* refactor(server)!: sanitize error messages to avoid leaking resource and permission details
* fix e2e tests
* fix(server): prevent login timing oracle by always running bcrypt
Always call compareBcrypt in the login path regardless of whether the
email is registered. When no user is found, a dummy hash is used so the
bcrypt KDF still runs and response latency is constant, making it
impossible to enumerate valid email addresses by measuring response time.
* fix(server): collapse OAuth callback messages to prevent email-existence oracle
Two distinct error messages in the OAuth callback endpoint revealed
whether an email address was already registered in the database.
An attacker controlling the OAuth provider's email claim could probe
the user table without authentication. Both cases now return the same
generic message.
* fix(server): replace email-in-use messages to prevent user-existence oracle
Error messages on registration and profile-update that named whether an
email address was already taken allowed callers to enumerate registered
accounts. All three sites now return the same generic message regardless
of whether the address is in use.
* fix(server): hide slug uniqueness constraint to prevent shared-link probe
Surfacing the Postgres unique-constraint name in the error response let
any authenticated user brute-force whether a custom slug was already in
use by another user's shared link, leaking the existence of other links.
* fix(server): unify profile image errors to prevent user-existence oracle via status code
GET /users/:id/profile-image returned HTTP 400 for an unknown user ID
but HTTP 404 when the user existed without a photo, letting callers
distinguish the two cases. Both now return 404 so the response is
identical regardless of whether the UUID maps to an account.
* fix(server): replace album user-not-found message to prevent UUID-existence oracle
Album owners could probe arbitrary UUIDs via the add-user endpoint and
determine whether they belonged to registered accounts by receiving
'User not found'. The message is now ambiguous about whether the ID was
unrecognised or the user is inactive.
* Revert "fix e2e tests"
This reverts commit c1bd7a116b3f0fccf3d2530c8e34b13c1d862989.
* Revert "refactor(server)!: sanitize error messages to avoid leaking resource and permission details"
This reverts commit b96421a08387340fbb77913ca89b0717bcd9945d.
* fix(server): use 403 instead of 400 for access-denied errors
requireAccess threw BadRequestException which is incorrect HTTP semantics.
Access denial is a client authorization problem (403 Forbidden), not a
malformed request (400 Bad Request). Keep the descriptive permission name
in the message since the full permission set is public API surface.
* Revert "fix(server): use 403 instead of 400 for access-denied errors"
This reverts commit bb069909571f4e514e7d050ddf588c017ee5a029.
* shorten comment
* add log messages
* format
* one more
* feat(server): add configurable OAuth prompt parameter
Add a `prompt` field to the OAuth system config, allowing admins to
configure the OIDC `prompt` parameter (e.g. `select_account`, `login`,
`consent`). Defaults to empty string (no prompt sent), preserving
backward compatibility.
This is useful for providers like Google where users want to be prompted
to select an account when multiple accounts are signed in.
Discussed in #20762
* chore: regenerate OpenAPI spec and clients for OAuth prompt field
* Adding e2e test cases
* feat: web setting
* feat: docs
---------
Co-authored-by: Jason Rasmussen <jason@rasm.me>
* fix(oauth): normalize email claim to lowercase before account lookup and registration
* test(auth): add test for OAuth email case normalization
* chore: clean up
---------
Co-authored-by: Jason Rasmussen <jason@rasm.me>
* fix!: do not allow insecure oauth requests by default
* fix: format
* fix: make open-api
* fix: tests
* nit: casing
* chore: migration to allow insecure if current oauth uses http
* feat(web): Synchronize information from deduplicated images
* Added new settings menu to the the deduplication tab.
* The toggable options in the settings are synchronization of: albums, favorites, ratings, description, visibility and location.
* When synchronizing the albums, the resolved images will be added to all albums of the duplicates.
* When synchronizing the favorite status, the resolved images will be marked as favorite, if at least one selectable image is marked as favorite.
* When synchronizing the ratings, the highest rating from the selectable images will be applied to the resolved image.
* When synchronizing the description, all descriptions from the selectable images will be merged into one description for the resolved image.
* When synchronizing the visibility, the most restrictive visibility setting from the selectable images will be applied to the resolved image.
* When synchronizing the location, if exactly one unique location exists among the selectable images, this location will be applied to the resolved image.
* There is no additional UI for these settings to keep the visual clutter minimal. The settings are applied automatically based on the user's preferences.
* Replace addAssetToAlbums with copyAsset
* fix linter
* feat(web): add duplicate sync fields and fix typo
* feat(web): add tag sync and enhance duplicate resolution
This update introduces tag synchronization for duplicate resolution,
ensuring all unique tag IDs from duplicates are applied to kept assets.
The visibility sync logic is updated to use a simplified ordering, as the hidden status items will never show up in a duplicate set.
Album synchronization now merges albums directly via addAssetsToAlbums; as the approach with copyAsset API endpoint was ineffiecient.
Description, rating, and location sync logic is improved for correctness.
and deduplication. i18n strings were added / updated.
* feat(server): move duplicate resolution to backend with sync and stacking
Moves duplicate metadata synchronization from frontend to backend, enabling robust
batch operations and proper validation. This is an improved refactor of PR #13851.
New endpoints:
- POST /duplicates/resolve - batch resolve with configurable metadata sync
- POST /duplicates/stack - create stacks from duplicate groups
- GET /duplicates - now includes suggestedKeepAssetIds based on file size and EXIF
Key changes:
- Move sync logic (albums, tags, favorites, ratings, descriptions, location, visibility) to server
- Add server-side metadata merge policies with proper conflict resolution
- Replace client-side resolution logic with new backend endpoints
- Add comprehensive E2E tests (70+ test cases) and unit tests
- Update OpenAPI specs and TypeScript SDK
No breaking changes - only additions to existing API.
* feat(preferences): enable all duplicate sync settings by default
* chore: clean up
* chore: clean up
* refactor: rename & clean up
* fix: preference upgrade
* chore: linting
* refactor(e2e): use updateAssets API for setAssetDuplicateId
* fix: visibility sync logic in duplicate resolution
* fix(duplicate): write description to exifUpdate
Previously the duplicate resolution populated assetUpdate.description even
though description belongs to exif info.
* fix(duplicate): remove redundant updateLockedColumns wrapper
updateAllExif already computes lockedProperties via distinctLocked
using Object.keys(options). The wrapper added a lockedProperties key
to the options object, causing the spurious string 'lockedProperties'
to be stored in the lockedProperties array.
* fix(duplicate): write merged tags to asset_exif to survive metadata re-extraction
During duplicate resolution, replaceAssetTags correctly wrote merged tag
IDs to the tag_asset table, but never updated asset_exif.tags or locked
the tags property. The subsequent SidecarWrite → AssetExtractMetadata
chain calls applyTagList, which destructively replaces tag_asset rows
with whatever is in asset_exif.tags — still the original per-asset tags,
not the merged set.
Write merged tag values to asset_exif.tags via updateAllExif (which also
locks the property via distinctLocked), and queue SidecarWrite when tags
change so they persist to the sidecar file.
* docs(duplicates): clarify location and tag sync behavior
* refactor(duplicate): remove sync settings, always sync all metadata on resolve
Remove DuplicateSyncSettingsDto and the per-field sync toggles
(albums, favorites, rating, description, visibility, location, tags).
Duplicate resolution now unconditionally syncs all metadata from
trashed assets to kept assets.
- Remove DuplicateSyncSettingsDto and settings field from DuplicateResolveDto
- Update DuplicateService to always run all sync logic without conditionals
- Delete DuplicateSettingsModal.svelte and settings gear button from UI
- Remove DuplicateSettings type and duplicateSettings persisted store
- Update unit and e2e tests to remove settings from resolve requests
* docs: update duplicates utility to reflect automatic metadata sync
* docs(web): replace duplicates info modal with link to documentation
* chore: clean up
* fix: add missing type cast to jsonAgg in duplicate repository getAll
* fix: skip persisting rating=0 in duplicate merge to avoid unnecessary sidecar write
---------
Co-authored-by: Toni <51962051+EinToni@users.noreply.github.com>
Co-authored-by: Jason Rasmussen <jason@rasm.me>
Co-authored-by: Jason Rasmussen <jrasm91@gmail.com>
* feat(web): adaptive progressive image loading for photo viewer
Replace ImageManager with a new AdaptiveImageLoader that progressively
loads images through quality tiers (thumbnail → preview → original).
New components and utilities:
- AdaptiveImage: layered image renderer with thumbhash, thumbnail,
preview, and original layers with visibility managed by load state
- AdaptiveImageLoader: state machine driving the quality progression
with per-quality callbacks and error handling
- ImageLayer/Image: low-level image elements with load/error lifecycle
- PreloadManager: preloads adjacent assets for instant navigation
- AlphaBackground/DelayedLoadingSpinner: loading state UI
Zoom is handled via a derived CSS transform applied to the content
wrapper in AdaptiveImage, with the zoom library (zoomTarget: null)
only tracking state without manipulating the DOM directly.
Also adds scaleToCover to container-utils and getAssetUrls to utils.
* fix: don't partially render images in firefox
* add passive loading indicator to asset-viewer
---------
Co-authored-by: Alex <alex.tran1502@gmail.com>
* feat: run maintance tests in isolation, share containers between all serial test suites
* refactor: organize files
---------
Co-authored-by: Jason Rasmussen <jason@rasm.me>
Timon
Daniel Dietzler
Mert
renovate[bot]
Aki Hakune
sparsh985
santanoce
Sergey Katsubo
Jason Rasmussen
Mees Frensel
Timothy Dobras
bo0tzz
Brandon Wees
Ray
Min Idzelis
John Maguire
Phlogi
Diogo Tavares Sendim Fernandes
Paul Makles
Yaros
Michel Heusschen
Belnadifia