Merge branch 'dev' into dev

server/src/routes/immich.ts

@@ -1,5 +1,5 @@
 import express, { Request, Response, NextFunction } from 'express';
-import { db } from '../db/database';
+import { db, canAccessTrip } from '../db/database';
 import { authenticate } from '../middleware/auth';
 import { broadcast } from '../websocket';
 import { AuthRequest } from '../types';
@@ -88,6 +88,24 @@ router.get('/status', authenticate, async (req: Request, res: Response) => {
   }
 });
 
+// Test connection with provided credentials (without saving)
+router.post('/test', authenticate, async (req: Request, res: Response) => {
+  const { immich_url, immich_api_key } = req.body;
+  if (!immich_url || !immich_api_key) return res.json({ connected: false, error: 'URL and API key required' });
+  if (!isValidImmichUrl(immich_url)) return res.json({ connected: false, error: 'Invalid Immich URL' });
+  try {
+    const resp = await fetch(`${immich_url}/api/users/me`, {
+      headers: { 'x-api-key': immich_api_key, 'Accept': 'application/json' },
+      signal: AbortSignal.timeout(10000),
+    });
+    if (!resp.ok) return res.json({ connected: false, error: `HTTP ${resp.status}` });
+    const data = await resp.json() as { name?: string; email?: string };
+    res.json({ connected: true, user: { name: data.name, email: data.email } });
+  } catch (err: unknown) {
+    res.json({ connected: false, error: err instanceof Error ? err.message : 'Connection failed' });
+  }
+});
+
 // ── Browse Immich Library (for photo picker) ────────────────────────────────
 
 router.get('/browse', authenticate, async (req: Request, res: Response) => {
@@ -161,6 +179,7 @@ router.post('/search', authenticate, async (req: Request, res: Response) => {
 router.get('/trips/:tripId/photos', authenticate, (req: Request, res: Response) => {
   const authReq = req as AuthRequest;
   const { tripId } = req.params;
+  if (!canAccessTrip(tripId, authReq.user.id)) return res.status(404).json({ error: 'Trip not found' });
 
   const photos = db.prepare(`
     SELECT tp.immich_asset_id, tp.user_id, tp.shared, tp.added_at,
@@ -179,6 +198,7 @@ router.get('/trips/:tripId/photos', authenticate, (req: Request, res: Response)
 router.post('/trips/:tripId/photos', authenticate, (req: Request, res: Response) => {
   const authReq = req as AuthRequest;
   const { tripId } = req.params;
+  if (!canAccessTrip(tripId, authReq.user.id)) return res.status(404).json({ error: 'Trip not found' });
   const { asset_ids, shared = true } = req.body;
 
   if (!Array.isArray(asset_ids) || asset_ids.length === 0) {
@@ -209,6 +229,7 @@ router.post('/trips/:tripId/photos', authenticate, (req: Request, res: Response)
 // Remove a photo from a trip (own photos only)
 router.delete('/trips/:tripId/photos/:assetId', authenticate, (req: Request, res: Response) => {
   const authReq = req as AuthRequest;
+  if (!canAccessTrip(req.params.tripId, authReq.user.id)) return res.status(404).json({ error: 'Trip not found' });
   db.prepare('DELETE FROM trip_photos WHERE trip_id = ? AND user_id = ? AND immich_asset_id = ?')
     .run(req.params.tripId, authReq.user.id, req.params.assetId);
   res.json({ success: true });
@@ -218,6 +239,7 @@ router.delete('/trips/:tripId/photos/:assetId', authenticate, (req: Request, res
 // Toggle sharing for a specific photo
 router.put('/trips/:tripId/photos/:assetId/sharing', authenticate, (req: Request, res: Response) => {
   const authReq = req as AuthRequest;
+  if (!canAccessTrip(req.params.tripId, authReq.user.id)) return res.status(404).json({ error: 'Trip not found' });
   const { shared } = req.body;
   db.prepare('UPDATE trip_photos SET shared = ? WHERE trip_id = ? AND user_id = ? AND immich_asset_id = ?')
     .run(shared ? 1 : 0, req.params.tripId, authReq.user.id, req.params.assetId);
@@ -331,4 +353,113 @@ router.get('/assets/:assetId/original', authFromQuery, async (req: Request, res:
   }
 });
 
+// ── Album Linking ──────────────────────────────────────────────────────────
+
+// List user's Immich albums
+router.get('/albums', authenticate, async (req: Request, res: Response) => {
+  const authReq = req as AuthRequest;
+  const user = db.prepare('SELECT immich_url, immich_api_key FROM users WHERE id = ?').get(authReq.user.id) as any;
+  if (!user?.immich_url || !user?.immich_api_key) return res.status(400).json({ error: 'Immich not configured' });
+
+  try {
+    const resp = await fetch(`${user.immich_url}/api/albums`, {
+      headers: { 'x-api-key': user.immich_api_key, 'Accept': 'application/json' },
+      signal: AbortSignal.timeout(10000),
+    });
+    if (!resp.ok) return res.status(resp.status).json({ error: 'Failed to fetch albums' });
+    const albums = (await resp.json() as any[]).map((a: any) => ({
+      id: a.id,
+      albumName: a.albumName,
+      assetCount: a.assetCount || 0,
+      startDate: a.startDate,
+      endDate: a.endDate,
+      albumThumbnailAssetId: a.albumThumbnailAssetId,
+    }));
+    res.json({ albums });
+  } catch {
+    res.status(502).json({ error: 'Could not reach Immich' });
+  }
+});
+
+// Get album links for a trip
+router.get('/trips/:tripId/album-links', authenticate, (req: Request, res: Response) => {
+  const authReq = req as AuthRequest;
+  if (!canAccessTrip(req.params.tripId, (authReq as AuthRequest).user.id)) return res.status(404).json({ error: 'Trip not found' });
+  const links = db.prepare(`
+    SELECT tal.*, u.username
+    FROM trip_album_links tal
+    JOIN users u ON tal.user_id = u.id
+    WHERE tal.trip_id = ?
+    ORDER BY tal.created_at ASC
+  `).all(req.params.tripId);
+  res.json({ links });
+});
+
+// Link an album to a trip
+router.post('/trips/:tripId/album-links', authenticate, async (req: Request, res: Response) => {
+  const authReq = req as AuthRequest;
+  const { tripId } = req.params;
+  if (!canAccessTrip(tripId, authReq.user.id)) return res.status(404).json({ error: 'Trip not found' });
+  const { album_id, album_name } = req.body;
+  if (!album_id) return res.status(400).json({ error: 'album_id required' });
+
+  try {
+    db.prepare(
+      'INSERT OR IGNORE INTO trip_album_links (trip_id, user_id, immich_album_id, album_name) VALUES (?, ?, ?, ?)'
+    ).run(tripId, authReq.user.id, album_id, album_name || '');
+    res.json({ success: true });
+  } catch (err: any) {
+    res.status(400).json({ error: 'Album already linked' });
+  }
+});
+
+// Remove album link
+router.delete('/trips/:tripId/album-links/:linkId', authenticate, (req: Request, res: Response) => {
+  const authReq = req as AuthRequest;
+  db.prepare('DELETE FROM trip_album_links WHERE id = ? AND trip_id = ? AND user_id = ?')
+    .run(req.params.linkId, req.params.tripId, authReq.user.id);
+  res.json({ success: true });
+});
+
+// Sync album — fetch all assets from Immich album and add missing ones to trip
+router.post('/trips/:tripId/album-links/:linkId/sync', authenticate, async (req: Request, res: Response) => {
+  const authReq = req as AuthRequest;
+  const { tripId, linkId } = req.params;
+
+  const link = db.prepare('SELECT * FROM trip_album_links WHERE id = ? AND trip_id = ? AND user_id = ?')
+    .get(linkId, tripId, authReq.user.id) as any;
+  if (!link) return res.status(404).json({ error: 'Album link not found' });
+
+  const user = db.prepare('SELECT immich_url, immich_api_key FROM users WHERE id = ?').get(authReq.user.id) as any;
+  if (!user?.immich_url || !user?.immich_api_key) return res.status(400).json({ error: 'Immich not configured' });
+
+  try {
+    const resp = await fetch(`${user.immich_url}/api/albums/${link.immich_album_id}`, {
+      headers: { 'x-api-key': user.immich_api_key, 'Accept': 'application/json' },
+      signal: AbortSignal.timeout(15000),
+    });
+    if (!resp.ok) return res.status(resp.status).json({ error: 'Failed to fetch album' });
+    const albumData = await resp.json() as { assets?: any[] };
+    const assets = (albumData.assets || []).filter((a: any) => a.type === 'IMAGE');
+
+    const insert = db.prepare(
+      'INSERT OR IGNORE INTO trip_photos (trip_id, user_id, immich_asset_id, shared) VALUES (?, ?, ?, 1)'
+    );
+    let added = 0;
+    for (const asset of assets) {
+      const r = insert.run(tripId, authReq.user.id, asset.id);
+      if (r.changes > 0) added++;
+    }
+
+    db.prepare('UPDATE trip_album_links SET last_synced_at = CURRENT_TIMESTAMP WHERE id = ?').run(linkId);
+
+    res.json({ success: true, added, total: assets.length });
+    if (added > 0) {
+      broadcast(tripId, 'memories:updated', { userId: authReq.user.id }, req.headers['x-socket-id'] as string);
+    }
+  } catch {
+    res.status(502).json({ error: 'Could not reach Immich' });
+  }
+});
+
 export default router;