* chore(mobile): harden mobile OpenAPI codegen and dependency install
* Cleaner mise cascade
* Version openapi-generator-cli with mise
* Relocate tool definition
* Update lock file
* fix: always set extension from provided file
The livephoto case can also happen with other files; for example, we
receive a DNG file as JPEG but then still call it .dng
Fixes#29805, partially addresses #28602
* chore: test cases for file extension naming
* fix(ios-widget): send date-only value for memories query param
Server v3.0.3 (immich-app#29907) validates the /memories `for` query
param with a date-only schema (YYYY-MM-DD). The iOS widget still sent a
full ISO 8601 datetime, so every request 400s and the widget shows
"Unable to connect to your Immich instance" on any server >= v3.0.3.
Build the value from the local calendar day, matching what the web
client (memory-manager.svelte.ts) and Android already send, instead of
a UTC datetime.
Also fix a related bug in the timeline provider: fetchMemory was
called with a bare try inside a Task, so a failure silently dropped
the error and never called completion, leaving the widget in a stale
state instead of showing an error card. Wrap it in a guard/try?, same
pattern already used in getSnapshot.
Fixes immich-app#30044
Signed-off-by: ajuijas <189517297+ajuijas@users.noreply.github.com>
* address review: drop unrelated widget change and comment
Signed-off-by: ajuijas <189517297+ajuijas@users.noreply.github.com>
---------
Signed-off-by: ajuijas <189517297+ajuijas@users.noreply.github.com>
Co-authored-by: ajuijas <189517297+ajuijas@users.noreply.github.com>
Co-authored-by: Santo Shakil <santoshakil@users.noreply.github.com>
* fix(server): re-evaluate OIDC role claim on every login and support array values
Previously the OIDC role claim (immich_role) was only read at user
auto-registration time and only accepted as a scalar string, so admin
status never updated after the first login and array-valued role/group
claims (common with Keycloak, Entra ID, etc.) were silently ignored.
Now the role claim is normalized from either a string or an array of
strings, and existing users have their isAdmin flag synced from the
claim on every login, keeping the IdP as the source of truth for
privileges while leaving isAdmin untouched when the claim is blank.
* fix(server): use .includes() instead of .some() for role claim check
Satisfies unicorn/prefer-includes lint rule flagged by CI.
* fix(server): resolve missing role claim to standard user and fix test mock
Default the OIDC role claim to 'user' when the IdP omits it so
auto-registration doesn't crash, and add the missing getAdmin mock in the
auth.service test so it correctly simulates an existing admin rather than
the first-user-registration path.
* fix: claim sync logic
---------
Co-authored-by: Jason Rasmussen <jrasm91@gmail.com>
shenlong-tanwen