bugfixes in thumbnail

preload thumbs and previews

cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@immich/cli",
-  "version": "2.5.2",
+  "version": "2.5.1",
   "description": "Command Line Interface (CLI) for Immich",
   "type": "module",
   "exports": "./dist/index.js",

deployment/mise.toml

@@ -1,6 +1,6 @@
 [tools]
-terragrunt = "0.98.0"
-opentofu = "1.11.4"
+terragrunt = "0.93.10"
+opentofu = "1.10.7"
 
 [tasks."tg:fmt"]
 run = "terragrunt hclfmt"

docs/docs/administration/postgres-standalone.md

@@ -88,7 +88,7 @@ The easiest option is to have both extensions installed during the migration:
 <details>
 <summary>Migration steps (automatic)</summary>
 1. Ensure you still have pgvecto.rs installed
-2. Install `pgvector` (`>= 0.7, < 0.9`). The easiest way to do this is on Debian/Ubuntu by adding the [PostgreSQL Apt repository][pg-apt] and then running `apt install postgresql-NN-pgvector`, where `NN` is your Postgres version (e.g., `16`)
+2. Install `pgvector` (`>= 0.7.0, < 1.0.0`). The easiest way to do this is on Debian/Ubuntu by adding the [PostgreSQL Apt repository][pg-apt] and then running `apt install postgresql-NN-pgvector`, where `NN` is your Postgres version (e.g., `16`)
 3. [Install VectorChord][vchord-install]
 4. Add `shared_preload_libraries= 'vchord.so, vectors.so'` to your `postgresql.conf`, making sure to include _both_ `vchord.so` and `vectors.so`. You may include other libraries here as well if needed
 5. Restart the Postgres database

docs/static/archived-versions.json

@@ -1,7 +1,7 @@
 [
   {
-    "label": "v2.5.2",
-    "url": "https://docs.v2.5.2.archive.immich.app"
+    "label": "v2.5.1",
+    "url": "https://docs.v2.5.1.archive.immich.app"
   },
   {
     "label": "v2.4.1",

e2e/package.json

@@ -1,6 +1,6 @@
 {
   "name": "immich-e2e",
-  "version": "2.5.2",
+  "version": "2.5.1",
   "description": "",
   "main": "index.js",
   "type": "module",

e2e/src/web/specs/photo-viewer.e2e-spec.ts

@@ -1,10 +1,7 @@
 import { AssetMediaResponseDto, LoginResponseDto } from '@immich/sdk';
-import { Page, expect, test } from '@playwright/test';
+import { expect, test } from '@playwright/test';
 import { utils } from 'src/utils';
 
-function imageLocator(page: Page) {
-  return page.getByAltText('Image taken').locator('visible=true');
-}
 test.describe('Photo Viewer', () => {
   let admin: LoginResponseDto;
   let asset: AssetMediaResponseDto;
@@ -26,31 +23,32 @@ test.describe('Photo Viewer', () => {
 
   test('loads original photo when zoomed', async ({ page }) => {
     await page.goto(`/photos/${asset.id}`);
-    await expect.poll(async () => await imageLocator(page).getAttribute('src')).toContain('thumbnail');
-    const box = await imageLocator(page).boundingBox();
+    await expect(page.getByTestId('thumbnail')).toHaveAttribute('src', /thumbnail/);
+    const box = await page.getByTestId('thumbnail').boundingBox();
     expect(box).toBeTruthy();
     const { x, y, width, height } = box!;
     await page.mouse.move(x + width / 2, y + height / 2);
     await page.mouse.wheel(0, -1);
-    await expect.poll(async () => await imageLocator(page).getAttribute('src')).toContain('original');
+    await expect(page.getByTestId('original')).toBeInViewport();
+    await expect(page.getByTestId('original')).toHaveAttribute('src', /original/);
   });
 
   test('loads fullsize image when zoomed and original is web-incompatible', async ({ page }) => {
     await page.goto(`/photos/${rawAsset.id}`);
-    await expect.poll(async () => await imageLocator(page).getAttribute('src')).toContain('thumbnail');
-    const box = await imageLocator(page).boundingBox();
+    await expect(page.getByTestId('thumbnail')).toHaveAttribute('src', /thumbnail/);
+    const box = await page.getByTestId('thumbnail').boundingBox();
     expect(box).toBeTruthy();
     const { x, y, width, height } = box!;
     await page.mouse.move(x + width / 2, y + height / 2);
     await page.mouse.wheel(0, -1);
-    await expect.poll(async () => await imageLocator(page).getAttribute('src')).toContain('fullsize');
+    await expect(page.getByTestId('original')).toHaveAttribute('src', /fullsize/);
   });
 
   test('reloads photo when checksum changes', async ({ page }) => {
     await page.goto(`/photos/${asset.id}`);
-    await expect.poll(async () => await imageLocator(page).getAttribute('src')).toContain('thumbnail');
-    const initialSrc = await imageLocator(page).getAttribute('src');
+    await expect(page.getByTestId('thumbnail')).toHaveAttribute('src', /thumbnail/);
+    const initialSrc = await page.getByTestId('thumbnail').getAttribute('src');
     await utils.replaceAsset(admin.accessToken, asset.id);
-    await expect.poll(async () => await imageLocator(page).getAttribute('src')).not.toBe(initialSrc);
+    await expect(page.getByTestId('preview')).not.toHaveAttribute('src', initialSrc!);
   });
 });

e2e/src/web/specs/timeline/utils.ts

@@ -65,7 +65,7 @@ export const thumbnailUtils = {
     return page.locator(`[data-thumbnail-focus-container][data-asset="${assetId}"] button`);
   },
   selectedAsset(page: Page) {
-    return page.locator('[data-thumbnail-focus-container]:has(button[aria-checked])');
+    return page.locator('[data-thumbnail-focus-container][data-selected]');
   },
   async clickAssetId(page: Page, assetId: string) {
     await thumbnailUtils.withAssetId(page, assetId).click();
@@ -103,11 +103,8 @@ export const thumbnailUtils = {
     await expect(thumbnailUtils.withAssetId(page, assetId).locator('[data-icon-archive]')).toHaveCount(0);
   },
   async expectSelectedReadonly(page: Page, assetId: string) {
-    // todo - need a data attribute for selected
     await expect(
-      page.locator(
-        `[data-thumbnail-focus-container][data-asset="${assetId}"] > .group.cursor-not-allowed > .rounded-xl`,
-      ),
+      page.locator(`[data-thumbnail-focus-container][data-asset="${assetId}"][data-selected]`),
     ).toBeVisible();
   },
   async expectTimelineHasOnScreenAssets(page: Page) {

i18n/en.json

@@ -782,8 +782,6 @@
   "client_cert_import": "Import",
   "client_cert_import_success_msg": "Client certificate is imported",
   "client_cert_invalid_msg": "Invalid certificate file or wrong password",
-  "client_cert_password_message": "Enter the password for this certificate",
-  "client_cert_password_title": "Certificate Password",
   "client_cert_remove_msg": "Client certificate is removed",
   "client_cert_subtitle": "Supports PKCS12 (.p12, .pfx) format only. Certificate import/removal is available only before login",
   "client_cert_title": "SSL client certificate [EXPERIMENTAL]",

i18n/package.json

@@ -1,6 +1,6 @@
 {
   "name": "immich-i18n",
-  "version": "2.5.2",
+  "version": "2.5.1",
   "private": true,
   "scripts": {
     "format": "prettier --check .",

machine-learning/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "immich-ml"
-version = "2.5.2"
+version = "2.5.1"
 description = ""
 authors = [{ name = "Hau Tran", email = "alex.tran1502@gmail.com" }]
 requires-python = ">=3.11,<4.0"

machine-learning/uv.lock

@@ -919,7 +919,7 @@ wheels = [
 
 [[package]]
 name = "immich-ml"
-version = "2.5.2"
+version = "2.4.1"
 source = { editable = "." }
 dependencies = [
     { name = "aiocache" },

mise.toml

@@ -17,9 +17,9 @@ config_roots = [
 node = "24.13.0"
 flutter = "3.35.7"
 pnpm = "10.28.0"
-terragrunt = "0.98.0"
-opentofu = "1.11.4"
-java = "21.0.2"
+terragrunt = "0.93.10"
+opentofu = "1.10.7"
+java = "25.0.1"
 
 [tools."github:CQLabs/homebrew-dcm"]
 version = "1.30.0"

mobile/.fvmrc

@@ -0,0 +1,3 @@
+{
+  "flutter": "3.35.7"
+}

mobile/.gitignore

@@ -55,5 +55,8 @@ default.isar
 default.isar.lock
 libisar.so
 
+# FVM Version
+.fvm/
+
 # Translation file
-lib/generated/
+lib/generated/

mobile/.vscode/settings.json

@@ -2,9 +2,7 @@
   "dart.flutterSdkPath": ".fvm/versions/3.35.7",
   "dart.lineLength": 120,
   "[dart]": {
-    "editor.rulers": [
-      120
-    ]
+    "editor.rulers": [120]
   },
   "search.exclude": {
     "**/.fvm": true

mobile/README.md

@@ -4,12 +4,10 @@ The Immich mobile app is a Flutter-based solution leveraging the Isar Database f
 
 ## Setup
 
-1. [Install mise](https://mise.jdx.dev/installing-mise.html).
-2. Change to the immich directory and trust the mise config with `mise trust`.
-3. Install tools with mise: `mise install`.
-4. Run `flutter pub get` to install the dependencies.
-5. Run `make translation` to generate the translation file.
-6. Run `flutter run` to start the app.
+1. Setup Flutter toolchain using FVM.
+2. Run `flutter pub get` to install the dependencies.
+3. Run `make translation` to generate the translation file.
+4. Run `fvm flutter run` to start the app.
 
 ## Translation
 
@@ -31,7 +29,7 @@ dcm analyze lib
 ```
 
 [DCM](https://dcm.dev/) is a vendor tool that needs to be downloaded manually to run locally.
-Immich was provided an open source license.
+Immich was provided an open source license. 
 To use it, it is important that you do not have an active free tier license (can be verified with `dcm license`).
 If you have write-access to the Immich repository directly, running dcm in your clone should just work.
 If you are working on a clone of a fork, you need to connect to the main Immich repository as remote first:

mobile/android/app/build.gradle

@@ -131,7 +131,6 @@ dependencies {
   implementation "androidx.compose.ui:ui-tooling:$compose_version"
   implementation "androidx.compose.material3:material3:1.2.1"
   implementation "androidx.lifecycle:lifecycle-runtime-ktx:2.6.2"
-  implementation "com.google.android.material:material:1.12.0"
 }
 
 // This is uncommented in F-Droid build script

mobile/android/app/src/main/AndroidManifest.xml

@@ -27,8 +27,7 @@
 
   <application android:label="Immich" android:name=".ImmichApp" android:usesCleartextTraffic="true"
     android:icon="@mipmap/ic_launcher" android:requestLegacyExternalStorage="true"
-    android:largeHeap="true" android:enableOnBackInvokedCallback="false" android:allowBackup="false"
-    android:networkSecurityConfig="@xml/network_security_config">
+    android:largeHeap="true" android:enableOnBackInvokedCallback="false" android:allowBackup="false">
 
     <profileable android:shell="true" />
 

mobile/android/app/src/main/cpp/native_buffer.c

@@ -36,17 +36,3 @@ Java_app_alextran_immich_NativeBuffer_copy(
         memcpy((void *) destAddress, (char *) src + offset, length);
     }
 }
-
-/**
- * Creates a JNI global reference to the given object and returns its address.
- * The caller is responsible for deleting the global reference when it's no longer needed.
- */
-JNIEXPORT jlong JNICALL
-Java_app_alextran_immich_NativeBuffer_createGlobalRef(JNIEnv *env, jobject clazz, jobject obj) {
-    if (obj == NULL) {
-        return 0;
-    }
-
-    jobject globalRef = (*env)->NewGlobalRef(env, obj);
-    return (jlong) globalRef;
-}

mobile/android/app/src/main/kotlin/app/alextran/immich/HttpSSLOptionsPlugin.kt

@@ -0,0 +1,153 @@
+package app.alextran.immich
+
+import android.annotation.SuppressLint
+import android.content.Context
+import app.alextran.immich.core.SSLConfig
+import io.flutter.embedding.engine.plugins.FlutterPlugin
+import io.flutter.plugin.common.BinaryMessenger
+import io.flutter.plugin.common.MethodCall
+import io.flutter.plugin.common.MethodChannel
+import java.io.ByteArrayInputStream
+import java.net.InetSocketAddress
+import java.net.Socket
+import java.security.KeyStore
+import java.security.cert.X509Certificate
+import javax.net.ssl.HostnameVerifier
+import javax.net.ssl.HttpsURLConnection
+import javax.net.ssl.KeyManager
+import javax.net.ssl.KeyManagerFactory
+import javax.net.ssl.SSLContext
+import javax.net.ssl.SSLEngine
+import javax.net.ssl.SSLSession
+import javax.net.ssl.TrustManager
+import javax.net.ssl.TrustManagerFactory
+import javax.net.ssl.X509ExtendedTrustManager
+
+/**
+ * Android plugin for Dart `HttpSSLOptions`
+ */
+class HttpSSLOptionsPlugin : FlutterPlugin, MethodChannel.MethodCallHandler {
+  private var methodChannel: MethodChannel? = null
+
+  override fun onAttachedToEngine(binding: FlutterPlugin.FlutterPluginBinding) {
+    onAttachedToEngine(binding.applicationContext, binding.binaryMessenger)
+  }
+
+  private fun onAttachedToEngine(ctx: Context, messenger: BinaryMessenger) {
+    methodChannel = MethodChannel(messenger, "immich/httpSSLOptions")
+    methodChannel?.setMethodCallHandler(this)
+  }
+
+  override fun onDetachedFromEngine(binding: FlutterPlugin.FlutterPluginBinding) {
+    onDetachedFromEngine()
+  }
+
+  private fun onDetachedFromEngine() {
+    methodChannel?.setMethodCallHandler(null)
+    methodChannel = null
+  }
+
+  override fun onMethodCall(call: MethodCall, result: MethodChannel.Result) {
+    try {
+      when (call.method) {
+        "apply" -> {
+          val args = call.arguments<ArrayList<*>>()!!
+          val allowSelfSigned = args[0] as Boolean
+          val serverHost = args[1] as? String
+          val clientCertHash = (args[2] as? ByteArray)
+
+          var tm: Array<TrustManager>? = null
+          if (allowSelfSigned) {
+            tm = arrayOf(AllowSelfSignedTrustManager(serverHost))
+          }
+
+          var km: Array<KeyManager>? = null
+          if (clientCertHash != null) {
+            val cert = ByteArrayInputStream(clientCertHash)
+            val password = (args[3] as String).toCharArray()
+            val keyStore = KeyStore.getInstance("PKCS12")
+            keyStore.load(cert, password)
+            val keyManagerFactory =
+              KeyManagerFactory.getInstance(KeyManagerFactory.getDefaultAlgorithm())
+            keyManagerFactory.init(keyStore, null)
+            km = keyManagerFactory.keyManagers
+          }
+
+          // Update shared SSL config for OkHttp and other HTTP clients
+          SSLConfig.apply(km, tm, allowSelfSigned, serverHost, clientCertHash?.contentHashCode() ?: 0)
+
+          val sslContext = SSLContext.getInstance("TLS")
+          sslContext.init(km, tm, null)
+          HttpsURLConnection.setDefaultSSLSocketFactory(sslContext.socketFactory)
+
+          HttpsURLConnection.setDefaultHostnameVerifier(AllowSelfSignedHostnameVerifier(args[1] as? String))
+
+          result.success(true)
+        }
+
+        else -> result.notImplemented()
+      }
+    } catch (e: Throwable) {
+      result.error("error", e.message, null)
+    }
+  }
+
+  @SuppressLint("CustomX509TrustManager")
+  class AllowSelfSignedTrustManager(private val serverHost: String?) : X509ExtendedTrustManager() {
+    private val defaultTrustManager: X509ExtendedTrustManager = getDefaultTrustManager()
+
+    override fun checkClientTrusted(chain: Array<out X509Certificate>?, authType: String?) =
+      defaultTrustManager.checkClientTrusted(chain, authType)
+
+    override fun checkClientTrusted(
+      chain: Array<out X509Certificate>?, authType: String?, socket: Socket?
+    ) = defaultTrustManager.checkClientTrusted(chain, authType, socket)
+
+    override fun checkClientTrusted(
+      chain: Array<out X509Certificate>?, authType: String?, engine: SSLEngine?
+    ) = defaultTrustManager.checkClientTrusted(chain, authType, engine)
+
+    override fun checkServerTrusted(chain: Array<out X509Certificate>?, authType: String?) {
+      if (serverHost == null) return
+      defaultTrustManager.checkServerTrusted(chain, authType)
+    }
+
+    override fun checkServerTrusted(
+      chain: Array<out X509Certificate>?, authType: String?, socket: Socket?
+    ) {
+      if (serverHost == null) return
+      val socketAddress = socket?.remoteSocketAddress
+      if (socketAddress is InetSocketAddress && socketAddress.hostName == serverHost) return
+      defaultTrustManager.checkServerTrusted(chain, authType, socket)
+    }
+
+    override fun checkServerTrusted(
+      chain: Array<out X509Certificate>?, authType: String?, engine: SSLEngine?
+    ) {
+      if (serverHost == null || engine?.peerHost == serverHost) return
+      defaultTrustManager.checkServerTrusted(chain, authType, engine)
+    }
+
+    override fun getAcceptedIssuers(): Array<X509Certificate> = defaultTrustManager.acceptedIssuers
+
+    private fun getDefaultTrustManager(): X509ExtendedTrustManager {
+      val factory = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm())
+      factory.init(null as KeyStore?)
+      return factory.trustManagers.filterIsInstance<X509ExtendedTrustManager>().first()
+    }
+  }
+
+  class AllowSelfSignedHostnameVerifier(private val serverHost: String?) : HostnameVerifier {
+    companion object {
+      private val _defaultHostnameVerifier = HttpsURLConnection.getDefaultHostnameVerifier()
+    }
+
+    override fun verify(hostname: String?, session: SSLSession?): Boolean {
+      if (serverHost == null || hostname == serverHost) {
+        return true
+      } else {
+        return _defaultHostnameVerifier.verify(hostname, session)
+      }
+    }
+  }
+}

mobile/android/app/src/main/kotlin/app/alextran/immich/MainActivity.kt

@@ -9,9 +9,7 @@ import app.alextran.immich.background.BackgroundWorkerFgHostApi
 import app.alextran.immich.background.BackgroundWorkerLockApi
 import app.alextran.immich.connectivity.ConnectivityApi
 import app.alextran.immich.connectivity.ConnectivityApiImpl
-import app.alextran.immich.core.HttpClientManager
 import app.alextran.immich.core.ImmichPlugin
-import app.alextran.immich.core.NetworkApiPlugin
 import app.alextran.immich.images.LocalImageApi
 import app.alextran.immich.images.LocalImagesImpl
 import app.alextran.immich.images.RemoteImageApi
@@ -30,9 +28,6 @@ class MainActivity : FlutterFragmentActivity() {
 
   companion object {
     fun registerPlugins(ctx: Context, flutterEngine: FlutterEngine) {
-      HttpClientManager.initialize(ctx)
-      flutterEngine.plugins.add(NetworkApiPlugin())
-
       val messenger = flutterEngine.dartExecutor.binaryMessenger
       val backgroundEngineLockImpl = BackgroundEngineLock(ctx)
       BackgroundWorkerLockApi.setUp(messenger, backgroundEngineLockImpl)
@@ -50,6 +45,7 @@ class MainActivity : FlutterFragmentActivity() {
       ConnectivityApi.setUp(messenger, ConnectivityApiImpl(ctx))
 
       flutterEngine.plugins.add(BackgroundServicePlugin())
+      flutterEngine.plugins.add(HttpSSLOptionsPlugin())
       flutterEngine.plugins.add(backgroundEngineLockImpl)
       flutterEngine.plugins.add(nativeSyncApiImpl)
     }

mobile/android/app/src/main/kotlin/app/alextran/immich/NativeBuffer.kt

@@ -23,9 +23,6 @@ object NativeBuffer {
 
   @JvmStatic
   external fun copy(buffer: ByteBuffer, destAddress: Long, offset: Int, length: Int)
-
-  @JvmStatic
-  external fun createGlobalRef(obj: Any): Long
 }
 
 class NativeByteBuffer(initialCapacity: Int) {

mobile/android/app/src/main/kotlin/app/alextran/immich/core/HttpClientManager.kt

@@ -1,147 +0,0 @@
-package app.alextran.immich.core
-
-import android.content.Context
-import app.alextran.immich.BuildConfig
-import okhttp3.Cache
-import okhttp3.ConnectionPool
-import okhttp3.Dispatcher
-import okhttp3.OkHttpClient
-import java.io.ByteArrayInputStream
-import java.io.File
-import java.net.Socket
-import java.security.KeyStore
-import java.security.Principal
-import java.security.PrivateKey
-import java.security.cert.X509Certificate
-import java.util.concurrent.TimeUnit
-import javax.net.ssl.SSLContext
-import javax.net.ssl.TrustManagerFactory
-import javax.net.ssl.X509KeyManager
-import javax.net.ssl.X509TrustManager
-
-const val CERT_ALIAS = "client_cert"
-const val USER_AGENT = "Immich_Android_${BuildConfig.VERSION_NAME}"
-
-/**
- * Manages a shared OkHttpClient with SSL configuration support.
- */
-object HttpClientManager {
-  private const val CACHE_SIZE_BYTES = 100L * 1024 * 1024  // 100MiB
-  private const val KEEP_ALIVE_CONNECTIONS = 10
-  private const val KEEP_ALIVE_DURATION_MINUTES = 5L
-  private const val MAX_REQUESTS_PER_HOST = 64
-
-  private var initialized = false
-  private val clientChangedListeners = mutableListOf<() -> Unit>()
-
-  private lateinit var client: OkHttpClient
-
-  private val keyStore = KeyStore.getInstance("AndroidKeyStore").apply { load(null) }
-
-  val isMtls: Boolean get() = keyStore.containsAlias(CERT_ALIAS)
-
-  fun initialize(context: Context) {
-    if (initialized) return
-    synchronized(this) {
-      if (initialized) return
-
-      val cacheDir = File(File(context.cacheDir, "okhttp"), "api")
-      client = build(cacheDir)
-      initialized = true
-    }
-  }
-
-  fun setKeyEntry(clientData: ByteArray, password: CharArray) {
-    synchronized(this) {
-      val wasMtls = isMtls
-      val tmpKeyStore = KeyStore.getInstance("PKCS12").apply {
-        ByteArrayInputStream(clientData).use { stream -> load(stream, password) }
-      }
-      val tmpAlias = tmpKeyStore.aliases().asSequence().firstOrNull { tmpKeyStore.isKeyEntry(it) }
-        ?: throw IllegalArgumentException("No private key found in PKCS12")
-      val key = tmpKeyStore.getKey(tmpAlias, password)
-      val chain = tmpKeyStore.getCertificateChain(tmpAlias)
-
-      if (wasMtls) {
-        keyStore.deleteEntry(CERT_ALIAS)
-      }
-      keyStore.setKeyEntry(CERT_ALIAS, key, null, chain)
-      if (wasMtls != isMtls) {
-        clientChangedListeners.forEach { it() }
-      }
-    }
-  }
-
-  fun deleteKeyEntry() {
-    synchronized(this) {
-      if (!isMtls) {
-        return
-      }
-
-      keyStore.deleteEntry(CERT_ALIAS)
-      clientChangedListeners.forEach { it() }
-    }
-  }
-
-  @JvmStatic
-  fun getClient(): OkHttpClient {
-    return client
-  }
-
-  fun addClientChangedListener(listener: () -> Unit) {
-    synchronized(this) { clientChangedListeners.add(listener) }
-  }
-
-  private fun build(cacheDir: File): OkHttpClient {
-    val connectionPool = ConnectionPool(
-      maxIdleConnections = KEEP_ALIVE_CONNECTIONS,
-      keepAliveDuration = KEEP_ALIVE_DURATION_MINUTES,
-      timeUnit = TimeUnit.MINUTES
-    )
-
-    val managerFactory = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm())
-    managerFactory.init(null as KeyStore?)
-    val trustManager = managerFactory.trustManagers.filterIsInstance<X509TrustManager>().first()
-
-    val sslContext = SSLContext.getInstance("TLS")
-      .apply { init(arrayOf(DynamicKeyManager()), arrayOf(trustManager), null) }
-
-    return OkHttpClient.Builder()
-      .addInterceptor { chain ->
-        chain.proceed(chain.request().newBuilder().header("User-Agent", USER_AGENT).build())
-      }
-      .connectionPool(connectionPool)
-      .dispatcher(Dispatcher().apply { maxRequestsPerHost = MAX_REQUESTS_PER_HOST })
-      .cache(Cache(cacheDir.apply { mkdirs() }, CACHE_SIZE_BYTES))
-      .sslSocketFactory(sslContext.socketFactory, trustManager)
-      .build()
-  }
-
-  // Reads from the key store rather than taking a snapshot at initialization time
-  private class DynamicKeyManager : X509KeyManager {
-    override fun getClientAliases(keyType: String, issuers: Array<Principal>?): Array<String>? =
-      if (isMtls) arrayOf(CERT_ALIAS) else null
-
-    override fun chooseClientAlias(
-      keyTypes: Array<String>,
-      issuers: Array<Principal>?,
-      socket: Socket?
-    ): String? =
-      if (isMtls) CERT_ALIAS else null
-
-    override fun getCertificateChain(alias: String): Array<X509Certificate>? =
-      keyStore.getCertificateChain(alias)?.map { it as X509Certificate }?.toTypedArray()
-
-    override fun getPrivateKey(alias: String): PrivateKey? =
-      keyStore.getKey(alias, null) as? PrivateKey
-
-    override fun getServerAliases(keyType: String, issuers: Array<Principal>?): Array<String>? =
-      null
-
-    override fun chooseServerAlias(
-      keyType: String,
-      issuers: Array<Principal>?,
-      socket: Socket?
-    ): String? = null
-  }
-}

mobile/android/app/src/main/kotlin/app/alextran/immich/core/Network.g.kt

@@ -1,269 +0,0 @@
-// Autogenerated from Pigeon (v26.0.2), do not edit directly.
-// See also: https://pub.dev/packages/pigeon
-@file:Suppress("UNCHECKED_CAST", "ArrayInDataClass")
-
-package app.alextran.immich.core
-
-import android.util.Log
-import io.flutter.plugin.common.BasicMessageChannel
-import io.flutter.plugin.common.BinaryMessenger
-import io.flutter.plugin.common.EventChannel
-import io.flutter.plugin.common.MessageCodec
-import io.flutter.plugin.common.StandardMethodCodec
-import io.flutter.plugin.common.StandardMessageCodec
-import java.io.ByteArrayOutputStream
-import java.nio.ByteBuffer
-private object NetworkPigeonUtils {
-
-  fun wrapResult(result: Any?): List<Any?> {
-    return listOf(result)
-  }
-
-  fun wrapError(exception: Throwable): List<Any?> {
-    return if (exception is FlutterError) {
-      listOf(
-        exception.code,
-        exception.message,
-        exception.details
-      )
-    } else {
-      listOf(
-        exception.javaClass.simpleName,
-        exception.toString(),
-        "Cause: " + exception.cause + ", Stacktrace: " + Log.getStackTraceString(exception)
-      )
-    }
-  }
-  fun deepEquals(a: Any?, b: Any?): Boolean {
-    if (a is ByteArray && b is ByteArray) {
-        return a.contentEquals(b)
-    }
-    if (a is IntArray && b is IntArray) {
-        return a.contentEquals(b)
-    }
-    if (a is LongArray && b is LongArray) {
-        return a.contentEquals(b)
-    }
-    if (a is DoubleArray && b is DoubleArray) {
-        return a.contentEquals(b)
-    }
-    if (a is Array<*> && b is Array<*>) {
-      return a.size == b.size &&
-          a.indices.all{ deepEquals(a[it], b[it]) }
-    }
-    if (a is List<*> && b is List<*>) {
-      return a.size == b.size &&
-          a.indices.all{ deepEquals(a[it], b[it]) }
-    }
-    if (a is Map<*, *> && b is Map<*, *>) {
-      return a.size == b.size && a.all {
-          (b as Map<Any?, Any?>).containsKey(it.key) &&
-          deepEquals(it.value, b[it.key])
-      }
-    }
-    return a == b
-  }
-      
-}
-
-/**
- * Error class for passing custom error details to Flutter via a thrown PlatformException.
- * @property code The error code.
- * @property message The error message.
- * @property details The error details. Must be a datatype supported by the api codec.
- */
-class FlutterError (
-  val code: String,
-  override val message: String? = null,
-  val details: Any? = null
-) : Throwable()
-
-/** Generated class from Pigeon that represents data sent in messages. */
-data class ClientCertData (
-  val data: ByteArray,
-  val password: String
-)
- {
-  companion object {
-    fun fromList(pigeonVar_list: List<Any?>): ClientCertData {
-      val data = pigeonVar_list[0] as ByteArray
-      val password = pigeonVar_list[1] as String
-      return ClientCertData(data, password)
-    }
-  }
-  fun toList(): List<Any?> {
-    return listOf(
-      data,
-      password,
-    )
-  }
-  override fun equals(other: Any?): Boolean {
-    if (other !is ClientCertData) {
-      return false
-    }
-    if (this === other) {
-      return true
-    }
-    return NetworkPigeonUtils.deepEquals(toList(), other.toList())  }
-
-  override fun hashCode(): Int = toList().hashCode()
-}
-
-/** Generated class from Pigeon that represents data sent in messages. */
-data class ClientCertPrompt (
-  val title: String,
-  val message: String,
-  val cancel: String,
-  val confirm: String
-)
- {
-  companion object {
-    fun fromList(pigeonVar_list: List<Any?>): ClientCertPrompt {
-      val title = pigeonVar_list[0] as String
-      val message = pigeonVar_list[1] as String
-      val cancel = pigeonVar_list[2] as String
-      val confirm = pigeonVar_list[3] as String
-      return ClientCertPrompt(title, message, cancel, confirm)
-    }
-  }
-  fun toList(): List<Any?> {
-    return listOf(
-      title,
-      message,
-      cancel,
-      confirm,
-    )
-  }
-  override fun equals(other: Any?): Boolean {
-    if (other !is ClientCertPrompt) {
-      return false
-    }
-    if (this === other) {
-      return true
-    }
-    return NetworkPigeonUtils.deepEquals(toList(), other.toList())  }
-
-  override fun hashCode(): Int = toList().hashCode()
-}
-private open class NetworkPigeonCodec : StandardMessageCodec() {
-  override fun readValueOfType(type: Byte, buffer: ByteBuffer): Any? {
-    return when (type) {
-      129.toByte() -> {
-        return (readValue(buffer) as? List<Any?>)?.let {
-          ClientCertData.fromList(it)
-        }
-      }
-      130.toByte() -> {
-        return (readValue(buffer) as? List<Any?>)?.let {
-          ClientCertPrompt.fromList(it)
-        }
-      }
-      else -> super.readValueOfType(type, buffer)
-    }
-  }
-  override fun writeValue(stream: ByteArrayOutputStream, value: Any?)   {
-    when (value) {
-      is ClientCertData -> {
-        stream.write(129)
-        writeValue(stream, value.toList())
-      }
-      is ClientCertPrompt -> {
-        stream.write(130)
-        writeValue(stream, value.toList())
-      }
-      else -> super.writeValue(stream, value)
-    }
-  }
-}
-
-
-/** Generated interface from Pigeon that represents a handler of messages from Flutter. */
-interface NetworkApi {
-  fun addCertificate(clientData: ClientCertData, callback: (Result<Unit>) -> Unit)
-  fun selectCertificate(promptText: ClientCertPrompt, callback: (Result<ClientCertData>) -> Unit)
-  fun removeCertificate(callback: (Result<Unit>) -> Unit)
-  fun getClientPointer(): Long
-
-  companion object {
-    /** The codec used by NetworkApi. */
-    val codec: MessageCodec<Any?> by lazy {
-      NetworkPigeonCodec()
-    }
-    /** Sets up an instance of `NetworkApi` to handle messages through the `binaryMessenger`. */
-    @JvmOverloads
-    fun setUp(binaryMessenger: BinaryMessenger, api: NetworkApi?, messageChannelSuffix: String = "") {
-      val separatedMessageChannelSuffix = if (messageChannelSuffix.isNotEmpty()) ".$messageChannelSuffix" else ""
-      run {
-        val channel = BasicMessageChannel<Any?>(binaryMessenger, "dev.flutter.pigeon.immich_mobile.NetworkApi.addCertificate$separatedMessageChannelSuffix", codec)
-        if (api != null) {
-          channel.setMessageHandler { message, reply ->
-            val args = message as List<Any?>
-            val clientDataArg = args[0] as ClientCertData
-            api.addCertificate(clientDataArg) { result: Result<Unit> ->
-              val error = result.exceptionOrNull()
-              if (error != null) {
-                reply.reply(NetworkPigeonUtils.wrapError(error))
-              } else {
-                reply.reply(NetworkPigeonUtils.wrapResult(null))
-              }
-            }
-          }
-        } else {
-          channel.setMessageHandler(null)
-        }
-      }
-      run {
-        val channel = BasicMessageChannel<Any?>(binaryMessenger, "dev.flutter.pigeon.immich_mobile.NetworkApi.selectCertificate$separatedMessageChannelSuffix", codec)
-        if (api != null) {
-          channel.setMessageHandler { message, reply ->
-            val args = message as List<Any?>
-            val promptTextArg = args[0] as ClientCertPrompt
-            api.selectCertificate(promptTextArg) { result: Result<ClientCertData> ->
-              val error = result.exceptionOrNull()
-              if (error != null) {
-                reply.reply(NetworkPigeonUtils.wrapError(error))
-              } else {
-                val data = result.getOrNull()
-                reply.reply(NetworkPigeonUtils.wrapResult(data))
-              }
-            }
-          }
-        } else {
-          channel.setMessageHandler(null)
-        }
-      }
-      run {
-        val channel = BasicMessageChannel<Any?>(binaryMessenger, "dev.flutter.pigeon.immich_mobile.NetworkApi.removeCertificate$separatedMessageChannelSuffix", codec)
-        if (api != null) {
-          channel.setMessageHandler { _, reply ->
-            api.removeCertificate{ result: Result<Unit> ->
-              val error = result.exceptionOrNull()
-              if (error != null) {
-                reply.reply(NetworkPigeonUtils.wrapError(error))
-              } else {
-                reply.reply(NetworkPigeonUtils.wrapResult(null))
-              }
-            }
-          }
-        } else {
-          channel.setMessageHandler(null)
-        }
-      }
-      run {
-        val channel = BasicMessageChannel<Any?>(binaryMessenger, "dev.flutter.pigeon.immich_mobile.NetworkApi.getClientPointer$separatedMessageChannelSuffix", codec)
-        if (api != null) {
-          channel.setMessageHandler { _, reply ->
-            val wrapped: List<Any?> = try {
-              listOf(api.getClientPointer())
-            } catch (exception: Throwable) {
-              NetworkPigeonUtils.wrapError(exception)
-            }
-            reply.reply(wrapped)
-          }
-        } else {
-          channel.setMessageHandler(null)
-        }
-      }
-    }
-  }
-}

mobile/android/app/src/main/kotlin/app/alextran/immich/core/NetworkApiPlugin.kt

@@ -1,168 +0,0 @@
-package app.alextran.immich.core
-
-import android.app.Activity
-import android.content.Context
-import android.net.Uri
-import android.os.OperationCanceledException
-import android.text.InputType
-import android.view.ContextThemeWrapper
-import android.view.ViewGroup.LayoutParams.MATCH_PARENT
-import android.view.ViewGroup.LayoutParams.WRAP_CONTENT
-import android.widget.FrameLayout
-import android.widget.LinearLayout
-import androidx.activity.ComponentActivity
-import androidx.activity.result.ActivityResultLauncher
-import androidx.activity.result.contract.ActivityResultContracts
-import app.alextran.immich.NativeBuffer
-import com.google.android.material.dialog.MaterialAlertDialogBuilder
-import com.google.android.material.textfield.TextInputEditText
-import com.google.android.material.textfield.TextInputLayout
-import io.flutter.embedding.engine.plugins.FlutterPlugin
-import io.flutter.embedding.engine.plugins.activity.ActivityAware
-import io.flutter.embedding.engine.plugins.activity.ActivityPluginBinding
-
-class NetworkApiPlugin : FlutterPlugin, ActivityAware {
-  private var networkApi: NetworkApiImpl? = null
-
-  override fun onAttachedToEngine(binding: FlutterPlugin.FlutterPluginBinding) {
-    networkApi = NetworkApiImpl(binding.applicationContext)
-    NetworkApi.setUp(binding.binaryMessenger, networkApi)
-  }
-
-  override fun onDetachedFromEngine(binding: FlutterPlugin.FlutterPluginBinding) {
-    NetworkApi.setUp(binding.binaryMessenger, null)
-    networkApi = null
-  }
-
-  override fun onAttachedToActivity(binding: ActivityPluginBinding) {
-    networkApi?.onAttachedToActivity(binding)
-  }
-
-  override fun onDetachedFromActivityForConfigChanges() {
-    networkApi?.onDetachedFromActivityForConfigChanges()
-  }
-
-  override fun onReattachedToActivityForConfigChanges(binding: ActivityPluginBinding) {
-    networkApi?.onReattachedToActivityForConfigChanges(binding)
-  }
-
-  override fun onDetachedFromActivity() {
-    networkApi?.onDetachedFromActivity()
-  }
-}
-
-private class NetworkApiImpl(private val context: Context) : NetworkApi {
-  private var activity: Activity? = null
-  private var pendingCallback: ((Result<ClientCertData>) -> Unit)? = null
-  private var filePicker: ActivityResultLauncher<Array<String>>? = null
-  private var promptText: ClientCertPrompt? = null
-
-  fun onAttachedToActivity(binding: ActivityPluginBinding) {
-    activity = binding.activity
-    (binding.activity as? ComponentActivity)?.let { componentActivity ->
-      filePicker = componentActivity.registerForActivityResult(
-        ActivityResultContracts.OpenDocument()
-      ) { uri -> uri?.let { handlePickedFile(it) } ?: pendingCallback?.invoke(Result.failure(OperationCanceledException())) }
-    }
-  }
-
-  fun onDetachedFromActivityForConfigChanges() {
-    activity = null
-  }
-
-  fun onReattachedToActivityForConfigChanges(binding: ActivityPluginBinding) {
-    activity = binding.activity
-  }
-
-  fun onDetachedFromActivity() {
-    activity = null
-  }
-
-  override fun addCertificate(clientData: ClientCertData, callback: (Result<Unit>) -> Unit) {
-    try {
-      HttpClientManager.setKeyEntry(clientData.data, clientData.password.toCharArray())
-      callback(Result.success(Unit))
-    } catch (e: Exception) {
-      callback(Result.failure(e))
-    }
-  }
-
-  override fun selectCertificate(promptText: ClientCertPrompt, callback: (Result<ClientCertData>) -> Unit) {
-    val picker = filePicker ?: return callback(Result.failure(IllegalStateException("No activity")))
-    pendingCallback = callback
-    this.promptText = promptText
-    picker.launch(arrayOf("application/x-pkcs12", "application/x-pem-file"))
-  }
-
-  override fun removeCertificate(callback: (Result<Unit>) -> Unit) {
-    HttpClientManager.deleteKeyEntry()
-    callback(Result.success(Unit))
-  }
-
-  override fun getClientPointer(): Long {
-    val client = HttpClientManager.getClient()
-    return NativeBuffer.createGlobalRef(client)
-  }
-
-  private fun handlePickedFile(uri: Uri) {
-    val callback = pendingCallback ?: return
-    pendingCallback = null
-
-    try {
-      val data = context.contentResolver.openInputStream(uri)?.use { it.readBytes() }
-        ?: throw IllegalStateException("Could not read file")
-
-      val activity = activity ?: throw IllegalStateException("No activity")
-      promptForPassword(activity) { password ->
-        promptText = null
-        if (password == null) {
-          callback(Result.failure(OperationCanceledException()))
-          return@promptForPassword
-        }
-        try {
-          HttpClientManager.setKeyEntry(data, password.toCharArray())
-          callback(Result.success(ClientCertData(data, password)))
-        } catch (e: Exception) {
-          callback(Result.failure(e))
-        }
-      }
-    } catch (e: Exception) {
-      callback(Result.failure(e))
-    }
-  }
-
-  private fun promptForPassword(activity: Activity, callback: (String?) -> Unit) {
-    val themedContext = ContextThemeWrapper(activity, com.google.android.material.R.style.Theme_Material3_DayNight_Dialog)
-    val density = activity.resources.displayMetrics.density
-    val horizontalPadding = (24 * density).toInt()
-
-    val textInputLayout = TextInputLayout(themedContext).apply {
-      hint = "Password"
-      endIconMode = TextInputLayout.END_ICON_PASSWORD_TOGGLE
-      layoutParams = FrameLayout.LayoutParams(MATCH_PARENT, WRAP_CONTENT).apply {
-        setMargins(horizontalPadding, 0, horizontalPadding, 0)
-      }
-    }
-
-    val editText = TextInputEditText(textInputLayout.context).apply {
-      inputType = InputType.TYPE_CLASS_TEXT or InputType.TYPE_TEXT_VARIATION_PASSWORD
-      layoutParams = LinearLayout.LayoutParams(MATCH_PARENT, WRAP_CONTENT)
-    }
-    textInputLayout.addView(editText)
-
-    val container = FrameLayout(themedContext).apply { addView(textInputLayout) }
-
-    val text = promptText!!
-    MaterialAlertDialogBuilder(themedContext)
-      .setTitle(text.title)
-      .setMessage(text.message)
-      .setView(container)
-      .setPositiveButton(text.confirm) { _, _ -> callback(editText.text.toString()) }
-      .setNegativeButton(text.cancel) { dialog, _ ->
-        dialog.cancel()
-        callback(null)
-      }
-      .setOnCancelListener { callback(null) }
-      .show()
-  }
-}

mobile/android/app/src/main/kotlin/app/alextran/immich/core/SSLConfig.kt

@@ -0,0 +1,73 @@
+package app.alextran.immich.core
+
+import java.security.KeyStore
+import javax.net.ssl.KeyManager
+import javax.net.ssl.SSLContext
+import javax.net.ssl.SSLSocketFactory
+import javax.net.ssl.TrustManager
+import javax.net.ssl.TrustManagerFactory
+import javax.net.ssl.X509TrustManager
+
+/**
+ * Shared SSL configuration for OkHttp and HttpsURLConnection.
+ * Stores the SSLSocketFactory and X509TrustManager configured by HttpSSLOptionsPlugin.
+ */
+object SSLConfig {
+  var sslSocketFactory: SSLSocketFactory? = null
+    private set
+
+  var trustManager: X509TrustManager? = null
+    private set
+
+  var requiresCustomSSL: Boolean = false
+    private set
+
+  private val listeners = mutableListOf<() -> Unit>()
+  private var configHash: Int = 0
+
+  fun addListener(listener: () -> Unit) {
+    listeners.add(listener)
+  }
+
+  fun apply(
+    keyManagers: Array<KeyManager>?,
+    trustManagers: Array<TrustManager>?,
+    allowSelfSigned: Boolean,
+    serverHost: String?,
+    clientCertHash: Int
+  ) {
+    synchronized(this) {
+      val newHash = computeHash(allowSelfSigned, serverHost, clientCertHash)
+      val newRequiresCustomSSL = allowSelfSigned || keyManagers != null
+      if (newHash == configHash && sslSocketFactory != null && requiresCustomSSL == newRequiresCustomSSL) {
+        return  // Config unchanged, skip
+      }
+
+      val sslContext = SSLContext.getInstance("TLS")
+      sslContext.init(keyManagers, trustManagers, null)
+      sslSocketFactory = sslContext.socketFactory
+      trustManager = trustManagers?.filterIsInstance<X509TrustManager>()?.firstOrNull()
+        ?: getDefaultTrustManager()
+      requiresCustomSSL = newRequiresCustomSSL
+      configHash = newHash
+      notifyListeners()
+    }
+  }
+
+  private fun computeHash(allowSelfSigned: Boolean, serverHost: String?, clientCertHash: Int): Int {
+    var result = allowSelfSigned.hashCode()
+    result = 31 * result + (serverHost?.hashCode() ?: 0)
+    result = 31 * result + clientCertHash
+    return result
+  }
+
+  private fun notifyListeners() {
+    listeners.forEach { it() }
+  }
+
+  private fun getDefaultTrustManager(): X509TrustManager {
+    val factory = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm())
+    factory.init(null as KeyStore?)
+    return factory.trustManagers.filterIsInstance<X509TrustManager>().first()
+  }
+}

mobile/android/app/src/main/kotlin/app/alextran/immich/images/RemoteImagesImpl.kt

@@ -3,15 +3,17 @@ package app.alextran.immich.images
 import android.content.Context
 import android.os.CancellationSignal
 import android.os.OperationCanceledException
+import app.alextran.immich.BuildConfig
 import app.alextran.immich.INITIAL_BUFFER_SIZE
 import app.alextran.immich.NativeBuffer
 import app.alextran.immich.NativeByteBuffer
-import app.alextran.immich.core.HttpClientManager
-import app.alextran.immich.core.USER_AGENT
+import app.alextran.immich.core.SSLConfig
 import kotlinx.coroutines.*
 import okhttp3.Cache
 import okhttp3.Call
 import okhttp3.Callback
+import okhttp3.ConnectionPool
+import okhttp3.Dispatcher
 import okhttp3.OkHttpClient
 import okhttp3.Request
 import okhttp3.Response
@@ -30,8 +32,15 @@ import java.nio.file.SimpleFileVisitor
 import java.nio.file.attribute.BasicFileAttributes
 import java.util.concurrent.ConcurrentHashMap
 import java.util.concurrent.Executors
+import java.util.concurrent.TimeUnit
+import javax.net.ssl.SSLSocketFactory
+import javax.net.ssl.X509TrustManager
 
 
+private const val USER_AGENT = "Immich_Android_${BuildConfig.VERSION_NAME}"
+private const val MAX_REQUESTS_PER_HOST = 64
+private const val KEEP_ALIVE_CONNECTIONS = 10
+private const val KEEP_ALIVE_DURATION_MINUTES = 5L
 private const val CACHE_SIZE_BYTES = 1024L * 1024 * 1024
 
 private class RemoteRequest(val cancellationSignal: CancellationSignal)
@@ -112,7 +121,7 @@ private object ImageFetcherManager {
       appContext = context.applicationContext
       cacheDir = context.cacheDir
       fetcher = build()
-      HttpClientManager.addClientChangedListener(::invalidate)
+      SSLConfig.addListener(::invalidate)
       initialized = true
     }
   }
@@ -134,14 +143,18 @@ private object ImageFetcherManager {
   private fun invalidate() {
     synchronized(this) {
       val oldFetcher = fetcher
+      if (oldFetcher is OkHttpImageFetcher && SSLConfig.requiresCustomSSL) {
+        fetcher = oldFetcher.reconfigure(SSLConfig.sslSocketFactory, SSLConfig.trustManager)
+        return
+      }
       fetcher = build()
       oldFetcher.drain()
     }
   }
 
   private fun build(): ImageFetcher {
-    return if (HttpClientManager.isMtls) {
-      OkHttpImageFetcher.create(cacheDir)
+    return if (SSLConfig.requiresCustomSSL) {
+      OkHttpImageFetcher.create(cacheDir, SSLConfig.sslSocketFactory, SSLConfig.trustManager)
     } else {
       CronetImageFetcher(appContext, cacheDir)
     }
@@ -367,17 +380,51 @@ private class OkHttpImageFetcher private constructor(
   private var draining = false
 
   companion object {
-    fun create(cacheDir: File): OkHttpImageFetcher {
+    fun create(
+      cacheDir: File,
+      sslSocketFactory: SSLSocketFactory?,
+      trustManager: X509TrustManager?,
+    ): OkHttpImageFetcher {
       val dir = File(cacheDir, "okhttp")
+      val connectionPool = ConnectionPool(
+        maxIdleConnections = KEEP_ALIVE_CONNECTIONS,
+        keepAliveDuration = KEEP_ALIVE_DURATION_MINUTES,
+        timeUnit = TimeUnit.MINUTES
+      )
 
-      val client = HttpClientManager.getClient().newBuilder()
+      val builder = OkHttpClient.Builder()
+        .addInterceptor { chain ->
+          chain.proceed(
+            chain.request().newBuilder()
+              .header("User-Agent", USER_AGENT)
+              .build()
+          )
+        }
+        .dispatcher(Dispatcher().apply { maxRequestsPerHost = MAX_REQUESTS_PER_HOST })
+        .connectionPool(connectionPool)
         .cache(Cache(File(dir, "thumbnails"), CACHE_SIZE_BYTES))
-        .build()
 
-      return OkHttpImageFetcher(client)
+      if (sslSocketFactory != null && trustManager != null) {
+        builder.sslSocketFactory(sslSocketFactory, trustManager)
+      }
+
+      return OkHttpImageFetcher(builder.build())
     }
   }
 
+  fun reconfigure(
+    sslSocketFactory: SSLSocketFactory?,
+    trustManager: X509TrustManager?,
+  ): OkHttpImageFetcher {
+    val builder = client.newBuilder()
+    if (sslSocketFactory != null && trustManager != null) {
+      builder.sslSocketFactory(sslSocketFactory, trustManager)
+    }
+    // Evict idle connections using old SSL config
+    client.connectionPool.evictAll()
+    return OkHttpImageFetcher(builder.build())
+  }
+
   private fun onComplete() {
     val shouldClose = synchronized(stateLock) {
       activeCount--
@@ -465,6 +512,7 @@ private class OkHttpImageFetcher private constructor(
       draining = true
       activeCount == 0
     }
+    client.connectionPool.evictAll()
     if (shouldClose) {
       client.cache?.close()
     }

mobile/android/app/src/main/res/xml/network_security_config.xml

@@ -1,9 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<network-security-config cleartextTrafficPermitted="true">
-    <base-config>
-        <trust-anchors>
-            <certificates src="system" />
-            <certificates src="user" />
-        </trust-anchors>
-    </base-config>
-</network-security-config>

mobile/android/fastlane/Fastfile

@@ -35,8 +35,8 @@ platform :android do
       task: 'bundle', 
       build_type: 'Release',
       properties: {
-        "android.injected.version.code" => 3033,
-        "android.injected.version.name" => "2.5.2",
+        "android.injected.version.code" => 3032,
+        "android.injected.version.name" => "2.5.1",
       }
     )
     upload_to_play_store(skip_upload_apk: true, skip_upload_images: true, skip_upload_screenshots: true, aab: '../build/app/outputs/bundle/release/app-release.aab')

mobile/ios/Podfile.lock

@@ -11,6 +11,40 @@ PODS:
     - FlutterMacOS
   - device_info_plus (0.0.1):
     - Flutter
+  - DKImagePickerController/Core (4.3.9):
+    - DKImagePickerController/ImageDataManager
+    - DKImagePickerController/Resource
+  - DKImagePickerController/ImageDataManager (4.3.9)
+  - DKImagePickerController/PhotoGallery (4.3.9):
+    - DKImagePickerController/Core
+    - DKPhotoGallery
+  - DKImagePickerController/Resource (4.3.9)
+  - DKPhotoGallery (0.0.19):
+    - DKPhotoGallery/Core (= 0.0.19)
+    - DKPhotoGallery/Model (= 0.0.19)
+    - DKPhotoGallery/Preview (= 0.0.19)
+    - DKPhotoGallery/Resource (= 0.0.19)
+    - SDWebImage
+    - SwiftyGif
+  - DKPhotoGallery/Core (0.0.19):
+    - DKPhotoGallery/Model
+    - DKPhotoGallery/Preview
+    - SDWebImage
+    - SwiftyGif
+  - DKPhotoGallery/Model (0.0.19):
+    - SDWebImage
+    - SwiftyGif
+  - DKPhotoGallery/Preview (0.0.19):
+    - DKPhotoGallery/Model
+    - DKPhotoGallery/Resource
+    - SDWebImage
+    - SwiftyGif
+  - DKPhotoGallery/Resource (0.0.19):
+    - SDWebImage
+    - SwiftyGif
+  - file_picker (0.0.1):
+    - DKImagePickerController/PhotoGallery
+    - Flutter
   - Flutter (1.0.0)
   - flutter_local_notifications (0.0.1):
     - Flutter
@@ -59,6 +93,9 @@ PODS:
     - Flutter
     - FlutterMacOS
   - SAMKeychain (1.5.3)
+  - SDWebImage (5.21.0):
+    - SDWebImage/Core (= 5.21.0)
+  - SDWebImage/Core (5.21.0)
   - share_handler_ios (0.0.14):
     - Flutter
     - share_handler_ios/share_handler_ios_models (= 0.0.14)
@@ -94,6 +131,7 @@ PODS:
     - sqlite3/fts5
     - sqlite3/perf-threadsafe
     - sqlite3/rtree
+  - SwiftyGif (5.4.5)
   - url_launcher_ios (0.0.1):
     - Flutter
   - wakelock_plus (0.0.1):
@@ -105,6 +143,7 @@ DEPENDENCIES:
   - connectivity_plus (from `.symlinks/plugins/connectivity_plus/ios`)
   - cupertino_http (from `.symlinks/plugins/cupertino_http/darwin`)
   - device_info_plus (from `.symlinks/plugins/device_info_plus/ios`)
+  - file_picker (from `.symlinks/plugins/file_picker/ios`)
   - Flutter (from `Flutter`)
   - flutter_local_notifications (from `.symlinks/plugins/flutter_local_notifications/ios`)
   - flutter_native_splash (from `.symlinks/plugins/flutter_native_splash/ios`)
@@ -137,9 +176,13 @@ DEPENDENCIES:
 
 SPEC REPOS:
   trunk:
+    - DKImagePickerController
+    - DKPhotoGallery
     - MapLibre
     - SAMKeychain
+    - SDWebImage
     - sqlite3
+    - SwiftyGif
 
 EXTERNAL SOURCES:
   background_downloader:
@@ -152,6 +195,8 @@ EXTERNAL SOURCES:
     :path: ".symlinks/plugins/cupertino_http/darwin"
   device_info_plus:
     :path: ".symlinks/plugins/device_info_plus/ios"
+  file_picker:
+    :path: ".symlinks/plugins/file_picker/ios"
   Flutter:
     :path: Flutter
   flutter_local_notifications:
@@ -217,6 +262,9 @@ SPEC CHECKSUMS:
   connectivity_plus: cb623214f4e1f6ef8fe7403d580fdad517d2f7dd
   cupertino_http: 94ac07f5ff090b8effa6c5e2c47871d48ab7c86c
   device_info_plus: 21fcca2080fbcd348be798aa36c3e5ed849eefbe
+  DKImagePickerController: 946cec48c7873164274ecc4624d19e3da4c1ef3c
+  DKPhotoGallery: b3834fecb755ee09a593d7c9e389d8b5d6deed60
+  file_picker: a0560bc09d61de87f12d246fc47d2119e6ef37be
   Flutter: cabc95a1d2626b1b06e7179b784ebcf0c0cde467
   flutter_local_notifications: ad39620c743ea4c15127860f4b5641649a988100
   flutter_native_splash: c32d145d68aeda5502d5f543ee38c192065986cf
@@ -240,6 +288,7 @@ SPEC CHECKSUMS:
   permission_handler_apple: 4ed2196e43d0651e8ff7ca3483a069d469701f2d
   photo_manager: 1d80ae07a89a67dfbcae95953a1e5a24af7c3e62
   SAMKeychain: 483e1c9f32984d50ca961e26818a534283b4cd5c
+  SDWebImage: f84b0feeb08d2d11e6a9b843cb06d75ebf5b8868
   share_handler_ios: e2244e990f826b2c8eaa291ac3831569438ba0fb
   share_handler_ios_models: fc638c9b4330dc7f082586c92aee9dfa0b87b871
   share_plus: 50da8cb520a8f0f65671c6c6a99b3617ed10a58a
@@ -247,6 +296,7 @@ SPEC CHECKSUMS:
   sqflite_darwin: 20b2a3a3b70e43edae938624ce550a3cbf66a3d0
   sqlite3: fc1400008a9b3525f5914ed715a5d1af0b8f4983
   sqlite3_flutter_libs: f8fc13346870e73fe35ebf6dbb997fbcd156b241
+  SwiftyGif: 706c60cf65fa2bc5ee0313beece843c8eb8194d4
   url_launcher_ios: 694010445543906933d732453a59da0a173ae33d
   wakelock_plus: e29112ab3ef0b318e58cfa5c32326458be66b556
 

mobile/ios/Runner.xcodeproj/project.pbxproj

@@ -33,7 +33,6 @@
 		FE5499F42F1197D8006016CB /* RemoteImages.g.swift in Sources */ = {isa = PBXBuildFile; fileRef = FE5499F22F1197D8006016CB /* RemoteImages.g.swift */; };
 		FE5499F62F11980E006016CB /* LocalImagesImpl.swift in Sources */ = {isa = PBXBuildFile; fileRef = FE5499F52F11980E006016CB /* LocalImagesImpl.swift */; };
 		FE5499F82F1198E2006016CB /* RemoteImagesImpl.swift in Sources */ = {isa = PBXBuildFile; fileRef = FE5499F72F1198DE006016CB /* RemoteImagesImpl.swift */; };
-		FE5FE4AE2F30FBC000A71243 /* ImageProcessing.swift in Sources */ = {isa = PBXBuildFile; fileRef = FE5FE4AD2F30FBC000A71243 /* ImageProcessing.swift */; };
 		FEAFA8732E4D42F4001E47FE /* Thumbhash.swift in Sources */ = {isa = PBXBuildFile; fileRef = FEAFA8722E4D42F4001E47FE /* Thumbhash.swift */; };
 		FEE084F82EC172460045228E /* SQLiteData in Frameworks */ = {isa = PBXBuildFile; productRef = FEE084F72EC172460045228E /* SQLiteData */; };
 		FEE084FB2EC1725A0045228E /* RawStructuredFieldValues in Frameworks */ = {isa = PBXBuildFile; productRef = FEE084FA2EC1725A0045228E /* RawStructuredFieldValues */; };
@@ -125,7 +124,6 @@
 		FE5499F22F1197D8006016CB /* RemoteImages.g.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = RemoteImages.g.swift; sourceTree = "<group>"; };
 		FE5499F52F11980E006016CB /* LocalImagesImpl.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = LocalImagesImpl.swift; sourceTree = "<group>"; };
 		FE5499F72F1198DE006016CB /* RemoteImagesImpl.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = RemoteImagesImpl.swift; sourceTree = "<group>"; };
-		FE5FE4AD2F30FBC000A71243 /* ImageProcessing.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = ImageProcessing.swift; sourceTree = "<group>"; };
 		FEAFA8722E4D42F4001E47FE /* Thumbhash.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = Thumbhash.swift; sourceTree = "<group>"; };
 /* End PBXFileReference section */
 
@@ -327,7 +325,6 @@
 		FED3B1952E253E9B0030FD97 /* Images */ = {
 			isa = PBXGroup;
 			children = (
-				FE5FE4AD2F30FBC000A71243 /* ImageProcessing.swift */,
 				FE5499F72F1198DE006016CB /* RemoteImagesImpl.swift */,
 				FE5499F52F11980E006016CB /* LocalImagesImpl.swift */,
 				FE5499F12F1197D8006016CB /* LocalImages.g.swift */,
@@ -612,7 +609,6 @@
 				FE5499F32F1197D8006016CB /* LocalImages.g.swift in Sources */,
 				FE5499F62F11980E006016CB /* LocalImagesImpl.swift in Sources */,
 				FE5499F42F1197D8006016CB /* RemoteImages.g.swift in Sources */,
-				FE5FE4AE2F30FBC000A71243 /* ImageProcessing.swift in Sources */,
 				B25D377A2E72CA15008B6CA7 /* Connectivity.g.swift in Sources */,
 				FE5499F82F1198E2006016CB /* RemoteImagesImpl.swift in Sources */,
 				FEAFA8732E4D42F4001E47FE /* Thumbhash.swift in Sources */,

mobile/ios/Runner/AppDelegate.swift

@@ -15,12 +15,12 @@ import UIKit
   ) -> Bool {
     // Required for flutter_local_notification
     if #available(iOS 10.0, *) {
-      UNUserNotificationCenter.current().delegate = self as UNUserNotificationCenterDelegate
+      UNUserNotificationCenter.current().delegate = self as? UNUserNotificationCenterDelegate
     }
 
     GeneratedPluginRegistrant.register(with: self)
     let controller: FlutterViewController = window?.rootViewController as! FlutterViewController
-    AppDelegate.registerPlugins(with: controller.engine, controller: controller)
+    AppDelegate.registerPlugins(with: controller.engine)
     BackgroundServicePlugin.register(with: self.registrar(forPlugin: "BackgroundServicePlugin")!)
 
     BackgroundServicePlugin.registerBackgroundProcessing()
@@ -51,13 +51,12 @@ import UIKit
     return super.application(application, didFinishLaunchingWithOptions: launchOptions)
   }
   
-  public static func registerPlugins(with engine: FlutterEngine, controller: FlutterViewController?) {
+  public static func registerPlugins(with engine: FlutterEngine) {
     NativeSyncApiImpl.register(with: engine.registrar(forPlugin: NativeSyncApiImpl.name)!)
     LocalImageApiSetup.setUp(binaryMessenger: engine.binaryMessenger, api: LocalImageApiImpl())
     RemoteImageApiSetup.setUp(binaryMessenger: engine.binaryMessenger, api: RemoteImageApiImpl())
     BackgroundWorkerFgHostApiSetup.setUp(binaryMessenger: engine.binaryMessenger, api: BackgroundWorkerApiImpl())
     ConnectivityApiSetup.setUp(binaryMessenger: engine.binaryMessenger, api: ConnectivityApiImpl())
-    NetworkApiSetup.setUp(binaryMessenger: engine.binaryMessenger, api: NetworkApiImpl(viewController: controller))
   }
   
   public static func cancelPlugins(with engine: FlutterEngine) {

mobile/ios/Runner/Background/BackgroundWorker.swift

@@ -95,7 +95,7 @@ class BackgroundWorker: BackgroundWorkerBgHostApi {
     // Register plugins in the new engine
     GeneratedPluginRegistrant.register(with: engine)
     // Register custom plugins
-    AppDelegate.registerPlugins(with: engine, controller: nil)
+    AppDelegate.registerPlugins(with: engine)
     flutterApi = BackgroundWorkerFlutterApi(binaryMessenger: engine.binaryMessenger)
     BackgroundWorkerBgHostApiSetup.setUp(binaryMessenger: engine.binaryMessenger, api: self)
     

mobile/ios/Runner/Core/Network.g.swift

@@ -1,298 +0,0 @@
-// Autogenerated from Pigeon (v26.0.2), do not edit directly.
-// See also: https://pub.dev/packages/pigeon
-
-import Foundation
-
-#if os(iOS)
-  import Flutter
-#elseif os(macOS)
-  import FlutterMacOS
-#else
-  #error("Unsupported platform.")
-#endif
-
-private func wrapResult(_ result: Any?) -> [Any?] {
-  return [result]
-}
-
-private func wrapError(_ error: Any) -> [Any?] {
-  if let pigeonError = error as? PigeonError {
-    return [
-      pigeonError.code,
-      pigeonError.message,
-      pigeonError.details,
-    ]
-  }
-  if let flutterError = error as? FlutterError {
-    return [
-      flutterError.code,
-      flutterError.message,
-      flutterError.details,
-    ]
-  }
-  return [
-    "\(error)",
-    "\(type(of: error))",
-    "Stacktrace: \(Thread.callStackSymbols)",
-  ]
-}
-
-private func isNullish(_ value: Any?) -> Bool {
-  return value is NSNull || value == nil
-}
-
-private func nilOrValue<T>(_ value: Any?) -> T? {
-  if value is NSNull { return nil }
-  return value as! T?
-}
-
-func deepEqualsNetwork(_ lhs: Any?, _ rhs: Any?) -> Bool {
-  let cleanLhs = nilOrValue(lhs) as Any?
-  let cleanRhs = nilOrValue(rhs) as Any?
-  switch (cleanLhs, cleanRhs) {
-  case (nil, nil):
-    return true
-
-  case (nil, _), (_, nil):
-    return false
-
-  case is (Void, Void):
-    return true
-
-  case let (cleanLhsHashable, cleanRhsHashable) as (AnyHashable, AnyHashable):
-    return cleanLhsHashable == cleanRhsHashable
-
-  case let (cleanLhsArray, cleanRhsArray) as ([Any?], [Any?]):
-    guard cleanLhsArray.count == cleanRhsArray.count else { return false }
-    for (index, element) in cleanLhsArray.enumerated() {
-      if !deepEqualsNetwork(element, cleanRhsArray[index]) {
-        return false
-      }
-    }
-    return true
-
-  case let (cleanLhsDictionary, cleanRhsDictionary) as ([AnyHashable: Any?], [AnyHashable: Any?]):
-    guard cleanLhsDictionary.count == cleanRhsDictionary.count else { return false }
-    for (key, cleanLhsValue) in cleanLhsDictionary {
-      guard cleanRhsDictionary.index(forKey: key) != nil else { return false }
-      if !deepEqualsNetwork(cleanLhsValue, cleanRhsDictionary[key]!) {
-        return false
-      }
-    }
-    return true
-
-  default:
-    // Any other type shouldn't be able to be used with pigeon. File an issue if you find this to be untrue.
-    return false
-  }
-}
-
-func deepHashNetwork(value: Any?, hasher: inout Hasher) {
-  if let valueList = value as? [AnyHashable] {
-     for item in valueList { deepHashNetwork(value: item, hasher: &hasher) }
-     return
-  }
-
-  if let valueDict = value as? [AnyHashable: AnyHashable] {
-    for key in valueDict.keys { 
-      hasher.combine(key)
-      deepHashNetwork(value: valueDict[key]!, hasher: &hasher)
-    }
-    return
-  }
-
-  if let hashableValue = value as? AnyHashable {
-    hasher.combine(hashableValue.hashValue)
-  }
-
-  return hasher.combine(String(describing: value))
-}
-
-    
-
-/// Generated class from Pigeon that represents data sent in messages.
-struct ClientCertData: Hashable {
-  var data: FlutterStandardTypedData
-  var password: String
-
-
-  // swift-format-ignore: AlwaysUseLowerCamelCase
-  static func fromList(_ pigeonVar_list: [Any?]) -> ClientCertData? {
-    let data = pigeonVar_list[0] as! FlutterStandardTypedData
-    let password = pigeonVar_list[1] as! String
-
-    return ClientCertData(
-      data: data,
-      password: password
-    )
-  }
-  func toList() -> [Any?] {
-    return [
-      data,
-      password,
-    ]
-  }
-  static func == (lhs: ClientCertData, rhs: ClientCertData) -> Bool {
-    return deepEqualsNetwork(lhs.toList(), rhs.toList())  }
-  func hash(into hasher: inout Hasher) {
-    deepHashNetwork(value: toList(), hasher: &hasher)
-  }
-}
-
-/// Generated class from Pigeon that represents data sent in messages.
-struct ClientCertPrompt: Hashable {
-  var title: String
-  var message: String
-  var cancel: String
-  var confirm: String
-
-
-  // swift-format-ignore: AlwaysUseLowerCamelCase
-  static func fromList(_ pigeonVar_list: [Any?]) -> ClientCertPrompt? {
-    let title = pigeonVar_list[0] as! String
-    let message = pigeonVar_list[1] as! String
-    let cancel = pigeonVar_list[2] as! String
-    let confirm = pigeonVar_list[3] as! String
-
-    return ClientCertPrompt(
-      title: title,
-      message: message,
-      cancel: cancel,
-      confirm: confirm
-    )
-  }
-  func toList() -> [Any?] {
-    return [
-      title,
-      message,
-      cancel,
-      confirm,
-    ]
-  }
-  static func == (lhs: ClientCertPrompt, rhs: ClientCertPrompt) -> Bool {
-    return deepEqualsNetwork(lhs.toList(), rhs.toList())  }
-  func hash(into hasher: inout Hasher) {
-    deepHashNetwork(value: toList(), hasher: &hasher)
-  }
-}
-
-private class NetworkPigeonCodecReader: FlutterStandardReader {
-  override func readValue(ofType type: UInt8) -> Any? {
-    switch type {
-    case 129:
-      return ClientCertData.fromList(self.readValue() as! [Any?])
-    case 130:
-      return ClientCertPrompt.fromList(self.readValue() as! [Any?])
-    default:
-      return super.readValue(ofType: type)
-    }
-  }
-}
-
-private class NetworkPigeonCodecWriter: FlutterStandardWriter {
-  override func writeValue(_ value: Any) {
-    if let value = value as? ClientCertData {
-      super.writeByte(129)
-      super.writeValue(value.toList())
-    } else if let value = value as? ClientCertPrompt {
-      super.writeByte(130)
-      super.writeValue(value.toList())
-    } else {
-      super.writeValue(value)
-    }
-  }
-}
-
-private class NetworkPigeonCodecReaderWriter: FlutterStandardReaderWriter {
-  override func reader(with data: Data) -> FlutterStandardReader {
-    return NetworkPigeonCodecReader(data: data)
-  }
-
-  override func writer(with data: NSMutableData) -> FlutterStandardWriter {
-    return NetworkPigeonCodecWriter(data: data)
-  }
-}
-
-class NetworkPigeonCodec: FlutterStandardMessageCodec, @unchecked Sendable {
-  static let shared = NetworkPigeonCodec(readerWriter: NetworkPigeonCodecReaderWriter())
-}
-
-
-/// Generated protocol from Pigeon that represents a handler of messages from Flutter.
-protocol NetworkApi {
-  func addCertificate(clientData: ClientCertData, completion: @escaping (Result<Void, Error>) -> Void)
-  func selectCertificate(promptText: ClientCertPrompt, completion: @escaping (Result<ClientCertData, Error>) -> Void)
-  func removeCertificate(completion: @escaping (Result<Void, Error>) -> Void)
-  func getClientPointer() throws -> Int64
-}
-
-/// Generated setup class from Pigeon to handle messages through the `binaryMessenger`.
-class NetworkApiSetup {
-  static var codec: FlutterStandardMessageCodec { NetworkPigeonCodec.shared }
-  /// Sets up an instance of `NetworkApi` to handle messages through the `binaryMessenger`.
-  static func setUp(binaryMessenger: FlutterBinaryMessenger, api: NetworkApi?, messageChannelSuffix: String = "") {
-    let channelSuffix = messageChannelSuffix.count > 0 ? ".\(messageChannelSuffix)" : ""
-    let addCertificateChannel = FlutterBasicMessageChannel(name: "dev.flutter.pigeon.immich_mobile.NetworkApi.addCertificate\(channelSuffix)", binaryMessenger: binaryMessenger, codec: codec)
-    if let api = api {
-      addCertificateChannel.setMessageHandler { message, reply in
-        let args = message as! [Any?]
-        let clientDataArg = args[0] as! ClientCertData
-        api.addCertificate(clientData: clientDataArg) { result in
-          switch result {
-          case .success:
-            reply(wrapResult(nil))
-          case .failure(let error):
-            reply(wrapError(error))
-          }
-        }
-      }
-    } else {
-      addCertificateChannel.setMessageHandler(nil)
-    }
-    let selectCertificateChannel = FlutterBasicMessageChannel(name: "dev.flutter.pigeon.immich_mobile.NetworkApi.selectCertificate\(channelSuffix)", binaryMessenger: binaryMessenger, codec: codec)
-    if let api = api {
-      selectCertificateChannel.setMessageHandler { message, reply in
-        let args = message as! [Any?]
-        let promptTextArg = args[0] as! ClientCertPrompt
-        api.selectCertificate(promptText: promptTextArg) { result in
-          switch result {
-          case .success(let res):
-            reply(wrapResult(res))
-          case .failure(let error):
-            reply(wrapError(error))
-          }
-        }
-      }
-    } else {
-      selectCertificateChannel.setMessageHandler(nil)
-    }
-    let removeCertificateChannel = FlutterBasicMessageChannel(name: "dev.flutter.pigeon.immich_mobile.NetworkApi.removeCertificate\(channelSuffix)", binaryMessenger: binaryMessenger, codec: codec)
-    if let api = api {
-      removeCertificateChannel.setMessageHandler { _, reply in
-        api.removeCertificate { result in
-          switch result {
-          case .success:
-            reply(wrapResult(nil))
-          case .failure(let error):
-            reply(wrapError(error))
-          }
-        }
-      }
-    } else {
-      removeCertificateChannel.setMessageHandler(nil)
-    }
-    let getClientPointerChannel = FlutterBasicMessageChannel(name: "dev.flutter.pigeon.immich_mobile.NetworkApi.getClientPointer\(channelSuffix)", binaryMessenger: binaryMessenger, codec: codec)
-    if let api = api {
-      getClientPointerChannel.setMessageHandler { _, reply in
-        do {
-          let result = try api.getClientPointer()
-          reply(wrapResult(result))
-        } catch {
-          reply(wrapError(error))
-        }
-      }
-    } else {
-      getClientPointerChannel.setMessageHandler(nil)
-    }
-  }
-}

mobile/ios/Runner/Core/NetworkApiImpl.swift

@@ -1,162 +0,0 @@
-import Foundation
-import UniformTypeIdentifiers
-
-enum ImportError: Error {
-  case noFile
-  case noViewController
-  case keychainError(OSStatus)
-  case cancelled
-}
-
-class NetworkApiImpl: NetworkApi {
-  weak var viewController: UIViewController?
-  private var activeImporter: CertImporter?
-  
-  init(viewController: UIViewController?) {
-    self.viewController = viewController
-  }
-  
-  func selectCertificate(promptText: ClientCertPrompt, completion: @escaping (Result<ClientCertData, any Error>) -> Void) {
-    let importer = CertImporter(promptText: promptText, completion: { [weak self] result in
-      self?.activeImporter = nil
-      completion(result.map { ClientCertData(data: FlutterStandardTypedData(bytes: $0.0), password: $0.1) })
-    }, viewController: viewController)
-    activeImporter = importer
-    importer.load()
-  }
-  
-  func removeCertificate(completion: @escaping (Result<Void, any Error>) -> Void) {
-    let status = clearCerts()
-    if status == errSecSuccess || status == errSecItemNotFound {
-      return completion(.success(()))
-    }
-    completion(.failure(ImportError.keychainError(status)))
-  }
-  
-  func addCertificate(clientData: ClientCertData, completion: @escaping (Result<Void, any Error>) -> Void) {
-    let status = importCert(clientData: clientData.data.data, password: clientData.password)
-    if status == errSecSuccess {
-      return completion(.success(()))
-    }
-    completion(.failure(ImportError.keychainError(status)))
-  }
-  
-  func getClientPointer() throws -> Int64 {
-    let pointer = URLSessionManager.shared.sessionPointer
-    return Int64(Int(bitPattern: pointer))
-  }
-}
-
-private class CertImporter: NSObject, UIDocumentPickerDelegate {
-  private let promptText: ClientCertPrompt
-  private var completion: ((Result<(Data, String), Error>) -> Void)
-  private weak var viewController: UIViewController?
-  
-  init(promptText: ClientCertPrompt, completion: (@escaping (Result<(Data, String), Error>) -> Void), viewController: UIViewController?) {
-    self.promptText = promptText
-    self.completion = completion
-    self.viewController = viewController
-  }
-  
-  func load() {
-    guard let vc = viewController else { return completion(.failure(ImportError.noViewController)) }
-    let picker = UIDocumentPickerViewController(forOpeningContentTypes: [
-      UTType(filenameExtension: "p12")!,
-      UTType(filenameExtension: "pfx")!,
-    ])
-    picker.delegate = self
-    picker.allowsMultipleSelection = false
-    vc.present(picker, animated: true)
-  }
-  
-  func documentPicker(_ controller: UIDocumentPickerViewController, didPickDocumentsAt urls: [URL]) {
-    guard let url = urls.first else {
-      return completion(.failure(ImportError.noFile))
-    }
-    
-    Task { @MainActor in
-      do {
-        let data = try readSecurityScoped(url: url)
-        guard let password = await promptForPassword() else {
-          return completion(.failure(ImportError.cancelled))
-        }
-        let status = importCert(clientData: data, password: password)
-        if status != errSecSuccess {
-          return completion(.failure(ImportError.keychainError(status)))
-        }
-        
-        await URLSessionManager.shared.session.flush()
-        self.completion(.success((data, password)))
-      } catch {
-        completion(.failure(error))
-      }
-    }
-  }
-  
-  func documentPickerWasCancelled(_ controller: UIDocumentPickerViewController) {
-    completion(.failure(ImportError.cancelled))
-  }
-  
-  private func promptForPassword() async -> String? {
-    guard let vc = viewController else { return nil }
-    
-    return await withCheckedContinuation { continuation in
-      let alert = UIAlertController(
-        title: promptText.title,
-        message: promptText.message,
-        preferredStyle: .alert
-      )
-      
-      alert.addTextField { $0.isSecureTextEntry = true }
-      
-      alert.addAction(UIAlertAction(title: promptText.cancel, style: .cancel) { _ in
-        continuation.resume(returning: nil)
-      })
-      
-      alert.addAction(UIAlertAction(title: promptText.confirm, style: .default) { _ in
-        continuation.resume(returning: alert.textFields?.first?.text ?? "")
-      })
-      
-      vc.present(alert, animated: true)
-    }
-  }
-  
-  private func readSecurityScoped(url: URL) throws -> Data {
-    guard url.startAccessingSecurityScopedResource() else {
-      throw ImportError.noFile
-    }
-    defer { url.stopAccessingSecurityScopedResource() }
-    return try Data(contentsOf: url)
-  }
-}
-
-private func importCert(clientData: Data, password: String) -> OSStatus {
-  let options = [kSecImportExportPassphrase: password] as CFDictionary
-  var items: CFArray?
-  let status = SecPKCS12Import(clientData as CFData, options, &items)
-  
-  guard status == errSecSuccess,
-        let array = items as? [[String: Any]],
-        let first = array.first,
-        let identity = first[kSecImportItemIdentity as String] else {
-    return status
-  }
-  
-  clearCerts()
-  
-  let addQuery: [String: Any] = [
-    kSecClass as String: kSecClassIdentity,
-    kSecValueRef as String: identity,
-    kSecAttrLabel as String: CLIENT_CERT_LABEL,
-    kSecAttrAccessible as String: kSecAttrAccessibleAfterFirstUnlockThisDeviceOnly,
-  ]
-  return SecItemAdd(addQuery as CFDictionary, nil)
-}
-
-@discardableResult private func clearCerts() -> OSStatus {
-  let deleteQuery: [String: Any] = [
-    kSecClass as String: kSecClassIdentity,
-    kSecAttrLabel as String: CLIENT_CERT_LABEL,
-  ]
-  return SecItemDelete(deleteQuery as CFDictionary)
-}

mobile/ios/Runner/Core/URLSessionManager.swift

@@ -1,91 +0,0 @@
-import Foundation
-
-let CLIENT_CERT_LABEL = "app.alextran.immich.client_identity"
-
-/// Manages a shared URLSession with SSL configuration support.
-class URLSessionManager: NSObject {
-  static let shared = URLSessionManager()
-  
-  let session: URLSession
-  private let configuration = {
-    let config = URLSessionConfiguration.default
-    
-    let cacheDir = FileManager.default.urls(for: .cachesDirectory, in: .userDomainMask)
-      .first!
-      .appendingPathComponent("api", isDirectory: true)
-    try! FileManager.default.createDirectory(at: cacheDir, withIntermediateDirectories: true)
-    
-    config.urlCache = URLCache(
-      memoryCapacity: 0,
-      diskCapacity: 1024 * 1024 * 1024,
-      directory: cacheDir
-    )
-    
-    config.httpMaximumConnectionsPerHost = 64
-    config.timeoutIntervalForRequest = 60
-    config.timeoutIntervalForResource = 300
-    
-    let version = Bundle.main.object(forInfoDictionaryKey: "CFBundleShortVersionString") as? String ?? "unknown"
-    config.httpAdditionalHeaders = ["User-Agent": "Immich_iOS_\(version)"]
-    
-    return config
-  }()
-  
-  var sessionPointer: UnsafeMutableRawPointer {
-    Unmanaged.passUnretained(session).toOpaque()
-  }
-  
-  private override init() {
-    session = URLSession(configuration: configuration, delegate: URLSessionManagerDelegate(), delegateQueue: nil)
-    super.init()
-  }
-}
-
-class URLSessionManagerDelegate: NSObject, URLSessionTaskDelegate {
-  func urlSession(
-    _ session: URLSession,
-    didReceive challenge: URLAuthenticationChallenge,
-    completionHandler: @escaping (URLSession.AuthChallengeDisposition, URLCredential?) -> Void
-  ) {
-    handleChallenge(challenge, completionHandler: completionHandler)
-  }
-  
-  func urlSession(
-    _ session: URLSession,
-    task: URLSessionTask,
-    didReceive challenge: URLAuthenticationChallenge,
-    completionHandler: @escaping (URLSession.AuthChallengeDisposition, URLCredential?) -> Void
-  ) {
-    handleChallenge(challenge, completionHandler: completionHandler)
-  }
-  
-  func handleChallenge(
-    _ challenge: URLAuthenticationChallenge,
-    completionHandler: @escaping (URLSession.AuthChallengeDisposition, URLCredential?) -> Void
-  ) {
-    switch challenge.protectionSpace.authenticationMethod {
-    case NSURLAuthenticationMethodClientCertificate: handleClientCertificate(completion: completionHandler)
-    default: completionHandler(.performDefaultHandling, nil)
-    }
-  }
-  
-  private func handleClientCertificate(
-    completion: @escaping (URLSession.AuthChallengeDisposition, URLCredential?) -> Void
-  ) {
-    let query: [String: Any] = [
-      kSecClass as String: kSecClassIdentity,
-      kSecAttrLabel as String: CLIENT_CERT_LABEL,
-      kSecReturnRef as String: true,
-    ]
-    
-    var item: CFTypeRef?
-    let status = SecItemCopyMatching(query as CFDictionary, &item)
-    if status == errSecSuccess, let identity = item {
-      let credential = URLCredential(identity: identity as! SecIdentity,
-                                     certificates: nil,
-                                     persistence: .forSession)
-      return completion(.useCredential, credential)
-    }
-    completion(.performDefaultHandling, nil)
-  }
-}

mobile/ios/Runner/Images/ImageProcessing.swift

@@ -1,7 +0,0 @@
-import Foundation
-
-enum ImageProcessing {
-  static let queue = DispatchQueue(label: "thumbnail.processing", qos: .userInitiated, attributes: .concurrent)
-  static let semaphore = DispatchSemaphore(value: ProcessInfo.processInfo.activeProcessorCount * 2)
-  static let cancelledResult = Result<[String: Int64]?, any Error>.success(nil)
-}

mobile/ios/Runner/Images/LocalImagesImpl.swift

@@ -34,6 +34,7 @@ class LocalImageApiImpl: LocalImageApi {
   private static let assetQueue = DispatchQueue(label: "thumbnail.assets", qos: .userInitiated)
   private static let requestQueue = DispatchQueue(label: "thumbnail.requests", qos: .userInitiated)
   private static let cancelQueue = DispatchQueue(label: "thumbnail.cancellation", qos: .default)
+  private static let processingQueue = DispatchQueue(label: "thumbnail.processing", qos: .userInteractive, attributes: .concurrent)
   
   private static var rgbaFormat = vImage_CGImageFormat(
     bitsPerComponent: 8,
@@ -43,6 +44,8 @@ class LocalImageApiImpl: LocalImageApi {
     renderingIntent: .defaultIntent
   )!
   private static var requests = [Int64: LocalImageRequest]()
+  private static let cancelledResult = Result<[String: Int64]?, any Error>.success(nil)
+  private static let concurrencySemaphore = DispatchSemaphore(value: ProcessInfo.processInfo.activeProcessorCount * 2)
   private static let assetCache = {
     let assetCache = NSCache<NSString, PHAsset>()
     assetCache.countLimit = 10000
@@ -50,7 +53,7 @@ class LocalImageApiImpl: LocalImageApi {
   }()
   
   func getThumbhash(thumbhash: String, completion: @escaping (Result<[String : Int64], any Error>) -> Void) {
-    ImageProcessing.queue.async {
+    Self.processingQueue.async {
       guard let data = Data(base64Encoded: thumbhash)
       else { return completion(.failure(PigeonError(code: "", message: "Invalid base64 string: \(thumbhash)", details: nil)))}
       
@@ -68,16 +71,16 @@ class LocalImageApiImpl: LocalImageApi {
     let request = LocalImageRequest(callback: completion)
     let item = DispatchWorkItem {
       if request.isCancelled {
-        return completion(ImageProcessing.cancelledResult)
+        return completion(Self.cancelledResult)
       }
       
-      ImageProcessing.semaphore.wait()
+      Self.concurrencySemaphore.wait()
       defer {
-        ImageProcessing.semaphore.signal()
+        Self.concurrencySemaphore.signal()
       }
       
       if request.isCancelled {
-        return completion(ImageProcessing.cancelledResult)
+        return completion(Self.cancelledResult)
       }
       
       guard let asset = Self.requestAsset(assetId: assetId)
@@ -88,7 +91,7 @@ class LocalImageApiImpl: LocalImageApi {
       }
       
       if request.isCancelled {
-        return completion(ImageProcessing.cancelledResult)
+        return completion(Self.cancelledResult)
       }
       
       var image: UIImage?
@@ -103,7 +106,7 @@ class LocalImageApiImpl: LocalImageApi {
       )
       
       if request.isCancelled {
-        return completion(ImageProcessing.cancelledResult)
+        return completion(Self.cancelledResult)
       }
       
       guard let image = image,
@@ -113,7 +116,7 @@ class LocalImageApiImpl: LocalImageApi {
       }
       
       if request.isCancelled {
-        return completion(ImageProcessing.cancelledResult)
+        return completion(Self.cancelledResult)
       }
       
       do {
@@ -121,7 +124,7 @@ class LocalImageApiImpl: LocalImageApi {
         
         if request.isCancelled {
           buffer.free()
-          return completion(ImageProcessing.cancelledResult)
+          return completion(Self.cancelledResult)
         }
         
         request.callback(.success([
@@ -130,6 +133,7 @@ class LocalImageApiImpl: LocalImageApi {
           "height": Int64(buffer.height),
           "rowBytes": Int64(buffer.rowBytes)
         ]))
+        print("Successful response for \(requestId)")
         Self.remove(requestId: requestId)
       } catch {
         Self.remove(requestId: requestId)
@@ -139,7 +143,7 @@ class LocalImageApiImpl: LocalImageApi {
     
     request.workItem = item
     Self.add(requestId: requestId, request: request)
-    ImageProcessing.queue.async(execute: item)
+    Self.processingQueue.async(execute: item)
   }
   
   func cancelRequest(requestId: Int64) {
@@ -160,7 +164,7 @@ class LocalImageApiImpl: LocalImageApi {
       request.isCancelled = true
       guard let item = request.workItem else { return }
       if item.isCancelled {
-        cancelQueue.async { request.callback(ImageProcessing.cancelledResult) }
+        cancelQueue.async { request.callback(Self.cancelledResult) }
       }
     }
   }

mobile/ios/Runner/Images/RemoteImagesImpl.swift

@@ -7,18 +7,64 @@ class RemoteImageRequest {
   weak var task: URLSessionDataTask?
   let id: Int64
   var isCancelled = false
+  var data: CFMutableData?
   let completion: (Result<[String: Int64]?, any Error>) -> Void
   
   init(id: Int64, task: URLSessionDataTask, completion: @escaping (Result<[String: Int64]?, any Error>) -> Void) {
     self.id = id
     self.task = task
+    self.data = nil
     self.completion = completion
   }
 }
 
 class RemoteImageApiImpl: NSObject, RemoteImageApi {
-  private static var lock = os_unfair_lock()
-  private static var requests = [Int64: RemoteImageRequest]()
+  private static let delegate = RemoteImageApiDelegate()
+  static let session = {
+    let cacheDir = FileManager.default.temporaryDirectory.appendingPathComponent("thumbnails", isDirectory: true)
+    let config = URLSessionConfiguration.default
+    config.requestCachePolicy = .returnCacheDataElseLoad
+    let version = Bundle.main.object(forInfoDictionaryKey: "CFBundleShortVersionString") as? String ?? "unknown"
+    config.httpAdditionalHeaders = ["User-Agent": "Immich_iOS_\(version)"]
+    try! FileManager.default.createDirectory(at: cacheDir, withIntermediateDirectories: true)
+    config.urlCache = URLCache(
+      memoryCapacity: 0,
+      diskCapacity: 1 << 30,
+      directory: cacheDir
+    )
+    config.httpMaximumConnectionsPerHost = 64
+    return URLSession(configuration: config, delegate: delegate, delegateQueue: nil)
+  }()
+  
+  func requestImage(url: String, headers: [String : String], requestId: Int64, completion: @escaping (Result<[String : Int64]?, any Error>) -> Void) {
+    var urlRequest = URLRequest(url: URL(string: url)!)
+    for (key, value) in headers {
+      urlRequest.setValue(value, forHTTPHeaderField: key)
+    }
+    let task = Self.session.dataTask(with: urlRequest)
+    
+    let imageRequest = RemoteImageRequest(id: requestId, task: task, completion: completion)
+    Self.delegate.add(taskId: task.taskIdentifier, request: imageRequest)
+    
+    task.resume()
+  }
+  
+  func cancelRequest(requestId: Int64) {
+    Self.delegate.cancel(requestId: requestId)
+  }
+  
+  func clearCache(completion: @escaping (Result<Int64, any Error>) -> Void) {
+    Task {
+      let cache = Self.session.configuration.urlCache!
+      let cacheSize = Int64(cache.currentDiskUsage)
+      cache.removeAllCachedResponses()
+      completion(.success(cacheSize))
+    }
+  }
+}
+
+class RemoteImageApiDelegate: NSObject, URLSessionDataDelegate {
+  private static let requestQueue = DispatchQueue(label: "thumbnail.requests", qos: .userInitiated, attributes: .concurrent)
   private static var rgbaFormat = vImage_CGImageFormat(
     bitsPerComponent: 8,
     bitsPerPixel: 32,
@@ -26,110 +72,114 @@ class RemoteImageApiImpl: NSObject, RemoteImageApi {
     bitmapInfo: CGBitmapInfo(rawValue: CGImageAlphaInfo.premultipliedLast.rawValue),
     renderingIntent: .perceptual
   )!
+  private static var requestByTaskId = [Int: RemoteImageRequest]()
+  private static var taskIdByRequestId = [Int64: Int]()
+  private static let cancelledResult = Result<[String: Int64]?, any Error>.success(nil)
   private static let decodeOptions = [
     kCGImageSourceShouldCache: false,
     kCGImageSourceShouldCacheImmediately: true,
     kCGImageSourceCreateThumbnailWithTransform: true,
-    kCGImageSourceCreateThumbnailFromImageAlways: true
   ] as CFDictionary
   
-  func requestImage(url: String, headers: [String : String], requestId: Int64, completion: @escaping (Result<[String : Int64]?, any Error>) -> Void) {
-    var urlRequest = URLRequest(url: URL(string: url)!)
-    urlRequest.cachePolicy = .returnCacheDataElseLoad
-    for (key, value) in headers {
-      urlRequest.setValue(value, forHTTPHeaderField: key)
+  func urlSession(
+    _ session: URLSession, dataTask: URLSessionDataTask,
+    didReceive response: URLResponse,
+    completionHandler: @escaping (URLSession.ResponseDisposition) -> Void
+  ) {
+    guard let request = get(taskId: dataTask.taskIdentifier)
+    else {
+      return completionHandler(.cancel)
     }
     
-    let task = URLSessionManager.shared.session.dataTask(with: urlRequest) { data, response, error in
-      Self.handleCompletion(requestId: requestId, data: data, response: response, error: error)
-    }
+    let capacity = max(Int(response.expectedContentLength), 0)
+    request.data = CFDataCreateMutable(nil, capacity)
     
-    let request = RemoteImageRequest(id: requestId, task: task, completion: completion)
-    
-    os_unfair_lock_lock(&Self.lock)
-    Self.requests[requestId] = request
-    os_unfair_lock_unlock(&Self.lock)
-    
-    task.resume()
+    completionHandler(.allow)
   }
   
-  private static func handleCompletion(requestId: Int64, data: Data?, response: URLResponse?, error: Error?) {
-    os_unfair_lock_lock(&Self.lock)
-    guard let request = requests[requestId] else {
-      return os_unfair_lock_unlock(&Self.lock)
+  func urlSession(_ session: URLSession, dataTask: URLSessionDataTask,
+                  didReceive data: Data) {
+    guard let request = get(taskId: dataTask.taskIdentifier) else { return }
+    
+    data.withUnsafeBytes { bytes in
+      CFDataAppendBytes(request.data, bytes.bindMemory(to: UInt8.self).baseAddress, data.count)
     }
-    requests[requestId] = nil
-    os_unfair_lock_unlock(&Self.lock)
+  }
+  
+  func urlSession(_ session: URLSession, task: URLSessionTask,
+                  didCompleteWithError error: Error?) {
+    guard let request = get(taskId: task.taskIdentifier) else { return }
+        
+    defer { remove(taskId: task.taskIdentifier, requestId: request.id) }
     
     if let error = error {
       if request.isCancelled || (error as NSError).code == NSURLErrorCancelled {
-        return request.completion(ImageProcessing.cancelledResult)
+        return request.completion(Self.cancelledResult)
       }
       return request.completion(.failure(error))
     }
     
     if request.isCancelled {
-      return request.completion(ImageProcessing.cancelledResult)
+      return request.completion(Self.cancelledResult)
     }
     
-    guard let data = data else {
+    guard let data = request.data else {
       return request.completion(.failure(PigeonError(code: "", message: "No data received", details: nil)))
     }
     
-    ImageProcessing.queue.async {
-      ImageProcessing.semaphore.wait()
-      defer { ImageProcessing.semaphore.signal() }
+    guard let imageSource = CGImageSourceCreateWithData(data, nil),
+          let cgImage = CGImageSourceCreateThumbnailAtIndex(imageSource, 0, Self.decodeOptions) else {
+      return request.completion(.failure(PigeonError(code: "", message: "Failed to decode image for request", details: nil)))
+    }
+    
+    if request.isCancelled {
+      return request.completion(Self.cancelledResult)
+    }
+    
+    do {
+      let buffer = try vImage_Buffer(cgImage: cgImage, format: Self.rgbaFormat)
       
       if request.isCancelled {
-        return request.completion(ImageProcessing.cancelledResult)
+        buffer.free()
+        return request.completion(Self.cancelledResult)
       }
       
-      guard let imageSource = CGImageSourceCreateWithData(data as CFData, nil),
-            let cgImage = CGImageSourceCreateThumbnailAtIndex(imageSource, 0, decodeOptions) else {
-        return request.completion(.failure(PigeonError(code: "", message: "Failed to decode image for request", details: nil)))
-      }
-      
-      if request.isCancelled {
-        return request.completion(ImageProcessing.cancelledResult)
-      }
-      
-      do {
-        let buffer = try vImage_Buffer(cgImage: cgImage, format: rgbaFormat)
-        
-        if request.isCancelled {
-          buffer.free()
-          return request.completion(ImageProcessing.cancelledResult)
-        }
-        
-        request.completion(
-          .success([
-            "pointer": Int64(Int(bitPattern: buffer.data)),
-            "width": Int64(buffer.width),
-            "height": Int64(buffer.height),
-            "rowBytes": Int64(buffer.rowBytes),
-          ]))
-      } catch {
-        return request.completion(.failure(PigeonError(code: "", message: "Failed to convert image for request: \(error)", details: nil)))
-      }
+      request.completion(
+        .success([
+          "pointer": Int64(Int(bitPattern: buffer.data)),
+          "width": Int64(buffer.width),
+          "height": Int64(buffer.height),
+          "rowBytes": Int64(buffer.rowBytes),
+        ]))
+    } catch {
+      return request.completion(.failure(PigeonError(code: "", message: "Failed to convert image for request: \(error)", details: nil)))
     }
   }
   
-  func cancelRequest(requestId: Int64) {
-    os_unfair_lock_lock(&Self.lock)
-    let request = Self.requests[requestId]
-    os_unfair_lock_unlock(&Self.lock)
-    
-    guard let request = request else { return }
+  @inline(__always) func get(taskId: Int) -> RemoteImageRequest? {
+    Self.requestQueue.sync { Self.requestByTaskId[taskId] }
+  }
+  
+  @inline(__always) func add(taskId: Int, request: RemoteImageRequest) -> Void {
+    Self.requestQueue.async(flags: .barrier) {
+      Self.requestByTaskId[taskId] = request
+      Self.taskIdByRequestId[request.id] = taskId
+    }
+  }
+  
+  @inline(__always) func remove(taskId: Int, requestId: Int64) -> Void {
+    Self.requestQueue.async(flags: .barrier) {
+      Self.taskIdByRequestId[requestId] = nil
+      Self.requestByTaskId[taskId] = nil
+    }
+  }
+  
+  @inline(__always) func cancel(requestId: Int64) -> Void {
+    guard let request: RemoteImageRequest = (Self.requestQueue.sync {
+      guard let taskId = Self.taskIdByRequestId[requestId] else { return nil }
+      return Self.requestByTaskId[taskId]
+    }) else { return }
     request.isCancelled = true
     request.task?.cancel()
   }
-  
-  func clearCache(completion: @escaping (Result<Int64, any Error>) -> Void) {
-    Task {
-      let cache = URLSessionManager.shared.session.configuration.urlCache!
-      let cacheSize = Int64(cache.currentDiskUsage)
-      cache.removeAllCachedResponses()
-      completion(.success(cacheSize))
-    }
-  }
 }

mobile/ios/Runner/Info.plist

@@ -80,7 +80,7 @@
 	<key>CFBundlePackageType</key>
 	<string>APPL</string>
 	<key>CFBundleShortVersionString</key>
-	<string>2.5.2</string>
+	<string>2.5.1</string>
 	<key>CFBundleSignature</key>
 	<string>????</string>
 	<key>CFBundleURLTypes</key>

mobile/lib/domain/models/store.model.dart

@@ -89,9 +89,7 @@ enum StoreKey<T> {
   cleanupKeepMediaType<int>._(1009),
   cleanupKeepAlbumIds<String>._(1010),
   cleanupCutoffDaysAgo<int>._(1011),
-  cleanupDefaultsInitialized<bool>._(1012),
-
-  syncMigrationStatus<String>._(1013);
+  cleanupDefaultsInitialized<bool>._(1012);
 
   const StoreKey._(this.id);
   final int id;

mobile/lib/domain/services/background_worker.service.dart

@@ -3,6 +3,7 @@ import 'dart:io';
 import 'dart:ui';
 
 import 'package:background_downloader/background_downloader.dart';
+import 'package:cancellation_token_http/http.dart';
 import 'package:flutter/material.dart';
 import 'package:hooks_riverpod/hooks_riverpod.dart';
 import 'package:immich_mobile/constants/constants.dart';
@@ -27,6 +28,7 @@ import 'package:immich_mobile/services/localization.service.dart';
 import 'package:immich_mobile/services/foreground_upload.service.dart';
 import 'package:immich_mobile/utils/bootstrap.dart';
 import 'package:immich_mobile/utils/debug_print.dart';
+import 'package:immich_mobile/utils/http_ssl_options.dart';
 import 'package:immich_mobile/wm_executor.dart';
 import 'package:isar/isar.dart';
 import 'package:logging/logging.dart';
@@ -62,7 +64,7 @@ class BackgroundWorkerBgService extends BackgroundWorkerFlutterApi {
   final Drift _drift;
   final DriftLogger _driftLogger;
   final BackgroundWorkerBgHostApi _backgroundHostApi;
-  final _cancellationToken = Completer();
+  final CancellationToken _cancellationToken = CancellationToken();
   final Logger _logger = Logger('BackgroundWorkerBgService');
 
   bool _isCleanedUp = false;
@@ -86,6 +88,8 @@ class BackgroundWorkerBgService extends BackgroundWorkerFlutterApi {
 
   Future<void> init() async {
     try {
+      HttpSSLOptions.apply(applyNative: false);
+
       await Future.wait(
         [
           loadTranslations(),
@@ -194,7 +198,7 @@ class BackgroundWorkerBgService extends BackgroundWorkerFlutterApi {
       _ref?.dispose();
       _ref = null;
 
-      _cancellationToken.complete();
+      _cancellationToken.cancel();
       _logger.info("Cleaning up background worker");
 
       final cleanupFutures = [

mobile/lib/domain/services/sync_stream.service.dart

@@ -1,7 +1,4 @@
-// ignore_for_file: constant_identifier_names
-
 import 'dart:async';
-import 'dart:convert';
 
 import 'package:immich_mobile/domain/models/store.model.dart';
 import 'package:immich_mobile/domain/models/sync_event.model.dart';
@@ -10,21 +7,12 @@ import 'package:immich_mobile/extensions/platform_extensions.dart';
 import 'package:immich_mobile/infrastructure/repositories/local_asset.repository.dart';
 import 'package:immich_mobile/infrastructure/repositories/storage.repository.dart';
 import 'package:immich_mobile/infrastructure/repositories/sync_api.repository.dart';
-import 'package:immich_mobile/infrastructure/repositories/sync_migration.repository.dart';
 import 'package:immich_mobile/infrastructure/repositories/sync_stream.repository.dart';
 import 'package:immich_mobile/infrastructure/repositories/trashed_local_asset.repository.dart';
 import 'package:immich_mobile/repositories/local_files_manager.repository.dart';
-import 'package:immich_mobile/services/api.service.dart';
-import 'package:immich_mobile/utils/semver.dart';
 import 'package:logging/logging.dart';
 import 'package:openapi/api.dart';
 
-enum SyncMigrationTask {
-  v20260128_ResetExifV1, // EXIF table has incorrect width and height information.
-  v20260128_CopyExifWidthHeightToAsset, // Asset table has incorrect width and height for video ratio calculations.
-  v20260128_ResetAssetV1, // Asset v2.5.0 has width and height information that were edited assets.
-}
-
 class SyncStreamService {
   final Logger _logger = Logger('SyncStreamService');
 
@@ -34,8 +22,6 @@ class SyncStreamService {
   final DriftTrashedLocalAssetRepository _trashedLocalAssetRepository;
   final LocalFilesManagerRepository _localFilesManager;
   final StorageRepository _storageRepository;
-  final SyncMigrationRepository _syncMigrationRepository;
-  final ApiService _api;
   final bool Function()? _cancelChecker;
 
   SyncStreamService({
@@ -45,8 +31,6 @@ class SyncStreamService {
     required DriftTrashedLocalAssetRepository trashedLocalAssetRepository,
     required LocalFilesManagerRepository localFilesManager,
     required StorageRepository storageRepository,
-    required SyncMigrationRepository syncMigrationRepository,
-    required ApiService api,
     bool Function()? cancelChecker,
   }) : _syncApiRepository = syncApiRepository,
        _syncStreamRepository = syncStreamRepository,
@@ -54,32 +38,12 @@ class SyncStreamService {
        _trashedLocalAssetRepository = trashedLocalAssetRepository,
        _localFilesManager = localFilesManager,
        _storageRepository = storageRepository,
-       _syncMigrationRepository = syncMigrationRepository,
-       _api = api,
        _cancelChecker = cancelChecker;
 
   bool get isCancelled => _cancelChecker?.call() ?? false;
 
   Future<bool> sync() async {
     _logger.info("Remote sync request for user");
-    final serverVersion = await _api.serverInfoApi.getServerVersion();
-    if (serverVersion == null) {
-      _logger.severe("Cannot perform sync: unable to determine server version");
-      return false;
-    }
-
-    final semVer = SemVer(major: serverVersion.major, minor: serverVersion.minor, patch: serverVersion.patch_);
-
-    final value = Store.get(StoreKey.syncMigrationStatus, "[]");
-    final migrations = (jsonDecode(value) as List).cast<String>();
-    int previousLength = migrations.length;
-    await _runPreSyncTasks(migrations, semVer);
-
-    if (migrations.length != previousLength) {
-      _logger.info("Updated pre-sync migration status: $migrations");
-      await Store.put(StoreKey.syncMigrationStatus, jsonEncode(migrations));
-    }
-
     // Start the sync stream and handle events
     bool shouldReset = false;
     await _syncApiRepository.streamChanges(_handleEvents, onReset: () => shouldReset = true);
@@ -87,56 +51,9 @@ class SyncStreamService {
       _logger.info("Resetting sync state as requested by server");
       await _syncApiRepository.streamChanges(_handleEvents);
     }
-
-    previousLength = migrations.length;
-    await _runPostSyncTasks(migrations);
-
-    if (migrations.length != previousLength) {
-      _logger.info("Updated pre-sync migration status: $migrations");
-      await Store.put(StoreKey.syncMigrationStatus, jsonEncode(migrations));
-    }
-
     return true;
   }
 
-  Future<void> _runPreSyncTasks(List<String> migrations, SemVer semVer) async {
-    if (!migrations.contains(SyncMigrationTask.v20260128_ResetExifV1.name)) {
-      _logger.info("Running pre-sync task: v20260128_ResetExifV1");
-      await _syncApiRepository.deleteSyncAck([
-        SyncEntityType.assetExifV1,
-        SyncEntityType.partnerAssetExifV1,
-        SyncEntityType.albumAssetExifCreateV1,
-        SyncEntityType.albumAssetExifUpdateV1,
-      ]);
-      migrations.add(SyncMigrationTask.v20260128_ResetExifV1.name);
-    }
-
-    if (!migrations.contains(SyncMigrationTask.v20260128_ResetAssetV1.name) &&
-        semVer >= const SemVer(major: 2, minor: 5, patch: 0)) {
-      _logger.info("Running pre-sync task: v20260128_ResetAssetV1");
-      await _syncApiRepository.deleteSyncAck([
-        SyncEntityType.assetV1,
-        SyncEntityType.partnerAssetV1,
-        SyncEntityType.albumAssetCreateV1,
-        SyncEntityType.albumAssetUpdateV1,
-      ]);
-
-      migrations.add(SyncMigrationTask.v20260128_ResetAssetV1.name);
-
-      if (!migrations.contains(SyncMigrationTask.v20260128_CopyExifWidthHeightToAsset.name)) {
-        migrations.add(SyncMigrationTask.v20260128_CopyExifWidthHeightToAsset.name);
-      }
-    }
-  }
-
-  Future<void> _runPostSyncTasks(List<String> migrations) async {
-    if (!migrations.contains(SyncMigrationTask.v20260128_CopyExifWidthHeightToAsset.name)) {
-      _logger.info("Running post-sync task: v20260128_CopyExifWidthHeightToAsset");
-      await _syncMigrationRepository.v20260128CopyExifWidthHeightToAsset();
-      migrations.add(SyncMigrationTask.v20260128_CopyExifWidthHeightToAsset.name);
-    }
-  }
-
   Future<void> _handleEvents(List<SyncEvent> events, Function() abort, Function() reset) async {
     List<SyncEvent> items = [];
     for (final event in events) {

mobile/lib/infrastructure/repositories/network.repository.dart

@@ -1,46 +1,67 @@
-import 'dart:ffi';
 import 'dart:io';
 
+import 'package:cronet_http/cronet_http.dart';
 import 'package:cupertino_http/cupertino_http.dart';
 import 'package:http/http.dart' as http;
-import 'package:immich_mobile/providers/infrastructure/platform.provider.dart';
-import 'package:logging/logging.dart';
-import 'package:ok_http/ok_http.dart';
+import 'package:immich_mobile/utils/user_agent.dart';
+import 'package:path_provider/path_provider.dart';
 
 class NetworkRepository {
-  static final _log = Logger('NetworkRepository');
-  static http.Client? _client;
+  static late Directory _cachePath;
+  static late String _userAgent;
+  static final _clients = <String, http.Client>{};
 
-  static Future<void> init() async {
-    final pointer = await networkApi.getClientPointer();
-    _client?.close();
-    if (Platform.isIOS) {
-      _client = _createIOSClient(pointer);
-    } else {
-      _client = _createAndroidClient(pointer);
+  static Future<void> init() {
+    return (
+      getTemporaryDirectory().then((cachePath) => _cachePath = cachePath),
+      getUserAgentString().then((userAgent) => _userAgent = userAgent),
+    ).wait;
+  }
+
+  static void reset() {
+    Future.microtask(init);
+    for (final client in _clients.values) {
+      client.close();
     }
+    _clients.clear();
   }
 
   const NetworkRepository();
 
-  /// Returns a shared HTTP client that uses native SSL configuration.
-  ///
-  /// On iOS: Uses SharedURLSessionManager's URLSession.
-  /// On Android: Uses SharedHttpClientManager's OkHttpClient.
-  ///
-  /// Must call [init] before using this method.
-  static http.Client get client => _client!;
+  /// Note: when disk caching is enabled, only one client may use a given directory at a time.
+  /// Different isolates or engines must use different directories.
+  http.Client getHttpClient(
+    String directoryName, {
+    CacheMode cacheMode = CacheMode.memory,
+    int diskCapacity = 0,
+    int maxConnections = 6,
+    int memoryCapacity = 10 << 20,
+  }) {
+    final cachedClient = _clients[directoryName];
+    if (cachedClient != null) {
+      return cachedClient;
+    }
 
-  static http.Client _createIOSClient(int address) {
-    final pointer = Pointer.fromAddress(address);
-    final session = URLSession.fromRawPointer(pointer.cast());
-    _log.info('Using shared native URLSession');
-    return CupertinoClient.fromSharedSession(session);
-  }
+    final directory = Directory('${_cachePath.path}/$directoryName');
+    directory.createSync(recursive: true);
+    if (Platform.isAndroid) {
+      final engine = CronetEngine.build(
+        cacheMode: cacheMode,
+        cacheMaxSize: diskCapacity,
+        storagePath: directory.path,
+        userAgent: _userAgent,
+      );
+      return _clients[directoryName] = CronetClient.fromCronetEngine(engine, closeEngine: true);
+    }
 
-  static http.Client _createAndroidClient(int address) {
-    final pointer = Pointer<Void>.fromAddress(address);
-    _log.info('Using shared native OkHttpClient');
-    return OkHttpClient.fromJniGlobalRef(pointer);
+    final config = URLSessionConfiguration.defaultSessionConfiguration()
+      ..httpMaximumConnectionsPerHost = maxConnections
+      ..cache = URLCache.withCapacity(
+        diskCapacity: diskCapacity,
+        memoryCapacity: memoryCapacity,
+        directory: directory.uri,
+      )
+      ..httpAdditionalHeaders = {'User-Agent': _userAgent};
+    return _clients[directoryName] = CupertinoClient.fromSessionConfiguration(config);
   }
 }

mobile/lib/infrastructure/repositories/sync_api.repository.dart

@@ -6,7 +6,6 @@ import 'package:immich_mobile/constants/constants.dart';
 import 'package:immich_mobile/domain/models/store.model.dart';
 import 'package:immich_mobile/domain/models/sync_event.model.dart';
 import 'package:immich_mobile/entities/store.entity.dart';
-import 'package:immich_mobile/infrastructure/repositories/network.repository.dart';
 import 'package:immich_mobile/services/api.service.dart';
 import 'package:logging/logging.dart';
 import 'package:openapi/api.dart';
@@ -20,10 +19,6 @@ class SyncApiRepository {
     return _api.syncApi.sendSyncAck(SyncAckSetDto(acks: data));
   }
 
-  Future<void> deleteSyncAck(List<SyncEntityType> types) {
-    return _api.syncApi.deleteSyncAck(SyncAckDeleteDto(types: types));
-  }
-
   Future<void> streamChanges(
     Future<void> Function(List<SyncEvent>, Function() abort, Function() reset) onData, {
     Function()? onReset,
@@ -31,7 +26,7 @@ class SyncApiRepository {
     http.Client? httpClient,
   }) async {
     final stopwatch = Stopwatch()..start();
-    final client = httpClient ?? NetworkRepository.client;
+    final client = httpClient ?? http.Client();
     final endpoint = "${_api.apiClient.basePath}/sync/stream";
 
     final headers = {'Content-Type': 'application/json', 'Accept': 'application/jsonlines+json'};
@@ -117,6 +112,8 @@ class SyncApiRepository {
       }
     } catch (error, stack) {
       return Future.error(error, stack);
+    } finally {
+      client.close();
     }
     stopwatch.stop();
     _logger.info("Remote Sync completed in ${stopwatch.elapsed.inMilliseconds}ms");

mobile/lib/infrastructure/repositories/sync_migration.repository.dart

@@ -1,24 +0,0 @@
-import 'package:immich_mobile/infrastructure/repositories/db.repository.dart';
-
-class SyncMigrationRepository extends DriftDatabaseRepository {
-  final Drift _db;
-
-  const SyncMigrationRepository(super.db) : _db = db;
-
-  Future<void> v20260128CopyExifWidthHeightToAsset() async {
-    await _db.customStatement('''
-      UPDATE remote_asset_entity
-      SET width = CASE
-            WHEN exif.orientation IN ('5', '6', '7', '8', '-90', '90') THEN exif.height
-            ELSE exif.width
-          END,
-          height = CASE
-            WHEN exif.orientation IN ('5', '6', '7', '8', '-90', '90') THEN exif.width
-            ELSE exif.height
-          END
-      FROM remote_exif_entity exif
-      WHERE exif.asset_id = remote_asset_entity.id
-        AND (exif.width IS NOT NULL OR exif.height IS NOT NULL);
-    ''');
-  }
-}

mobile/lib/main.dart

@@ -39,6 +39,7 @@ import 'package:immich_mobile/theme/theme_data.dart';
 import 'package:immich_mobile/utils/bootstrap.dart';
 import 'package:immich_mobile/utils/cache/widgets_binding.dart';
 import 'package:immich_mobile/utils/debug_print.dart';
+import 'package:immich_mobile/utils/http_ssl_options.dart';
 import 'package:immich_mobile/utils/licenses.dart';
 import 'package:immich_mobile/utils/migration.dart';
 import 'package:immich_mobile/wm_executor.dart';
@@ -56,6 +57,7 @@ void main() async {
   // Warm-up isolate pool for worker manager
   await workerManagerPatch.init(dynamicSpawning: true, isolatesCount: max(Platform.numberOfProcessors - 1, 5));
   await migrateDatabaseIfNeeded(isar, drift);
+  HttpSSLOptions.apply();
 
   runApp(
     ProviderScope(
@@ -239,7 +241,7 @@ class ImmichAppState extends ConsumerState<ImmichApp> with WidgetsBindingObserve
   @override
   void reassemble() {
     if (kDebugMode) {
-      NetworkRepository.init();
+      NetworkRepository.reset();
     }
     super.reassemble();
   }

mobile/lib/models/backup/backup_state.model.dart

@@ -1,7 +1,6 @@
 // ignore_for_file: public_member_api_docs, sort_constructors_first
 
-import 'dart:async';
-
+import 'package:cancellation_token_http/http.dart';
 import 'package:collection/collection.dart';
 import 'package:immich_mobile/models/backup/backup_candidate.model.dart';
 
@@ -22,7 +21,7 @@ class BackUpState {
   final DateTime progressInFileSpeedUpdateTime;
   final int progressInFileSpeedUpdateSentBytes;
   final double iCloudDownloadProgress;
-  final Completer cancelToken;
+  final CancellationToken cancelToken;
   final ServerDiskInfo serverInfo;
   final bool autoBackup;
   final bool backgroundBackup;
@@ -79,7 +78,7 @@ class BackUpState {
     DateTime? progressInFileSpeedUpdateTime,
     int? progressInFileSpeedUpdateSentBytes,
     double? iCloudDownloadProgress,
-    Completer? cancelToken,
+    CancellationToken? cancelToken,
     ServerDiskInfo? serverInfo,
     bool? autoBackup,
     bool? backgroundBackup,

mobile/lib/models/backup/manual_upload_state.model.dart

@@ -1,11 +1,10 @@
-import 'dart:async';
-
+import 'package:cancellation_token_http/http.dart';
 import 'package:collection/collection.dart';
 
 import 'package:immich_mobile/models/backup/current_upload_asset.model.dart';
 
 class ManualUploadState {
-  final Completer cancelToken;
+  final CancellationToken cancelToken;
 
   // Current Backup Asset
   final CurrentUploadAsset currentUploadAsset;
@@ -45,7 +44,7 @@ class ManualUploadState {
     List<double>? progressInFileSpeeds,
     DateTime? progressInFileSpeedUpdateTime,
     int? progressInFileSpeedUpdateSentBytes,
-    Completer? cancelToken,
+    CancellationToken? cancelToken,
     CurrentUploadAsset? currentUploadAsset,
     int? totalAssetsToUpload,
     int? successfulUploads,

mobile/lib/models/server_info/server_info.model.dart

@@ -20,7 +20,7 @@ enum VersionStatus {
 
 class ServerInfo {
   final ServerVersion serverVersion;
-  final ServerVersion? latestVersion;
+  final ServerVersion latestVersion;
   final ServerFeatures serverFeatures;
   final ServerConfig serverConfig;
   final ServerDiskInfo serverDiskInfo;

mobile/lib/pages/backup/failed_backup_status.page.dart

@@ -2,10 +2,9 @@ import 'package:auto_route/auto_route.dart';
 import 'package:flutter/material.dart';
 import 'package:hooks_riverpod/hooks_riverpod.dart';
 import 'package:immich_mobile/extensions/build_context_extensions.dart';
-import 'package:immich_mobile/presentation/widgets/images/local_image_provider.dart';
 import 'package:immich_mobile/providers/backup/error_backup_list.provider.dart';
+import 'package:immich_mobile/providers/image/immich_local_thumbnail_provider.dart';
 import 'package:intl/intl.dart';
-import 'package:immich_mobile/domain/models/asset/base_asset.model.dart' as base_asset;
 
 @RoutePage()
 class FailedBackupStatusPage extends HookConsumerWidget {
@@ -59,7 +58,7 @@ class FailedBackupStatusPage extends HookConsumerWidget {
                       clipBehavior: Clip.hardEdge,
                       child: Image(
                         fit: BoxFit.cover,
-                        image: LocalThumbProvider(id: errorAsset.asset.localId!, assetType: base_asset.AssetType.video),
+                        image: ImmichLocalThumbnailProvider(asset: errorAsset.asset, height: 512, width: 512),
                       ),
                     ),
                   ),

mobile/lib/pages/common/gallery_stacked_children.dart

@@ -1,9 +1,9 @@
 import 'package:flutter/material.dart';
 import 'package:hooks_riverpod/hooks_riverpod.dart';
-import 'package:immich_mobile/presentation/widgets/images/remote_image_provider.dart';
 import 'package:immich_mobile/providers/asset_viewer/asset_stack.provider.dart';
 import 'package:immich_mobile/providers/asset_viewer/current_asset.provider.dart';
 import 'package:immich_mobile/providers/asset_viewer/show_controls.provider.dart';
+import 'package:immich_mobile/providers/image/immich_remote_image_provider.dart';
 
 class GalleryStackedChildren extends HookConsumerWidget {
   final ValueNotifier<int> stackIndex;
@@ -70,7 +70,7 @@ class GalleryStackedChildren extends HookConsumerWidget {
                       borderRadius: const BorderRadius.all(Radius.circular(4)),
                       child: Image(
                         fit: BoxFit.cover,
-                        image: RemoteImageProvider.thumbnail(assetId: assetId, thumbhash: asset.thumbhash ?? ""),
+                        image: ImmichRemoteImageProvider(assetId: assetId),
                       ),
                     ),
                   ),

mobile/lib/pages/library/library.page.dart

@@ -11,7 +11,7 @@ import 'package:immich_mobile/providers/partner.provider.dart';
 import 'package:immich_mobile/providers/search/people.provider.dart';
 import 'package:immich_mobile/providers/server_info.provider.dart';
 import 'package:immich_mobile/routing/router.dart';
-import 'package:immich_mobile/presentation/widgets/images/remote_image_provider.dart';
+import 'package:immich_mobile/services/api.service.dart';
 import 'package:immich_mobile/utils/image_url_builder.dart';
 import 'package:immich_mobile/widgets/album/album_thumbnail_card.dart';
 import 'package:immich_mobile/widgets/common/immich_app_bar.dart';
@@ -221,7 +221,12 @@ class PeopleCollectionCard extends ConsumerWidget {
                       mainAxisSpacing: 8,
                       physics: const NeverScrollableScrollPhysics(),
                       children: people.take(4).map((person) {
-                        return CircleAvatar(backgroundImage: RemoteImageProvider(url: getFaceThumbnailUrl(person.id)));
+                        return CircleAvatar(
+                          backgroundImage: NetworkImage(
+                            getFaceThumbnailUrl(person.id),
+                            headers: ApiService.getRequestHeaders(),
+                          ),
+                        );
                       }).toList(),
                     );
                   },

mobile/lib/pages/library/people/people_collection.page.dart

@@ -5,8 +5,8 @@ import 'package:flutter_hooks/flutter_hooks.dart';
 import 'package:hooks_riverpod/hooks_riverpod.dart';
 import 'package:immich_mobile/extensions/build_context_extensions.dart';
 import 'package:immich_mobile/providers/search/people.provider.dart';
-import 'package:immich_mobile/presentation/widgets/images/remote_image_provider.dart';
 import 'package:immich_mobile/routing/router.dart';
+import 'package:immich_mobile/services/api.service.dart';
 import 'package:immich_mobile/utils/image_url_builder.dart';
 import 'package:immich_mobile/widgets/common/search_field.dart';
 import 'package:immich_mobile/widgets/search/person_name_edit_form.dart';
@@ -17,6 +17,7 @@ class PeopleCollectionPage extends HookConsumerWidget {
   @override
   Widget build(BuildContext context, WidgetRef ref) {
     final people = ref.watch(getAllPeopleProvider);
+    final headers = ApiService.getRequestHeaders();
     final formFocus = useFocusNode();
     final ValueNotifier<String?> search = useState(null);
 
@@ -87,7 +88,7 @@ class PeopleCollectionPage extends HookConsumerWidget {
                             elevation: 3,
                             child: CircleAvatar(
                               maxRadius: isTablet ? 120 / 2 : 96 / 2,
-                              backgroundImage: RemoteImageProvider(url: getFaceThumbnailUrl(person.id)),
+                              backgroundImage: NetworkImage(getFaceThumbnailUrl(person.id), headers: headers),
                             ),
                           ),
                         ),

mobile/lib/pages/library/places/places_collection.page.dart

@@ -1,4 +1,5 @@
 import 'package:auto_route/auto_route.dart';
+import 'package:cached_network_image/cached_network_image.dart';
 import 'package:easy_localization/easy_localization.dart';
 import 'package:flutter/material.dart';
 import 'package:flutter_hooks/flutter_hooks.dart' hide Store;
@@ -9,10 +10,9 @@ import 'package:immich_mobile/entities/store.entity.dart';
 import 'package:immich_mobile/extensions/build_context_extensions.dart';
 import 'package:immich_mobile/models/search/search_filter.model.dart';
 import 'package:immich_mobile/pages/common/large_leading_tile.dart';
-import 'package:immich_mobile/presentation/widgets/images/remote_image_provider.dart';
-import 'package:immich_mobile/presentation/widgets/images/thumbnail.widget.dart';
 import 'package:immich_mobile/providers/search/search_page_state.provider.dart';
 import 'package:immich_mobile/routing/router.dart';
+import 'package:immich_mobile/services/api.service.dart';
 import 'package:immich_mobile/widgets/common/search_field.dart';
 import 'package:immich_mobile/widgets/map/map_thumbnail.dart';
 import 'package:maplibre_gl/maplibre_gl.dart';
@@ -125,10 +125,13 @@ class PlaceTile extends StatelessWidget {
       title: Text(name, style: context.textTheme.titleMedium?.copyWith(fontWeight: FontWeight.w500)),
       leading: ClipRRect(
         borderRadius: const BorderRadius.all(Radius.circular(20)),
-        child: SizedBox(
+        child: CachedNetworkImage(
           width: 80,
           height: 80,
-          child: Thumbnail(imageProvider: RemoteImageProvider(url: thumbnailUrl)),
+          fit: BoxFit.cover,
+          imageUrl: thumbnailUrl,
+          httpHeaders: ApiService.getRequestHeaders(),
+          errorWidget: (context, url, error) => const Icon(Icons.image_not_supported_outlined),
         ),
       ),
     );

mobile/lib/pages/search/person_result.page.dart

@@ -4,8 +4,8 @@ import 'package:flutter/material.dart';
 import 'package:flutter_hooks/flutter_hooks.dart' hide Store;
 import 'package:hooks_riverpod/hooks_riverpod.dart';
 import 'package:immich_mobile/extensions/build_context_extensions.dart';
-import 'package:immich_mobile/presentation/widgets/images/remote_image_provider.dart';
 import 'package:immich_mobile/providers/search/people.provider.dart';
+import 'package:immich_mobile/services/api.service.dart';
 import 'package:immich_mobile/widgets/search/person_name_edit_form.dart';
 import 'package:immich_mobile/widgets/asset_grid/multiselect_grid.dart';
 import 'package:immich_mobile/utils/image_url_builder.dart';
@@ -88,7 +88,10 @@ class PersonResultPage extends HookConsumerWidget {
           padding: const EdgeInsets.only(left: 8.0, top: 24),
           child: Row(
             children: [
-              CircleAvatar(radius: 36, backgroundImage: RemoteImageProvider(url: getFaceThumbnailUrl(personId))),
+              CircleAvatar(
+                radius: 36,
+                backgroundImage: NetworkImage(getFaceThumbnailUrl(personId), headers: ApiService.getRequestHeaders()),
+              ),
               Expanded(
                 child: Padding(padding: const EdgeInsets.only(left: 16.0, right: 16.0), child: buildTitleBlock()),
               ),

mobile/lib/platform/network_api.g.dart

@@ -1,260 +0,0 @@
-// Autogenerated from Pigeon (v26.0.2), do not edit directly.
-// See also: https://pub.dev/packages/pigeon
-// ignore_for_file: public_member_api_docs, non_constant_identifier_names, avoid_as, unused_import, unnecessary_parenthesis, prefer_null_aware_operators, omit_local_variable_types, unused_shown_name, unnecessary_import, no_leading_underscores_for_local_identifiers
-
-import 'dart:async';
-import 'dart:typed_data' show Float64List, Int32List, Int64List, Uint8List;
-
-import 'package:flutter/foundation.dart' show ReadBuffer, WriteBuffer;
-import 'package:flutter/services.dart';
-
-PlatformException _createConnectionError(String channelName) {
-  return PlatformException(
-    code: 'channel-error',
-    message: 'Unable to establish connection on channel: "$channelName".',
-  );
-}
-
-bool _deepEquals(Object? a, Object? b) {
-  if (a is List && b is List) {
-    return a.length == b.length && a.indexed.every(((int, dynamic) item) => _deepEquals(item.$2, b[item.$1]));
-  }
-  if (a is Map && b is Map) {
-    return a.length == b.length &&
-        a.entries.every(
-          (MapEntry<Object?, Object?> entry) =>
-              (b as Map<Object?, Object?>).containsKey(entry.key) && _deepEquals(entry.value, b[entry.key]),
-        );
-  }
-  return a == b;
-}
-
-class ClientCertData {
-  ClientCertData({required this.data, required this.password});
-
-  Uint8List data;
-
-  String password;
-
-  List<Object?> _toList() {
-    return <Object?>[data, password];
-  }
-
-  Object encode() {
-    return _toList();
-  }
-
-  static ClientCertData decode(Object result) {
-    result as List<Object?>;
-    return ClientCertData(data: result[0]! as Uint8List, password: result[1]! as String);
-  }
-
-  @override
-  // ignore: avoid_equals_and_hash_code_on_mutable_classes
-  bool operator ==(Object other) {
-    if (other is! ClientCertData || other.runtimeType != runtimeType) {
-      return false;
-    }
-    if (identical(this, other)) {
-      return true;
-    }
-    return _deepEquals(encode(), other.encode());
-  }
-
-  @override
-  // ignore: avoid_equals_and_hash_code_on_mutable_classes
-  int get hashCode => Object.hashAll(_toList());
-}
-
-class ClientCertPrompt {
-  ClientCertPrompt({required this.title, required this.message, required this.cancel, required this.confirm});
-
-  String title;
-
-  String message;
-
-  String cancel;
-
-  String confirm;
-
-  List<Object?> _toList() {
-    return <Object?>[title, message, cancel, confirm];
-  }
-
-  Object encode() {
-    return _toList();
-  }
-
-  static ClientCertPrompt decode(Object result) {
-    result as List<Object?>;
-    return ClientCertPrompt(
-      title: result[0]! as String,
-      message: result[1]! as String,
-      cancel: result[2]! as String,
-      confirm: result[3]! as String,
-    );
-  }
-
-  @override
-  // ignore: avoid_equals_and_hash_code_on_mutable_classes
-  bool operator ==(Object other) {
-    if (other is! ClientCertPrompt || other.runtimeType != runtimeType) {
-      return false;
-    }
-    if (identical(this, other)) {
-      return true;
-    }
-    return _deepEquals(encode(), other.encode());
-  }
-
-  @override
-  // ignore: avoid_equals_and_hash_code_on_mutable_classes
-  int get hashCode => Object.hashAll(_toList());
-}
-
-class _PigeonCodec extends StandardMessageCodec {
-  const _PigeonCodec();
-  @override
-  void writeValue(WriteBuffer buffer, Object? value) {
-    if (value is int) {
-      buffer.putUint8(4);
-      buffer.putInt64(value);
-    } else if (value is ClientCertData) {
-      buffer.putUint8(129);
-      writeValue(buffer, value.encode());
-    } else if (value is ClientCertPrompt) {
-      buffer.putUint8(130);
-      writeValue(buffer, value.encode());
-    } else {
-      super.writeValue(buffer, value);
-    }
-  }
-
-  @override
-  Object? readValueOfType(int type, ReadBuffer buffer) {
-    switch (type) {
-      case 129:
-        return ClientCertData.decode(readValue(buffer)!);
-      case 130:
-        return ClientCertPrompt.decode(readValue(buffer)!);
-      default:
-        return super.readValueOfType(type, buffer);
-    }
-  }
-}
-
-class NetworkApi {
-  /// Constructor for [NetworkApi].  The [binaryMessenger] named argument is
-  /// available for dependency injection.  If it is left null, the default
-  /// BinaryMessenger will be used which routes to the host platform.
-  NetworkApi({BinaryMessenger? binaryMessenger, String messageChannelSuffix = ''})
-    : pigeonVar_binaryMessenger = binaryMessenger,
-      pigeonVar_messageChannelSuffix = messageChannelSuffix.isNotEmpty ? '.$messageChannelSuffix' : '';
-  final BinaryMessenger? pigeonVar_binaryMessenger;
-
-  static const MessageCodec<Object?> pigeonChannelCodec = _PigeonCodec();
-
-  final String pigeonVar_messageChannelSuffix;
-
-  Future<void> addCertificate(ClientCertData clientData) async {
-    final String pigeonVar_channelName =
-        'dev.flutter.pigeon.immich_mobile.NetworkApi.addCertificate$pigeonVar_messageChannelSuffix';
-    final BasicMessageChannel<Object?> pigeonVar_channel = BasicMessageChannel<Object?>(
-      pigeonVar_channelName,
-      pigeonChannelCodec,
-      binaryMessenger: pigeonVar_binaryMessenger,
-    );
-    final Future<Object?> pigeonVar_sendFuture = pigeonVar_channel.send(<Object?>[clientData]);
-    final List<Object?>? pigeonVar_replyList = await pigeonVar_sendFuture as List<Object?>?;
-    if (pigeonVar_replyList == null) {
-      throw _createConnectionError(pigeonVar_channelName);
-    } else if (pigeonVar_replyList.length > 1) {
-      throw PlatformException(
-        code: pigeonVar_replyList[0]! as String,
-        message: pigeonVar_replyList[1] as String?,
-        details: pigeonVar_replyList[2],
-      );
-    } else {
-      return;
-    }
-  }
-
-  Future<ClientCertData> selectCertificate(ClientCertPrompt promptText) async {
-    final String pigeonVar_channelName =
-        'dev.flutter.pigeon.immich_mobile.NetworkApi.selectCertificate$pigeonVar_messageChannelSuffix';
-    final BasicMessageChannel<Object?> pigeonVar_channel = BasicMessageChannel<Object?>(
-      pigeonVar_channelName,
-      pigeonChannelCodec,
-      binaryMessenger: pigeonVar_binaryMessenger,
-    );
-    final Future<Object?> pigeonVar_sendFuture = pigeonVar_channel.send(<Object?>[promptText]);
-    final List<Object?>? pigeonVar_replyList = await pigeonVar_sendFuture as List<Object?>?;
-    if (pigeonVar_replyList == null) {
-      throw _createConnectionError(pigeonVar_channelName);
-    } else if (pigeonVar_replyList.length > 1) {
-      throw PlatformException(
-        code: pigeonVar_replyList[0]! as String,
-        message: pigeonVar_replyList[1] as String?,
-        details: pigeonVar_replyList[2],
-      );
-    } else if (pigeonVar_replyList[0] == null) {
-      throw PlatformException(
-        code: 'null-error',
-        message: 'Host platform returned null value for non-null return value.',
-      );
-    } else {
-      return (pigeonVar_replyList[0] as ClientCertData?)!;
-    }
-  }
-
-  Future<void> removeCertificate() async {
-    final String pigeonVar_channelName =
-        'dev.flutter.pigeon.immich_mobile.NetworkApi.removeCertificate$pigeonVar_messageChannelSuffix';
-    final BasicMessageChannel<Object?> pigeonVar_channel = BasicMessageChannel<Object?>(
-      pigeonVar_channelName,
-      pigeonChannelCodec,
-      binaryMessenger: pigeonVar_binaryMessenger,
-    );
-    final Future<Object?> pigeonVar_sendFuture = pigeonVar_channel.send(null);
-    final List<Object?>? pigeonVar_replyList = await pigeonVar_sendFuture as List<Object?>?;
-    if (pigeonVar_replyList == null) {
-      throw _createConnectionError(pigeonVar_channelName);
-    } else if (pigeonVar_replyList.length > 1) {
-      throw PlatformException(
-        code: pigeonVar_replyList[0]! as String,
-        message: pigeonVar_replyList[1] as String?,
-        details: pigeonVar_replyList[2],
-      );
-    } else {
-      return;
-    }
-  }
-
-  Future<int> getClientPointer() async {
-    final String pigeonVar_channelName =
-        'dev.flutter.pigeon.immich_mobile.NetworkApi.getClientPointer$pigeonVar_messageChannelSuffix';
-    final BasicMessageChannel<Object?> pigeonVar_channel = BasicMessageChannel<Object?>(
-      pigeonVar_channelName,
-      pigeonChannelCodec,
-      binaryMessenger: pigeonVar_binaryMessenger,
-    );
-    final Future<Object?> pigeonVar_sendFuture = pigeonVar_channel.send(null);
-    final List<Object?>? pigeonVar_replyList = await pigeonVar_sendFuture as List<Object?>?;
-    if (pigeonVar_replyList == null) {
-      throw _createConnectionError(pigeonVar_channelName);
-    } else if (pigeonVar_replyList.length > 1) {
-      throw PlatformException(
-        code: pigeonVar_replyList[0]! as String,
-        message: pigeonVar_replyList[1] as String?,
-        details: pigeonVar_replyList[2],
-      );
-    } else if (pigeonVar_replyList[0] == null) {
-      throw PlatformException(
-        code: 'null-error',
-        message: 'Host platform returned null value for non-null return value.',
-      );
-    } else {
-      return (pigeonVar_replyList[0] as int?)!;
-    }
-  }
-}

mobile/lib/presentation/pages/drift_library.page.dart

@@ -12,8 +12,8 @@ import 'package:immich_mobile/providers/infrastructure/album.provider.dart';
 import 'package:immich_mobile/providers/infrastructure/partner.provider.dart';
 import 'package:immich_mobile/providers/infrastructure/people.provider.dart';
 import 'package:immich_mobile/providers/server_info.provider.dart';
-import 'package:immich_mobile/presentation/widgets/images/remote_image_provider.dart';
 import 'package:immich_mobile/routing/router.dart';
+import 'package:immich_mobile/services/api.service.dart';
 import 'package:immich_mobile/utils/image_url_builder.dart';
 import 'package:immich_mobile/widgets/common/immich_sliver_app_bar.dart';
 import 'package:immich_mobile/widgets/map/map_thumbnail.dart';
@@ -179,7 +179,12 @@ class _PeopleCollectionCard extends ConsumerWidget {
                       mainAxisSpacing: 8,
                       physics: const NeverScrollableScrollPhysics(),
                       children: people.take(4).map((person) {
-                        return CircleAvatar(backgroundImage: RemoteImageProvider(url: getFaceThumbnailUrl(person.id)));
+                        return CircleAvatar(
+                          backgroundImage: NetworkImage(
+                            getFaceThumbnailUrl(person.id),
+                            headers: ApiService.getRequestHeaders(),
+                          ),
+                        );
                       }).toList(),
                     );
                   },

mobile/lib/presentation/pages/drift_people_collection.page.dart

@@ -4,8 +4,8 @@ import 'package:flutter/material.dart';
 import 'package:hooks_riverpod/hooks_riverpod.dart';
 import 'package:immich_mobile/extensions/build_context_extensions.dart';
 import 'package:immich_mobile/providers/infrastructure/people.provider.dart';
-import 'package:immich_mobile/presentation/widgets/images/remote_image_provider.dart';
 import 'package:immich_mobile/routing/router.dart';
+import 'package:immich_mobile/services/api.service.dart';
 import 'package:immich_mobile/utils/image_url_builder.dart';
 import 'package:immich_mobile/utils/people.utils.dart';
 import 'package:immich_mobile/widgets/common/search_field.dart';
@@ -31,6 +31,7 @@ class _DriftPeopleCollectionPageState extends ConsumerState<DriftPeopleCollectio
   @override
   Widget build(BuildContext context) {
     final people = ref.watch(driftGetAllPeopleProvider);
+    final headers = ApiService.getRequestHeaders();
 
     return LayoutBuilder(
       builder: (context, constraints) {
@@ -89,7 +90,7 @@ class _DriftPeopleCollectionPageState extends ConsumerState<DriftPeopleCollectio
                             elevation: 3,
                             child: CircleAvatar(
                               maxRadius: isTablet ? 100 / 2 : 96 / 2,
-                              backgroundImage: RemoteImageProvider(url: getFaceThumbnailUrl(person.id)),
+                              backgroundImage: NetworkImage(getFaceThumbnailUrl(person.id), headers: headers),
                             ),
                           ),
                         ),

mobile/lib/presentation/pages/editing/drift_edit.page.dart

@@ -2,6 +2,7 @@ import 'dart:async';
 import 'dart:ui';
 
 import 'package:auto_route/auto_route.dart';
+import 'package:cancellation_token_http/http.dart';
 import 'package:easy_localization/easy_localization.dart';
 import 'package:flutter/material.dart';
 import 'package:flutter/services.dart';
@@ -78,7 +79,7 @@ class DriftEditImagePage extends ConsumerWidget {
         return;
       }
 
-      await ref.read(foregroundUploadServiceProvider).uploadManual([localAsset], Completer());
+      await ref.read(foregroundUploadServiceProvider).uploadManual([localAsset], CancellationToken());
     } catch (e) {
       ImmichToast.show(
         durationInSecond: 6,

mobile/lib/presentation/widgets/action_buttons/upload_action_button.widget.dart

@@ -101,7 +101,7 @@ class _UploadProgressDialog extends ConsumerWidget {
       actions: [
         ImmichTextButton(
           onPressed: () {
-            ref.read(manualUploadCancelTokenProvider)?.complete();
+            ref.read(manualUploadCancelTokenProvider)?.cancel();
             Navigator.of(context).pop();
           },
           labelText: 'cancel'.t(context: context),

mobile/lib/presentation/widgets/asset_viewer/asset_viewer.page.dart

@@ -92,9 +92,7 @@ class AssetViewer extends ConsumerStatefulWidget {
     if (asset.isVideo || asset.isMotionPhoto) {
       ref.read(videoPlaybackValueProvider.notifier).reset();
       ref.read(videoPlayerControlsProvider.notifier).pause();
-    }
-    // Hide controls by default for videos
-    if (asset.isVideo) {
+      // Hide controls by default for videos and motion photos
       ref.read(assetViewerProvider.notifier).setControls(false);
     }
   }
@@ -149,11 +147,6 @@ class _AssetViewerState extends ConsumerState<AssetViewer> {
     if (asset != null) {
       _stackChildrenKeepAlive = ref.read(stackChildrenNotifier(asset).notifier).ref.keepAlive();
     }
-    if (ref.read(assetViewerProvider).showingControls) {
-      unawaited(SystemChrome.setEnabledSystemUIMode(SystemUiMode.edgeToEdge));
-    } else {
-      unawaited(SystemChrome.setEnabledSystemUIMode(SystemUiMode.immersiveSticky));
-    }
   }
 
   @override

mobile/lib/presentation/widgets/asset_viewer/bottom_sheet/sheet_people_details.widget.dart

@@ -10,8 +10,8 @@ import 'package:immich_mobile/presentation/widgets/people/person_edit_name_modal
 import 'package:immich_mobile/providers/infrastructure/asset_viewer/current_asset.provider.dart';
 import 'package:immich_mobile/providers/infrastructure/people.provider.dart';
 import 'package:immich_mobile/providers/routes.provider.dart';
-import 'package:immich_mobile/presentation/widgets/images/remote_image_provider.dart';
 import 'package:immich_mobile/routing/router.dart';
+import 'package:immich_mobile/services/api.service.dart';
 import 'package:immich_mobile/utils/image_url_builder.dart';
 import 'package:immich_mobile/utils/people.utils.dart';
 
@@ -108,6 +108,8 @@ class _PeopleAvatar extends StatelessWidget {
 
   @override
   Widget build(BuildContext context) {
+    final headers = ApiService.getRequestHeaders();
+
     return ConstrainedBox(
       constraints: const BoxConstraints(maxWidth: 96),
       child: Padding(
@@ -125,7 +127,7 @@ class _PeopleAvatar extends StatelessWidget {
                   elevation: 3,
                   child: CircleAvatar(
                     maxRadius: imageSize / 2,
-                    backgroundImage: RemoteImageProvider(url: getFaceThumbnailUrl(person.id)),
+                    backgroundImage: NetworkImage(getFaceThumbnailUrl(person.id), headers: headers),
                   ),
                 ),
               ),

mobile/lib/presentation/widgets/images/image_provider.dart

@@ -134,7 +134,7 @@ ImageProvider? getThumbnailImageProvider(BaseAsset asset, {Size size = kThumbnai
 
   final assetId = asset is RemoteAsset ? asset.id : (asset as LocalAsset).remoteId;
   final thumbhash = asset is RemoteAsset ? asset.thumbHash ?? "" : "";
-  return assetId != null ? RemoteImageProvider.thumbnail(assetId: assetId, thumbhash: thumbhash) : null;
+  return assetId != null ? RemoteThumbProvider(assetId: assetId, thumbhash: thumbhash) : null;
 }
 
 bool _shouldUseLocalAsset(BaseAsset asset) =>

mobile/lib/presentation/widgets/images/remote_image_provider.dart

@@ -10,48 +10,50 @@ import 'package:immich_mobile/services/api.service.dart';
 import 'package:immich_mobile/utils/image_url_builder.dart';
 import 'package:openapi/api.dart';
 
-class RemoteImageProvider extends CancellableImageProvider<RemoteImageProvider>
-    with CancellableImageProviderMixin<RemoteImageProvider> {
-  final String url;
+class RemoteThumbProvider extends CancellableImageProvider<RemoteThumbProvider>
+    with CancellableImageProviderMixin<RemoteThumbProvider> {
+  final String assetId;
+  final String thumbhash;
 
-  RemoteImageProvider({required this.url});
-
-  RemoteImageProvider.thumbnail({required String assetId, required String thumbhash})
-    : url = getThumbnailUrlForRemoteId(assetId, thumbhash: thumbhash);
+  RemoteThumbProvider({required this.assetId, required this.thumbhash});
 
   @override
-  Future<RemoteImageProvider> obtainKey(ImageConfiguration configuration) {
+  Future<RemoteThumbProvider> obtainKey(ImageConfiguration configuration) {
     return SynchronousFuture(this);
   }
 
   @override
-  ImageStreamCompleter loadImage(RemoteImageProvider key, ImageDecoderCallback decode) {
+  ImageStreamCompleter loadImage(RemoteThumbProvider key, ImageDecoderCallback decode) {
     return OneFramePlaceholderImageStreamCompleter(
       _codec(key, decode),
       informationCollector: () => <DiagnosticsNode>[
         DiagnosticsProperty<ImageProvider>('Image provider', this),
-        DiagnosticsProperty<String>('URL', key.url),
+        DiagnosticsProperty<String>('Asset Id', key.assetId),
       ],
       onDispose: cancel,
     );
   }
 
-  Stream<ImageInfo> _codec(RemoteImageProvider key, ImageDecoderCallback decode) {
-    final request = this.request = RemoteImageRequest(uri: key.url, headers: ApiService.getRequestHeaders());
+  Stream<ImageInfo> _codec(RemoteThumbProvider key, ImageDecoderCallback decode) {
+    final request = this.request = RemoteImageRequest(
+      uri: getThumbnailUrlForRemoteId(key.assetId, thumbhash: key.thumbhash),
+      headers: ApiService.getRequestHeaders(),
+    );
     return loadRequest(request, decode);
   }
 
   @override
   bool operator ==(Object other) {
     if (identical(this, other)) return true;
-    if (other is RemoteImageProvider) {
-      return url == other.url;
+    if (other is RemoteThumbProvider) {
+      return assetId == other.assetId && thumbhash == other.thumbhash;
     }
+
     return false;
   }
 
   @override
-  int get hashCode => url.hashCode;
+  int get hashCode => assetId.hashCode ^ thumbhash.hashCode;
 }
 
 class RemoteFullImageProvider extends CancellableImageProvider<RemoteFullImageProvider>
@@ -71,7 +73,7 @@ class RemoteFullImageProvider extends CancellableImageProvider<RemoteFullImagePr
   ImageStreamCompleter loadImage(RemoteFullImageProvider key, ImageDecoderCallback decode) {
     return OneFramePlaceholderImageStreamCompleter(
       _codec(key, decode),
-      initialImage: getInitialImage(RemoteImageProvider.thumbnail(assetId: key.assetId, thumbhash: key.thumbhash)),
+      initialImage: getInitialImage(RemoteThumbProvider(assetId: key.assetId, thumbhash: key.thumbhash)),
       informationCollector: () => <DiagnosticsNode>[
         DiagnosticsProperty<ImageProvider>('Image provider', this),
         DiagnosticsProperty<String>('Asset Id', key.assetId),

mobile/lib/presentation/widgets/images/thumbnail.widget.dart

@@ -27,7 +27,7 @@ class Thumbnail extends StatefulWidget {
     this.fit = BoxFit.cover,
     Size size = kThumbnailResolution,
     super.key,
-  }) : imageProvider = RemoteImageProvider.thumbnail(assetId: remoteId, thumbhash: thumbhash),
+  }) : imageProvider = RemoteThumbProvider(assetId: remoteId, thumbhash: thumbhash),
        thumbhashProvider = null;
 
   Thumbnail.fromAsset({

mobile/lib/presentation/widgets/people/partner_user_avatar.widget.dart

@@ -1,9 +1,10 @@
+import 'package:cached_network_image/cached_network_image.dart';
 import 'package:flutter/material.dart';
 import 'package:immich_mobile/domain/models/store.model.dart';
 import 'package:immich_mobile/domain/models/user.model.dart';
 import 'package:immich_mobile/entities/store.entity.dart';
 import 'package:immich_mobile/extensions/build_context_extensions.dart';
-import 'package:immich_mobile/presentation/widgets/images/remote_image_provider.dart';
+import 'package:immich_mobile/services/api.service.dart';
 
 class PartnerUserAvatar extends StatelessWidget {
   const PartnerUserAvatar({super.key, required this.partner});
@@ -17,7 +18,11 @@ class PartnerUserAvatar extends StatelessWidget {
     return CircleAvatar(
       radius: 16,
       backgroundColor: context.primaryColor.withAlpha(50),
-      foregroundImage: RemoteImageProvider(url: url),
+      foregroundImage: CachedNetworkImageProvider(
+        url,
+        headers: ApiService.getRequestHeaders(),
+        cacheKey: "user-${partner.id}-profile",
+      ),
       // silence errors if user has no profile image, use initials as fallback
       onForegroundImageError: (exception, stackTrace) {},
       child: Text(nameFirstLetter.toUpperCase()),

mobile/lib/providers/backup/asset_upload_progress.provider.dart

@@ -1,5 +1,4 @@
-import 'dart:async';
-
+import 'package:cancellation_token_http/http.dart';
 import 'package:hooks_riverpod/hooks_riverpod.dart';
 
 /// Tracks per-asset upload progress.
@@ -31,4 +30,4 @@ final assetUploadProgressProvider = NotifierProvider<AssetUploadProgressNotifier
   AssetUploadProgressNotifier.new,
 );
 
-final manualUploadCancelTokenProvider = StateProvider<Completer?>((ref) => null);
+final manualUploadCancelTokenProvider = StateProvider<CancellationToken?>((ref) => null);

mobile/lib/providers/backup/backup.provider.dart

@@ -1,6 +1,6 @@
-import 'dart:async';
 import 'dart:io';
 
+import 'package:cancellation_token_http/http.dart';
 import 'package:collection/collection.dart';
 import 'package:hooks_riverpod/hooks_riverpod.dart';
 import 'package:immich_mobile/domain/models/store.model.dart';
@@ -68,7 +68,7 @@ class BackupNotifier extends StateNotifier<BackUpState> {
           progressInFileSpeeds: const [],
           progressInFileSpeedUpdateTime: DateTime.now(),
           progressInFileSpeedUpdateSentBytes: 0,
-          cancelToken: Completer(),
+          cancelToken: CancellationToken(),
           autoBackup: Store.get(StoreKey.autoBackup, false),
           backgroundBackup: Store.get(StoreKey.backgroundBackup, false),
           backupRequireWifi: Store.get(StoreKey.backupRequireWifi, true),
@@ -454,7 +454,7 @@ class BackupNotifier extends StateNotifier<BackUpState> {
       }
 
       // Perform Backup
-      state = state.copyWith(cancelToken: Completer());
+      state = state.copyWith(cancelToken: CancellationToken());
 
       final pmProgressHandler = Platform.isIOS ? PMProgressHandler() : null;
 
@@ -494,7 +494,7 @@ class BackupNotifier extends StateNotifier<BackUpState> {
     if (state.backupProgress != BackUpProgressEnum.inProgress) {
       notifyBackgroundServiceCanRun();
     }
-    state.cancelToken.complete();
+    state.cancelToken.cancel();
     state = state.copyWith(
       backupProgress: BackUpProgressEnum.idle,
       progressInPercentage: 0.0,

mobile/lib/providers/backup/drift_backup.provider.dart

@@ -1,5 +1,6 @@
 import 'dart:async';
 
+import 'package:cancellation_token_http/http.dart';
 import 'package:collection/collection.dart';
 import 'package:hooks_riverpod/hooks_riverpod.dart';
 import 'package:logging/logging.dart';
@@ -108,7 +109,7 @@ class DriftBackupState {
   final BackupError error;
 
   final Map<String, DriftUploadStatus> uploadItems;
-  final Completer? cancelToken;
+  final CancellationToken? cancelToken;
 
   final Map<String, double> iCloudDownloadProgress;
 
@@ -132,7 +133,7 @@ class DriftBackupState {
     bool? isSyncing,
     BackupError? error,
     Map<String, DriftUploadStatus>? uploadItems,
-    Completer? cancelToken,
+    CancellationToken? cancelToken,
     Map<String, double>? iCloudDownloadProgress,
   }) {
     return DriftBackupState(
@@ -260,7 +261,7 @@ class DriftBackupNotifier extends StateNotifier<DriftBackupState> {
   Future<void> startForegroundBackup(String userId) async {
     state = state.copyWith(error: BackupError.none);
 
-    final cancelToken = Completer();
+    final cancelToken = CancellationToken();
     state = state.copyWith(cancelToken: cancelToken);
 
     return _foregroundUploadService.uploadCandidates(
@@ -276,7 +277,7 @@ class DriftBackupNotifier extends StateNotifier<DriftBackupState> {
   }
 
   Future<void> stopForegroundBackup() async {
-    state.cancelToken?.complete();
+    state.cancelToken?.cancel();
     _uploadSpeedManager.clear();
     state = state.copyWith(cancelToken: null, uploadItems: {}, iCloudDownloadProgress: {});
   }

mobile/lib/providers/backup/manual_upload.provider.dart

@@ -1,6 +1,7 @@
 import 'dart:async';
 import 'dart:io';
 
+import 'package:cancellation_token_http/http.dart';
 import 'package:collection/collection.dart';
 import 'package:easy_localization/easy_localization.dart';
 import 'package:flutter/widgets.dart';
@@ -64,7 +65,7 @@ class ManualUploadNotifier extends StateNotifier<ManualUploadState> {
           progressInFileSpeeds: const [],
           progressInFileSpeedUpdateTime: DateTime.now(),
           progressInFileSpeedUpdateSentBytes: 0,
-          cancelToken: Completer(),
+          cancelToken: CancellationToken(),
           currentUploadAsset: CurrentUploadAsset(
             id: '...',
             fileCreatedAt: DateTime.parse('2020-10-04'),
@@ -235,7 +236,7 @@ class ManualUploadNotifier extends StateNotifier<ManualUploadState> {
             fileName: '...',
             fileType: '...',
           ),
-          cancelToken: Completer(),
+          cancelToken: CancellationToken(),
         );
         // Reset Error List
         ref.watch(errorBackupListProvider.notifier).empty();
@@ -272,14 +273,14 @@ class ManualUploadNotifier extends StateNotifier<ManualUploadState> {
         );
 
         // User cancelled upload
-        if (!ok && state.cancelToken.isCompleted) {
+        if (!ok && state.cancelToken.isCancelled) {
           await _localNotificationService.showOrUpdateManualUploadStatus(
             "backup_manual_title".tr(),
             "backup_manual_cancelled".tr(),
             presentBanner: true,
           );
           hasErrors = true;
-        } else if (state.successfulUploads == 0 || (!ok && !state.cancelToken.isCompleted)) {
+        } else if (state.successfulUploads == 0 || (!ok && !state.cancelToken.isCancelled)) {
           await _localNotificationService.showOrUpdateManualUploadStatus(
             "backup_manual_title".tr(),
             "failed".tr(),
@@ -323,7 +324,7 @@ class ManualUploadNotifier extends StateNotifier<ManualUploadState> {
         _backupProvider.backupProgress != BackUpProgressEnum.manualInProgress) {
       _backupProvider.notifyBackgroundServiceCanRun();
     }
-    state.cancelToken.complete();
+    state.cancelToken.cancel();
     if (_backupProvider.backupProgress != BackUpProgressEnum.manualInProgress) {
       _backupProvider.updateBackupProgress(BackUpProgressEnum.idle);
     }

mobile/lib/providers/image/immich_local_image_provider.dart

@@ -0,0 +1,94 @@
+import 'dart:async';
+import 'dart:io';
+import 'dart:ui' as ui;
+
+import 'package:cached_network_image/cached_network_image.dart';
+import 'package:flutter/foundation.dart';
+import 'package:flutter/painting.dart';
+import 'package:immich_mobile/entities/asset.entity.dart';
+import 'package:logging/logging.dart';
+import 'package:photo_manager/photo_manager.dart' show ThumbnailSize;
+
+/// The local image provider for an asset
+class ImmichLocalImageProvider extends ImageProvider<ImmichLocalImageProvider> {
+  final Asset asset;
+  // only used for videos
+  final double width;
+  final double height;
+  final Logger log = Logger('ImmichLocalImageProvider');
+
+  ImmichLocalImageProvider({required this.asset, required this.width, required this.height})
+    : assert(asset.local != null, 'Only usable when asset.local is set');
+
+  /// Converts an [ImageProvider]'s settings plus an [ImageConfiguration] to a key
+  /// that describes the precise image to load.
+  @override
+  Future<ImmichLocalImageProvider> obtainKey(ImageConfiguration configuration) {
+    return SynchronousFuture(this);
+  }
+
+  @override
+  ImageStreamCompleter loadImage(ImmichLocalImageProvider key, ImageDecoderCallback decode) {
+    final chunkEvents = StreamController<ImageChunkEvent>();
+    return MultiImageStreamCompleter(
+      codec: _codec(key.asset, decode, chunkEvents),
+      scale: 1.0,
+      chunkEvents: chunkEvents.stream,
+      informationCollector: () sync* {
+        yield ErrorDescription(asset.fileName);
+      },
+    );
+  }
+
+  // Streams in each stage of the image as we ask for it
+  Stream<ui.Codec> _codec(
+    Asset asset,
+    ImageDecoderCallback decode,
+    StreamController<ImageChunkEvent> chunkEvents,
+  ) async* {
+    try {
+      final local = asset.local;
+      if (local == null) {
+        throw StateError('Asset ${asset.fileName} has no local data');
+      }
+
+      switch (asset.type) {
+        case AssetType.image:
+          final File? file = await local.originFile;
+          if (file == null) {
+            throw StateError("Opening file for asset ${asset.fileName} failed");
+          }
+          final buffer = await ui.ImmutableBuffer.fromFilePath(file.path);
+          yield await decode(buffer);
+          break;
+        case AssetType.video:
+          final size = ThumbnailSize(width.ceil(), height.ceil());
+          final thumbBytes = await local.thumbnailDataWithSize(size);
+          if (thumbBytes == null) {
+            throw StateError("Failed to load preview for ${asset.fileName}");
+          }
+          final buffer = await ui.ImmutableBuffer.fromUint8List(thumbBytes);
+          yield await decode(buffer);
+          break;
+        default:
+          throw StateError('Unsupported asset type ${asset.type}');
+      }
+    } catch (error, stack) {
+      log.severe('Error loading local image ${asset.fileName}', error, stack);
+    } finally {
+      unawaited(chunkEvents.close());
+    }
+  }
+
+  @override
+  bool operator ==(Object other) {
+    if (identical(this, other)) return true;
+    if (other is ImmichLocalImageProvider) {
+      return asset.id == other.asset.id && asset.localId == other.asset.localId;
+    }
+    return false;
+  }
+
+  @override
+  int get hashCode => Object.hash(asset.id, asset.localId);
+}

mobile/lib/providers/image/immich_local_thumbnail_provider.dart

@@ -0,0 +1,88 @@
+import 'dart:async';
+import 'dart:ui' as ui;
+
+import 'package:cached_network_image/cached_network_image.dart';
+import 'package:flutter_cache_manager/flutter_cache_manager.dart';
+import 'package:immich_mobile/providers/image/cache/thumbnail_image_cache_manager.dart';
+
+import 'package:flutter/foundation.dart';
+import 'package:flutter/painting.dart';
+import 'package:immich_mobile/entities/asset.entity.dart';
+import 'package:photo_manager/photo_manager.dart' show ThumbnailSize;
+import 'package:logging/logging.dart';
+
+/// The local image provider for an asset
+/// Only viable
+class ImmichLocalThumbnailProvider extends ImageProvider<ImmichLocalThumbnailProvider> {
+  final Asset asset;
+  final int height;
+  final int width;
+  final CacheManager? cacheManager;
+  final Logger log = Logger("ImmichLocalThumbnailProvider");
+  final String? userId;
+
+  ImmichLocalThumbnailProvider({
+    required this.asset,
+    this.height = 256,
+    this.width = 256,
+    this.cacheManager,
+    this.userId,
+  }) : assert(asset.local != null, 'Only usable when asset.local is set');
+
+  /// Converts an [ImageProvider]'s settings plus an [ImageConfiguration] to a key
+  /// that describes the precise image to load.
+  @override
+  Future<ImmichLocalThumbnailProvider> obtainKey(ImageConfiguration configuration) {
+    return SynchronousFuture(this);
+  }
+
+  @override
+  ImageStreamCompleter loadImage(ImmichLocalThumbnailProvider key, ImageDecoderCallback decode) {
+    final cache = cacheManager ?? ThumbnailImageCacheManager();
+    return MultiImageStreamCompleter(
+      codec: _codec(key.asset, cache, decode),
+      scale: 1.0,
+      informationCollector: () sync* {
+        yield ErrorDescription(key.asset.fileName);
+      },
+    );
+  }
+
+  // Streams in each stage of the image as we ask for it
+  Stream<ui.Codec> _codec(Asset assetData, CacheManager cache, ImageDecoderCallback decode) async* {
+    final cacheKey = '$userId${assetData.localId}${assetData.checksum}$width$height';
+    final fileFromCache = await cache.getFileFromCache(cacheKey);
+    if (fileFromCache != null) {
+      try {
+        final buffer = await ui.ImmutableBuffer.fromFilePath(fileFromCache.file.path);
+        final codec = await decode(buffer);
+        yield codec;
+        return;
+      } catch (error) {
+        log.severe('Found thumbnail in cache, but loading it failed', error);
+      }
+    }
+
+    final thumbnailBytes = await assetData.local?.thumbnailDataWithSize(ThumbnailSize(width, height), quality: 80);
+    if (thumbnailBytes == null) {
+      throw StateError("Loading thumb for local photo ${assetData.fileName} failed");
+    }
+
+    final buffer = await ui.ImmutableBuffer.fromUint8List(thumbnailBytes);
+    final codec = await decode(buffer);
+    yield codec;
+    await cache.putFile(cacheKey, thumbnailBytes);
+  }
+
+  @override
+  bool operator ==(Object other) {
+    if (identical(this, other)) return true;
+    if (other is ImmichLocalThumbnailProvider) {
+      return asset.id == other.asset.id && asset.localId == other.asset.localId;
+    }
+    return false;
+  }
+
+  @override
+  int get hashCode => Object.hash(asset.id, asset.localId);
+}

mobile/lib/providers/image/immich_remote_image_provider.dart

@@ -0,0 +1,82 @@
+import 'dart:async';
+import 'dart:ui' as ui;
+
+import 'package:cached_network_image/cached_network_image.dart';
+import 'package:flutter_cache_manager/flutter_cache_manager.dart';
+import 'package:immich_mobile/providers/image/cache/image_loader.dart';
+import 'package:immich_mobile/providers/image/cache/remote_image_cache_manager.dart';
+import 'package:openapi/api.dart' as api;
+
+import 'package:flutter/foundation.dart';
+import 'package:flutter/painting.dart';
+import 'package:immich_mobile/services/app_settings.service.dart';
+import 'package:immich_mobile/entities/asset.entity.dart';
+import 'package:immich_mobile/entities/store.entity.dart';
+import 'package:immich_mobile/utils/image_url_builder.dart';
+
+/// The remote image provider for full size remote images
+class ImmichRemoteImageProvider extends ImageProvider<ImmichRemoteImageProvider> {
+  /// The [Asset.remoteId] of the asset to fetch
+  final String assetId;
+
+  /// The image cache manager
+  final CacheManager? cacheManager;
+
+  const ImmichRemoteImageProvider({required this.assetId, this.cacheManager});
+
+  /// Converts an [ImageProvider]'s settings plus an [ImageConfiguration] to a key
+  /// that describes the precise image to load.
+  @override
+  Future<ImmichRemoteImageProvider> obtainKey(ImageConfiguration configuration) {
+    return SynchronousFuture(this);
+  }
+
+  @override
+  ImageStreamCompleter loadImage(ImmichRemoteImageProvider key, ImageDecoderCallback decode) {
+    final cache = cacheManager ?? RemoteImageCacheManager();
+    final chunkEvents = StreamController<ImageChunkEvent>();
+    return MultiImageStreamCompleter(
+      codec: _codec(key, cache, decode, chunkEvents),
+      scale: 1.0,
+      chunkEvents: chunkEvents.stream,
+    );
+  }
+
+  /// Whether to show the original file or load a compressed version
+  bool get _useOriginal => Store.get(AppSettingsEnum.loadOriginal.storeKey, AppSettingsEnum.loadOriginal.defaultValue);
+
+  // Streams in each stage of the image as we ask for it
+  Stream<ui.Codec> _codec(
+    ImmichRemoteImageProvider key,
+    CacheManager cache,
+    ImageDecoderCallback decode,
+    StreamController<ImageChunkEvent> chunkEvents,
+  ) async* {
+    // Load the higher resolution version of the image
+    final url = getThumbnailUrlForRemoteId(key.assetId, type: api.AssetMediaSize.preview);
+    final codec = await ImageLoader.loadImageFromCache(url, cache: cache, decode: decode, chunkEvents: chunkEvents);
+    yield codec;
+
+    // Load the final remote image
+    if (_useOriginal) {
+      // Load the original image
+      final url = getOriginalUrlForRemoteId(key.assetId);
+      final codec = await ImageLoader.loadImageFromCache(url, cache: cache, decode: decode, chunkEvents: chunkEvents);
+      yield codec;
+    }
+    await chunkEvents.close();
+  }
+
+  @override
+  bool operator ==(Object other) {
+    if (identical(this, other)) return true;
+    if (other is ImmichRemoteImageProvider) {
+      return assetId == other.assetId;
+    }
+
+    return false;
+  }
+
+  @override
+  int get hashCode => assetId.hashCode;
+}

mobile/lib/providers/image/immich_remote_thumbnail_provider.dart

@@ -0,0 +1,61 @@
+import 'dart:async';
+import 'dart:ui' as ui;
+
+import 'package:cached_network_image/cached_network_image.dart';
+import 'package:flutter_cache_manager/flutter_cache_manager.dart';
+import 'package:immich_mobile/providers/image/cache/image_loader.dart';
+import 'package:immich_mobile/providers/image/cache/thumbnail_image_cache_manager.dart';
+import 'package:openapi/api.dart' as api;
+
+import 'package:flutter/foundation.dart';
+import 'package:flutter/painting.dart';
+import 'package:immich_mobile/entities/asset.entity.dart';
+import 'package:immich_mobile/utils/image_url_builder.dart';
+
+/// The remote image provider
+class ImmichRemoteThumbnailProvider extends ImageProvider<ImmichRemoteThumbnailProvider> {
+  /// The [Asset.remoteId] of the asset to fetch
+  final String assetId;
+
+  final int? height;
+  final int? width;
+
+  /// The image cache manager
+  final CacheManager? cacheManager;
+
+  const ImmichRemoteThumbnailProvider({required this.assetId, this.height, this.width, this.cacheManager});
+
+  /// Converts an [ImageProvider]'s settings plus an [ImageConfiguration] to a key
+  /// that describes the precise image to load.
+  @override
+  Future<ImmichRemoteThumbnailProvider> obtainKey(ImageConfiguration configuration) {
+    return SynchronousFuture(this);
+  }
+
+  @override
+  ImageStreamCompleter loadImage(ImmichRemoteThumbnailProvider key, ImageDecoderCallback decode) {
+    final cache = cacheManager ?? ThumbnailImageCacheManager();
+    return MultiImageStreamCompleter(codec: _codec(key, cache, decode), scale: 1.0);
+  }
+
+  // Streams in each stage of the image as we ask for it
+  Stream<ui.Codec> _codec(ImmichRemoteThumbnailProvider key, CacheManager cache, ImageDecoderCallback decode) async* {
+    // Load a preview to the chunk events
+    final preview = getThumbnailUrlForRemoteId(key.assetId, type: api.AssetMediaSize.thumbnail);
+
+    yield await ImageLoader.loadImageFromCache(preview, cache: cache, decode: decode);
+  }
+
+  @override
+  bool operator ==(Object other) {
+    if (identical(this, other)) return true;
+    if (other is ImmichRemoteThumbnailProvider) {
+      return assetId == other.assetId;
+    }
+
+    return false;
+  }
+
+  @override
+  int get hashCode => assetId.hashCode;
+}

mobile/lib/providers/infrastructure/action.provider.dart

@@ -2,6 +2,7 @@ import 'dart:async';
 
 import 'package:auto_route/auto_route.dart';
 import 'package:background_downloader/background_downloader.dart';
+import 'package:cancellation_token_http/http.dart';
 import 'package:flutter/material.dart';
 import 'package:immich_mobile/constants/enums.dart';
 import 'package:immich_mobile/domain/models/asset/base_asset.model.dart';
@@ -432,7 +433,7 @@ class ActionNotifier extends Notifier<void> {
     final assetsToUpload = assets ?? _getAssets(source).whereType<LocalAsset>().toList();
 
     final progressNotifier = ref.read(assetUploadProgressProvider.notifier);
-    final cancelToken = Completer();
+    final cancelToken = CancellationToken();
     ref.read(manualUploadCancelTokenProvider.notifier).state = cancelToken;
 
     // Initialize progress for all assets

mobile/lib/providers/infrastructure/platform.provider.dart

@@ -5,7 +5,6 @@ import 'package:immich_mobile/platform/background_worker_lock_api.g.dart';
 import 'package:immich_mobile/platform/connectivity_api.g.dart';
 import 'package:immich_mobile/platform/native_sync_api.g.dart';
 import 'package:immich_mobile/platform/local_image_api.g.dart';
-import 'package:immich_mobile/platform/network_api.g.dart';
 import 'package:immich_mobile/platform/remote_image_api.g.dart';
 
 final backgroundWorkerFgServiceProvider = Provider((_) => BackgroundWorkerFgService(BackgroundWorkerFgHostApi()));
@@ -21,5 +20,3 @@ final connectivityApiProvider = Provider<ConnectivityApi>((_) => ConnectivityApi
 final localImageApi = LocalImageApi();
 
 final remoteImageApi = RemoteImageApi();
-
-final networkApi = NetworkApi();

mobile/lib/providers/infrastructure/sync.provider.dart

@@ -3,7 +3,6 @@ import 'package:immich_mobile/domain/services/hash.service.dart';
 import 'package:immich_mobile/domain/services/local_sync.service.dart';
 import 'package:immich_mobile/domain/services/sync_stream.service.dart';
 import 'package:immich_mobile/infrastructure/repositories/sync_api.repository.dart';
-import 'package:immich_mobile/infrastructure/repositories/sync_migration.repository.dart';
 import 'package:immich_mobile/infrastructure/repositories/sync_stream.repository.dart';
 import 'package:immich_mobile/providers/api.provider.dart';
 import 'package:immich_mobile/providers/infrastructure/album.provider.dart';
@@ -14,8 +13,6 @@ import 'package:immich_mobile/providers/infrastructure/platform.provider.dart';
 import 'package:immich_mobile/providers/infrastructure/storage.provider.dart';
 import 'package:immich_mobile/repositories/local_files_manager.repository.dart';
 
-final syncMigrationRepositoryProvider = Provider((ref) => SyncMigrationRepository(ref.watch(driftProvider)));
-
 final syncStreamServiceProvider = Provider(
   (ref) => SyncStreamService(
     syncApiRepository: ref.watch(syncApiRepositoryProvider),
@@ -24,8 +21,6 @@ final syncStreamServiceProvider = Provider(
     trashedLocalAssetRepository: ref.watch(trashedLocalAssetRepository),
     localFilesManager: ref.watch(localFilesManagerRepositoryProvider),
     storageRepository: ref.watch(storageRepositoryProvider),
-    syncMigrationRepository: ref.watch(syncMigrationRepositoryProvider),
-    api: ref.watch(apiServiceProvider),
     cancelChecker: ref.watch(cancellationProvider),
   ),
 );

mobile/lib/providers/server_info.provider.dart

@@ -15,7 +15,7 @@ class ServerInfoNotifier extends StateNotifier<ServerInfo> {
     : super(
         const ServerInfo(
           serverVersion: ServerVersion(major: 0, minor: 0, patch: 0),
-          latestVersion: null,
+          latestVersion: ServerVersion(major: 0, minor: 0, patch: 0),
           serverFeatures: ServerFeatures(map: true, trash: true, oauthEnabled: false, passwordLogin: true),
           serverConfig: ServerConfig(
             trashDays: 30,
@@ -43,7 +43,7 @@ class ServerInfoNotifier extends StateNotifier<ServerInfo> {
     try {
       final serverVersion = await _serverInfoService.getServerVersion();
 
-      // using isClientOutOfDate since that will show to users regardless of if they are an admin
+      // using isClientOutOfDate since that will show to users reguardless of if they are an admin
       if (serverVersion == null) {
         state = state.copyWith(versionStatus: VersionStatus.error);
         return;
@@ -76,7 +76,7 @@ class ServerInfoNotifier extends StateNotifier<ServerInfo> {
     state = state.copyWith(versionStatus: VersionStatus.upToDate);
   }
 
-  handleReleaseInfo(ServerVersion serverVersion, ServerVersion? latestVersion) {
+  handleReleaseInfo(ServerVersion serverVersion, ServerVersion latestVersion) {
     // Update local server version
     _checkServerVersionMismatch(serverVersion, latestVersion: latestVersion);
   }

mobile/lib/repositories/upload.repository.dart

@@ -3,14 +3,21 @@ import 'dart:convert';
 import 'dart:io';
 
 import 'package:background_downloader/background_downloader.dart';
+import 'package:cancellation_token_http/http.dart';
 import 'package:hooks_riverpod/hooks_riverpod.dart';
 import 'package:immich_mobile/constants/constants.dart';
 import 'package:immich_mobile/domain/models/store.model.dart';
 import 'package:immich_mobile/entities/store.entity.dart';
 import 'package:logging/logging.dart';
-import 'package:http/http.dart';
 import 'package:immich_mobile/utils/debug_print.dart';
 
+class UploadTaskWithFile {
+  final File file;
+  final UploadTask task;
+
+  const UploadTaskWithFile({required this.file, required this.task});
+}
+
 final uploadRepositoryProvider = Provider((ref) => UploadRepository());
 
 class UploadRepository {
@@ -93,26 +100,23 @@ class UploadRepository {
     required Map<String, String> headers,
     required Map<String, String> fields,
     required Client httpClient,
-    required Completer cancelToken,
-    required void Function(int bytes, int totalBytes) onProgress, // TODO: use onProgress
+    required CancellationToken cancelToken,
+    required void Function(int bytes, int totalBytes) onProgress,
     required String logContext,
   }) async {
     final String savedEndpoint = Store.get(StoreKey.serverEndpoint);
-    final baseRequest = AbortableMultipartRequest(
-      'POST',
-      Uri.parse('$savedEndpoint/assets'),
-      abortTrigger: cancelToken.future,
-    );
 
     try {
       final fileStream = file.openRead();
       final assetRawUploadData = MultipartFile("assetData", fileStream, file.lengthSync(), filename: originalFileName);
 
+      final baseRequest = _CustomMultipartRequest('POST', Uri.parse('$savedEndpoint/assets'), onProgress: onProgress);
+
       baseRequest.headers.addAll(headers);
       baseRequest.fields.addAll(fields);
       baseRequest.files.add(assetRawUploadData);
 
-      final response = await httpClient.send(baseRequest);
+      final response = await httpClient.send(baseRequest, cancellationToken: cancelToken);
       final responseBodyString = await response.stream.bytesToString();
 
       if (![200, 201].contains(response.statusCode)) {
@@ -141,7 +145,7 @@ class UploadRepository {
       } catch (e) {
         return UploadResult.error(errorMessage: 'Failed to parse server response');
       }
-    } on RequestAbortedException {
+    } on CancelledException {
       logger.warning("Upload $logContext was cancelled");
       return UploadResult.cancelled();
     } catch (error, stackTrace) {
@@ -178,3 +182,26 @@ class UploadResult {
     return const UploadResult(isSuccess: false, isCancelled: true);
   }
 }
+
+class _CustomMultipartRequest extends MultipartRequest {
+  _CustomMultipartRequest(super.method, super.url, {required this.onProgress});
+
+  final void Function(int bytes, int totalBytes) onProgress;
+
+  @override
+  ByteStream finalize() {
+    final byteStream = super.finalize();
+    final total = contentLength;
+    var bytes = 0;
+
+    final t = StreamTransformer.fromHandlers(
+      handleData: (List<int> data, EventSink<List<int>> sink) {
+        bytes += data.length;
+        onProgress.call(bytes, total);
+        sink.add(data);
+      },
+    );
+    final stream = byteStream.transform(t);
+    return ByteStream(stream);
+  }
+}

mobile/lib/services/api.service.dart

@@ -3,11 +3,12 @@ import 'dart:convert';
 import 'dart:io';
 
 import 'package:device_info_plus/device_info_plus.dart';
+import 'package:http/http.dart';
 import 'package:immich_mobile/domain/models/store.model.dart';
 import 'package:immich_mobile/entities/store.entity.dart';
-import 'package:immich_mobile/infrastructure/repositories/network.repository.dart';
 import 'package:immich_mobile/utils/debug_print.dart';
 import 'package:immich_mobile/utils/url_helper.dart';
+import 'package:immich_mobile/utils/user_agent.dart';
 import 'package:logging/logging.dart';
 import 'package:openapi/api.dart';
 
@@ -49,7 +50,7 @@ class ApiService implements Authentication {
 
   setEndpoint(String endpoint) {
     _apiClient = ApiClient(basePath: endpoint, authentication: this);
-    _apiClient.client = NetworkRepository.client;
+    _setUserAgentHeader();
     if (_accessToken != null) {
       setAccessToken(_accessToken!);
     }
@@ -75,6 +76,11 @@ class ApiService implements Authentication {
     sessionsApi = SessionsApi(_apiClient);
   }
 
+  Future<void> _setUserAgentHeader() async {
+    final userAgent = await getUserAgentString();
+    _apiClient.addDefaultHeader('User-Agent', userAgent);
+  }
+
   Future<String> resolveAndSetEndpoint(String serverUrl) async {
     final endpoint = await resolveEndpoint(serverUrl);
     setEndpoint(endpoint);
@@ -128,11 +134,13 @@ class ApiService implements Authentication {
   }
 
   Future<String> _getWellKnownEndpoint(String baseUrl) async {
+    final Client client = Client();
+
     try {
       var headers = {"Accept": "application/json"};
       headers.addAll(getRequestHeaders());
 
-      final res = await NetworkRepository.client
+      final res = await client
           .get(Uri.parse("$baseUrl/.well-known/immich"), headers: headers)
           .timeout(const Duration(seconds: 5));
 

mobile/lib/services/auth.service.dart

@@ -1,10 +1,10 @@
 import 'dart:async';
+import 'dart:io';
 
 import 'package:hooks_riverpod/hooks_riverpod.dart';
 import 'package:immich_mobile/domain/models/store.model.dart';
 import 'package:immich_mobile/domain/utils/background_sync.dart';
 import 'package:immich_mobile/entities/store.entity.dart';
-import 'package:immich_mobile/infrastructure/repositories/network.repository.dart';
 import 'package:immich_mobile/models/auth/auxilary_endpoint.model.dart';
 import 'package:immich_mobile/models/auth/login_response.model.dart';
 import 'package:immich_mobile/providers/api.provider.dart';
@@ -64,16 +64,27 @@ class AuthService {
   }
 
   Future<bool> validateAuxilaryServerUrl(String url) async {
+    final httpclient = HttpClient();
     bool isValid = false;
 
     try {
       final uri = Uri.parse('$url/users/me');
-      final response = await NetworkRepository.client.get(uri, headers: ApiService.getRequestHeaders());
+      final request = await httpclient.getUrl(uri);
+
+      // add auth token + any configured custom headers
+      final customHeaders = ApiService.getRequestHeaders();
+      customHeaders.forEach((key, value) {
+        request.headers.add(key, value);
+      });
+
+      final response = await request.close();
       if (response.statusCode == 200) {
         isValid = true;
       }
     } catch (error) {
       _log.severe("Error validating auxiliary endpoint", error);
+    } finally {
+      httpclient.close();
     }
 
     return isValid;

mobile/lib/services/background.service.dart

@@ -4,6 +4,7 @@ import 'dart:io';
 import 'dart:isolate';
 import 'dart:ui' show DartPluginRegistrant, IsolateNameServer, PluginUtilities;
 
+import 'package:cancellation_token_http/http.dart';
 import 'package:collection/collection.dart';
 import 'package:easy_localization/easy_localization.dart';
 import 'package:flutter/services.dart';
@@ -29,6 +30,7 @@ import 'package:immich_mobile/utils/backup_progress.dart';
 import 'package:immich_mobile/utils/bootstrap.dart';
 import 'package:immich_mobile/utils/debug_print.dart';
 import 'package:immich_mobile/utils/diff.dart';
+import 'package:immich_mobile/utils/http_ssl_options.dart';
 import 'package:path_provider_foundation/path_provider_foundation.dart';
 import 'package:photo_manager/photo_manager.dart' show PMProgressHandler;
 
@@ -41,7 +43,7 @@ class BackgroundService {
   static const MethodChannel _backgroundChannel = MethodChannel('immich/backgroundChannel');
   static const notifyInterval = Duration(milliseconds: 400);
   bool _isBackgroundInitialized = false;
-  Completer? _cancellationToken;
+  CancellationToken? _cancellationToken;
   bool _canceledBySystem = false;
   int _wantsLockTime = 0;
   bool _hasLock = false;
@@ -319,7 +321,7 @@ class BackgroundService {
         }
       case "systemStop":
         _canceledBySystem = true;
-        _cancellationToken?.complete();
+        _cancellationToken?.cancel();
         return true;
       default:
         dPrint(() => "Unknown method ${call.method}");
@@ -339,6 +341,7 @@ class BackgroundService {
       ],
     );
 
+    HttpSSLOptions.apply();
     await ref.read(apiServiceProvider).setAccessToken(Store.get(StoreKey.accessToken));
     await ref.read(authServiceProvider).setOpenApiServiceEndpoint();
     dPrint(() => "[BG UPLOAD] Using endpoint: ${ref.read(apiServiceProvider).apiClient.basePath}");
@@ -438,7 +441,7 @@ class BackgroundService {
       ),
     );
 
-    _cancellationToken = Completer();
+    _cancellationToken = CancellationToken();
     final pmProgressHandler = Platform.isIOS ? PMProgressHandler() : null;
 
     final bool ok = await backupService.backupAsset(
@@ -452,7 +455,7 @@ class BackgroundService {
       isBackground: true,
     );
 
-    if (!ok && !_cancellationToken!.isCompleted) {
+    if (!ok && !_cancellationToken!.isCancelled) {
       unawaited(
         _showErrorNotification(
           title: "backup_background_service_error_title".tr(),

mobile/lib/services/backup.service.dart

@@ -2,15 +2,14 @@ import 'dart:async';
 import 'dart:convert';
 import 'dart:io';
 
+import 'package:cancellation_token_http/http.dart' as http;
 import 'package:collection/collection.dart';
 import 'package:hooks_riverpod/hooks_riverpod.dart';
-import 'package:http/http.dart';
 import 'package:immich_mobile/domain/models/store.model.dart';
 import 'package:immich_mobile/entities/album.entity.dart';
 import 'package:immich_mobile/entities/asset.entity.dart';
 import 'package:immich_mobile/entities/backup_album.entity.dart';
 import 'package:immich_mobile/entities/store.entity.dart';
-import 'package:immich_mobile/infrastructure/repositories/network.repository.dart';
 import 'package:immich_mobile/models/backup/backup_candidate.model.dart';
 import 'package:immich_mobile/models/backup/current_upload_asset.model.dart';
 import 'package:immich_mobile/models/backup/error_upload_asset.model.dart';
@@ -44,6 +43,7 @@ final backupServiceProvider = Provider(
 );
 
 class BackupService {
+  final httpClient = http.Client();
   final ApiService _apiService;
   final Logger _log = Logger("BackupService");
   final AppSettingsService _appSetting;
@@ -233,11 +233,11 @@ class BackupService {
 
   Future<bool> backupAsset(
     Iterable<BackupCandidate> assets,
-    Completer cancelToken, {
+    http.CancellationToken cancelToken, {
     bool isBackground = false,
     PMProgressHandler? pmProgressHandler,
     required void Function(SuccessUploadAsset result) onSuccess,
-    required void Function(int bytes, int totalBytes) onProgress, // TODO: use onProgress
+    required void Function(int bytes, int totalBytes) onProgress,
     required void Function(CurrentUploadAsset asset) onCurrentAsset,
     required void Function(ErrorUploadAsset error) onError,
   }) async {
@@ -306,17 +306,17 @@ class BackupService {
           }
 
           final fileStream = file.openRead();
-          final assetRawUploadData = MultipartFile(
+          final assetRawUploadData = http.MultipartFile(
             "assetData",
             fileStream,
             file.lengthSync(),
             filename: originalFileName,
           );
 
-          final baseRequest = AbortableMultipartRequest(
+          final baseRequest = MultipartRequest(
             'POST',
             Uri.parse('$savedEndpoint/assets'),
-            abortTrigger: cancelToken.future,
+            onProgress: ((bytes, totalBytes) => onProgress(bytes, totalBytes)),
           );
 
           baseRequest.headers.addAll(ApiService.getRequestHeaders());
@@ -348,7 +348,7 @@ class BackupService {
             baseRequest.fields['livePhotoVideoId'] = livePhotoVideoId;
           }
 
-          final response = await NetworkRepository.client.send(baseRequest);
+          final response = await httpClient.send(baseRequest, cancellationToken: cancelToken);
 
           final responseBody = jsonDecode(await response.stream.bytesToString());
 
@@ -398,7 +398,7 @@ class BackupService {
             await _albumService.syncUploadAlbums(candidate.albumNames, [responseBody['id'] as String]);
           }
         }
-      } on RequestAbortedException {
+      } on http.CancelledException {
         dPrint(() => "Backup was cancelled by the user");
         anyErrors = true;
         break;
@@ -429,27 +429,26 @@ class BackupService {
     String originalFileName,
     File? livePhotoVideoFile,
     MultipartRequest baseRequest,
-    Completer cancelToken,
+    http.CancellationToken cancelToken,
   ) async {
     if (livePhotoVideoFile == null) {
       return null;
     }
     final livePhotoTitle = p.setExtension(originalFileName, p.extension(livePhotoVideoFile.path));
     final fileStream = livePhotoVideoFile.openRead();
-    final livePhotoRawUploadData = MultipartFile(
+    final livePhotoRawUploadData = http.MultipartFile(
       "assetData",
       fileStream,
       livePhotoVideoFile.lengthSync(),
       filename: livePhotoTitle,
     );
-    final livePhotoReq =
-        AbortableMultipartRequest(baseRequest.method, baseRequest.url, abortTrigger: cancelToken.future)
+    final livePhotoReq = MultipartRequest(baseRequest.method, baseRequest.url, onProgress: baseRequest.onProgress)
       ..headers.addAll(baseRequest.headers)
       ..fields.addAll(baseRequest.fields);
 
     livePhotoReq.files.add(livePhotoRawUploadData);
 
-    var response = await NetworkRepository.client.send(livePhotoReq);
+    var response = await httpClient.send(livePhotoReq, cancellationToken: cancelToken);
 
     var responseBody = jsonDecode(await response.stream.bytesToString());
 
@@ -471,3 +470,31 @@ class BackupService {
     AssetType.other => "OTHER",
   };
 }
+
+class MultipartRequest extends http.MultipartRequest {
+  /// Creates a new [MultipartRequest].
+  MultipartRequest(super.method, super.url, {required this.onProgress});
+
+  final void Function(int bytes, int totalBytes) onProgress;
+
+  /// Freezes all mutable fields and returns a
+  /// single-subscription [http.ByteStream]
+  /// that will emit the request body.
+  @override
+  http.ByteStream finalize() {
+    final byteStream = super.finalize();
+
+    final total = contentLength;
+    var bytes = 0;
+
+    final t = StreamTransformer.fromHandlers(
+      handleData: (List<int> data, EventSink<List<int>> sink) {
+        bytes += data.length;
+        onProgress.call(bytes, total);
+        sink.add(data);
+      },
+    );
+    final stream = byteStream.transform(t);
+    return http.ByteStream(stream);
+  }
+}

mobile/lib/services/foreground_upload.service.dart

@@ -2,7 +2,7 @@ import 'dart:async';
 import 'dart:convert';
 import 'dart:io';
 
-import 'package:http/http.dart';
+import 'package:cancellation_token_http/http.dart';
 import 'package:hooks_riverpod/hooks_riverpod.dart';
 import 'package:immich_mobile/domain/models/asset/asset_metadata.model.dart';
 import 'package:immich_mobile/domain/models/asset/base_asset.model.dart';
@@ -12,7 +12,6 @@ import 'package:immich_mobile/extensions/platform_extensions.dart';
 import 'package:immich_mobile/extensions/network_capability_extensions.dart';
 import 'package:immich_mobile/extensions/translate_extensions.dart';
 import 'package:immich_mobile/infrastructure/repositories/backup.repository.dart';
-import 'package:immich_mobile/infrastructure/repositories/network.repository.dart';
 import 'package:immich_mobile/infrastructure/repositories/storage.repository.dart';
 import 'package:immich_mobile/platform/connectivity_api.g.dart';
 import 'package:immich_mobile/providers/app_settings.provider.dart';
@@ -83,7 +82,7 @@ class ForegroundUploadService {
   /// Bulk upload of backup candidates from selected albums
   Future<void> uploadCandidates(
     String userId,
-    Completer cancelToken, {
+    CancellationToken cancelToken, {
     UploadCallbacks callbacks = const UploadCallbacks(),
     bool useSequentialUpload = false,
   }) async {
@@ -106,7 +105,7 @@ class ForegroundUploadService {
           final requireWifi = _shouldRequireWiFi(asset);
           return requireWifi && !hasWifi;
         },
-        processItem: (asset) => _uploadSingleAsset(asset, cancelToken, callbacks: callbacks),
+        processItem: (asset, httpClient) => _uploadSingleAsset(asset, httpClient, cancelToken, callbacks: callbacks),
       );
     }
   }
@@ -114,32 +113,37 @@ class ForegroundUploadService {
   /// Sequential upload - used for background isolate where concurrent HTTP clients may cause issues
   Future<void> _uploadSequentially({
     required List<LocalAsset> items,
-    required Completer cancelToken,
+    required CancellationToken cancelToken,
     required bool hasWifi,
     required UploadCallbacks callbacks,
   }) async {
+    final httpClient = Client();
     await _storageRepository.clearCache();
     shouldAbortUpload = false;
 
-    for (final asset in items) {
-      if (shouldAbortUpload || cancelToken.isCompleted) {
-        break;
-      }
+    try {
+      for (final asset in items) {
+        if (shouldAbortUpload || cancelToken.isCancelled) {
+          break;
+        }
 
-      final requireWifi = _shouldRequireWiFi(asset);
-      if (requireWifi && !hasWifi) {
-        _logger.warning('Skipping upload for ${asset.id} because it requires WiFi');
-        continue;
-      }
+        final requireWifi = _shouldRequireWiFi(asset);
+        if (requireWifi && !hasWifi) {
+          _logger.warning('Skipping upload for ${asset.id} because it requires WiFi');
+          continue;
+        }
 
-      await _uploadSingleAsset(asset, cancelToken, callbacks: callbacks);
+        await _uploadSingleAsset(asset, httpClient, cancelToken, callbacks: callbacks);
+      }
+    } finally {
+      httpClient.close();
     }
   }
 
   /// Manually upload picked local assets
   Future<void> uploadManual(
     List<LocalAsset> localAssets,
-    Completer cancelToken, {
+    CancellationToken cancelToken, {
     UploadCallbacks callbacks = const UploadCallbacks(),
   }) async {
     if (localAssets.isEmpty) {
@@ -149,14 +153,14 @@ class ForegroundUploadService {
     await _executeWithWorkerPool<LocalAsset>(
       items: localAssets,
       cancelToken: cancelToken,
-      processItem: (asset) => _uploadSingleAsset(asset, cancelToken, callbacks: callbacks),
+      processItem: (asset, httpClient) => _uploadSingleAsset(asset, httpClient, cancelToken, callbacks: callbacks),
     );
   }
 
   /// Upload files from shared intent
   Future<void> uploadShareIntent(
     List<File> files, {
-    Completer? cancelToken,
+    CancellationToken? cancelToken,
     void Function(String fileId, int bytes, int totalBytes)? onProgress,
     void Function(String fileId)? onSuccess,
     void Function(String fileId, String errorMessage)? onError,
@@ -164,18 +168,19 @@ class ForegroundUploadService {
     if (files.isEmpty) {
       return;
     }
-    final effectiveCancelToken = cancelToken ?? Completer();
+
+    final effectiveCancelToken = cancelToken ?? CancellationToken();
 
     await _executeWithWorkerPool<File>(
       items: files,
       cancelToken: effectiveCancelToken,
-      processItem: (file) async {
+      processItem: (file, httpClient) async {
         final fileId = p.hash(file.path).toString();
 
         final result = await _uploadSingleFile(
           file,
           deviceAssetId: fileId,
-          httpClient: NetworkRepository.client,
+          httpClient: httpClient,
           cancelToken: effectiveCancelToken,
           onProgress: (bytes, totalBytes) => onProgress?.call(fileId, bytes, totalBytes),
         );
@@ -202,47 +207,60 @@ class ForegroundUploadService {
   /// [concurrentWorkers] - Number of concurrent workers (default: 3)
   Future<void> _executeWithWorkerPool<T>({
     required List<T> items,
-    required Completer cancelToken,
-    required Future<void> Function(T item) processItem,
+    required CancellationToken cancelToken,
+    required Future<void> Function(T item, Client httpClient) processItem,
     bool Function(T item)? shouldSkip,
     int concurrentWorkers = 3,
   }) async {
+    final httpClients = List.generate(concurrentWorkers, (_) => Client());
+
     await _storageRepository.clearCache();
     shouldAbortUpload = false;
 
-    int currentIndex = 0;
+    try {
+      int currentIndex = 0;
 
-    Future<void> worker() async {
-      while (true) {
-        if (shouldAbortUpload || cancelToken.isCompleted) {
-          break;
+      Future<void> worker(Client httpClient) async {
+        while (true) {
+          if (shouldAbortUpload || cancelToken.isCancelled) {
+            break;
+          }
+
+          final index = currentIndex;
+          if (index >= items.length) {
+            break;
+          }
+          currentIndex++;
+
+          final item = items[index];
+
+          if (shouldSkip?.call(item) ?? false) {
+            continue;
+          }
+
+          await processItem(item, httpClient);
         }
+      }
 
-        final index = currentIndex;
-        if (index >= items.length) {
-          break;
-        }
-        currentIndex++;
+      final workerFutures = <Future<void>>[];
+      for (int i = 0; i < concurrentWorkers; i++) {
+        workerFutures.add(worker(httpClients[i]));
+      }
 
-        final item = items[index];
-
-        if (shouldSkip?.call(item) ?? false) {
-          continue;
-        }
-
-        await processItem(item);
+      await Future.wait(workerFutures);
+    } finally {
+      for (final client in httpClients) {
+        client.close();
       }
     }
-
-    final workerFutures = <Future<void>>[];
-    for (int i = 0; i < concurrentWorkers; i++) {
-      workerFutures.add(worker());
-    }
-
-    await Future.wait(workerFutures);
   }
 
-  Future<void> _uploadSingleAsset(LocalAsset asset, Completer cancelToken, {required UploadCallbacks callbacks}) async {
+  Future<void> _uploadSingleAsset(
+    LocalAsset asset,
+    Client httpClient,
+    CancellationToken cancelToken, {
+    required UploadCallbacks callbacks,
+  }) async {
     File? file;
     File? livePhotoFile;
 
@@ -345,7 +363,7 @@ class ForegroundUploadService {
           originalFileName: livePhotoTitle,
           headers: headers,
           fields: fields,
-          httpClient: NetworkRepository.client,
+          httpClient: httpClient,
           cancelToken: cancelToken,
           onProgress: (bytes, totalBytes) =>
               callbacks.onProgress?.call(asset.localId!, livePhotoTitle, bytes, totalBytes),
@@ -382,7 +400,7 @@ class ForegroundUploadService {
         originalFileName: originalFileName,
         headers: headers,
         fields: fields,
-        httpClient: NetworkRepository.client,
+        httpClient: httpClient,
         cancelToken: cancelToken,
         onProgress: (bytes, totalBytes) =>
             callbacks.onProgress?.call(asset.localId!, originalFileName, bytes, totalBytes),
@@ -425,7 +443,7 @@ class ForegroundUploadService {
     File file, {
     required String deviceAssetId,
     required Client httpClient,
-    required Completer cancelToken,
+    required CancellationToken cancelToken,
     void Function(int bytes, int totalBytes)? onProgress,
   }) async {
     try {

mobile/lib/utils/cache/custom_image_cache.dart

@@ -2,6 +2,10 @@ import 'package:flutter/painting.dart';
 import 'package:immich_mobile/presentation/widgets/images/local_image_provider.dart';
 import 'package:immich_mobile/presentation/widgets/images/remote_image_provider.dart';
 import 'package:immich_mobile/presentation/widgets/images/thumb_hash_provider.dart';
+import 'package:immich_mobile/providers/image/immich_local_image_provider.dart';
+import 'package:immich_mobile/providers/image/immich_local_thumbnail_provider.dart';
+import 'package:immich_mobile/providers/image/immich_remote_image_provider.dart';
+import 'package:immich_mobile/providers/image/immich_remote_thumbnail_provider.dart';
 
 /// [ImageCache] that uses two caches for small and large images
 /// so that a single large image does not evict all small images
@@ -35,9 +39,14 @@ final class CustomImageCache implements ImageCache {
   }
 
   /// Gets the cache for the given key
+  /// [_large] is used for [ImmichLocalImageProvider] and [ImmichRemoteImageProvider]
+  /// [_small] is used for [ImmichLocalThumbnailProvider] and [ImmichRemoteThumbnailProvider]
   ImageCache _cacheForKey(Object key) {
     return switch (key) {
-      LocalFullImageProvider() || RemoteFullImageProvider() => _large,
+      ImmichLocalImageProvider() ||
+      ImmichRemoteImageProvider() ||
+      LocalFullImageProvider() ||
+      RemoteFullImageProvider() => _large,
       ThumbHashProvider() => _thumbhash,
       _ => _small,
     };

mobile/lib/utils/http_ssl_cert_override.dart

@@ -0,0 +1,61 @@
+import 'dart:io';
+
+import 'package:immich_mobile/entities/store.entity.dart';
+import 'package:logging/logging.dart';
+
+class HttpSSLCertOverride extends HttpOverrides {
+  static final Logger _log = Logger("HttpSSLCertOverride");
+  final bool _allowSelfSignedSSLCert;
+  final String? _serverHost;
+  final SSLClientCertStoreVal? _clientCert;
+  late final SecurityContext? _ctxWithCert;
+
+  HttpSSLCertOverride(this._allowSelfSignedSSLCert, this._serverHost, this._clientCert) {
+    if (_clientCert != null) {
+      _ctxWithCert = SecurityContext(withTrustedRoots: true);
+      if (_ctxWithCert != null) {
+        setClientCert(_ctxWithCert, _clientCert);
+      } else {
+        _log.severe("Failed to create security context with client cert!");
+      }
+    } else {
+      _ctxWithCert = null;
+    }
+  }
+
+  static bool setClientCert(SecurityContext ctx, SSLClientCertStoreVal cert) {
+    try {
+      _log.info("Setting client certificate");
+      ctx.usePrivateKeyBytes(cert.data, password: cert.password);
+      ctx.useCertificateChainBytes(cert.data, password: cert.password);
+    } catch (e) {
+      _log.severe("Failed to set SSL client cert: $e");
+      return false;
+    }
+    return true;
+  }
+
+  @override
+  HttpClient createHttpClient(SecurityContext? context) {
+    if (context != null) {
+      if (_clientCert != null) {
+        setClientCert(context, _clientCert);
+      }
+    } else {
+      context = _ctxWithCert;
+    }
+
+    return super.createHttpClient(context)
+      ..badCertificateCallback = (X509Certificate cert, String host, int port) {
+        if (_allowSelfSignedSSLCert) {
+          // Conduct server host checks if user is logged in to avoid making
+          // insecure SSL connections to services that are not the immich server.
+          if (_serverHost == null || _serverHost.contains(host)) {
+            return true;
+          }
+        }
+        _log.severe("Invalid SSL certificate for $host:$port");
+        return false;
+      };
+  }
+}

mobile/lib/utils/http_ssl_options.dart

@@ -0,0 +1,42 @@
+import 'dart:io';
+
+import 'package:flutter/services.dart';
+import 'package:immich_mobile/domain/models/store.model.dart';
+import 'package:immich_mobile/entities/store.entity.dart';
+import 'package:immich_mobile/services/app_settings.service.dart';
+import 'package:immich_mobile/utils/http_ssl_cert_override.dart';
+import 'package:logging/logging.dart';
+
+class HttpSSLOptions {
+  static const MethodChannel _channel = MethodChannel('immich/httpSSLOptions');
+
+  static void apply({bool applyNative = true}) {
+    AppSettingsEnum setting = AppSettingsEnum.allowSelfSignedSSLCert;
+    bool allowSelfSignedSSLCert = Store.get(setting.storeKey as StoreKey<bool>, setting.defaultValue);
+    _apply(allowSelfSignedSSLCert, applyNative: applyNative);
+  }
+
+  static void applyFromSettings(bool newValue) {
+    _apply(newValue);
+  }
+
+  static void _apply(bool allowSelfSignedSSLCert, {bool applyNative = true}) {
+    String? serverHost;
+    if (allowSelfSignedSSLCert && Store.tryGet(StoreKey.currentUser) != null) {
+      serverHost = Uri.parse(Store.tryGet(StoreKey.serverEndpoint) ?? "").host;
+    }
+
+    SSLClientCertStoreVal? clientCert = SSLClientCertStoreVal.load();
+
+    HttpOverrides.global = HttpSSLCertOverride(allowSelfSignedSSLCert, serverHost, clientCert);
+
+    if (applyNative && Platform.isAndroid) {
+      _channel
+          .invokeMethod("apply", [allowSelfSignedSSLCert, serverHost, clientCert?.data, clientCert?.password])
+          .onError<PlatformException>((e, _) {
+            final log = Logger("HttpSSLOptions");
+            log.severe('Failed to set SSL options', e.message);
+          });
+    }
+  }
+}

mobile/lib/utils/isolate.dart

@@ -10,6 +10,7 @@ import 'package:immich_mobile/providers/infrastructure/cancel.provider.dart';
 import 'package:immich_mobile/providers/infrastructure/db.provider.dart';
 import 'package:immich_mobile/utils/bootstrap.dart';
 import 'package:immich_mobile/utils/debug_print.dart';
+import 'package:immich_mobile/utils/http_ssl_options.dart';
 import 'package:immich_mobile/wm_executor.dart';
 import 'package:logging/logging.dart';
 import 'package:worker_manager/worker_manager.dart';
@@ -53,6 +54,7 @@ Cancelable<T?> runInIsolateGentle<T>({
         Logger log = Logger("IsolateLogger");
 
         try {
+          HttpSSLOptions.apply(applyNative: false);
           result = await computation(ref);
         } on CanceledError {
           log.warning("Computation cancelled ${debugLabel == null ? '' : ' for $debugLabel'}");

mobile/lib/utils/migration.dart

@@ -23,18 +23,15 @@ import 'package:immich_mobile/infrastructure/entities/user.entity.dart';
 import 'package:immich_mobile/infrastructure/repositories/db.repository.dart';
 import 'package:immich_mobile/infrastructure/repositories/sync_stream.repository.dart';
 import 'package:immich_mobile/platform/native_sync_api.g.dart';
-import 'package:immich_mobile/platform/network_api.g.dart';
-import 'package:immich_mobile/providers/infrastructure/platform.provider.dart';
 import 'package:immich_mobile/services/app_settings.service.dart';
 import 'package:immich_mobile/utils/datetime_helpers.dart';
 import 'package:immich_mobile/utils/debug_print.dart';
 import 'package:immich_mobile/utils/diff.dart';
 import 'package:isar/isar.dart';
-
 // ignore: import_rule_photo_manager
 import 'package:photo_manager/photo_manager.dart';
 
-const int targetVersion = 21;
+const int targetVersion = 20;
 
 Future<void> migrateDatabaseIfNeeded(Isar db, Drift drift) async {
   final hasVersion = Store.tryGet(StoreKey.version) != null;
@@ -91,13 +88,7 @@ Future<void> migrateDatabaseIfNeeded(Isar db, Drift drift) async {
 
   if (version < 20 && Store.isBetaTimelineEnabled) {
     await _syncLocalAlbumIsIosSharedAlbum(drift);
-  }
-
-  if (version < 21) {
-    final certData = SSLClientCertStoreVal.load();
-    if (certData != null) {
-      await networkApi.addCertificate(ClientCertData(data: certData.data, password: certData.password ?? ""));
-    }
+    await _backfillAssetExifWidthHeight(drift);
   }
 
   if (targetVersion >= 12) {
@@ -291,6 +282,22 @@ Future<void> _syncLocalAlbumIsIosSharedAlbum(Drift db) async {
   }
 }
 
+Future<void> _backfillAssetExifWidthHeight(Drift db) async {
+  try {
+    await db.customStatement('''
+      UPDATE remote_exif_entity AS remote_exif
+      SET width = asset.width,
+          height = asset.height
+      FROM remote_asset_entity AS asset
+      WHERE remote_exif.asset_id = asset.id;
+    ''');
+
+    dPrint(() => "[MIGRATION] Successfully backfilled asset exif width and height");
+  } catch (error) {
+    dPrint(() => "[MIGRATION] Error while backfilling asset exif width and height: $error");
+  }
+}
+
 Future<void> migrateDeviceAssetToSqlite(Isar db, Drift drift) async {
   try {
     final isarDeviceAssets = await db.deviceAssetEntitys.where().findAll();

mobile/lib/widgets/activities/activity_tile.dart

@@ -4,8 +4,8 @@ import 'package:hooks_riverpod/hooks_riverpod.dart';
 import 'package:immich_mobile/extensions/build_context_extensions.dart';
 import 'package:immich_mobile/extensions/datetime_extensions.dart';
 import 'package:immich_mobile/models/activities/activity.model.dart';
-import 'package:immich_mobile/presentation/widgets/images/remote_image_provider.dart';
 import 'package:immich_mobile/providers/activity_service.provider.dart';
+import 'package:immich_mobile/providers/image/immich_remote_thumbnail_provider.dart';
 import 'package:immich_mobile/providers/asset_viewer/current_asset.provider.dart';
 import 'package:immich_mobile/widgets/common/user_circle_avatar.dart';
 
@@ -102,7 +102,7 @@ class _ActivityAssetThumbnail extends StatelessWidget {
         decoration: BoxDecoration(
           borderRadius: const BorderRadius.all(Radius.circular(4)),
           image: DecorationImage(
-            image: RemoteImageProvider.thumbnail(assetId: assetId, thumbhash: ""),
+            image: ImmichRemoteThumbnailProvider(assetId: assetId),
             fit: BoxFit.cover,
           ),
         ),

mobile/lib/widgets/activities/comment_bubble.dart

@@ -4,9 +4,9 @@ import 'package:hooks_riverpod/hooks_riverpod.dart';
 import 'package:immich_mobile/extensions/build_context_extensions.dart';
 import 'package:immich_mobile/extensions/datetime_extensions.dart';
 import 'package:immich_mobile/models/activities/activity.model.dart';
-import 'package:immich_mobile/presentation/widgets/images/remote_image_provider.dart';
 import 'package:immich_mobile/providers/activity.provider.dart';
 import 'package:immich_mobile/providers/activity_service.provider.dart';
+import 'package:immich_mobile/providers/image/immich_remote_thumbnail_provider.dart';
 import 'package:immich_mobile/providers/infrastructure/current_album.provider.dart';
 import 'package:immich_mobile/providers/user.provider.dart';
 import 'package:immich_mobile/widgets/activities/dismissible_activity.dart';
@@ -56,7 +56,7 @@ class CommentBubble extends ConsumerWidget {
               child: ClipRRect(
                 borderRadius: const BorderRadius.all(Radius.circular(10)),
                 child: Image(
-                  image: RemoteImageProvider.thumbnail(assetId: activity.assetId!, thumbhash: ""),
+                  image: ImmichRemoteThumbnailProvider(assetId: activity.assetId!),
                   fit: BoxFit.cover,
                 ),
               ),

mobile/lib/widgets/album/album_thumbnail_listtile.dart

@@ -1,12 +1,12 @@
 import 'package:auto_route/auto_route.dart';
+import 'package:cached_network_image/cached_network_image.dart';
 import 'package:easy_localization/easy_localization.dart';
 import 'package:flutter/material.dart';
 import 'package:immich_mobile/entities/album.entity.dart';
 import 'package:immich_mobile/extensions/build_context_extensions.dart';
 import 'package:immich_mobile/extensions/translate_extensions.dart';
-import 'package:immich_mobile/presentation/widgets/images/remote_image_provider.dart';
-import 'package:immich_mobile/presentation/widgets/images/thumbnail.widget.dart';
 import 'package:immich_mobile/routing/router.dart';
+import 'package:immich_mobile/services/api.service.dart';
 import 'package:immich_mobile/utils/image_url_builder.dart';
 import 'package:openapi/api.dart';
 
@@ -32,12 +32,15 @@ class AlbumThumbnailListTile extends StatelessWidget {
     }
 
     buildAlbumThumbnail() {
-      return SizedBox(
+      return CachedNetworkImage(
         width: cardSize,
         height: cardSize,
-        child: Thumbnail(
-          imageProvider: RemoteImageProvider(url: getAlbumThumbnailUrl(album, type: AssetMediaSize.thumbnail)),
-        ),
+        fit: BoxFit.cover,
+        fadeInDuration: const Duration(milliseconds: 200),
+        imageUrl: getAlbumThumbnailUrl(album, type: AssetMediaSize.thumbnail),
+        httpHeaders: ApiService.getRequestHeaders(),
+        cacheKey: getAlbumThumbNailCacheKey(album, type: AssetMediaSize.thumbnail),
+        errorWidget: (context, url, error) => const Icon(Icons.image_not_supported_outlined),
       );
     }
 

mobile/lib/widgets/common/app_bar_dialog/app_bar_server_info.dart

@@ -170,52 +170,50 @@ class AppBarServerInfo extends HookConsumerWidget {
                   ),
                 ],
               ),
-              if (serverInfoState.latestVersion != null) ...[
-                const Padding(padding: EdgeInsets.symmetric(horizontal: 10), child: Divider(thickness: 1)),
-                Row(
-                  mainAxisAlignment: MainAxisAlignment.spaceBetween,
-                  children: [
-                    Expanded(
-                      child: Padding(
-                        padding: const EdgeInsets.only(left: 10.0),
-                        child: Row(
-                          children: [
-                            if (serverInfoState.versionStatus == VersionStatus.serverOutOfDate)
-                              const Padding(
-                                padding: EdgeInsets.only(right: 5.0),
-                                child: Icon(Icons.info, color: Color.fromARGB(255, 243, 188, 106), size: 12),
-                              ),
-                            Text(
-                              "latest_version".tr(),
-                              style: TextStyle(
-                                fontSize: titleFontSize,
-                                color: context.textTheme.labelSmall?.color,
-                                fontWeight: FontWeight.w500,
-                              ),
+              const Padding(padding: EdgeInsets.symmetric(horizontal: 10), child: Divider(thickness: 1)),
+              Row(
+                mainAxisAlignment: MainAxisAlignment.spaceBetween,
+                children: [
+                  Expanded(
+                    child: Padding(
+                      padding: const EdgeInsets.only(left: 10.0),
+                      child: Row(
+                        children: [
+                          if (serverInfoState.versionStatus == VersionStatus.serverOutOfDate)
+                            const Padding(
+                              padding: EdgeInsets.only(right: 5.0),
+                              child: Icon(Icons.info, color: Color.fromARGB(255, 243, 188, 106), size: 12),
+                            ),
+                          Text(
+                            "latest_version".tr(),
+                            style: TextStyle(
+                              fontSize: titleFontSize,
+                              color: context.textTheme.labelSmall?.color,
+                              fontWeight: FontWeight.w500,
                             ),
-                          ],
-                        ),
-                      ),
-                    ),
-                    Expanded(
-                      flex: 0,
-                      child: Padding(
-                        padding: const EdgeInsets.only(right: 10.0),
-                        child: Text(
-                          serverInfoState.latestVersion!.major > 0
-                              ? "${serverInfoState.latestVersion!.major}.${serverInfoState.latestVersion!.minor}.${serverInfoState.latestVersion!.patch}"
-                              : "--",
-                          style: TextStyle(
-                            fontSize: contentFontSize,
-                            color: context.colorScheme.onSurfaceSecondary,
-                            fontWeight: FontWeight.bold,
                           ),
+                        ],
+                      ),
+                    ),
+                  ),
+                  Expanded(
+                    flex: 0,
+                    child: Padding(
+                      padding: const EdgeInsets.only(right: 10.0),
+                      child: Text(
+                        serverInfoState.latestVersion.major > 0
+                            ? "${serverInfoState.latestVersion.major}.${serverInfoState.latestVersion.minor}.${serverInfoState.latestVersion.patch}"
+                            : "--",
+                        style: TextStyle(
+                          fontSize: contentFontSize,
+                          color: context.colorScheme.onSurfaceSecondary,
+                          fontWeight: FontWeight.bold,
                         ),
                       ),
                     ),
-                  ],
-                ),
-              ],
+                  ),
+                ],
+              ),
             ],
           ),
         ),

mobile/lib/widgets/common/immich_image.dart

@@ -1,11 +1,10 @@
 import 'package:flutter/material.dart';
-import 'package:immich_mobile/domain/models/asset/base_asset.model.dart' as base_asset;
 import 'package:immich_mobile/domain/models/store.model.dart';
 import 'package:immich_mobile/entities/asset.entity.dart';
 import 'package:immich_mobile/entities/store.entity.dart';
 import 'package:immich_mobile/extensions/build_context_extensions.dart';
-import 'package:immich_mobile/presentation/widgets/images/local_image_provider.dart';
-import 'package:immich_mobile/presentation/widgets/images/remote_image_provider.dart';
+import 'package:immich_mobile/providers/image/immich_local_image_provider.dart';
+import 'package:immich_mobile/providers/image/immich_remote_image_provider.dart';
 import 'package:immich_mobile/widgets/asset_grid/thumbnail_placeholder.dart';
 import 'package:octo_image/octo_image.dart';
 
@@ -35,21 +34,13 @@ class ImmichImage extends StatelessWidget {
     }
 
     if (asset == null) {
-      return RemoteFullImageProvider(assetId: assetId!, thumbhash: '', assetType: base_asset.AssetType.video);
+      return ImmichRemoteImageProvider(assetId: assetId!);
     }
 
     if (useLocal(asset)) {
-      return LocalFullImageProvider(
-        id: asset.localId!,
-        assetType: base_asset.AssetType.video,
-        size: Size(width, height),
-      );
+      return ImmichLocalImageProvider(asset: asset, width: width, height: height);
     } else {
-      return RemoteFullImageProvider(
-        assetId: asset.remoteId!,
-        thumbhash: asset.thumbhash ?? '',
-        assetType: base_asset.AssetType.video,
-      );
+      return ImmichRemoteImageProvider(assetId: asset.remoteId!);
     }
   }
 

mobile/lib/widgets/common/immich_thumbnail.dart

@@ -2,15 +2,15 @@ import 'dart:typed_data';
 
 import 'package:flutter/material.dart';
 import 'package:hooks_riverpod/hooks_riverpod.dart';
-import 'package:immich_mobile/presentation/widgets/images/local_image_provider.dart';
-import 'package:immich_mobile/presentation/widgets/images/remote_image_provider.dart';
+import 'package:immich_mobile/providers/image/immich_local_thumbnail_provider.dart';
+import 'package:immich_mobile/providers/image/immich_remote_thumbnail_provider.dart';
 import 'package:immich_mobile/entities/asset.entity.dart';
 import 'package:immich_mobile/utils/hooks/blurhash_hook.dart';
 import 'package:immich_mobile/utils/thumbnail_utils.dart';
 import 'package:immich_mobile/widgets/common/immich_image.dart';
 import 'package:immich_mobile/widgets/common/thumbhash_placeholder.dart';
 import 'package:octo_image/octo_image.dart';
-import 'package:immich_mobile/domain/models/asset/base_asset.model.dart' as base_asset;
+import 'package:immich_mobile/providers/user.provider.dart';
 
 class ImmichThumbnail extends HookConsumerWidget {
   const ImmichThumbnail({this.asset, this.width = 250, this.height = 250, this.fit = BoxFit.cover, super.key});
@@ -24,29 +24,26 @@ class ImmichThumbnail extends HookConsumerWidget {
   /// either by using the asset ID or the asset itself
   /// [asset] is the Asset to request, or else use [assetId] to get a remote
   /// image provider
-  static ImageProvider imageProvider({Asset? asset, String? assetId, int thumbnailSize = 256}) {
+  static ImageProvider imageProvider({Asset? asset, String? assetId, String? userId, int thumbnailSize = 256}) {
     if (asset == null && assetId == null) {
       throw Exception('Must supply either asset or assetId');
     }
 
     if (asset == null) {
-      return RemoteImageProvider.thumbnail(assetId: assetId!, thumbhash: "");
+      return ImmichRemoteThumbnailProvider(assetId: assetId!);
     }
 
     if (ImmichImage.useLocal(asset)) {
-      return LocalThumbProvider(
-        id: asset.localId!,
-        assetType: base_asset.AssetType.video,
-        size: Size(thumbnailSize.toDouble(), thumbnailSize.toDouble()),
-      );
+      return ImmichLocalThumbnailProvider(asset: asset, height: thumbnailSize, width: thumbnailSize, userId: userId);
     } else {
-      return RemoteImageProvider.thumbnail(assetId: asset.remoteId!, thumbhash: asset.thumbhash ?? "");
+      return ImmichRemoteThumbnailProvider(assetId: asset.remoteId!, height: thumbnailSize, width: thumbnailSize);
     }
   }
 
   @override
   Widget build(BuildContext context, WidgetRef ref) {
     Uint8List? blurhash = useBlurHashRef(asset).value;
+    final userId = ref.watch(currentUserProvider)?.id;
 
     if (asset == null) {
       return Container(
@@ -59,7 +56,7 @@ class ImmichThumbnail extends HookConsumerWidget {
 
     final assetAltText = getAltText(asset!.exifInfo, asset!.fileCreatedAt, asset!.type, []);
 
-    final thumbnailProviderInstance = ImmichThumbnail.imageProvider(asset: asset);
+    final thumbnailProviderInstance = ImmichThumbnail.imageProvider(asset: asset, userId: userId);
 
     customErrorBuilder(BuildContext ctx, Object error, StackTrace? stackTrace) {
       thumbnailProviderInstance.evict();

mobile/lib/widgets/common/person_sliver_app_bar.dart

@@ -14,8 +14,8 @@ import 'package:immich_mobile/extensions/build_context_extensions.dart';
 import 'package:immich_mobile/extensions/translate_extensions.dart';
 import 'package:immich_mobile/presentation/widgets/images/image_provider.dart';
 import 'package:immich_mobile/providers/infrastructure/timeline.provider.dart';
-import 'package:immich_mobile/presentation/widgets/images/remote_image_provider.dart';
 import 'package:immich_mobile/providers/timeline/multiselect.provider.dart';
+import 'package:immich_mobile/services/api.service.dart';
 import 'package:immich_mobile/utils/people.utils.dart';
 import 'package:immich_mobile/utils/image_url_builder.dart';
 
@@ -230,7 +230,10 @@ class _ExpandedBackgroundState extends ConsumerState<_ExpandedBackground> with S
                     elevation: 3,
                     child: CircleAvatar(
                       maxRadius: 84 / 2,
-                      backgroundImage: RemoteImageProvider(url: getFaceThumbnailUrl(widget.person.id)),
+                      backgroundImage: NetworkImage(
+                        getFaceThumbnailUrl(widget.person.id),
+                        headers: ApiService.getRequestHeaders(),
+                      ),
                     ),
                   ),
                 ),

mobile/lib/widgets/common/user_avatar.dart

@@ -1,9 +1,10 @@
+import 'package:cached_network_image/cached_network_image.dart';
 import 'package:flutter/material.dart';
 import 'package:immich_mobile/domain/models/store.model.dart';
 import 'package:immich_mobile/domain/models/user.model.dart';
 import 'package:immich_mobile/entities/store.entity.dart';
 import 'package:immich_mobile/extensions/build_context_extensions.dart';
-import 'package:immich_mobile/presentation/widgets/images/remote_image_provider.dart';
+import 'package:immich_mobile/services/api.service.dart';
 
 Widget userAvatar(BuildContext context, UserDto u, {double? radius}) {
   final url = "${Store.get(StoreKey.serverEndpoint)}/users/${u.id}/profile-image";
@@ -11,7 +12,11 @@ Widget userAvatar(BuildContext context, UserDto u, {double? radius}) {
   return CircleAvatar(
     radius: radius,
     backgroundColor: context.primaryColor.withAlpha(50),
-    foregroundImage: RemoteImageProvider(url: url),
+    foregroundImage: CachedNetworkImageProvider(
+      url,
+      headers: ApiService.getRequestHeaders(),
+      cacheKey: "user-${u.id}-profile",
+    ),
     // silence errors if user has no profile image, use initials as fallback
     onForegroundImageError: (exception, stackTrace) {},
     child: Text(nameFirstLetter.toUpperCase()),

mobile/lib/widgets/common/user_circle_avatar.dart

@@ -1,11 +1,13 @@
 import 'dart:math';
 
+import 'package:cached_network_image/cached_network_image.dart';
 import 'package:flutter/material.dart';
 import 'package:hooks_riverpod/hooks_riverpod.dart';
 import 'package:immich_mobile/domain/models/store.model.dart';
 import 'package:immich_mobile/domain/models/user.model.dart';
 import 'package:immich_mobile/entities/store.entity.dart';
-import 'package:immich_mobile/presentation/widgets/images/remote_image_provider.dart';
+import 'package:immich_mobile/services/api.service.dart';
+import 'package:immich_mobile/widgets/common/transparent_image.dart';
 
 // ignore: must_be_immutable
 class UserCircleAvatar extends ConsumerWidget {
@@ -44,12 +46,16 @@ class UserCircleAvatar extends ConsumerWidget {
           child: user.hasProfileImage
               ? ClipRRect(
                   borderRadius: const BorderRadius.all(Radius.circular(50)),
-                  child: Image(
+                  child: CachedNetworkImage(
                     fit: BoxFit.cover,
+                    cacheKey: '${user.id}-${user.profileChangedAt.toIso8601String()}',
                     width: size,
                     height: size,
-                    image: RemoteImageProvider(url: profileImageUrl),
-                    errorBuilder: (context, error, stackTrace) => textIcon,
+                    placeholder: (_, __) => Image.memory(kTransparentImage),
+                    imageUrl: profileImageUrl,
+                    httpHeaders: ApiService.getRequestHeaders(),
+                    fadeInDuration: const Duration(milliseconds: 300),
+                    errorWidget: (context, error, stackTrace) => textIcon,
                   ),
                 )
               : textIcon,

mobile/lib/widgets/forms/login/login_form.dart

@@ -414,7 +414,6 @@ class LoginForm extends HookConsumerWidget {
                     keyboardAction: TextInputAction.next,
                     keyboardType: TextInputType.url,
                     autofillHints: const [AutofillHints.url],
-                    autoCorrect: false,
                     onSubmit: (ctx, _) => ImmichForm.of(ctx).submit(),
                   ),
                 ),