bo0tzz
af7c177f13
feat: require @Authenticated decorator everywhere
2026-07-28 16:43:03 +02:00
bo0tzz
8591f391a8
chore: add medium test
2026-07-28 15:45:28 +02:00
bo0tzz
6f71c86157
fix: shared check for server setup availability
2026-07-28 15:45:28 +02:00
Daniel Dietzler and GitHub
b08f6b9c50
chore: medium tests system config helpers ( #30174 )
2026-07-24 21:27:31 +02:00
Ben Beckford and GitHub
0f5bf6071f
chore(server): test assetDateFilter workflow method ( #30110 )
2026-07-22 10:48:31 +02:00
Daniel Dietzler and GitHub
5d7283e44d
fix: album update event emitting ( #30120 )
2026-07-21 19:43:27 +00:00
73329a8ce8
fix(server): send id_token_hint on OIDC logout ( #29720 )
...
Co-authored-by: Daniel Dietzler <mail@ddietzler.dev >
2026-07-21 19:19:13 +02:00
Timon and GitHub
ee4bd3f833
feat: add album asset event handling ( #29008 )
...
* feat: add album asset event handling
* fix medium tests
* patch medium test
* collapse in AlbumUpdate
2026-07-21 10:55:46 -05:00
df970da59e
chore(deps): update dependency eslint-plugin-unicorn to v70 - abandoned ( #29684 )
...
* chore(deps): update dependency eslint-plugin-unicorn to v70
* fix: linting
---------
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: Daniel Dietzler <mail@ddietzler.dev >
2026-07-20 23:47:14 -04:00
Daniel Dietzler and GitHub
77091b0107
fix: search statistics locked folder permissions ( #30063 )
...
fix; search statistics locked folder permissions
2026-07-20 20:08:42 -04:00
Daniel Dietzler and GitHub
4c754f2999
fix: timebuckets locked permissions ( #30066 )
2026-07-20 20:07:56 -04:00
b4530b0671
fix(server): workflow date filter, make end date inclusive ( #29876 )
...
Co-authored-by: Raul Plesa <raul.plesa@external.grifols.com >
Co-authored-by: Daniel Dietzler <mail@ddietzler.dev >
2026-07-15 10:50:03 +00:00
Daniel Dietzler and GitHub
35fcca6254
fix: locked visibility in search random endpoint ( #29887 )
2026-07-13 20:03:20 +00:00
Daniel Dietzler and GitHub
fea0db02f3
fix: emit album update event when uploading assets through shared link ( #29757 )
2026-07-09 15:21:16 +02:00
Daniel Dietzler and GitHub
66e30d5fa1
fix: missing files integrity checks ( #29737 )
2026-07-08 14:53:46 -05:00
Daniel Dietzler and GitHub
704b287bba
fix: integrity checks checksum pagination ( #29516 )
2026-07-07 18:42:14 +02:00
Daniel Dietzler and GitHub
deeb042a9e
feat: honor album access permissions in search endpoints ( #29352 )
2026-06-29 22:27:22 +02:00
Daniel Dietzler and GitHub
b4cc406a3f
fix!: search endpoints visibility can be omitted ( #29385 )
2026-06-29 22:00:02 +02:00
953ef5c047
feat: webhook workflow action ( #29258 )
...
Co-authored-by: Daniel Dietzler <mail@ddietzler.dev >
2026-06-26 16:08:45 +02:00
Jason Rasmussen and GitHub
ec7c0f9ec8
fix: sync backfill ( #29267 )
2026-06-22 16:19:01 -04:00
Daniel Dietzler and GitHub
c484bd99b6
fix: ignore external libraries for integrity report checksum check ( #29248 )
2026-06-22 13:56:24 +00:00
Daniel Dietzler and GitHub
53fe26593c
fix: asset type filter ( #29190 )
2026-06-18 15:30:34 +02:00
74878628c8
feat: integrity check jobs (missing files, untracked files, checksums) ( #24205 )
...
Co-authored-by: Daniel Dietzler <mail@ddietzler.dev >
Signed-off-by: izzy <me@insrt.uk >
2026-06-10 21:02:27 +02:00
bo0tzz and GitHub
d3680871ef
feat: warn if microservices worker is missing ( #28869 )
...
* feat: warn if microservices worker is missing
* fix: ci
2026-06-10 09:31:32 -04:00
Ben Beckford and GitHub
1ce961fbb3
feat: geolocation workflow filter ( #28961 )
...
* feat: geolocation workflow filter
* refactor: geolocation workflow filter
* feat: location filter workflow example
2026-06-10 05:05:01 +00:00
Timon and GitHub
d10153bbc7
fix(server): hide isFavorite from album asset sync stream ( #28923 )
...
* fix(server): hide isFavorite from album asset sync stream
* some tests
* Revert "some tests"
This reverts commit 3242e6961cf1d4c47f5f
2026-06-09 00:03:03 -04:00
Timon and GitHub
b846afeb08
chore(server): tests for hide isFavorite for partner assets ( #28927 )
2026-06-09 00:01:39 -04:00
Yaros and GitHub
733373c0ca
feat(mobile): ocr support ( #26523 )
2026-06-05 04:29:03 +05:30
b3d49045de
feat: user upload heatmap ( #28593 )
...
* Feat - Heatmap
* Implemented Comments to prettify and code cleanup
* fixing code to pass cases.
* fixing errors for OpenAPI Clients
* Improving the code.
* Fix code
* Rerun generated client check
* Rerun generated client
* feat: command for user pages (#28554 )
* fix(web): timeline stuttering with many assets in 1 day (#28509 )
* fix(web): timeline stuttering with many assets in 1 day
* cache isInOrNearViewport per day
* skip inOrNearViewport check on first run
* chore(ml): allow insightface 1.x (#28595 )
* chore(ml): allow insightface 1.x
The new insightface 1.0 release appears to have no breaking code changes nor relevant license changes ([before](https://github.com/deepinsight/insightface/blob/2a78baec428354883e0cda39c54b555a5ed8358a/README.md ), [after](https://github.com/deepinsight/insightface/blob/70f3269ea628d0658c5723976944c9de414e96f8/README.md ), c.f. https://github.com/immich-app/immich/blob/fd7ddfef54cdf2b6256c4fc08bc5ff3f86176775/machine-learning/README.md ), and it works on my machine.
* Update uv.lock
* please excuse my incompetence
* Triggering the actions.
* bad merge
* Fix code
* Code clear
* Resolve conflict
* Resolve conflict
* Resolve conflict
* Resolve errors
* Resolve errors
* Resolve errors more
* chore: clean up
---------
Co-authored-by: Alex <alex.tran1502@gmail.com >
Co-authored-by: Ben Beckford <ben@benjaminbeckford.com >
Co-authored-by: Aaron Liu <aaronliu0130@gmail.com >
Co-authored-by: Jason Rasmussen <jason@rasm.me >
2026-06-04 15:36:09 -04:00
Mert and GitHub
7eabac6702
feat(server): hls with real-time transcoding ( #28230 )
...
* hls implementation
* fix stale state after ffmpeg exit
2026-06-01 18:52:29 +00:00
Jason Rasmussen and GitHub
da8505f61d
feat: more plugin triggers and methods ( #28690 )
2026-05-29 14:02:07 -04:00
Jason Rasmussen and GitHub
8783180cf3
refactor: plugin manifest ( #28673 )
2026-05-28 17:23:49 -04:00
Timon and GitHub
26714f6bfe
fix(server): prevent locked assets from leaking to partners ( #28652 )
...
* fix(server): prevent locked assets from leaking to partners
* fix tests
2026-05-27 17:33:49 -04:00
Daniel Dietzler and GitHub
452e88267a
fix: strip metadata from timeline responses for shared links without exif sharing ( #28644 )
2026-05-27 17:29:37 +02:00
Jason Rasmussen and GitHub
e46f2843f7
refactor: asset create event ( #28647 )
2026-05-27 10:28:02 -04:00
8682be4774
feat: workflow template ( #28553 )
...
* wip: confirm before existing and disable/enable save button condition
* fix: get correct workflow detail
* wip: add back workflow summary
* wip: add back json editor
* wip: step property badge
* wip: redesign card flow
* wip: redesign card flow
* redesign workflow summary
* wworkflow summary styling
* wip
* drag and drop
* list redesign
* refactor
* refactor
* remove deadcode
* refactor
* insert steps
* push down when dropped
* feat: workflow template
* simplify
* move template to manifest
* feat: hash manifest file
* fix: template column
* fix: migration
* fix: workflow lookup
* chore: clean up
---------
Co-authored-by: Jason Rasmussen <jason@rasm.me >
2026-05-26 16:47:05 -04:00
Jason Rasmussen and GitHub
3d075f2bf8
feat: workflows & plugins ( #26727 )
...
feat: plugins
chore: better types
feat: plugins
2026-05-18 11:09:33 -04:00
e142e3aca7
feat: recently added assets page ( #28272 )
...
* feat(server): add ordering date option to time buckets
* feat(web): add recently added page
* feat(server): recently created assets in explore data
* feat(web): recently added in explore tab
* fix: recently added assets ordering
* fix(server): failing bucket test
* feat(web): improve recently added preview
* chore: update e2e explore/timeline tests
* chore: rename and refactor timeline ordering dates
* fix(web): invalid timeline option
* feat(mobile): recently added page
* fix(server): sync tests
* fix(mobile): resync assets to get uploadedAt column
* chore: rename assetorderby enum
* chore(mobile): formatting
* minor fixes
* stylings
---------
Co-authored-by: Alex <alex.tran1502@gmail.com >
2026-05-11 21:35:10 +00:00
37e6a49652
fix(deps): update dependency nestjs-otel to v8 ( #27863 )
...
* fix(deps): update dependency nestjs-otel to v8
* fix: apiMetrics
---------
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: Jason Rasmussen <jason@rasm.me >
2026-05-07 19:14:15 +00:00
Mert and GitHub
01712cf0a7
fix(server): av typing ( #28223 )
...
* fix av typing, move fixtures to stub file
* fix tests
2026-05-04 09:04:29 -04:00
Timon and GitHub
3decc864b5
refactor(server)!: structured validation error responses ( #28204 )
...
* refactor(server)!: structured validation error responses
* refactor(server): clarify comment on removing duplicate HTTP response fields
* enhance validation error tests
* make path and message required
* fmt
* fix e2e test
* fmt
* feat: enhance error handling in getServerErrorMessage function
2026-05-04 00:00:03 -04:00
Mert and GitHub
f1d8ab8aae
feat(server): track video metadata ( #28023 )
...
* track video metadata
* earlier duration check
* revert colorspace change
* duplicate constant
* formatting
* linting
* add comments
* redundant variable
* simplify tests
* use totalDuration instead of format.duration
* medium tests
* install ffmpeg
* install noble
* update test-assets commit
* make timeBase non-nullable
* linting
* use proper smallint
* add ffmpeg to mise
* simplify duration
* regenerate migration
2026-05-01 17:03:49 +00:00
Timon and GitHub
c0898b96ca
refactor(server)!: sanitize error messages to avoid leaking resource details ( #28154 )
...
* refactor(server)!: sanitize error messages to avoid leaking resource and permission details
* fix e2e tests
* fix(server): prevent login timing oracle by always running bcrypt
Always call compareBcrypt in the login path regardless of whether the
email is registered. When no user is found, a dummy hash is used so the
bcrypt KDF still runs and response latency is constant, making it
impossible to enumerate valid email addresses by measuring response time.
* fix(server): collapse OAuth callback messages to prevent email-existence oracle
Two distinct error messages in the OAuth callback endpoint revealed
whether an email address was already registered in the database.
An attacker controlling the OAuth provider's email claim could probe
the user table without authentication. Both cases now return the same
generic message.
* fix(server): replace email-in-use messages to prevent user-existence oracle
Error messages on registration and profile-update that named whether an
email address was already taken allowed callers to enumerate registered
accounts. All three sites now return the same generic message regardless
of whether the address is in use.
* fix(server): hide slug uniqueness constraint to prevent shared-link probe
Surfacing the Postgres unique-constraint name in the error response let
any authenticated user brute-force whether a custom slug was already in
use by another user's shared link, leaking the existence of other links.
* fix(server): unify profile image errors to prevent user-existence oracle via status code
GET /users/:id/profile-image returned HTTP 400 for an unknown user ID
but HTTP 404 when the user existed without a photo, letting callers
distinguish the two cases. Both now return 404 so the response is
identical regardless of whether the UUID maps to an account.
* fix(server): replace album user-not-found message to prevent UUID-existence oracle
Album owners could probe arbitrary UUIDs via the add-user endpoint and
determine whether they belonged to registered accounts by receiving
'User not found'. The message is now ambiguous about whether the ID was
unrecognised or the user is inactive.
* Revert "fix e2e tests"
This reverts commit c1bd7a116b3f0fccf3d2530c8e34b13c1d862989.
* Revert "refactor(server)!: sanitize error messages to avoid leaking resource and permission details"
This reverts commit b96421a08387340fbb77913ca89b0717bcd9945d.
* fix(server): use 403 instead of 400 for access-denied errors
requireAccess threw BadRequestException which is incorrect HTTP semantics.
Access denial is a client authorization problem (403 Forbidden), not a
malformed request (400 Bad Request). Keep the descriptive permission name
in the message since the full permission set is public API surface.
* Revert "fix(server): use 403 instead of 400 for access-denied errors"
This reverts commit bb069909571f4e514e7d050ddf588c017ee5a029.
* shorten comment
* add log messages
* format
* one more
2026-05-01 10:00:18 -04:00
Mert and GitHub
b554664791
chore!: duration in milliseconds ( #28003 )
...
* server changes
* openapi
* web changes
* mobile changes
* assume 3.0 client
* deprecate
* review feedback
* update medium tests
* linting
2026-04-30 09:44:27 -04:00
Mert and GitHub
97c62136b7
chore(server)!: drop pgvecto.rs support ( #28159 )
...
drop pgvecto.rs
2026-04-30 09:40:38 -04:00
bf32864644
feat(server): video streaming table definitions ( #28147 )
...
* video streaming table definitions
Co-authored-by: Copilot <copilot@github.com >
* update sql
* tetris
* use enum
Co-authored-by: Copilot <copilot@github.com >
* fix column name
---------
Co-authored-by: Copilot <copilot@github.com >
2026-04-29 15:48:15 +00:00
92634f923b
refactor(server)!: remove redundant error and statusCode fields from error responses ( #28140 )
...
* refactor(server)!: remove redundant error and statusCode fields from error responses
* use enum
* enhance response management
* chore: clean up header
* fix: chaining
* refactor: handle error
* fix e2e tests
---------
Co-authored-by: Jason Rasmussen <jason@rasm.me >
2026-04-28 17:54:54 -04:00
Timon and GitHub
96b6165bd3
refactor(server)!: move correlationId to X-Correlation-ID response header ( #28139 )
2026-04-28 13:07:39 -04:00
4bfb8b36c2
chore!: migrate album owner to album_user ( #27467 )
...
Co-authored-by: mertalev <101130780+mertalev@users.noreply.github.com >
Co-authored-by: shenlong-tanwen <139912620+shalong-tanwen@users.noreply.github.com >
2026-04-22 16:52:23 +02:00
Jason Rasmussen and GitHub
94a34436a3
chore: remove unused packages & code ( #27925 )
2026-04-20 08:39:46 -04:00
bo0tzz