plugins/photos
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

give each member their own immich account and key

Browse Source 
Photos had no user provisioning at all: one registry row, the owner's, and
every other account resolving to nothing. Same shape as the Jellyfin gap, but
this one was never built rather than built and dropped.

photos_accounts records who on Officer is who on Immich, and carries that
person's own API key. getConfig falls back to it when the caller has no
registry of their own, and there is no path from there to the owner's key —
an Immich key with permissions:['all'] can read and delete the whole library,
so a member resolving to it would be administering everyone's photographs
rather than reading their own.

Matching is on email, which Immich enforces uniqueness on and Officer already
holds. That is exact where the Jellyfin side has to go through an uppercased
username index and cope with two Officer names colliding into one.

Two deliberate differences from the Jellyfin flow:

The admin's own account is reported as itself, not as "no Officer account".
That bug shipped there and was fixed in 591c0da; there was no reason to write
it twice, so reconcile takes the key's identity from /api/users/me and the
test pins it.

And the temporary password is HANDED OVER rather than discarded. Jellyfin
discards because it has no must-change-password flag, so anything handed over
stays valid forever. Immich has one, and Immich's own app is where phone
backup runs — discarding would leave a photo account that can never back a
phone up again. So: set a password, spend it on a key, raise
shouldChangePassword, return it once. POST /_config/:id/handover re-issues on
demand, because "setting up my phone" happens long after provisioning and more
than once. Verified against the running 3.1.0 image that an API key survives a
password change, so re-issuing never costs Officer its access.

Applied on alpha: conceiba and fedra linked, guipinto and diogo created, all
four keyed and each resolving to their own Immich identity. jrg.conceicao left
alone. Members still need the photos grant on the Member role before the
permission gate lets them through.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This commit is contained in:
pastilhas
2026-08-21 15:46:13 +00:00
co-authored by Claude Fable 5
parent 0b9e4f32db
commit a83da42a1f
11 changed files with 977 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
db/queries.ts
+117 -2
View File
@@ -1,6 +1,6 @@
import { eq, and, desc } from 'drizzle-orm';
import { eq, and, desc, isNotNull } from 'drizzle-orm';
import { db } from 'officerdb/db';
import { photosConfig } from './schema';
import { photosAccounts, photosConfig } from './schema';
import { encryptSecret, decryptSecret } from 'officerdb/crypto';
// Immich account registry for the officer-photos sidecar. Callers deal in PLAINTEXT — encryption to and from
@@ -53,6 +53,44 @@ export async function getActivePhotosCredentials(userId: number): Promise<Photos
return { id: row.id, label: row.label, url: row.url, apiKey: decryptSecret('photos', row.apiKey) };
}
/**
* The credentials a NON-OWNER reads the library with: the owner's selected instance, and that person's own
* API key from their link row.
*
* `id` and `label` are the REGISTRY row's, so a probe is recorded against the instance it actually reached
* and everything downstream treats this as "the connection in use" without caring whose key is inside it.
* The only field that differs from the owner's is the one that must — the key.
*
* Null rather than a fallback in two cases, and both are deliberate:
*
* - **The instance must be the ACTIVE one.** Accounts are provisioned against one Immich, so a member
* linked to an instance the owner has since switched away from is genuinely not provisioned on the one
* in use.
* - **The key must exist.** Minting needs a password, which is not always ours to set.
*
* There is deliberately no path from here to the OWNER's key. An Immich key created with `permissions:
* ['all']` can read and delete the entire library, so a member resolving to it would not be reading their
* own photographs — they would be administering everyone's.
*/
export async function getLinkedPhotosCredentials(userId: number): Promise<PhotosCredentials | null> {
const [row] = await db
.select({
id: photosConfig.id,
label: photosConfig.label,
url: photosConfig.url,
apiKey: photosAccounts.apiKey,
})
.from(photosAccounts)
.innerJoin(photosConfig, eq(photosAccounts.configId, photosConfig.id))
.where(
and(eq(photosAccounts.userId, userId), eq(photosConfig.isActive, true), isNotNull(photosAccounts.apiKey)),
);
// The isNotNull above already excludes it; this narrows the type and keeps the guarantee local.
if (!row?.apiKey) return null;
return { id: row.id, label: row.label, url: row.url, apiKey: decryptSecret('photos', row.apiKey) };
}
/** One account's credentials by id — for probing a specific account rather than the active one. */
export async function getPhotosCredentials(userId: number, id: number): Promise<PhotosCredentials | null> {
const [row] = await db
@@ -175,3 +213,80 @@ export async function recordPhotosProbe(userId: number, id: number, version: str
.set({ version, lastSeenAt: new Date() })
.where(and(eq(photosConfig.userId, userId), eq(photosConfig.id, id)));
}
// ── The Officer ↔ Immich account mapping ──
/**
* Links already recorded for one instance, for the reconcile to compare against.
*
* `hasKey` rather than the key itself: callers need to know whether this person can reach their library,
* and none of them needs the credential to answer that. The ciphertext does not leave this file.
*/
export async function listPhotosAccountLinks(configId: number): Promise<
{ userId: number; immichUserId: string; immichEmail: string; adopted: boolean; hasKey: boolean }[]
> {
const rows = await db
.select({
userId: photosAccounts.userId,
immichUserId: photosAccounts.immichUserId,
immichEmail: photosAccounts.immichEmail,
adopted: photosAccounts.adopted,
apiKey: photosAccounts.apiKey,
})
.from(photosAccounts)
.where(eq(photosAccounts.configId, configId));
return rows.map(({ apiKey, ...rest }) => ({ ...rest, hasKey: !!apiKey }));
}
/**
* Record a pairing.
*
* `onConflictDoNothing` on BOTH unique indexes, so a re-run is silent rather than an error — a second
* reconcile finding the same thing already true is the normal case, not a fault.
*/
export async function linkPhotosAccount(params: {
userId: number;
configId: number;
immichUserId: string;
immichEmail: string;
adopted: boolean;
}): Promise<void> {
await db
.insert(photosAccounts)
.values({
userId: params.userId,
configId: params.configId,
immichUserId: params.immichUserId,
immichEmail: params.immichEmail,
// Mirrors what Immich stores, so matching is a lookup rather than a convention every call site has
// to remember.
normalizedEmail: params.immichEmail.trim().toLowerCase(),
adopted: params.adopted,
})
.onConflictDoNothing();
}
/**
* Store the key minted for one person, encrypted.
*
* Separate from `linkPhotosAccount` rather than a parameter on it, for the reason the Jellyfin side learned
* the hard way: linking is `onConflictDoNothing`, but a key is exactly the thing you re-run provisioning to
* REPLACE. An insert that does nothing on conflict cannot express that.
*/
export async function setPhotosAccountKey(params: {
userId: number;
configId: number;
apiKey: string;
}): Promise<void> {
await db
.update(photosAccounts)
.set({ apiKey: encryptSecret('photos', params.apiKey) })
.where(and(eq(photosAccounts.userId, params.userId), eq(photosAccounts.configId, params.configId)));
}
/** Drop a pairing. Removes Officer's RECORD of the account, never the account itself. */
export async function unlinkPhotosAccount(userId: number, configId: number): Promise<void> {
await db
.delete(photosAccounts)
.where(and(eq(photosAccounts.userId, userId), eq(photosAccounts.configId, configId)));
}
db/schema.ts
+63
View File
@@ -47,3 +47,66 @@ export const photosConfig = pgTable(
.where(sql`${t.isActive}`),
],
);
// ── Which Officer account owns which Immich account ──
//
// The same shape as `jellyfin_accounts`, and for the same reason: Officer's users and Immich's are two
// populations that overlap, and this records where they meet. Without it a member has a permission grant,
// a dock tile, and no credential — which reads as a permissions fault and is not one.
//
// ── Matching is on EMAIL, not a username ──
//
// This is the one real difference from the Jellyfin side, and it is a simplification. Immich identifies an
// account by email and enforces uniqueness on it, while Jellyfin has usernames and a case-folded
// `NormalizedUsername` index to match against. Officer's `users.email` is therefore the same key on both
// sides, so pairing is an exact lookup rather than a convention. `normalizedEmail` is lowercased, because
// Immich lowercases what it stores (`ZodEmail` with a transform) and a mixed-case address would otherwise
// fail to match the account it just created.
//
// ── `adopted` earns its column here too ──
//
// False means Officer created the account and may remove it. True means it pre-existed and was merely
// linked — on this server `conceiba@gmail.com` and `fedrasantamaria@gmail.com` both had Immich accounts,
// with photographs in them, before Officer knew who they were.
export const photosAccounts = pgTable(
'photos_accounts',
{
id: serial('id').primaryKey(),
userId: integer('user_id')
.notNull()
.references(() => users.id, { onDelete: 'cascade' }),
/** Which registry row this account lives on. Immich users are per-instance. */
configId: integer('config_id')
.notNull()
.references(() => photosConfig.id, { onDelete: 'cascade' }),
/** Immich's own user id — a UUID. The only handle its admin API accepts. */
immichUserId: text('immich_user_id').notNull(),
/** As Immich holds it, for display. */
immichEmail: text('immich_email').notNull(),
/** Lowercased, mirroring what Immich stores. What matching compares. */
normalizedEmail: text('normalized_email').notNull(),
/** False = Officer created it and may remove it. True = it pre-existed and was linked. */
adopted: boolean('adopted').notNull().default(false),
/**
* That person's OWN Immich API key, encrypted — the credential their Officer session reads the library
* with.
*
* Nullable, and null is a real state rather than an error: minting requires a session, a session
* requires a password, and a password is not always ours to set. Null resolves to the 503 the UI
* already knows how to explain, never to the owner's key.
*
* An Immich key survives a later password change — `UserAdminService.update` hashes and writes the
* password and touches nothing else, verified against the running 3.1.0 image. That is what makes it
* safe to hand somebody a temporary password for their own mobile app without this going stale.
*/
apiKey: text('api_key'), // encrypted
linkedAt: timestamp('linked_at', { withTimezone: true }).notNull().defaultNow(),
},
(t) => [
// One Immich account per Officer user per instance. uniqueIndex, not unique().on() — drizzle-kit
// re-creates named composite CONSTRAINTS on every push. See src/databases/CLAUDE.md.
uniqueIndex('uq_photos_accounts_user_config').on(t.userId, t.configId),
// And one Officer user per Immich account: two people cannot share a library.
uniqueIndex('uq_photos_accounts_config_immich_user').on(t.configId, t.immichUserId),
],
);