* refactor(server)!: sanitize error messages to avoid leaking resource and permission details
* fix e2e tests
* fix(server): prevent login timing oracle by always running bcrypt
Always call compareBcrypt in the login path regardless of whether the
email is registered. When no user is found, a dummy hash is used so the
bcrypt KDF still runs and response latency is constant, making it
impossible to enumerate valid email addresses by measuring response time.
* fix(server): collapse OAuth callback messages to prevent email-existence oracle
Two distinct error messages in the OAuth callback endpoint revealed
whether an email address was already registered in the database.
An attacker controlling the OAuth provider's email claim could probe
the user table without authentication. Both cases now return the same
generic message.
* fix(server): replace email-in-use messages to prevent user-existence oracle
Error messages on registration and profile-update that named whether an
email address was already taken allowed callers to enumerate registered
accounts. All three sites now return the same generic message regardless
of whether the address is in use.
* fix(server): hide slug uniqueness constraint to prevent shared-link probe
Surfacing the Postgres unique-constraint name in the error response let
any authenticated user brute-force whether a custom slug was already in
use by another user's shared link, leaking the existence of other links.
* fix(server): unify profile image errors to prevent user-existence oracle via status code
GET /users/:id/profile-image returned HTTP 400 for an unknown user ID
but HTTP 404 when the user existed without a photo, letting callers
distinguish the two cases. Both now return 404 so the response is
identical regardless of whether the UUID maps to an account.
* fix(server): replace album user-not-found message to prevent UUID-existence oracle
Album owners could probe arbitrary UUIDs via the add-user endpoint and
determine whether they belonged to registered accounts by receiving
'User not found'. The message is now ambiguous about whether the ID was
unrecognised or the user is inactive.
* Revert "fix e2e tests"
This reverts commit c1bd7a116b.
* Revert "refactor(server)!: sanitize error messages to avoid leaking resource and permission details"
This reverts commit b96421a083.
* fix(server): use 403 instead of 400 for access-denied errors
requireAccess threw BadRequestException which is incorrect HTTP semantics.
Access denial is a client authorization problem (403 Forbidden), not a
malformed request (400 Bad Request). Keep the descriptive permission name
in the message since the full permission set is public API surface.
* Revert "fix(server): use 403 instead of 400 for access-denied errors"
This reverts commit bb06990957.
* shorten comment
* add log messages
* format
* one more
* feat(web): Synchronize information from deduplicated images
* Added new settings menu to the the deduplication tab.
* The toggable options in the settings are synchronization of: albums, favorites, ratings, description, visibility and location.
* When synchronizing the albums, the resolved images will be added to all albums of the duplicates.
* When synchronizing the favorite status, the resolved images will be marked as favorite, if at least one selectable image is marked as favorite.
* When synchronizing the ratings, the highest rating from the selectable images will be applied to the resolved image.
* When synchronizing the description, all descriptions from the selectable images will be merged into one description for the resolved image.
* When synchronizing the visibility, the most restrictive visibility setting from the selectable images will be applied to the resolved image.
* When synchronizing the location, if exactly one unique location exists among the selectable images, this location will be applied to the resolved image.
* There is no additional UI for these settings to keep the visual clutter minimal. The settings are applied automatically based on the user's preferences.
* Replace addAssetToAlbums with copyAsset
* fix linter
* feat(web): add duplicate sync fields and fix typo
* feat(web): add tag sync and enhance duplicate resolution
This update introduces tag synchronization for duplicate resolution,
ensuring all unique tag IDs from duplicates are applied to kept assets.
The visibility sync logic is updated to use a simplified ordering, as the hidden status items will never show up in a duplicate set.
Album synchronization now merges albums directly via addAssetsToAlbums; as the approach with copyAsset API endpoint was ineffiecient.
Description, rating, and location sync logic is improved for correctness.
and deduplication. i18n strings were added / updated.
* feat(server): move duplicate resolution to backend with sync and stacking
Moves duplicate metadata synchronization from frontend to backend, enabling robust
batch operations and proper validation. This is an improved refactor of PR #13851.
New endpoints:
- POST /duplicates/resolve - batch resolve with configurable metadata sync
- POST /duplicates/stack - create stacks from duplicate groups
- GET /duplicates - now includes suggestedKeepAssetIds based on file size and EXIF
Key changes:
- Move sync logic (albums, tags, favorites, ratings, descriptions, location, visibility) to server
- Add server-side metadata merge policies with proper conflict resolution
- Replace client-side resolution logic with new backend endpoints
- Add comprehensive E2E tests (70+ test cases) and unit tests
- Update OpenAPI specs and TypeScript SDK
No breaking changes - only additions to existing API.
* feat(preferences): enable all duplicate sync settings by default
* chore: clean up
* chore: clean up
* refactor: rename & clean up
* fix: preference upgrade
* chore: linting
* refactor(e2e): use updateAssets API for setAssetDuplicateId
* fix: visibility sync logic in duplicate resolution
* fix(duplicate): write description to exifUpdate
Previously the duplicate resolution populated assetUpdate.description even
though description belongs to exif info.
* fix(duplicate): remove redundant updateLockedColumns wrapper
updateAllExif already computes lockedProperties via distinctLocked
using Object.keys(options). The wrapper added a lockedProperties key
to the options object, causing the spurious string 'lockedProperties'
to be stored in the lockedProperties array.
* fix(duplicate): write merged tags to asset_exif to survive metadata re-extraction
During duplicate resolution, replaceAssetTags correctly wrote merged tag
IDs to the tag_asset table, but never updated asset_exif.tags or locked
the tags property. The subsequent SidecarWrite → AssetExtractMetadata
chain calls applyTagList, which destructively replaces tag_asset rows
with whatever is in asset_exif.tags — still the original per-asset tags,
not the merged set.
Write merged tag values to asset_exif.tags via updateAllExif (which also
locks the property via distinctLocked), and queue SidecarWrite when tags
change so they persist to the sidecar file.
* docs(duplicates): clarify location and tag sync behavior
* refactor(duplicate): remove sync settings, always sync all metadata on resolve
Remove DuplicateSyncSettingsDto and the per-field sync toggles
(albums, favorites, rating, description, visibility, location, tags).
Duplicate resolution now unconditionally syncs all metadata from
trashed assets to kept assets.
- Remove DuplicateSyncSettingsDto and settings field from DuplicateResolveDto
- Update DuplicateService to always run all sync logic without conditionals
- Delete DuplicateSettingsModal.svelte and settings gear button from UI
- Remove DuplicateSettings type and duplicateSettings persisted store
- Update unit and e2e tests to remove settings from resolve requests
* docs: update duplicates utility to reflect automatic metadata sync
* docs(web): replace duplicates info modal with link to documentation
* chore: clean up
* fix: add missing type cast to jsonAgg in duplicate repository getAll
* fix: skip persisting rating=0 in duplicate merge to avoid unnecessary sidecar write
---------
Co-authored-by: Toni <51962051+EinToni@users.noreply.github.com>
Co-authored-by: Jason Rasmussen <jason@rasm.me>
Co-authored-by: Jason Rasmussen <jrasm91@gmail.com>
* fix(server): prevent album shared link from breaking after uploads
* update test
* add withSharedAssets helper
* remove options
* add more helpers
* update selects
* Fix opus handling as accepted audio codec in transcode policy
Fix the issue when opus is among accepted audio codecs in transcode policy
(which is default) but it still triggers transcoding because the codec name
from ffprobe (opus) does not match `libopus` literal in Immich.
Make a distinction between a codec name and encoder:
- codec name: switch to `opus` as the audio codec name. This matches what ffprobe
returns for a media file with opus audio.
- encoder: continue using the `libopus` encoder in ffmpeg.
* Add unit tests for accepted audio codecs and for libopus encoder
* Add db migration for ffmpeg.targetAudioCodec opus
* backward compatibility
* tweak
* noisy logs
* full mapping
* make check happy
* mark deprecated
* update api
* indexOf
---------
Co-authored-by: mertalev <101130780+mertalev@users.noreply.github.com>
Add `name` to all vitest configs matching CI job buckets (server:unit,
server:medium, cli:unit, web:unit, e2e:server, e2e:maintenance) so they
appear as filterable @tags in the Vitest VSCode extension.
Fix `root` in server vitest configs to use an absolute path derived from
`import.meta.url` instead of `'./'`, which resolved relative to the config
file directory (`server/test/`) rather than `server/`, causing test
discovery to fail in the Vitest VSCode extension.
* feat: SyncAssetV2
* feat: mobile sync handling
* feat: request correct sync object based on server version
* fix: mobile queries
* chore: sync sql
* fix: test
* chore: switch to mapper
* fix: sql sync
renovate[bot]
Mert
Timon
Daniel Dietzler
Jason Rasmussen
santanoce
Brandon Wees
Zack Pollard
Alex
Phlogi
Jonathan Jogenfors
Michel Heusschen
Thomas
Sergey Katsubo
Mees Frensel
Min Idzelis
Joe Babbitt
Nikhil Alapati