mirror of
https://github.com/immich-app/immich.git
synced 2026-07-28 14:47:30 -07:00
a560e08693
* fix(server): re-evaluate OIDC role claim on every login and support array values Previously the OIDC role claim (immich_role) was only read at user auto-registration time and only accepted as a scalar string, so admin status never updated after the first login and array-valued role/group claims (common with Keycloak, Entra ID, etc.) were silently ignored. Now the role claim is normalized from either a string or an array of strings, and existing users have their isAdmin flag synced from the claim on every login, keeping the IdP as the source of truth for privileges while leaving isAdmin untouched when the claim is blank. * fix(server): use .includes() instead of .some() for role claim check Satisfies unicorn/prefer-includes lint rule flagged by CI. * fix(server): resolve missing role claim to standard user and fix test mock Default the OIDC role claim to 'user' when the IdP omits it so auto-registration doesn't crash, and add the missing getAdmin mock in the auth.service test so it correctly simulates an existing admin rather than the first-user-registration path. * fix: claim sync logic --------- Co-authored-by: Jason Rasmussen <jrasm91@gmail.com>