate an existing token, checked in
separate processes.

Note the one-time effect: existing admin sessions are invalidated by the
change in derivation, so everyone logs in once more.

* security(admin): key the signing-key cache on its inputs, not a digest

#441 removed the SHA-256 digest of the admin password from the key
derivation and introduced a new one three lines above it, as the cache
key. Same rule, same file: CodeQL reported it immediately.

The comment justifying it was wrong too. It claimed no second plaintext
copy of the password was retained, while building the digest input
allocates exactly that in order to hash it.

The cache now holds the two input strings and compares them directly.
They are the same objects the env and install caches already hold, so
nothing extra is retained, and no fast hash of the password exists in
memory for the life of the process.

Re-verified after the change, in separate processes: a token from one
process verifies in another with the same inputs, a changed password or
secret rejects it, first derivation 24ms, cached calls 0.001ms.

That leaves scrypt as the only place the password is hashed here. The
two HMACs further down operate on the derived key and on token data, not
on the password; the constant-time comparison in verifyAdminPassword is
the previously dismissed one.

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
 2026-08-14 16:55:07 +02:00
Ralksta
d4d8c8b42f 🛡️ Sentinel: [HIGH] Fix timingSafeEqual DoS Vulnerability (#423) 
* Fix timingSafeEqual DoS Vulnerability in Webhook

Co-authored-by: ralksta <16941050+ralksta@users.noreply.github.com>

* Fix memory exhaustion DoS in token decoding

Co-authored-by: ralksta <16941050+ralksta@users.noreply.github.com>

---------

Co-authored-by: google-labs-jules[bot] <161369871+google-labs-jules[bot]@users.noreply.github.com>
 2026-08-14 11:10:42 +02:00
Ralksta
2318409e75 chore(release): v0.10.0 (#400) 
Photo Essay mode, client proofing, studio-modern preset, admin panel overhaul, watermark, cookieless analytics, subpage toggle, SEO title templates. Analytics API now admin-only, Trivy scan on publish. Album order mirrors the Immich timeline; map theme, admin status panel, lightbox counter and Docker health check fixed.

See CHANGELOG.md for the full list and the health-check upgrade note.
 2026-08-10 09:56:20 +02:00
Ralksta
c9036fdc94 security: add Trivy container scan to Docker publish workflow (#399) 
* feat(admin): add backup manager UI with 1-click restore

* feat(admin): collapse older backup entries by default

* fix(theme): isolate admin layout, instant DOM theme updates, and add Light/Dark mode toggle

* feat(admin): replace text controls for Photo Frame and Hero Style with visual preview cards

* fix(admin): define missing CSS rules for button system (.btn, .preset-btn)

* feat(admin): redesign theme settings with segmented mode toggle, accent color swatches, and custom iOS-style toggle cards

* feat(admin): upgrade all settings tabs with visual grid previews, Google SEO snippet preview, and toggle cards

* feat(admin): overhaul Pages Builder UX with slide-over drawer, card hover badges, real-time search, and floating save bar

* fix(admin): remove leftover dangling syntax snippet in PageBuilder.tsx

* fix(admin): add position: relative to subpage-tile so hover overlay is contained inside the tile

* style(admin): replace all emojis with clean Leica-style vector SVG icons

* fix(types): extend IconProps with SVGProps to allow style prop on Leica SVG icons

* feat(admin): add subpage live-preview, privacy analytics, and asset protection settings

* fix(typecheck): fix AlbumEntry property access in subpage drawer preview mode

* fix(types): fix ImmichAlbumInfo property names thumbnailAssetId and albumName in PageBuilder.tsx

* fix(types): add protection and watermark optional properties to AppConfig interface

* feat(settings): add toggle for disabling analytics tracking (defaults to enabled)

* feat(ux): show status banner when analytics tracking is disabled + add live sync indicator

* feat(watermark): render customizable watermark overlay on Lightbox images + rename section to Portfolio Features & Modules

* fix(types): import type LightboxWatermark in PhotoGrid.tsx

* fix(types): destructure watermark prop in PhotoGrid function signature

* feat(seo): add configurable subpage title template and metadata descriptions

* feat(seo): add generateMetadata to about page for title template support

* feat(proofing): add client proofing, favorites selection, compact URL bitmasking, and export modal

* feat(essay): add Photo Essay storytelling mode with RSC markdown parser and fullbleed/pair layouts

* feat(subpages): add page enabled toggle to deactivate subpages without deleting them

* feat(admin): add visual essay block builder for photo essay storytelling pages

* security: add Trivy container scan to Docker publish workflow

Scans the built image for CRITICAL/HIGH CVEs on every release and
uploads results to the GitHub Security tab. Non-blocking for now
(exit-code 0) so releases aren't gated on findings. Also documents
the scan and existing Dependabot coverage in the README.

---------

Co-authored-by: ralksta <ralksta@users.noreply.github.com>
 2026-08-07 11:08:04 +02:00
Ralksta
716ae14b0f Close the gaps left after v0.9.2's outage handling: route tests, stale cache, loading states (#397) 
* docs: brainstorm resilience/adoption features and plan follow-up work

Brainstorm and deep-dive on where Immich Folio breaks under Immich
outages and what blocks self-hosted adoption, plus an implementation
plan for the remaining gaps after v0.9.2 (route-handler tests,
stale-while-error caching, loading skeletons).

* test: enable route-handler tests and cover admin guards and image content-type

vitest.config.ts only ran lib/__tests__/**, so route handlers were
structurally untestable. Two mechanisms live only at the route level and
cannot be extracted the way lib/imageSize.ts was: the admin auth guards
and the image proxy's Content-Type sanitisation (the stored-XSS fix from
c2fa8e7). Both were correct but unverified by any test.

Adds a table-driven test over all ten guarded /api/admin/* handlers,
including a filesystem walk that fails if a future route is added
without a row in the table. Adds a route-level test for
/api/image/[id] covering token validation, the six Content-Type
rewrite cases, ETag/304, and the 404 vs 503 (ImmichUnavailableError)
distinction.

Verified both catch real regressions by temporarily removing the admin
guards and the Content-Type rewrite and confirming the expected tests
fail, then restoring and confirming green again.

134 new tests (244 total, up from 210), tsc 0 errors, build succeeds.

* feat: serve stale cache entries while Immich is unavailable

v0.9.2 (#394) correctly split "gone" (404/410) from "unavailable"
(ImmichUnavailableError), and pages now render a 5xx instead of a false
404 during an outage — but that 5xx still replaced a gallery that had
loaded fine seconds earlier. lib/cache.ts deleted expired entries on
access, so nothing survived long enough to fall back to.

Cache entries now carry two deadlines: staleAt (the existing CACHE_TTL,
after which get() still reports a miss) and hardExpiresAt (the new
STALE_MAX_AGE, default 24h, after which the entry is dropped entirely).
Between the two, getStale() can still return the data.

getAlbums(), getAlbum() and getAssetInfo() catch ImmichUnavailableError
and fall back to getStale() before propagating. The two MISSING-sentinel
writes (definitive 404s) are deliberately left on the short cacheTtl
window — a corrected asset ID should take effect after the normal TTL,
not sit in the 24h stale window meant for outages.

STALE_MAX_AGE=0 disables the fallback. Verified the fallback only
engages on a real outage, not on a cache hit at the TTL boundary, and
that a definitive 404 still reports missing rather than falling back.

256 tests (up from 244), tsc 0 errors, build succeeds.

* feat: add loading skeletons for dynamic gallery routes

Every gallery route is force-dynamic and waits on a live Immich
round-trip — up to IMMICH_TIMEOUT_MS when the server is struggling —
with nothing rendered until it resolves. loading.tsx renders instantly
while the page component awaits its data.

Not browser-verified against live data: this worktree has no
.env.local and only .example content files, so the app boots into
setup mode (confirmed the dev server starts cleanly and the setup
screen renders, HTTP 200). tsc 0 errors, build succeeds, no new lint
errors.

* docs: document stale cache window, image token revocation, route-test convention

- README: STALE_MAX_AGE env var and a "Behaviour when Immich is
  unreachable" section (stale-serves-until-STALE_MAX_AGE, 503 not 404,
  outages never cached).
- docs/gallery-config.md: new "Image Token Revocation" subsection under
  System & Security — un-publishing an album does not revoke already
  issued image URLs; rotating AUTH_SECRET does.
- CLAUDE.md: updated cache description to cover the stale window and
  MISSING sentinel, and a new code-convention note that route-level
  logic (guards, header sanitisation) should get a route-level test
  rather than being extracted into lib/ just to reach the test runner.

---------

Co-authored-by: ralksta <ralksta@users.noreply.github.com>
 2026-08-07 11:07:34 +02:00
Ralksta
871d54fafb security: stop leaking the admin password length through timing (#395) 
verifyAdminPassword compared the raw strings, so timingSafeEqual could
only run once the lengths already matched. The early return on a length
mismatch is observable: an attacker who can time login attempts learns
how long ADMIN_PASSWORD is, which is exactly the information that makes
a brute-force search tractable. The dummy comparison that guarded the
mismatch path did not help — it ran on Buffer.alloc(attempt.length),
which is attacker-sized and leaves the branch timing intact anyway.

HMAC both sides to a fixed 32 bytes first, then compare. Every attempt
now takes the same path regardless of length. Keyed with AUTH_SECRET
rather than a bare SHA-256 so the intermediate values are useless
without the secret, matching how lib/auth.ts already compares subpage
passwords.

MAX_PASSWORD_LENGTH caps an attempt at 1024 characters, rejected in the
route before the body reaches the hashing path and again in the library
so no caller can bypass it. 1024 is far above any real passphrase — a
cap a user could actually hit would be a lockout, not a fix.

Supersedes #390 and #388, which fixed the same comparison with an
unkeyed digest. The .jules/sentinel.md note the original branch carried
is left out: .jules/ is gitignored since cf2e8e6.

Adds 3 tests: a wrong password of exactly the right length, an
oversized attempt, and that a long configured password still logs in.

Verified: 210 unit tests passing (207 before), vitest exit 0, tsc 0
errors, production build exit 0, prettier clean.

Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
 2026-08-05 12:13:32 +02:00
Ralksta
300a031445 fix: Immich outage handling, image tiers, admin save safety (#394) 
* fix: migrate deprecated middleware convention to proxy

Next.js 16 deprecated the `middleware` file convention in favour of
`proxy`. The build warned on every run, and the convention is slated for
removal in a future major — at which point Next.js would silently stop
invoking this file. That is not a cosmetic failure: proxy.ts owns the
Content-Security-Policy and the per-request nonce, so an uninvoked file
means every document response ships with no CSP at all, with nothing in
the build output to catch it.

Renames middleware.ts to proxy.ts and the exported middleware() to
proxy(), per the official migration. The config.matcher export is
unchanged, so route coverage is identical.

Adds lib/__tests__/proxy.test.ts, which pins the export name and
verifies the behaviour a silent regression would take out: a CSP is set,
the nonce in the policy matches the one forwarded to pages via x-nonce,
nonces differ per request, x-pathname still reaches the root layout, and
the matcher continues to cover /admin.

Verified: tsc 0 errors, 105 unit tests passing (98 before), production
build succeeds with 0 deprecation warnings.

* fix: stop reporting Immich outages as missing albums

lib/immich.ts request() returned null for every failure mode: a 5xx, a
rejected API key, a network error, and a non-JSON body all looked exactly
like "Immich answered and said this does not exist". Callers had no way
to tell the two apart, and app/[...path]/page.tsx calls notFound() on a
null album in five places.

The result was that while Immich was down or returning 5xx, every album
URL served a hard 404 — for albums that exist. Visitors saw "not found",
and crawlers were free to de-index real content over a transient outage.

request() now throws ImmichUnavailableError for anything that is not a
definitive answer about the resource, and reserves null for 404 and 410.
Pages let that propagate, so an outage surfaces as a 500 rather than a
404. Two callers must not propagate and are handled explicitly:

- ping() catches and returns false — it answers "is Immich reachable",
  and both callers (/api/health, /api/admin/status) render that as a
  status field.
- /api/exif and /api/map return 503 with Retry-After instead of 404 and
  an empty marker list respectively. An empty map is otherwise
  indistinguishable from a gallery with no GPS data.

Adds 10 tests: each failure mode maps to the right outcome, getAlbum and
getAlbums propagate rather than reporting empty, ping stays non-throwing,
and a failed request leaves no stale entry in the in-flight coalescing
map — which would otherwise replay the failure after Immich recovered.

Verified: tsc 0 errors, 115 unit tests passing (105 before), production
build exit 0, eslint 0 errors on all touched files.

* fix: bound how long Immich requests may hang

lib/immich.ts set no timeout on any of its three fetch call sites, so the
only ceiling was undici's built-in default, measured in minutes. Every
page is force-dynamic, which means an Immich that accepts connections but
never answers held each visitor's render open for that whole window —
and since nothing caches the failure, load kept arriving.

Adds IMMICH_TIMEOUT_MS (default 15000, floored at 1000 so a stray 0
cannot mean "no timeout"), threaded through env.ts and AppConfig like
CACHE_TTL.

The two kinds of call need different treatment:

- request() carries a whole-exchange AbortSignal.timeout(). JSON
  payloads are small, so one budget can cover headers and body.
- streamAsset()/streamVideo() use an AbortController whose timer is
  cleared in a finally the moment response headers arrive. A large
  original photo or a long video is legitimately slow to transfer; a
  whole-request timeout would truncate playback and break seeking, since
  every range request would restart the clock.

A timed-out request surfaces as ImmichUnavailableError naming the budget,
so a misconfigured value is diagnosable from the log line alone.

Adds 5 tests, including the two that pin the distinction: a stream whose
headers have arrived is not aborted an hour later, while a stream that
never sends headers still is.

Verified: tsc 0 errors, 120 unit tests passing (115 before), production
build exit 0, no new eslint errors (the one error in env.ts is
pre-existing — confirmed against a clean tree).

* fix: stop caching Immich outages as permanently missing media

f3 split "gone" from "unavailable" in request(), but streamAsset() and
streamVideo() have their own fetch calls and were left returning null for
every failure. Both proxy routes turn null into a 404.

That 404 carried no Cache-Control, and a 404 is heuristically cacheable
per RFC 9111 — on URLs the success path serves as `immutable`. So a
transient outage, or a timeout introduced in 370e668, could pin a broken
image or an unplayable video in the visitor's browser cache well after
Immich recovered.

Both stream methods now throw ImmichUnavailableError for transport
failures, timeouts, and any error status other than 404/410, and reserve
null for genuinely absent media. A 200 with no body counts as
unavailable, not as missing. The routes translate that into 503 with
Retry-After, and both error responses — the 503 and the real 404 — now
send Cache-Control: no-store.

streamVideo keeps accepting 206, so range requests and seeking are
unaffected.

Adds 7 tests covering each failure mode for both methods plus the 206
path, and updates the F4 timeout test, which asserted the old null return.

Verified: tsc 0 errors, 127 unit tests passing (120 before), production
build exit 0, eslint 0 errors on touched files.

* perf: cache "does not exist" answers from Immich

getAlbum() and getAssetInfo() cached successes but discarded a definitive
"not found", so a missing resource was re-queried upstream on every call.

Measured before: 5 sequential lookups of a missing asset produced 5
upstream fetches. After: 1.

This is not hypothetical. app/page.tsx resolves every gallery.yaml hero
ID through getAssetInfo() on each render, and the homepage is
force-dynamic — so a hero photo deleted from Immich but still listed in
gallery.yaml cost one 404 round-trip per page view, indefinitely.

Absence is stored as a frozen MISSING sentinel because the cache cannot
distinguish a miss from a stored null; both read back as null.

Only definitive 404/410 answers are cached. An outage throws
ImmichUnavailableError and is deliberately never stored — caching one
would keep the gallery broken after Immich recovered. A test pins that:
a 503 followed by a healthy response must reach Immich the second time.

Stored under the normal cacheTtl rather than a separate shorter negative
TTL, because the reason for a shorter one no longer applies: outages are
not cached at all now, and both invalidation paths (the Immich webhook
and the admin save/reload) clear the entry immediately, so a corrected
asset ID takes effect at once rather than waiting out a TTL.

Also raises the test config's cacheTtl from 0, which expired entries in
the same millisecond they were written and would have made any caching
assertion flaky. Test isolation comes from cache.clear() in beforeEach.

Verified: tsc 0 errors, 131 unit tests passing (127 before), production
build exit 0, eslint 0 errors on touched files.

* fix: add themed error and not-found pages

The app had no app/error.tsx, app/not-found.tsx or global-error.tsx, so
every failure fell through to Next.js's unstyled default page.

That gap became visible with 253ade0, which made an Immich outage produce
a 500 instead of a false 404 — correct, but what a visitor saw was a bare
framework error screen with none of the site's theming.

The two pages also carry the distinction the error split was for, and
they carry it structurally rather than by inspecting the error: notFound()
renders not-found.tsx, a throw renders error.tsx. That matters because
Next.js strips error messages in production and replaces them with a
digest — this component genuinely cannot tell an Immich outage from any
other server error, so it does not claim to. It frames the failure as
temporary and offers reset(); not-found.tsx deliberately does not, since
a real 404 is not transient.

The digest is shown so a user report can be traced to a log line. The raw
error message is never rendered — it can carry an upstream URL, a header
or a config value.

Both pages reuse .empty-state, which existed in globals.css but was
unreferenced anywhere in the app; extended with title, actions and button
elements matching the PasswordGate button, the only other action button
in the codebase.

Tested by server-rendering both components (react-dom/server, no new
dependencies) — 8 tests covering the styling hook, the retry and home
affordances, digest handling, and that a message containing an API key or
host address does not reach the markup. Note vitest.config.ts only
includes lib/__tests__/**/*.test.ts, so the test uses createElement
rather than JSX; a .tsx file there would never run.

Not verified in a browser: this worktree has no .env.local and only
.example content files, so the app boots into setup mode and neither
Playwright nor a dev server can exercise these routes here.

Verified: tsc 0 errors, 139 unit tests passing (131 before), production
build exit 0 with /_not-found registered, eslint 0 errors.

* perf: drop the unused originalUrl from every photo item

PhotoItem declared originalUrl and toPhotoItems computed it for every
asset, but a repo-wide grep found exactly two references: the field
declaration and the assignment. Nothing ever read it — the grid uses
thumbUrl, the lightbox uses previewUrl.

The cost was not the encryption. PhotoItem is a server-to-client prop, so
the dead field was serialized into the RSC payload and shipped to the
browser for every photo.

Measured: 137 bytes per asset once serialized, so 6.7 KB for a 50-photo
album and 66.9 KB for a 500-photo one — transferred and parsed on every
page view, never read.

Removed rather than wired up to a "view original" affordance. Exposing
full-size originals is a bandwidth and privacy decision for the project
to make deliberately, not something to infer from a dangling field.

No unit test: this is a deletion whose correctness is exactly "nothing
referenced it", which tsc and a repo-wide grep already establish. A test
asserting the absence of a field would restate the type checker.

Verified: tsc 0 errors, 139 unit tests passing, production build exit 0,
eslint unchanged at 4 pre-existing errors on the touched files (unused
imports, confirmed identical against a stashed clean tree).

* chore: remove four orphaned imports from the catch-all route

Link, Image, PhotoGrid and BackLink were imported by app/[...path]/page.tsx
and never used — 4 of the 6 no-unused-vars errors in the repo baseline.

Verified they are leftovers, not a dropped render path: PhotoGrid and
BackLink are both rendered by AlbumDetailView, which imports them itself,
and BackLink is also used by the impressum and map pages. Rendering was
extracted out of page.tsx into AlbumDetailView/SubpageGridView at some
point and the imports stayed behind. `type PhotoItem` is still needed by
toPhotoItems, so that import narrows to a type-only import rather than
disappearing.

No bundle win, measured: .next/static is 1084 KB across 20 JS chunks both
before and after, byte-identical. Turbopack already tree-shook them. The
backlog note that predicted unused client-component imports would hold
them in the client graph was wrong, and has been corrected there.

The value is readability and lint: repo errors drop from 54 to 50, and
page.tsx no longer reads as though it renders the grid itself.

chore: rather than fix:/perf: — nothing behaves differently and the
measurement showed no performance change, so either of those labels would
misdescribe it. CLAUDE.md lists chore: as a valid prefix.

Verified: tsc 0 errors, 139 unit tests passing, production build exit 0,
eslint 0 errors on the touched file.

* fix: make ?w= able to narrow the image tier instead of being ignored

The image proxy resolved its Immich rendition with `?size=` winning
whenever present, falling back to `?w=` otherwise. lib/urls.ts always
writes `?size=`, so for every URL this app generates the width branch was
unreachable and widthToSize() was dead code — while CLAUDE.md documented
the width mapping as the actual behaviour.

`?size=` is now a ceiling rather than an override: when both are present
the smaller tier wins, so a width can narrow the request but never widen
it. That asymmetry is the point. Letting width win outright — the obvious
reading of the docs — would have been a real regression: next/image emits
widths up to 3840 and widthToSize(1920) is 'original', so every large
display would have started downloading full-size originals in place of
previews. A test pins that specific case.

No measured change today. The only URLs carrying both parameters are
?size=preview with next/image widths, whose smallest vw-based deviceSize
is 640 — already preview either way. This is a correctness fix that makes
the documented contract true and testable, not a performance win.

Moved the logic to lib/imageSize.ts so it can be tested at all:
vitest.config.ts only collects lib/__tests__, so nothing inside a route
file is reachable from the suite. 9 tests cover the tier boundaries, both
single-parameter paths, malformed input, and the ceiling behaviour.

CLAUDE.md updated to describe the ceiling rule rather than a plain
width mapping.

Verified: tsc 0 errors, 148 unit tests passing (139 before), production
build exit 0, eslint 0 errors on touched files.

* fix: validate the per-album heroImage UUID from gallery.yaml

Every asset ID in gallery.yaml is routed through validateUuid before it
can reach encodeAssetId, which encrypts whatever it is handed. One was
not: for a per-album entry the album ID (the map key) was validated while
the heroImage value was stored raw.

A typo there produced a perfectly well-formed image URL that 404s forever,
with nothing in the log naming the cause — the failure surfaced as a
broken hero image on an album page, far from the line that caused it.

This is narrower than the finding that prompted it, which proposed
guarding encodeAssetId itself. Validation belongs at config load, where it
runs once and can name the file and the album; a guard in encodeAssetId
would run on every render and duplicate validateUuid at the wrong layer.
The heroImage path was the only unvalidated route into it.

validateUuid warns and substitutes the nil UUID rather than throwing, so a
bad ID still degrades to a missing image instead of taking the page down —
and since f511e62 that 404 is negative-cached, so it costs one upstream
request rather than one per render.

Adds 4 tests. The two that pin the wiring were mutation-checked: both fail
against the unfixed code and pass with it.

Verified: tsc 0 errors, 152 unit tests passing (148 before), production
build exit 0, eslint 0 errors on touched files.

* fix: keep /admin reachable when gallery.yaml cannot be derived

getConfig() throws on three shapes the admin page builder is able to
write: a gallery with neither albums nor subpages, a subpage with no name,
and a subpage with neither albums nor sections.

RootLayout called it unguarded, and a throw in a *layout* is not caught by
app/error.tsx — that needs a global-error boundary, which this app does
not have. /admin renders inside that same layout, so one bad save took
down the site together with the only tool that could undo it. Recovery
meant editing content/gallery.yaml on the host, or exec'ing into the
container. This is issue #326's failure mode reached through an invalid
config instead of a missing one.

Adds getConfigOrNull(), which returns null rather than throwing and logs
the underlying error plus the path to content/.backups/. The layout treats
null exactly like needsSetup: setup screen for visitors, children rendered
for admin paths so the panel still loads. generateMetadata() is guarded
too — it also calls getConfig(), and it also runs before any error
boundary.

This is the half of the finding that makes every broken config
recoverable, including ones this app never wrote: a hand-edited file, a
restored backup, a config from an older version. The other half —
validating in the admin PUT so the bad state is never written — is filed
separately; it prevents new breakage but cannot repair existing breakage,
so it was not the one to do first.

Adds 10 tests. Three pin the premise by asserting getConfig() really does
throw on each shape, so the fallback cannot quietly become dead weight.
One asserts the needsSetup path still returns a config rather than null,
since missing and invalid are different states that must not collapse.

Not verified in a browser: this worktree has no .env.local and only
.example content files, so the layout/error-boundary interaction is
reasoned from Next.js semantics and covered at the getConfig level only.

Verified: tsc 0 errors, 162 unit tests passing (152 before), production
build exit 0, eslint 0 errors on touched files.

* fix: reject an admin save the site would not be able to load

The admin PUT validated only the shape of the hero field, then wrote. None
of getConfig()'s three throw conditions was checked, so the page builder
could persist a gallery.yaml that cannot be loaded — and the user got
"Saved successfully" for it. Since 95877af that no longer locks anyone
out, but the public site still drops to the setup screen until someone
notices.

Extracts the gallery half of getConfig() into deriveGallery(), which the
route now runs against the proposed gallery before writing. Two
alternatives were rejected on purpose:

- Re-checking the three conditions in the route would put a second copy of
  the rules next to the first, and the two would drift.
- Write-then-verify-then-roll-back leaves a window in which other requests
  read the broken config.

The extraction is a pure move: no logic changed inside it, and all 162
pre-existing tests pass untouched, which is what makes that claim
checkable rather than asserted.

The 400 carries the derivation's own message, so the admin UI names the
offending subpage instead of saying "invalid gallery" — a builder with a
dozen subpages needs to know which one. A test pins that the message
identifies it.

Adds 8 tests: each rejected shape, the named-subpage message, and the
valid structures (standalone albums, subpage membership, sections,
per-album overrides and hero images) so the extraction cannot silently
lose behaviour.

Verified: tsc 0 errors, 170 unit tests passing (162 before), production
build exit 0, eslint 0 errors on touched files.

* fix: hash subpage passwords off the main thread

verifyScrypt used crypto.scryptSync, measured at 22.8ms per call — 22.8ms
during which the Node process serves nothing else, because the sync
variant runs on the main thread rather than the libuv threadpool.

The /api/auth rate limit does not contain this. It allows 10 attempts per
minute, but the bucket key is the client IP, and with the default
TRUSTED_PROXY_HOPS=0 that IP is read from x-real-ip / x-forwarded-for —
both attacker-controlled. lib/rate-limit.ts already documents that those
headers are spoofable at hops=0; what followed from it was not written
down anywhere: one attacker rotating a header gets unlimited buckets, and
each request buys 22.8ms of dead process. Roughly 44 requests per second
saturates it.

Switches verifyScrypt and generateScryptHash to the async crypto.scrypt,
which runs on the threadpool. This does not stop the spoofing — that is
inherent to hops=0 and already documented — it removes the amplification
that made spoofing worth doing.

authenticate() becomes async. It had exactly one caller
(app/api/auth/route.ts). isAuthenticated() is deliberately left
synchronous: it only computes an HMAC, and it is called from server
components.

Adds 4 tests, two of which pin the fix and were mutation-checked against
the old implementation — both fail with scryptSync and pass with scrypt.
One asserts scryptSync is never called; the other asserts a 2ms interval
still fires during a hash, which is the property that actually matters. A
slower machine lengthens the hash and yields more ticks, so that test
fails on a blocked loop rather than on a busy one.

Also adds a scrypt-hashed fixture subpage, so the suite exercises
verifyScrypt rather than only the deprecated plaintext fallback.

Verified: tsc 0 errors, 174 unit tests passing (170 before), production
build exit 0, eslint 0 errors on touched files.

* fix: warn when TRUSTED_PROXY_HOPS cannot identify a client

getClientIp falls back to a shared 'unknown' bucket whenever the
X-Forwarded-For chain is shorter than the configured hop count, or the
header is absent with hops > 1.

That fallback is correct — the alternative is trusting a spoofable entry —
but it was silent, and silence is the problem. Every unidentified request
shares one bucket per endpoint, and this is an image proxy: a single
50-photo grid issues ~50 /api/image requests, so the default
RATE_LIMIT_RPM=1500 is collectively spent by roughly 30 page loads a
minute. Someone who sets TRUSTED_PROXY_HOPS=2 for Cloudflare-plus-nginx
and then reaches nginx directly gets a site that 429s everyone, with
nothing in the log pointing at the cause.

Warns once per process, naming the configured hop count and what was
actually seen — the chain length, or which header was missing. Once, not
per request: enough to diagnose without flooding the log.

The fallback itself is unchanged. Trusting a shorter chain would hand
every client its own bucket key and defeat the limiter entirely.

No warning at hops=0, where the shared bucket is the documented
consequence of not declaring a proxy rather than a misconfiguration.

Adds 6 tests covering each fall-through path, the once-per-process
behaviour, and both silence cases. The once-per-process flag needs a test
seam to re-arm, hence the __resetProxyWarningForTests export.

Verified: tsc 0 errors, 180 unit tests passing (174 before), production
build exit 0, eslint 0 errors on touched files.

* fix: send Retry-After on every rate-limited response

/api/image, /api/video and /api/exif each computed the retry delay,
interpolated it into a console.warn, and then returned a 429 without it —
the number was calculated and thrown away. /api/og did not compute it at
all. Only /api/auth and /api/map sent the header.

This matters more for an image proxy than for a typical API: one gallery
page issues around fifty /api/image requests, so a burst that trips the
limit produces fifty rejections carrying no back-off signal. The browser
and next/image then retry on their own schedule — a retry storm against a
server that just reported it was overloaded.

Adds Retry-After and Cache-Control: no-store to all four. no-store because
the success path serves these same URLs as `immutable`.

The delay now comes from a shared retryAfterSeconds() helper rather than
an inline Math.ceil in each route, which also fixes an edge every copy
shared: a window on the point of expiring yields 0, and Retry-After: 0
tells the client to retry immediately, which is the opposite of what a 429
means. A resetAt already in the past yields a negative number, which is
not valid HTTP. The helper floors at 1.

The three routes that already sent the header (/api/auth, /api/map,
/api/admin/auth) and /api/health now use the helper too — leaving four
copies of the buggy arithmetic behind while centralising the rest would
have been worse than not centralising at all.

Adds 2 tests, one of them specifically for the zero-and-negative edge.

Verified: tsc 0 errors, 182 unit tests passing (180 before), production
build exit 0, eslint 0 errors on all ten touched files.

* fix: add an escape hatch for stale browser image caches

Image and video responses are served
`Cache-Control: public, max-age=31536000, immutable`, so a browser does
not revalidate them for a year — the ETag is not even consulted. When
Immich regenerates thumbnails after a job re-run, or a photo is rotated,
the asset ID does not change, so neither does the deterministic token or
the URL. Visitors keep the old rendition, and the webhook that clears the
server-side caches cannot reach a browser. The only existing remedy was
rotating AUTH_SECRET, which invalidates every token on the site.

Corrects the framing this started from. The finding described it as an
ETag problem, but `immutable` means the ETag is never reached in the case
that matters. The URL is the only lever a browser cache responds to, so
the buster belongs there. It is also mixed into the ETag, since a matching
ETag across two different URLs would be wrong regardless.

Adds IMAGE_CACHE_VERSION, empty by default. Unset, the generated URLs are
byte-identical to before — a test asserts exactly that, because a
cache-busting feature that changes URLs when nobody asked for it would
silently discard every visitor's cache on deploy.

The value is URL-encoded at parse time; an unescaped one could otherwise
inject query parameters into every image URL on the site.

Deliberately not done: shortening max-age or dropping `immutable`. Both
trade a large, real bandwidth win for a rare correctness case, and the
cost is not measurable from this worktree. The aggressive caching stays
the default; this only adds a way out.

Adds 6 tests: default-unchanged, whitespace treated as unset, both URL
shapes, escaping, and that a bump changes the query while leaving the
token intact.

Verified: tsc 0 errors, 188 unit tests passing (182 before), production
build exit 0, eslint unchanged (the one error in env.ts is pre-existing,
confirmed against a stashed tree).

* security: validate the backup filename before restoring from it

restoreBackup() joined its argument straight into a path and copied the
result over a content file. path.join resolves `..`, so
restoreBackup('../../../../etc/passwd') would have written any readable
file over content/settings.yaml — whose contents the admin GET endpoints
hand straight back. The destination was chosen by
backupFilename.includes('gallery.yaml'), which is substring matching on
the same attacker-supplied string, so the caller picked that too.

Not exploitable today: the function has zero callers. That is precisely
why it was worth fixing rather than leaving — it is an exported function
carrying a traversal bug, waiting for whoever wires up the restore button
the admin panel does not yet have.

Hardened rather than deleted. The status endpoint already reports backup
counts, so restore is plainly intended; removing a half-built feature is
the maintainer's call, not a side effect of a security fix.

The name must now match the pattern this service itself produces, and the
destination is derived from the matched group rather than a substring
search. The redundant basename check is kept on purpose: it preserves the
guarantee if that pattern is ever loosened.

Adds 12 tests. Nine of them fail against the unguarded version —
mutation-checked by removing the guard and confirming, rather than
assuming they would.

Verified: tsc 0 errors, 200 unit tests passing (188 before), production
build exit 0, eslint 0 errors on touched files.

* fix: give each admin save its own temp file

writeYamlFile wrote to a constant `${filePath}.tmp` before renaming. The
rename is what makes the write atomic; the temp filename was not. Two
saves of the same file in flight at once shared that path, so the second
writeFile could interleave with the first's rename — publishing one save's
bytes under the other's, or a truncated mix of both. A double-clicked Save
in the page builder is enough to reach it.

The temp name now carries the pid and a per-process counter, so concurrent
writers cannot collide either within a process or across workers.

Also wraps the write and rename so a failure unlinks the temp file instead
of leaving it in content/. The cleanup swallows its own errors: failing to
tidy up must not replace the real error with a misleading one.

Adds 7 tests, and both halves were mutation-checked independently —
reverting to the fixed temp path fails two of them, removing the cleanup
fails two others. Two of the tests exist to pin properties that are easy
to regress silently: that the rename targets the temp file just written,
and that the happy path issues no unlink.

Verified: tsc 0 errors, 207 unit tests passing (200 before), production
build exit 0, eslint 0 errors on touched files.

* fix: await the stream-timeout rejection before advancing timers

`npm run test:unit` exited 1 even though all 207 tests passed. The
timeout test started `streamAsset`, advanced the fake timers past the
15s budget, and only then attached the rejection expectation. The abort
fires *during* `advanceTimersByTimeAsync`, so for one microtask turn the
promise was rejected with no handler attached — Node reports that as an
unhandled rejection, and vitest fails the whole run on it regardless of
test outcomes. CI would have blocked on a green suite.

Attaching the assertion before advancing the timers fixes the ordering
without weakening it: the same rejection and the same `captured.aborted`
check still run, just awaited after the advance rather than created
after it.

Verified: vitest exit 0, 207/207 passing, tsc 0 errors, prettier clean.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
 2026-08-05 12:04:01 +02:00
Ralksta
37f7f62157 security: fix pre-auth bypasses and restore Immich 3.x compatibility (#378) 
Seven security issues from an audit, plus album pages and the map coming
up empty against Immich 3.x. Verified against a real Immich 3.0.3
instance in a production build.

Security:
- Admin session forgery via a hardcoded 'dev-fallback-secret' signing key
  that bypassed the production AUTH_SECRET guard
- /api/map ignored album passwords and returned working asset tokens;
  rewriting ?size=thumbnail to ?size=original downloaded full-resolution
  originals from protected albums
- Admin login had no rate limit, and the client IP came from a spoofable
  header, so rotating it bypassed every limit in the app
- Raw Immich asset UUIDs were serialized into the RSC payload
- Album tokens never expired server-side; a captured token replayed forever
- Path traversal into the Immich API via an unvalidated album id
- /admin ran with no enforced CSP (only Report-Only reached it)

TRUSTED_PROXIES is replaced by TRUSTED_PROXY_HOPS. The old variable
matched proxy IPs against the socket peer address, which self-hosted
Next.js never exposes, so the check could never pass: unset, the limiter
read a spoofable header; set, every request shared one bucket and a single
client could rate-limit the whole site. Migrates automatically.

Immich 3.x: GET /albums/:id no longer embeds assets. Assets now come from
POST /search/metadata with withExif: true — without that flag EXIF is
omitted and grid aspect ratios, the lightbox panel and map markers stay
empty. Drops support for Immich below 3.0, which now logs a warning.

Upgrade: requires Immich 3.0+; set TRUSTED_PROXY_HOPS (nginx = 1);
visitors of protected areas and admin sessions must log in once more.

91 unit tests (25 new); the new admin-auth and rate-limit cases were
confirmed to fail against the pre-fix code.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
 2026-07-20 18:57:57 +02:00
Ralksta
02f5e6a505 feat(admin): visual theme cards, album search, and status dashboard (#241) 
* feat(admin): implement visual theme cards, album search, and system status diagnostics

* fix(admin): resolve type-checking build errors in SettingsEditor and status route

---------

Co-authored-by: ralksta <ralksta@users.noreply.github.com>
 2026-05-31 21:17:52 +02:00
Ralksta
746e9ae4c9 ⚡ Bolt: Memoize auth checks in Map API (#236) 
Introduced a request-scoped `Map` (`authCache`) in `app/api/map/route.ts` to memoize `isAuthenticated` calls.
The `getMapData` loop iterates over all albums across all locations. Albums within the same subpage slug trigger repeated `isAuthenticated` checks, which execute expensive HMAC cryptographic operations, causing performance degradation for large datasets.
Eliminates redundant cryptographic operations during map data fetching, reducing CPU utilization and response times for the Map API.

Co-authored-by: google-labs-jules[bot] <161369871+google-labs-jules[bot]@users.noreply.github.com>
 2026-05-31 10:03:03 +02:00
Ralksta
c2fa8e7596 🛡️ Sentinel: Fix Stored XSS via Content-Type spoofing in asset proxies (#237) 
Sanitized the Content-Type header on image and video proxy routes (`/api/image/*`, `/api/video/*`). The content type is forced to lowercase, validated against a safe prefix (`image/`, `video/`, `audio/`), and restricted to block `svg` and `xml`. Any invalid type falls back to `application/octet-stream`. This prevents an attacker from uploading an SVG file containing a malicious script and triggering a Stored XSS attack via these proxy endpoints, which are excluded from the global CSP.

Co-authored-by: google-labs-jules[bot] <161369871+google-labs-jules[bot]@users.noreply.github.com>
 2026-05-31 10:02:59 +02:00
ralksta
19c3727afc feat: per-album hero image – picker from album assets, fullbleed banner on detail page 2026-05-30 15:33:43 +02:00
ralksta
6f4cb467fd fix: revalidate all pages on admin save so hero/config changes appear immediately 
Add revalidatePath('/', 'layout') calls to gallery save, settings save,
and reload routes. This tells Next.js to purge any cached page responses
so the next browser refresh picks up the new hero images and config.
 2026-05-29 18:10:48 +02:00
ralksta
e8e65e7172 feat(admin): add asset picker with favorites, drag-and-drop reordering, preview links, and keyboard shortcuts 
- Asset Picker: Visual browser for hero images with Favorites tab (shown first)
  and All Photos tab. Includes infinite scroll and UUID fallback input for
  assets not easily found in the grid.
- Drag & Drop: All lists (hero images, standalone albums, subpage albums,
  subpage tiles) are now reorderable via drag handles using @dnd-kit.
- Preview Links: 'Preview Site' button in save bar, '↗ Site' in header, and
  per-subpage preview links with URL slug preview shown inline.
- Keyboard Shortcuts: ⌘+S / Ctrl+S to save in both Pages and Settings tabs.
- Unsaved Changes Guard: beforeunload warning prevents accidental data loss.
- New API route /api/admin/assets for browsing Immich assets with pagination
  and favorites filter via search/metadata endpoint.
 2026-05-29 17:59:25 +02:00
ralksta
2e4cde4b6e fix: clear album cache on admin save so changes appear immediately 
When saving gallery/settings via admin, the config cache was invalidated
but the Immich album cache (which stores resolved title overrides and
descriptions) was not cleared. This meant changes only appeared after
the TTL expired or a manual 'Reload' click.

Now both gallery and settings saves also call immich.invalidateAll()
to flush the album cache, making changes visible on next page load.
 2026-05-29 17:47:08 +02:00
ralksta
b4fa37d680 fix: admin panel light/dark theme support, improved contrast, and backup confirmation 
a) Admin panel now respects the site's light/dark theme toggle via CSS
   custom properties that respond to [data-theme='light'] on <html>.
   All hardcoded dark colors replaced with semantic CSS variables.

b) Improved contrast in dark mode: secondary text changed from #666/#555
   to #a0a0a0, muted text from #555 to #707070. All text is now clearly
   readable against dark backgrounds.

c) Backup system was already implemented in yaml-service.ts (creates
   timestamped backups in content/.backups/ before each save, keeps last
   10 versions). Now the UI shows a confirmation message that a backup
   was created after each successful save.
 2026-05-29 17:20:56 +02:00
ralksta
4a0b57b932 feat: add thumbnail previews to admin panel for albums and hero images 
- Add /api/admin/thumbnail/[id] proxy endpoint for serving Immich thumbnails
- Show album cover thumbnails in AlbumCard components (subpages + standalone)
- Show actual image thumbnails in AlbumPicker modal instead of emoji placeholders
- Show small thumbnail previews for hero image entries
- Add corresponding CSS styles for all thumbnail elements
 2026-05-29 17:14:58 +02:00
ralksta
e9063d3a71 feat: add video streaming proxy and webhook cache invalidation 
- Add /api/video/[id] route with Range header support for seeking
- Add /api/webhook route for Immich event-driven cache invalidation
- Add streamVideo() to ImmichClient with 206 Partial Content support
- Support album description overrides in gallery.yaml
- Add videoUrl() helper to lib/urls.ts
- Export cache.delete() and cache.clear() methods
 2026-05-29 17:04:57 +02:00
ralksta
9e52d7a0b8 feat: add visual admin panel with page builder and settings editor 
- Add /admin route with password-protected visual page builder
- Page Builder: manage hero images, standalone albums, subpages, and sections
- Album Picker: browse all shared Immich albums with search and filtering
- Settings Editor: theme, grid, footer, legal, SEO configuration
- YAML service with atomic writes and automatic backups (content/.backups/)
- HMAC-signed admin sessions (24h expiry, HttpOnly cookies)
- API endpoints: /api/admin/{auth,gallery,settings,albums,reload}
- Enable with ADMIN_PASSWORD env var; disabled by default
- invalidateConfigCache() export for hot-reload after saves
 2026-05-29 17:04:37 +02:00
google-labs-jules[bot]
71381342d6 🛡️ Sentinel: [security improvement]\n\nAdded rate limiting to the /api/health endpoint using the shared checkRateLimit utility. This prevents potential DoS attacks by restricting the number of requests per IP, utilizing the configured rateLimitRpm. 
Co-authored-by: ralksta <16941050+ralksta@users.noreply.github.com>
 2026-05-03 10:20:32 +00:00
Ralksta
f18d9ae3d9 🛡️ Sentinel: [CRITICAL] Fix rate limit DoS vulnerability (#136) 
Co-authored-by: google-labs-jules[bot] <161369871+google-labs-jules[bot]@users.noreply.github.com>
 2026-04-24 22:12:42 +02:00
Ralksta
bb7c1aa1bd Improve rate-limit headers in auth API (#102) 
Destructures `remaining` and `resetAt` from `checkRateLimit` and adds standard rate-limiting headers (`Retry-After`, `X-RateLimit-Limit`, `X-RateLimit-Remaining`) to the 429 Too Many Requests response.

Co-authored-by: google-labs-jules[bot] <161369871+google-labs-jules[bot]@users.noreply.github.com>
 2026-04-21 22:51:42 +02:00
Ralksta
16e1c7647b 🎨 Palette: [UX improvement] Auto-focus Close button in Lightbox (#104) 
Co-authored-by: google-labs-jules[bot] <161369871+google-labs-jules[bot]@users.noreply.github.com>
 2026-04-21 22:51:31 +02:00
ralksta
17398dea39 feat: implement album-level password protection 2026-04-07 23:04:03 +02:00
ralksta
bf72a88d6c perf: implement proper LRU Cache and ETag optimizations 2026-03-27 11:11:23 +01:00
Ralksta
43d5b4d15d 🛡️ Sentinel: Add rate limiting to /api/og endpoint (#47) 
Co-authored-by: google-labs-jules[bot] <161369871+google-labs-jules[bot]@users.noreply.github.com>
 2026-03-27 10:36:25 +01:00
google-labs-jules[bot]
cdc26c00ac 🛡️ Sentinel: [HIGH] Cache health check endpoint to prevent upstream DoS 
Co-authored-by: ralksta <16941050+ralksta@users.noreply.github.com>
 2026-03-20 11:33:38 +00:00
ralksta
e9154cedb8 fix(security): resolve rate-limiting IP spoofing and eviction bypass 2026-03-15 07:41:49 +01:00
ralksta
922302ce5c chore: implement audit action items and translate hardcoded German text 2026-03-15 07:32:42 +01:00
ralksta
a97b261c14 fix: raise map rate limit 30→120/min, allow 5min private browser cache 
Prevents spurious 429s during normal browsing/refreshing.
Browser now caches personalised map data for 5 minutes (private,
so CDNs/proxies won't share it between users).
 2026-03-13 12:55:07 +01:00
ralksta
d64a7239d1 refactor: audit improvements - rate limit ceiling, map route protection, lazy DevToolbar, lang=de 
- lib/rate-limit.ts: add MAX_STORE_ENTRIES=10k ceiling + evictIfFull() to prevent DDoS memory exhaustion
- app/api/map/route.ts: add IP-based rate limiting (30 req/min) with proper Retry-After headers
- app/layout.tsx: lang='en' → 'de', DevToolbar loaded via dynamic import (reduces main bundle)
- app/layout.tsx: lazy DevToolbar keeps ~17KB out of production bundle via next/dynamic
 2026-03-13 11:41:56 +01:00
ralksta
43c59f4bc9 chore: clean up repo root and improve .gitignore 
- Remove debug scripts: check_albums.js, check_albums.ts
- Remove git-filter-repo binary from root
- Untrack server.log (was accidentally committed)
- Delete .DS_Store files
- Rewrite .gitignore with clear sections: deps, next.js,
  TypeScript, testing, logs, env, OS/editor, agent tools,
  one-off scripts, deployment, user content
- Add .Jules/ and *.log glob to .gitignore
 2026-03-13 11:34:28 +01:00
google-labs-jules[bot]
63e6a2f784 🛡️ Sentinel: [HIGH] Fix missing rate limiting on /api/exif/[id] 
Co-authored-by: ralksta <16941050+ralksta@users.noreply.github.com>
 2026-03-12 11:30:45 +00:00
ralksta
a0364ac9f0 fix: remove request.ip which was removed in Next.js 15+ 
The request.ip property no longer exists on NextRequest in Next.js 15+.
Fall back to x-real-ip (set by trusted reverse proxies) then x-forwarded-for.
The security intent from PR #4 is preserved — x-real-ip is preferred over
the more easily spoofed x-forwarded-for header.

Fixes build error: Property 'ip' does not exist on type 'NextRequest'
 2026-03-11 23:36:40 +01:00
Ralksta
a94b55704e security: prioritize request.ip over x-forwarded-for to prevent IP spoofing [#4] 
Co-authored-by: google-labs-jules[bot] <161369871+google-labs-jules[bot]@users.noreply.github.com>
 2026-03-11 23:32:32 +01:00
Ralksta
96fe4db099 security: validate auth input types and limit length to prevent DoS [#1] 
Added type checking and length validation to the `slug` and `password` variables in the `app/api/auth/route.ts` file to prevent potential DoS attacks via excessively long strings passed to expensive crypto functions.

Co-authored-by: google-labs-jules[bot] <161369871+google-labs-jules[bot]@users.noreply.github.com>
 2026-03-11 23:32:22 +01:00
ralksta
23d8bf0425 refactor: apply Clean Architecture principles 
- Extract EXIF and Swipe logic into custom hooks for Lightbox
- Extract Map layout data formatting into mapService
- Extract AlbumDetailView and SubpageGridView components from page router
- Restructure monolithic config.ts into clean config/ directory
 2026-03-08 18:55:45 +01:00
ralksta
ea72d720df chore: production-readiness audit fixes and linting cleanup 2026-03-08 16:26:05 +01:00
ralksta
21f9fda53a fix: improve image proxy compatibility with CORS headers and Content-Type fallbacks to resolve broken lightbox images 2026-03-07 09:46:09 +01:00
ralksta
faab17f9cd fix: increase rate limit and add detailed logging to diagnose broken thumbnails 2026-03-07 09:42:33 +01:00