pastilhasandClaude Opus 5
ea59b5f1a7
Locked assets are gated on elevation, and elevation lives on a session — an API key has no `auth.session`, so no key permission or allow-list entry can reach them. The gate sits inside the generic owner-access check, so a locked asset's thumbnail and original are covered too, not just its listings. So `/_locked` mints a session at unlock, holds it in memory for the elevation window, and closes it on lock, on idle, or when the active immich account changes. Nothing new is written to photos_config: the pin and the password are never at rest, and a full compromise of officer's database still does not open the folder. The cost is that unlocking asks for the immich password as well as the pin. `auth/*` stays refused wholesale in routes.ts. The four auth routes this needs are reached through named endpoints that each do one thing, and the elevated forward carries three resources rather than the main allow-list. Not yet exercised at runtime — the sidecar has not run this code. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>