pastilhasandClaude Fable 5
a83da42a1f
Photos had no user provisioning at all: one registry row, the owner's, and every other account resolving to nothing. Same shape as the Jellyfin gap, but this one was never built rather than built and dropped. photos_accounts records who on Officer is who on Immich, and carries that person's own API key. getConfig falls back to it when the caller has no registry of their own, and there is no path from there to the owner's key — an Immich key with permissions:['all'] can read and delete the whole library, so a member resolving to it would be administering everyone's photographs rather than reading their own. Matching is on email, which Immich enforces uniqueness on and Officer already holds. That is exact where the Jellyfin side has to go through an uppercased username index and cope with two Officer names colliding into one. Two deliberate differences from the Jellyfin flow: The admin's own account is reported as itself, not as "no Officer account". That bug shipped there and was fixed in 591c0da; there was no reason to write it twice, so reconcile takes the key's identity from /api/users/me and the test pins it. And the temporary password is HANDED OVER rather than discarded. Jellyfin discards because it has no must-change-password flag, so anything handed over stays valid forever. Immich has one, and Immich's own app is where phone backup runs — discarding would leave a photo account that can never back a phone up again. So: set a password, spend it on a key, raise shouldChangePassword, return it once. POST /_config/:id/handover re-issues on demand, because "setting up my phone" happens long after provisioning and more than once. Verified against the running 3.1.0 image that an API key survives a password change, so re-issuing never costs Officer its access. Applied on alpha: conceiba and fedra linked, guipinto and diogo created, all four keyed and each resolving to their own Immich identity. jrg.conceicao left alone. Members still need the photos grant on the Member role before the permission gate lets them through. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
48 lines
1.9 KiB
TypeScript
48 lines
1.9 KiB
TypeScript
import type { PluginManifest } from '@@/plugins/manifest';
|
|
|
|
/**
|
|
* Photos — your Immich library, reached through Officer.
|
|
*
|
|
* ── What this plugin is, and what it is not ──
|
|
*
|
|
* It does NOT store photographs, and it does not install Immich. You point it at an instance you already
|
|
* run and it forwards to it, holding the API key server-side so no device ever carries one. The library,
|
|
* the originals and every thumbnail stay where they are.
|
|
*
|
|
* The account registry is per-user and already server-side (`photos_config`): a label, a URL and an
|
|
* encrypted API key, with one marked active. Adding and switching instances happens in the app rather
|
|
* than in a shell, which is why nothing here reads `process.env` — an `IMMICH_API_KEY` in `.env` would
|
|
* also sit in the environment of every other pm2 process, including the one with the largest attack
|
|
* surface and no code to use it.
|
|
*
|
|
* ── No `osDependencies` ──
|
|
*
|
|
* Nothing shells out. The sidecar is a Bun HTTP proxy and reaches Immich with `fetch`.
|
|
*/
|
|
export const manifest: PluginManifest = {
|
|
publisher: 'officerdev',
|
|
version: '1.0.0',
|
|
platform: '>=1.0.0',
|
|
|
|
label: 'Photos',
|
|
summary: 'Your Immich library — browse, search, upload from the phone',
|
|
icon: 'Images',
|
|
color: '#10b981',
|
|
|
|
// Immich accounts are created one per Officer account. Declared here so the owner sees it on the install
|
|
// screen beside the permissions — "this plugin will be told who your users are" belongs where a person
|
|
// decides, not in a log afterwards.
|
|
//
|
|
// What it turns on: the sidecar receives `users:list` when it registers and whenever an account is
|
|
// created or removed. See src/servers/plugins/user-provisioning.ts and plugins/USER_PROVISIONING.md.
|
|
userProvisioning: true,
|
|
|
|
permissions: [
|
|
{
|
|
key: 'photos',
|
|
label: 'Photos',
|
|
description: 'Browse the photo library',
|
|
},
|
|
],
|
|
};
|