mirror of
https://github.com/mauriceboe/TREK.git
synced 2026-10-19 13:36:48 +00:00
Maurice
724c88c201
A mechanical prettier --write over server/src, server/tests, server/scripts and shared/src with the workspaces' .prettierrc; nothing but layout and import order changes, and every file keeps the same set of imports. shared is formatted throughout and its format baseline is empty. The server baseline keeps the 35 files that Prettier would grow past their lint:size limit (they need a split first, which is not a formatting change), and the generated entity files stay as their generator writes them.
1332 lines
54 KiB
TypeScript
1332 lines
54 KiB
TypeScript
/**
|
||
* Immich-specific integration tests (IMMICH-030 – IMMICH-070).
|
||
* Covers status, test-connection, browse, search, asset proxy, access control,
|
||
* and albums — everything NOT covered by the existing immich.test.ts.
|
||
*
|
||
* safeFetch is mocked to return fake Immich API responses based on URL patterns.
|
||
* No real HTTP calls are made.
|
||
*/
|
||
import { buildApp } from '../../src/bootstrap';
|
||
import { db as testDb } from '../../src/db/database';
|
||
import { PhotoProviders } from '../../src/db/entities/PhotoProviders.entity';
|
||
import { TrekPhotos } from '../../src/db/entities/TrekPhotos.entity';
|
||
import { TripPhotos } from '../../src/db/entities/TripPhotos.entity';
|
||
import { Users } from '../../src/db/entities/Users.entity';
|
||
import { safeFetch } from '../../src/utils/ssrfGuard';
|
||
import { authCookie } from '../helpers/auth';
|
||
import {
|
||
createUser,
|
||
createTrip,
|
||
addTripMember,
|
||
addTripPhoto,
|
||
addAlbumLink,
|
||
setImmichCredentials,
|
||
} from '../helpers/factories';
|
||
import type { FactoryOrm } from '../helpers/factories/context';
|
||
import { findRow, findRows, insertRow, updateRows } from '../helpers/factories/rows';
|
||
import { readUser } from '../helpers/factories/users';
|
||
import { resetTestDb, resetRateLimits, setAddonEnabled } from '../helpers/test-db';
|
||
import { MikroORM } from '@mikro-orm/core';
|
||
import type { INestApplication } from '@nestjs/common';
|
||
|
||
import type { Application } from 'express';
|
||
import request from 'supertest';
|
||
import { describe, it, expect, vi, beforeAll, beforeEach, afterAll } from 'vitest';
|
||
|
||
// ── Non-database hoisted state (kept separate from the db mock below) ────────
|
||
|
||
// Mutable fixture driving the fake Immich responses. Tests may override
|
||
// `albumAssetPages` to exercise pagination, and read `searchCalls` to assert
|
||
// on the request bodies TREK sends to POST /api/search/metadata.
|
||
const immichState = vi.hoisted(() => ({
|
||
albumAssets: [] as any[],
|
||
albumAssetPages: null as any[][] | null,
|
||
searchCalls: [] as any[],
|
||
/** Immich v2 embeds `assets` in the album detail body; v3 does not (#1492). */
|
||
albumDetailHasAssets: false,
|
||
}));
|
||
|
||
/**
|
||
* Default contents of `album-uuid-1` as Immich returns them from
|
||
* POST /api/search/metadata. Two visible assets plus two hidden ones (Live Photo
|
||
* motion parts): `visibility: 'hidden'` is the modern marker, `isVisible: false`
|
||
* the legacy one. Both must be filtered out of the picker (#1474).
|
||
*/
|
||
const DEFAULT_ALBUM_ASSETS = [
|
||
{
|
||
id: 'asset-sync-1',
|
||
type: 'IMAGE',
|
||
fileCreatedAt: '2024-06-01T10:00:00.000Z',
|
||
exifInfo: { city: 'Paris', country: 'France', latitude: 48.8584, longitude: 2.2945 },
|
||
},
|
||
{
|
||
id: 'asset-sync-2',
|
||
type: 'VIDEO',
|
||
fileCreatedAt: '2024-06-02T10:00:00.000Z',
|
||
exifInfo: { city: 'Lyon', country: 'France' },
|
||
},
|
||
{ id: 'asset-hidden', type: 'VIDEO', fileCreatedAt: '2024-06-03T10:00:00.000Z', visibility: 'hidden' },
|
||
{ id: 'asset-legacy-hidden', type: 'VIDEO', fileCreatedAt: '2024-06-04T10:00:00.000Z', isVisible: false },
|
||
];
|
||
|
||
vi.mock('../../src/db/database', async () => {
|
||
const { createSnapshotTestDb, buildDbMock } = await import('../helpers/db-mock');
|
||
return buildDbMock(createSnapshotTestDb());
|
||
});
|
||
|
||
// ── SSRF guard mock — routes all Immich API calls to fake responses ───────────
|
||
vi.mock('../../src/utils/ssrfGuard', async () => {
|
||
const actual = await vi.importActual<typeof import('../../src/utils/ssrfGuard')>('../../src/utils/ssrfGuard');
|
||
|
||
function makeFakeImmichFetch(url: string, init?: any) {
|
||
const u = typeof url === 'string' ? url : String(url);
|
||
|
||
// /api/users/me — used by status + test-connection
|
||
if (u.includes('/api/users/me')) {
|
||
return Promise.resolve({
|
||
ok: true,
|
||
status: 200,
|
||
headers: { get: (h: string) => (h === 'content-type' ? 'application/json' : null) },
|
||
json: () => Promise.resolve({ name: 'Test User', email: 'test@immich.local' }),
|
||
body: null,
|
||
});
|
||
}
|
||
// /api/timeline/buckets — browse
|
||
if (u.includes('/api/timeline/buckets')) {
|
||
return Promise.resolve({
|
||
ok: true,
|
||
status: 200,
|
||
headers: { get: () => null },
|
||
json: () => Promise.resolve([{ timeBucket: '2024-01-01T00:00:00.000Z', count: 3 }]),
|
||
body: null,
|
||
});
|
||
}
|
||
// /api/search/metadata — timeline search AND (since Immich v3) album contents
|
||
if (u.includes('/api/search/metadata')) {
|
||
const body = init?.body ? JSON.parse(init.body) : {};
|
||
immichState.searchCalls.push(body);
|
||
|
||
// Album query: Immich v3 removed AlbumResponseDto.assets, so album
|
||
// contents are fetched via an albumIds-filtered metadata search.
|
||
if (body.albumIds?.length) {
|
||
const pages = immichState.albumAssetPages ?? [immichState.albumAssets];
|
||
const items = pages[(body.page ?? 1) - 1] ?? [];
|
||
return Promise.resolve({
|
||
ok: true,
|
||
status: 200,
|
||
headers: { get: () => null },
|
||
json: () => Promise.resolve({ assets: { items } }),
|
||
body: null,
|
||
});
|
||
}
|
||
|
||
return Promise.resolve({
|
||
ok: true,
|
||
status: 200,
|
||
headers: { get: () => null },
|
||
json: () =>
|
||
Promise.resolve({
|
||
assets: {
|
||
items: [
|
||
{
|
||
id: 'asset-search-1',
|
||
fileCreatedAt: '2024-06-01T10:00:00.000Z',
|
||
exifInfo: { city: 'Paris', country: 'France', latitude: 48.8566, longitude: 2.3522 },
|
||
},
|
||
],
|
||
},
|
||
}),
|
||
body: null,
|
||
});
|
||
}
|
||
// /api/assets/:id/thumbnail — thumbnail proxy
|
||
if (u.includes('/thumbnail')) {
|
||
const imageBytes = Buffer.from('fake-thumbnail-data');
|
||
return Promise.resolve({
|
||
ok: true,
|
||
status: 200,
|
||
headers: { get: (h: string) => (h === 'content-type' ? 'image/webp' : null) },
|
||
body: new ReadableStream({
|
||
start(c) {
|
||
c.enqueue(imageBytes);
|
||
c.close();
|
||
},
|
||
}),
|
||
});
|
||
}
|
||
// /api/assets/:id/original — original proxy
|
||
if (u.includes('/original')) {
|
||
const imageBytes = Buffer.from('fake-original-data');
|
||
return Promise.resolve({
|
||
ok: true,
|
||
status: 200,
|
||
headers: { get: (h: string) => (h === 'content-type' ? 'image/jpeg' : null) },
|
||
body: new ReadableStream({
|
||
start(c) {
|
||
c.enqueue(imageBytes);
|
||
c.close();
|
||
},
|
||
}),
|
||
});
|
||
}
|
||
// /api/assets/:id — asset info
|
||
if (/\/api\/assets\/[^/]+$/.test(u)) {
|
||
return Promise.resolve({
|
||
ok: true,
|
||
status: 200,
|
||
headers: { get: () => null },
|
||
json: () =>
|
||
Promise.resolve({
|
||
id: 'asset-info-1',
|
||
fileCreatedAt: '2024-06-01T10:00:00.000Z',
|
||
originalFileName: 'photo.jpg',
|
||
exifInfo: {
|
||
exifImageWidth: 4032,
|
||
exifImageHeight: 3024,
|
||
make: 'Apple',
|
||
model: 'iPhone 15',
|
||
lensModel: null,
|
||
focalLength: 5.1,
|
||
fNumber: 1.8,
|
||
exposureTime: '1/500',
|
||
iso: 100,
|
||
city: 'Paris',
|
||
state: 'Île-de-France',
|
||
country: 'France',
|
||
latitude: 48.8566,
|
||
longitude: 2.3522,
|
||
fileSizeInByte: 2048000,
|
||
},
|
||
}),
|
||
body: null,
|
||
});
|
||
}
|
||
// /api/albums — list albums (owned and shared?=true variant)
|
||
if (/\/api\/albums(\?.*)?$/.test(u)) {
|
||
return Promise.resolve({
|
||
ok: true,
|
||
status: 200,
|
||
headers: { get: () => null },
|
||
json: () =>
|
||
Promise.resolve([
|
||
{
|
||
id: 'album-uuid-1',
|
||
albumName: 'Vacation 2024',
|
||
assetCount: 42,
|
||
startDate: '2024-06-01',
|
||
endDate: '2024-06-14',
|
||
albumThumbnailAssetId: null,
|
||
},
|
||
]),
|
||
body: null,
|
||
});
|
||
}
|
||
// /api/albums/:id — album detail.
|
||
// Immich v3 removed the `assets` property from AlbumResponseDto (#1492).
|
||
// Defaults to the v3 shape; `albumDetailHasAssets` models a v2 server.
|
||
if (/\/api\/albums\//.test(u)) {
|
||
const base: any = { id: 'album-uuid-1', albumName: 'Vacation 2024', assetCount: 42 };
|
||
if (immichState.albumDetailHasAssets) base.assets = immichState.albumAssets;
|
||
return Promise.resolve({
|
||
ok: true,
|
||
status: 200,
|
||
headers: { get: () => null },
|
||
json: () => Promise.resolve(base),
|
||
body: null,
|
||
});
|
||
}
|
||
// fallback — unexpected call
|
||
return Promise.reject(new Error(`Unexpected safeFetch call: ${u}`));
|
||
}
|
||
|
||
return {
|
||
...actual,
|
||
checkSsrf: vi.fn().mockImplementation(async (rawUrl: string) => {
|
||
try {
|
||
const url = new URL(rawUrl);
|
||
const h = url.hostname;
|
||
if (h === '127.0.0.1' || h === '::1' || h === 'localhost') {
|
||
return { allowed: false, isPrivate: true, error: 'Loopback not allowed' };
|
||
}
|
||
if (/^(10\.|192\.168\.|172\.(1[6-9]|2\d|3[01])\.)/.test(h)) {
|
||
return { allowed: false, isPrivate: true, error: 'Private IP not allowed' };
|
||
}
|
||
return { allowed: true, isPrivate: false, resolvedIp: '93.184.216.34' };
|
||
} catch {
|
||
return { allowed: false, isPrivate: false, error: 'Invalid URL' };
|
||
}
|
||
}),
|
||
safeFetch: vi.fn().mockImplementation(makeFakeImmichFetch),
|
||
};
|
||
});
|
||
|
||
let nestApp: INestApplication;
|
||
let app: Application;
|
||
let orm: FactoryOrm;
|
||
|
||
const IMMICH = '/api/integrations/memories/immich';
|
||
|
||
/** The trip's photo rows, each with the provider and asset id of the photo it points at. */
|
||
async function tripPhotoAssets(tripId: number, userId?: number) {
|
||
const links = await findRows(
|
||
orm,
|
||
TripPhotos,
|
||
userId === undefined ? { trip: tripId } : { trip: tripId, user: userId },
|
||
);
|
||
const rows = [];
|
||
for (const link of links) {
|
||
const photo = await findRow(orm, TrekPhotos, { id: link.photo_id });
|
||
if (photo) rows.push({ ...link, provider: photo.provider, asset_id: photo.asset_id });
|
||
}
|
||
return rows;
|
||
}
|
||
|
||
beforeAll(async () => {
|
||
nestApp = await buildApp();
|
||
app = nestApp.getHttpAdapter().getInstance();
|
||
orm = nestApp.get(MikroORM);
|
||
});
|
||
|
||
beforeEach(async () => {
|
||
resetTestDb(testDb);
|
||
await resetRateLimits(nestApp);
|
||
// Providers only count as enabled under an enabled journey addon (migration 84 seeds it off).
|
||
setAddonEnabled(testDb, 'journey', true);
|
||
// The migrated snapshot seeds photo_providers.immich.enabled = 0 (an admin must
|
||
// configure it before it's usable in production); the legacy test helper always
|
||
// seeded it enabled, which is what these tests assume. Same convention
|
||
// memories-synology.test.ts already uses for its own provider.
|
||
await updateRows(orm, PhotoProviders, { id: 'immich' }, { enabled: 1 });
|
||
immichState.albumAssets = DEFAULT_ALBUM_ASSETS.map((a) => ({ ...a }));
|
||
immichState.albumAssetPages = null;
|
||
immichState.searchCalls = [];
|
||
immichState.albumDetailHasAssets = false; // default: Immich v3
|
||
});
|
||
|
||
afterAll(async () => {
|
||
await nestApp.close();
|
||
testDb.close();
|
||
});
|
||
|
||
// ── Connection status ─────────────────────────────────────────────────────────
|
||
|
||
describe('Immich connection status', () => {
|
||
it('IMMICH-030 — GET /status when not configured returns { connected: false }', async () => {
|
||
const { user } = createUser(testDb);
|
||
|
||
const res = await request(app).get(`${IMMICH}/status`).set('Cookie', authCookie(user.id));
|
||
|
||
expect(res.status).toBe(200);
|
||
expect(res.body.connected).toBe(false);
|
||
});
|
||
|
||
it('IMMICH-031 — GET /status when configured returns connected + user info', async () => {
|
||
const { user } = createUser(testDb);
|
||
setImmichCredentials(testDb, user.id, 'https://immich.example.com', 'test-api-key');
|
||
|
||
const res = await request(app).get(`${IMMICH}/status`).set('Cookie', authCookie(user.id));
|
||
|
||
expect(res.status).toBe(200);
|
||
expect(res.body.connected).toBe(true);
|
||
expect(res.body.user).toMatchObject({ name: 'Test User', email: 'test@immich.local' });
|
||
});
|
||
});
|
||
|
||
// ── Test connection ───────────────────────────────────────────────────────────
|
||
|
||
describe('Immich test connection', () => {
|
||
it('IMMICH-032 — POST /test with missing fields returns { connected: false }', async () => {
|
||
const { user } = createUser(testDb);
|
||
|
||
const res = await request(app)
|
||
.post(`${IMMICH}/test`)
|
||
.set('Cookie', authCookie(user.id))
|
||
.send({ immich_url: 'https://immich.example.com' }); // missing api_key
|
||
|
||
expect(res.status).toBe(200);
|
||
expect(res.body.connected).toBe(false);
|
||
});
|
||
|
||
it('IMMICH-033 — POST /test with valid credentials returns { connected: true }', async () => {
|
||
const { user } = createUser(testDb);
|
||
|
||
const res = await request(app)
|
||
.post(`${IMMICH}/test`)
|
||
.set('Cookie', authCookie(user.id))
|
||
.send({ immich_url: 'https://immich.example.com', immich_api_key: 'valid-key' });
|
||
|
||
expect(res.status).toBe(200);
|
||
expect(res.body.connected).toBe(true);
|
||
expect(res.body.user).toBeDefined();
|
||
});
|
||
});
|
||
|
||
// ── Browse & Search ───────────────────────────────────────────────────────────
|
||
|
||
describe('Immich browse and search', () => {
|
||
it('IMMICH-040 — GET /browse when not configured returns 400', async () => {
|
||
const { user } = createUser(testDb);
|
||
|
||
const res = await request(app).get(`${IMMICH}/browse`).set('Cookie', authCookie(user.id));
|
||
|
||
expect(res.status).toBe(400);
|
||
});
|
||
|
||
it('IMMICH-041 — GET /browse returns timeline buckets', async () => {
|
||
const { user } = createUser(testDb);
|
||
setImmichCredentials(testDb, user.id, 'https://immich.example.com', 'test-api-key');
|
||
|
||
const res = await request(app).get(`${IMMICH}/browse`).set('Cookie', authCookie(user.id));
|
||
|
||
expect(res.status).toBe(200);
|
||
expect(Array.isArray(res.body.buckets)).toBe(true);
|
||
expect(res.body.buckets.length).toBeGreaterThan(0);
|
||
});
|
||
|
||
it('IMMICH-042 — POST /search returns mapped assets with hasMore flag', async () => {
|
||
const { user } = createUser(testDb);
|
||
setImmichCredentials(testDb, user.id, 'https://immich.example.com', 'test-api-key');
|
||
|
||
const res = await request(app)
|
||
.post(`${IMMICH}/search`)
|
||
.set('Cookie', authCookie(user.id))
|
||
.send({ page: 1, size: 50 });
|
||
|
||
expect(res.status).toBe(200);
|
||
expect(Array.isArray(res.body.assets)).toBe(true);
|
||
expect(res.body.assets[0]).toMatchObject({
|
||
id: 'asset-search-1',
|
||
city: 'Paris',
|
||
country: 'France',
|
||
lat: 48.8566,
|
||
lng: 2.3522,
|
||
});
|
||
expect(typeof res.body.hasMore).toBe('boolean');
|
||
expect(immichState.searchCalls[0]).toMatchObject({ withExif: true });
|
||
});
|
||
|
||
it('IMMICH-043 — POST /search when upstream throws returns 502', async () => {
|
||
const { user } = createUser(testDb);
|
||
setImmichCredentials(testDb, user.id, 'https://immich.example.com', 'test-api-key');
|
||
|
||
vi.mocked(safeFetch).mockRejectedValueOnce(new Error('upstream unreachable'));
|
||
|
||
const res = await request(app).post(`${IMMICH}/search`).set('Cookie', authCookie(user.id)).send({});
|
||
|
||
expect(res.status).toBe(502);
|
||
expect(res.body.error).toBeDefined();
|
||
});
|
||
});
|
||
|
||
// ── Asset proxy ───────────────────────────────────────────────────────────────
|
||
|
||
describe('Immich asset proxy', () => {
|
||
it('IMMICH-050 — GET /assets/info returns asset metadata for own photo', async () => {
|
||
const { user } = createUser(testDb);
|
||
const trip = createTrip(testDb, user.id);
|
||
setImmichCredentials(testDb, user.id, 'https://immich.example.com', 'test-api-key');
|
||
addTripPhoto(testDb, trip.id, user.id, 'asset-info-1', 'immich', { shared: false });
|
||
|
||
const res = await request(app)
|
||
.get(`${IMMICH}/assets/${trip.id}/asset-info-1/${user.id}/info`)
|
||
.set('Cookie', authCookie(user.id));
|
||
|
||
expect(res.status).toBe(200);
|
||
expect(res.body).toMatchObject({ id: 'asset-info-1', city: 'Paris', country: 'France' });
|
||
});
|
||
|
||
it('IMMICH-051 — GET /assets/info with invalid assetId (special chars) returns 400', async () => {
|
||
const { user } = createUser(testDb);
|
||
const trip = createTrip(testDb, user.id);
|
||
// ID contains characters outside [a-zA-Z0-9_-] → fails isValidAssetId()
|
||
const invalidId = 'asset!@#$%';
|
||
|
||
const res = await request(app)
|
||
.get(`${IMMICH}/assets/${trip.id}/${encodeURIComponent(invalidId)}/${user.id}/info`)
|
||
.set('Cookie', authCookie(user.id));
|
||
|
||
expect(res.status).toBe(400);
|
||
});
|
||
|
||
it('IMMICH-052 — GET /assets/info by non-owner of unshared photo returns 403', async () => {
|
||
const { user: owner } = createUser(testDb);
|
||
const { user: member } = createUser(testDb);
|
||
const trip = createTrip(testDb, owner.id);
|
||
addTripMember(testDb, trip.id, member.id);
|
||
setImmichCredentials(testDb, owner.id, 'https://immich.example.com', 'test-api-key');
|
||
// private photo — shared = false
|
||
addTripPhoto(testDb, trip.id, owner.id, 'asset-private', 'immich', { shared: false });
|
||
|
||
const res = await request(app)
|
||
.get(`${IMMICH}/assets/${trip.id}/asset-private/${owner.id}/info`)
|
||
.set('Cookie', authCookie(member.id));
|
||
|
||
expect(res.status).toBe(403);
|
||
});
|
||
|
||
it('IMMICH-053 — GET /assets/info by trip member for shared photo returns 200', async () => {
|
||
const { user: owner } = createUser(testDb);
|
||
const { user: member } = createUser(testDb);
|
||
const trip = createTrip(testDb, owner.id);
|
||
addTripMember(testDb, trip.id, member.id);
|
||
setImmichCredentials(testDb, owner.id, 'https://immich.example.com', 'test-api-key');
|
||
// shared photo
|
||
addTripPhoto(testDb, trip.id, owner.id, 'asset-shared', 'immich', { shared: true });
|
||
|
||
const res = await request(app)
|
||
.get(`${IMMICH}/assets/${trip.id}/asset-shared/${owner.id}/info`)
|
||
.set('Cookie', authCookie(member.id));
|
||
|
||
expect(res.status).toBe(200);
|
||
});
|
||
|
||
it('IMMICH-054 — GET /assets/thumbnail for own photo streams image data', async () => {
|
||
const { user } = createUser(testDb);
|
||
const trip = createTrip(testDb, user.id);
|
||
setImmichCredentials(testDb, user.id, 'https://immich.example.com', 'test-api-key');
|
||
addTripPhoto(testDb, trip.id, user.id, 'asset-thumb', 'immich', { shared: false });
|
||
|
||
const res = await request(app)
|
||
.get(`${IMMICH}/assets/${trip.id}/asset-thumb/${user.id}/thumbnail`)
|
||
.set('Cookie', authCookie(user.id));
|
||
|
||
expect(res.status).toBe(200);
|
||
expect(res.headers['content-type']).toContain('image/webp');
|
||
expect(res.body).toBeDefined();
|
||
});
|
||
|
||
it("IMMICH-055 — GET /assets/thumbnail for other's unshared photo returns 403", async () => {
|
||
const { user: owner } = createUser(testDb);
|
||
const { user: member } = createUser(testDb);
|
||
const trip = createTrip(testDb, owner.id);
|
||
addTripMember(testDb, trip.id, member.id);
|
||
addTripPhoto(testDb, trip.id, owner.id, 'asset-noshare', 'immich', { shared: false });
|
||
|
||
const res = await request(app)
|
||
.get(`${IMMICH}/assets/${trip.id}/asset-noshare/${owner.id}/thumbnail`)
|
||
.set('Cookie', authCookie(member.id));
|
||
|
||
expect(res.status).toBe(403);
|
||
});
|
||
|
||
it('IMMICH-056 — GET /assets/original for shared photo streams image data', async () => {
|
||
const { user: owner } = createUser(testDb);
|
||
const { user: member } = createUser(testDb);
|
||
const trip = createTrip(testDb, owner.id);
|
||
addTripMember(testDb, trip.id, member.id);
|
||
setImmichCredentials(testDb, owner.id, 'https://immich.example.com', 'test-api-key');
|
||
addTripPhoto(testDb, trip.id, owner.id, 'asset-orig', 'immich', { shared: true });
|
||
|
||
const res = await request(app)
|
||
.get(`${IMMICH}/assets/${trip.id}/asset-orig/${owner.id}/original`)
|
||
.set('Cookie', authCookie(member.id));
|
||
|
||
expect(res.status).toBe(200);
|
||
expect(res.headers['content-type']).toContain('image/');
|
||
});
|
||
|
||
it('IMMICH-057 — GET /assets/info where trip does not exist returns 403', async () => {
|
||
const { user: owner } = createUser(testDb);
|
||
const { user: member } = createUser(testDb);
|
||
// Insert a shared photo referencing a trip that doesn't exist (FK disabled temporarily)
|
||
testDb.exec('PRAGMA foreign_keys = OFF');
|
||
const known = await findRow(orm, TrekPhotos, { provider: 'immich', asset_id: 'asset-notrip', owner: owner.id });
|
||
const photoId =
|
||
known?.id ??
|
||
(await insertRow(orm, TrekPhotos, { provider: 'immich', asset_id: 'asset-notrip', owner: owner.id }));
|
||
await insertRow(orm, TripPhotos, { trip: 9999, user: owner.id, photo: photoId, shared: 1 });
|
||
testDb.exec('PRAGMA foreign_keys = ON');
|
||
|
||
const res = await request(app)
|
||
.get(`${IMMICH}/assets/9999/asset-notrip/${owner.id}/info`)
|
||
.set('Cookie', authCookie(member.id));
|
||
|
||
// canAccessUserPhoto: shared photo found, but canAccessTrip(9999) → null → false → 403
|
||
expect(res.status).toBe(403);
|
||
});
|
||
|
||
it('IMMICH-058 — GET /assets/info when upstream returns error propagates status', async () => {
|
||
const { user } = createUser(testDb);
|
||
const trip = createTrip(testDb, user.id);
|
||
setImmichCredentials(testDb, user.id, 'https://immich.example.com', 'test-api-key');
|
||
addTripPhoto(testDb, trip.id, user.id, 'asset-upstream-err', 'immich', { shared: false });
|
||
|
||
vi.mocked(safeFetch).mockResolvedValueOnce({
|
||
ok: false,
|
||
status: 503,
|
||
headers: { get: () => null } as any,
|
||
json: async () => ({}),
|
||
} as any);
|
||
|
||
const res = await request(app)
|
||
.get(`${IMMICH}/assets/${trip.id}/asset-upstream-err/${user.id}/info`)
|
||
.set('Cookie', authCookie(user.id));
|
||
|
||
expect(res.status).toBe(503);
|
||
expect(res.body.error).toBeDefined();
|
||
});
|
||
});
|
||
|
||
// ── Albums ────────────────────────────────────────────────────────────────────
|
||
|
||
describe('Immich albums', () => {
|
||
it('IMMICH-060 — GET /albums when not configured returns 400', async () => {
|
||
const { user } = createUser(testDb);
|
||
|
||
const res = await request(app).get(`${IMMICH}/albums`).set('Cookie', authCookie(user.id));
|
||
|
||
expect(res.status).toBe(400);
|
||
});
|
||
|
||
it('IMMICH-061 — GET /albums returns album list', async () => {
|
||
const { user } = createUser(testDb);
|
||
setImmichCredentials(testDb, user.id, 'https://immich.example.com', 'test-api-key');
|
||
|
||
const res = await request(app).get(`${IMMICH}/albums`).set('Cookie', authCookie(user.id));
|
||
|
||
expect(res.status).toBe(200);
|
||
expect(Array.isArray(res.body.albums)).toBe(true);
|
||
expect(res.body.albums[0]).toMatchObject({ id: 'album-uuid-1', albumName: 'Vacation 2024' });
|
||
});
|
||
});
|
||
|
||
// ── Album photos (#1492) ──────────────────────────────────────────────────────
|
||
|
||
describe('Immich album photos', () => {
|
||
it('IMMICH-062 — GET /albums/:id/photos returns photos even though the album detail body has no `assets` (Immich v3)', async () => {
|
||
const { user } = createUser(testDb);
|
||
setImmichCredentials(testDb, user.id, 'https://immich.example.com', 'test-api-key');
|
||
|
||
const res = await request(app).get(`${IMMICH}/albums/album-uuid-1/photos`).set('Cookie', authCookie(user.id));
|
||
|
||
expect(res.status).toBe(200);
|
||
expect(res.body.assets).toHaveLength(2);
|
||
// Newest first: asset-sync-2 was taken on the 2nd, asset-sync-1 on the 1st.
|
||
expect(res.body.assets.map((a: any) => a.id)).toEqual(['asset-sync-2', 'asset-sync-1']);
|
||
});
|
||
|
||
it('IMMICH-063 — GET /albums/:id/photos filters hidden assets (both visibility and legacy isVisible markers)', async () => {
|
||
const { user } = createUser(testDb);
|
||
setImmichCredentials(testDb, user.id, 'https://immich.example.com', 'test-api-key');
|
||
|
||
const res = await request(app).get(`${IMMICH}/albums/album-uuid-1/photos`).set('Cookie', authCookie(user.id));
|
||
|
||
const ids = res.body.assets.map((a: any) => a.id);
|
||
expect(ids).not.toContain('asset-hidden');
|
||
expect(ids).not.toContain('asset-legacy-hidden');
|
||
});
|
||
|
||
it('IMMICH-064 — GET /albums/:id/photos maps exif and media type', async () => {
|
||
const { user } = createUser(testDb);
|
||
setImmichCredentials(testDb, user.id, 'https://immich.example.com', 'test-api-key');
|
||
|
||
const res = await request(app).get(`${IMMICH}/albums/album-uuid-1/photos`).set('Cookie', authCookie(user.id));
|
||
|
||
// Keyed by id, not by position: the response is sorted by capture time now,
|
||
// so an index would pin the ordering here as a side effect.
|
||
const byId = Object.fromEntries(res.body.assets.map((a: any) => [a.id, a]));
|
||
expect(byId['asset-sync-1']).toMatchObject({
|
||
id: 'asset-sync-1',
|
||
takenAt: '2024-06-01T10:00:00.000Z',
|
||
city: 'Paris',
|
||
country: 'France',
|
||
mediaType: 'image',
|
||
});
|
||
expect(byId['asset-sync-2'].mediaType).toBe('video');
|
||
});
|
||
|
||
// #1614 — the album mapping used to drop lat/lng even though the search path
|
||
// kept them, so a photo picked from an album could never reach a map.
|
||
it('IMMICH-064b — album photos carry their capture coordinates, and tolerate their absence', async () => {
|
||
const { user } = createUser(testDb);
|
||
setImmichCredentials(testDb, user.id, 'https://immich.example.com', 'test-api-key');
|
||
|
||
const res = await request(app).get(`${IMMICH}/albums/album-uuid-1/photos`).set('Cookie', authCookie(user.id));
|
||
|
||
const byId = Object.fromEntries(res.body.assets.map((a: any) => [a.id, a]));
|
||
expect(byId['asset-sync-1']).toMatchObject({ lat: 48.8584, lng: 2.2945 });
|
||
// asset-sync-2 has no coordinates; it must come back null, not undefined
|
||
// or a half pair.
|
||
expect(byId['asset-sync-2'].lat).toBeNull();
|
||
expect(byId['asset-sync-2'].lng).toBeNull();
|
||
});
|
||
|
||
it('IMMICH-065 — album photos are fetched via search/metadata with albumIds and withExif', async () => {
|
||
const { user } = createUser(testDb);
|
||
setImmichCredentials(testDb, user.id, 'https://immich.example.com', 'test-api-key');
|
||
|
||
await request(app).get(`${IMMICH}/albums/album-uuid-1/photos`).set('Cookie', authCookie(user.id));
|
||
|
||
expect(immichState.searchCalls).toHaveLength(1);
|
||
// withExif is required: without it Immich omits exifInfo entirely and
|
||
// city/country would silently become null for every photo.
|
||
expect(immichState.searchCalls[0]).toMatchObject({
|
||
albumIds: ['album-uuid-1'],
|
||
withExif: true,
|
||
// The album path asks for the order too; without this it could fall out
|
||
// again unnoticed, because the local sort would still hide it here.
|
||
order: 'desc',
|
||
page: 1,
|
||
});
|
||
});
|
||
|
||
it('IMMICH-066 — GET /albums/:id/photos pages through albums larger than one page', async () => {
|
||
const { user } = createUser(testDb);
|
||
setImmichCredentials(testDb, user.id, 'https://immich.example.com', 'test-api-key');
|
||
|
||
// Page 1 is exactly `size` long, so the service must ask for page 2.
|
||
const pageOne = Array.from({ length: 1000 }, (_, i) => ({
|
||
id: `bulk-${i}`,
|
||
type: 'IMAGE',
|
||
fileCreatedAt: '2024-06-01T10:00:00.000Z',
|
||
}));
|
||
const pageTwo = [{ id: 'tail-asset', type: 'IMAGE', fileCreatedAt: '2024-06-02T10:00:00.000Z' }];
|
||
immichState.albumAssetPages = [pageOne, pageTwo];
|
||
|
||
const res = await request(app).get(`${IMMICH}/albums/album-uuid-1/photos`).set('Cookie', authCookie(user.id));
|
||
|
||
expect(res.status).toBe(200);
|
||
expect(res.body.assets).toHaveLength(1001);
|
||
// tail-asset is the only one from page two and the newest of the 1001, so
|
||
// the chronological sort puts it first. Its presence is what proves page
|
||
// two was fetched at all.
|
||
expect(res.body.assets[0].id).toBe('tail-asset');
|
||
expect(immichState.searchCalls.map((c) => c.page)).toEqual([1, 2]);
|
||
});
|
||
|
||
// Immich v2 still embeds `assets` in the album detail body. It must be used as-is:
|
||
// v2's searchMetadata unconditionally scopes to `[self, ...partners]`, so an
|
||
// albumIds search there returns nothing for an album shared by a non-partner.
|
||
it('IMMICH-069a — on Immich v2 album photos come from the album detail body, with no search call', async () => {
|
||
const { user } = createUser(testDb);
|
||
setImmichCredentials(testDb, user.id, 'https://immich.example.com', 'test-api-key');
|
||
immichState.albumDetailHasAssets = true;
|
||
|
||
const res = await request(app).get(`${IMMICH}/albums/album-uuid-1/photos`).set('Cookie', authCookie(user.id));
|
||
|
||
expect(res.status).toBe(200);
|
||
expect(res.body.assets.map((a: any) => a.id)).toEqual(['asset-sync-2', 'asset-sync-1']);
|
||
expect(immichState.searchCalls).toHaveLength(0);
|
||
});
|
||
|
||
it('IMMICH-069b — on Immich v2 an empty album stays empty and does not fall back to search', async () => {
|
||
const { user } = createUser(testDb);
|
||
setImmichCredentials(testDb, user.id, 'https://immich.example.com', 'test-api-key');
|
||
immichState.albumDetailHasAssets = true;
|
||
immichState.albumAssets = [];
|
||
|
||
const res = await request(app).get(`${IMMICH}/albums/album-uuid-1/photos`).set('Cookie', authCookie(user.id));
|
||
|
||
expect(res.status).toBe(200);
|
||
expect(res.body.assets).toEqual([]);
|
||
expect(immichState.searchCalls).toHaveLength(0);
|
||
});
|
||
|
||
it('IMMICH-069c — on Immich v2 sync reads the album detail body', async () => {
|
||
const { user } = createUser(testDb);
|
||
const trip = createTrip(testDb, user.id);
|
||
setImmichCredentials(testDb, user.id, 'https://immich.example.com', 'test-api-key');
|
||
const link = addAlbumLink(testDb, trip.id, user.id, 'immich', 'album-uuid-1', 'Vacation 2024');
|
||
immichState.albumDetailHasAssets = true;
|
||
|
||
const res = await request(app)
|
||
.post(`${IMMICH}/trips/${trip.id}/album-links/${link.id}/sync`)
|
||
.set('Cookie', authCookie(user.id));
|
||
|
||
expect(res.status).toBe(200);
|
||
expect(res.body.added).toBe(1);
|
||
expect(immichState.searchCalls).toHaveLength(0);
|
||
});
|
||
|
||
it('IMMICH-067 — GET /albums/:id/photos when not configured returns 400', async () => {
|
||
const { user } = createUser(testDb);
|
||
|
||
const res = await request(app).get(`${IMMICH}/albums/album-uuid-1/photos`).set('Cookie', authCookie(user.id));
|
||
|
||
expect(res.status).toBe(400);
|
||
});
|
||
|
||
it('IMMICH-068 — GET /albums/:id/photos when Immich is unreachable returns 502', async () => {
|
||
const { user } = createUser(testDb);
|
||
setImmichCredentials(testDb, user.id, 'https://immich.example.com', 'test-api-key');
|
||
|
||
vi.mocked(safeFetch).mockRejectedValueOnce(new Error('network failure'));
|
||
|
||
const res = await request(app).get(`${IMMICH}/albums/album-uuid-1/photos`).set('Cookie', authCookie(user.id));
|
||
|
||
expect(res.status).toBe(502);
|
||
});
|
||
});
|
||
|
||
// ── Auth checks ───────────────────────────────────────────────────────────────
|
||
|
||
describe('Immich auth checks', () => {
|
||
it('IMMICH-070 — GET /status without auth returns 401', async () => {
|
||
expect((await request(app).get(`${IMMICH}/status`)).status).toBe(401);
|
||
});
|
||
|
||
it('IMMICH-070 — POST /test without auth returns 401', async () => {
|
||
expect((await request(app).post(`${IMMICH}/test`)).status).toBe(401);
|
||
});
|
||
|
||
it('IMMICH-070 — GET /browse without auth returns 401', async () => {
|
||
expect((await request(app).get(`${IMMICH}/browse`)).status).toBe(401);
|
||
});
|
||
|
||
it('IMMICH-070 — POST /search without auth returns 401', async () => {
|
||
expect((await request(app).post(`${IMMICH}/search`)).status).toBe(401);
|
||
});
|
||
|
||
it('IMMICH-070 — GET /albums without auth returns 401', async () => {
|
||
expect((await request(app).get(`${IMMICH}/albums`)).status).toBe(401);
|
||
});
|
||
|
||
it('IMMICH-070 — GET /assets/info without auth returns 401', async () => {
|
||
expect((await request(app).get(`${IMMICH}/assets/1/asset-x/1/info`)).status).toBe(401);
|
||
});
|
||
|
||
it('IMMICH-070 — GET /assets/thumbnail without auth returns 401', async () => {
|
||
expect((await request(app).get(`${IMMICH}/assets/1/asset-x/1/thumbnail`)).status).toBe(401);
|
||
});
|
||
|
||
it('IMMICH-070 — GET /assets/original without auth returns 401', async () => {
|
||
expect((await request(app).get(`${IMMICH}/assets/1/asset-x/1/original`)).status).toBe(401);
|
||
});
|
||
});
|
||
|
||
// ── Album sync ────────────────────────────────────────────────────────────────
|
||
|
||
describe('Immich syncAlbumAssets', () => {
|
||
it('IMMICH-080 — POST sync happy path: trip owner with album link saves photos to DB', async () => {
|
||
const { user } = createUser(testDb);
|
||
const trip = createTrip(testDb, user.id);
|
||
setImmichCredentials(testDb, user.id, 'https://immich.example.com', 'test-api-key');
|
||
const link = addAlbumLink(testDb, trip.id, user.id, 'immich', 'album-uuid-1', 'Vacation 2024');
|
||
|
||
const res = await request(app)
|
||
.post(`${IMMICH}/trips/${trip.id}/album-links/${link.id}/sync`)
|
||
.set('Cookie', authCookie(user.id));
|
||
|
||
expect(res.status).toBe(200);
|
||
expect(res.body.success).toBe(true);
|
||
// Only asset-sync-1 is an IMAGE; the video and the hidden motion parts are
|
||
// not synced. A zero here is the #1492 silent-failure mode.
|
||
expect(res.body.total).toBe(1);
|
||
expect(res.body.added).toBe(1);
|
||
|
||
// Verify photos were inserted into the DB
|
||
const photos = await tripPhotoAssets(trip.id, user.id);
|
||
expect(photos.length).toBeGreaterThan(0);
|
||
expect(photos[0].provider).toBe('immich');
|
||
});
|
||
|
||
it('IMMICH-087 — POST sync does not persist hidden assets (#1474)', async () => {
|
||
const { user } = createUser(testDb);
|
||
const trip = createTrip(testDb, user.id);
|
||
setImmichCredentials(testDb, user.id, 'https://immich.example.com', 'test-api-key');
|
||
const link = addAlbumLink(testDb, trip.id, user.id, 'immich', 'album-uuid-1', 'Vacation 2024');
|
||
|
||
// A hidden IMAGE slips past the `type === 'IMAGE'` filter. Persisting it
|
||
// yields a permanently broken tile: nothing re-checks visibility on the
|
||
// render path, and Immich has no thumbnail to serve.
|
||
immichState.albumAssets = [
|
||
{ id: 'visible-still', type: 'IMAGE', visibility: 'timeline', fileCreatedAt: '2024-06-01T10:00:00.000Z' },
|
||
{ id: 'hidden-image', type: 'IMAGE', visibility: 'hidden', fileCreatedAt: '2024-06-02T10:00:00.000Z' },
|
||
{ id: 'legacy-hidden-image', type: 'IMAGE', isVisible: false, fileCreatedAt: '2024-06-03T10:00:00.000Z' },
|
||
];
|
||
|
||
const res = await request(app)
|
||
.post(`${IMMICH}/trips/${trip.id}/album-links/${link.id}/sync`)
|
||
.set('Cookie', authCookie(user.id));
|
||
|
||
expect(res.status).toBe(200);
|
||
expect(res.body.total).toBe(1);
|
||
|
||
const rows = await tripPhotoAssets(trip.id);
|
||
expect(rows.map((r) => r.asset_id)).toEqual(['visible-still']);
|
||
});
|
||
|
||
it('IMMICH-086 — POST sync fetches album contents via search/metadata with albumIds', async () => {
|
||
const { user } = createUser(testDb);
|
||
const trip = createTrip(testDb, user.id);
|
||
setImmichCredentials(testDb, user.id, 'https://immich.example.com', 'test-api-key');
|
||
const link = addAlbumLink(testDb, trip.id, user.id, 'immich', 'album-uuid-1', 'Vacation 2024');
|
||
|
||
await request(app)
|
||
.post(`${IMMICH}/trips/${trip.id}/album-links/${link.id}/sync`)
|
||
.set('Cookie', authCookie(user.id));
|
||
|
||
expect(immichState.searchCalls[0]).toMatchObject({ albumIds: ['album-uuid-1'] });
|
||
});
|
||
|
||
it('IMMICH-081 — POST sync when user is not a trip member returns 404', async () => {
|
||
const { user: owner } = createUser(testDb);
|
||
const { user: outsider } = createUser(testDb);
|
||
const trip = createTrip(testDb, owner.id);
|
||
setImmichCredentials(testDb, owner.id, 'https://immich.example.com', 'test-api-key');
|
||
const link = addAlbumLink(testDb, trip.id, owner.id, 'immich', 'album-uuid-1', 'Vacation 2024');
|
||
|
||
// outsider is not a trip member — getAlbumIdFromLink checks canAccessTrip
|
||
const res = await request(app)
|
||
.post(`${IMMICH}/trips/${trip.id}/album-links/${link.id}/sync`)
|
||
.set('Cookie', authCookie(outsider.id));
|
||
|
||
expect(res.status).toBe(404);
|
||
});
|
||
|
||
it('IMMICH-082 — POST sync when Immich is not configured returns 400', async () => {
|
||
const { user } = createUser(testDb);
|
||
const trip = createTrip(testDb, user.id);
|
||
// No Immich credentials set — but still need a valid album link owned by user
|
||
const link = addAlbumLink(testDb, trip.id, user.id, 'immich', 'album-uuid-1', 'Vacation 2024');
|
||
|
||
const res = await request(app)
|
||
.post(`${IMMICH}/trips/${trip.id}/album-links/${link.id}/sync`)
|
||
.set('Cookie', authCookie(user.id));
|
||
|
||
expect(res.status).toBe(400);
|
||
expect(res.body.error).toBeDefined();
|
||
});
|
||
|
||
it('IMMICH-083 — POST sync when safeFetch throws returns 502', async () => {
|
||
const { user } = createUser(testDb);
|
||
const trip = createTrip(testDb, user.id);
|
||
setImmichCredentials(testDb, user.id, 'https://immich.example.com', 'test-api-key');
|
||
const link = addAlbumLink(testDb, trip.id, user.id, 'immich', 'album-uuid-1', 'Vacation 2024');
|
||
|
||
vi.mocked(safeFetch).mockRejectedValueOnce(new Error('network failure during sync'));
|
||
|
||
const res = await request(app)
|
||
.post(`${IMMICH}/trips/${trip.id}/album-links/${link.id}/sync`)
|
||
.set('Cookie', authCookie(user.id));
|
||
|
||
expect(res.status).toBe(502);
|
||
expect(res.body.error).toBeDefined();
|
||
});
|
||
|
||
it('IMMICH-084 — POST sync when album link does not belong to requesting user returns 404', async () => {
|
||
const { user: owner } = createUser(testDb);
|
||
const { user: member } = createUser(testDb);
|
||
const trip = createTrip(testDb, owner.id);
|
||
addTripMember(testDb, trip.id, member.id);
|
||
setImmichCredentials(testDb, member.id, 'https://immich.example.com', 'test-api-key');
|
||
// Album link is owned by owner, not member
|
||
const link = addAlbumLink(testDb, trip.id, owner.id, 'immich', 'album-uuid-1', 'Vacation 2024');
|
||
|
||
// member is a trip member but the album link belongs to owner — getAlbumIdFromLink checks user_id
|
||
const res = await request(app)
|
||
.post(`${IMMICH}/trips/${trip.id}/album-links/${link.id}/sync`)
|
||
.set('Cookie', authCookie(member.id));
|
||
|
||
expect(res.status).toBe(404);
|
||
});
|
||
|
||
it('IMMICH-085 — POST sync without auth returns 401', async () => {
|
||
expect((await request(app).post(`${IMMICH}/trips/1/album-links/1/sync`)).status).toBe(401);
|
||
});
|
||
});
|
||
|
||
// ── searchPhotos pagination safety ────────────────────────────────────────────
|
||
|
||
describe('Immich searchPhotos pagination pass-through', () => {
|
||
it('IMMICH-090 — POST /search proxies client page param and returns hasMore', async () => {
|
||
const { user } = createUser(testDb);
|
||
setImmichCredentials(testDb, user.id, 'https://immich.example.com', 'test-api-key');
|
||
|
||
// Return a full page so hasMore=true (items.length >= size)
|
||
const fullPageResponse = {
|
||
ok: true,
|
||
status: 200,
|
||
headers: { get: () => null },
|
||
json: () =>
|
||
Promise.resolve({
|
||
assets: {
|
||
items: Array.from({ length: 50 }, (_, i) => ({
|
||
id: `asset-p2-${i}`,
|
||
fileCreatedAt: '2024-06-01T10:00:00.000Z',
|
||
exifInfo: { city: 'Berlin', country: 'Germany' },
|
||
})),
|
||
},
|
||
}),
|
||
body: null,
|
||
} as any;
|
||
|
||
vi.mocked(safeFetch).mockClear();
|
||
vi.mocked(safeFetch).mockResolvedValue(fullPageResponse);
|
||
|
||
const res = await request(app)
|
||
.post(`${IMMICH}/search`)
|
||
.set('Cookie', authCookie(user.id))
|
||
.send({ page: 2, size: 50 });
|
||
|
||
expect(res.status).toBe(200);
|
||
expect(Array.isArray(res.body.assets)).toBe(true);
|
||
// Single page returned — not 20× aggregation
|
||
expect(res.body.assets.length).toBe(50);
|
||
expect(res.body.hasMore).toBe(true);
|
||
// Immich was called exactly once
|
||
expect(vi.mocked(safeFetch)).toHaveBeenCalledTimes(1);
|
||
// page=2 was forwarded to Immich
|
||
const callBody = JSON.parse(vi.mocked(safeFetch).mock.calls[0][1]!.body as string);
|
||
expect(callBody.page).toBe(2);
|
||
});
|
||
|
||
it('IMMICH-091 — POST /search returns hasMore=false on last page', async () => {
|
||
const { user } = createUser(testDb);
|
||
setImmichCredentials(testDb, user.id, 'https://immich.example.com', 'test-api-key');
|
||
|
||
// Partial page → hasMore=false
|
||
const partialPageResponse = {
|
||
ok: true,
|
||
status: 200,
|
||
headers: { get: () => null },
|
||
json: () =>
|
||
Promise.resolve({
|
||
assets: {
|
||
items: Array.from({ length: 3 }, (_, i) => ({
|
||
id: `asset-last-${i}`,
|
||
fileCreatedAt: '2024-06-01T10:00:00.000Z',
|
||
exifInfo: { city: 'Rome', country: 'Italy' },
|
||
})),
|
||
},
|
||
}),
|
||
body: null,
|
||
} as any;
|
||
|
||
vi.mocked(safeFetch).mockResolvedValue(partialPageResponse);
|
||
|
||
const res = await request(app)
|
||
.post(`${IMMICH}/search`)
|
||
.set('Cookie', authCookie(user.id))
|
||
.send({ page: 5, size: 50 });
|
||
|
||
expect(res.status).toBe(200);
|
||
expect(res.body.assets.length).toBe(3);
|
||
expect(res.body.hasMore).toBe(false);
|
||
});
|
||
|
||
it('IMMICH-094: POST /search reaches a date-filtered page past the twentieth at the picker page size (#1587)', async () => {
|
||
const { user } = createUser(testDb);
|
||
setImmichCredentials(testDb, user.id, 'https://immich.example.com', 'test-api-key');
|
||
|
||
// Every raw page is 200 photos of the searched day, so answered page 21
|
||
// needs raw pages 1 to 21. The old flat budget of 20 answered it empty with
|
||
// hasMore false, which is where a trip stopped without a word.
|
||
const previous = vi.mocked(safeFetch).getMockImplementation();
|
||
vi.mocked(safeFetch).mockClear();
|
||
vi.mocked(safeFetch).mockImplementation(async (_url: unknown, init?: { body?: unknown }) => {
|
||
const rawPage = JSON.parse(String(init?.body ?? '{}')).page as number;
|
||
return {
|
||
ok: true,
|
||
status: 200,
|
||
headers: { get: () => null },
|
||
json: () =>
|
||
Promise.resolve({
|
||
assets: {
|
||
items: Array.from({ length: 200 }, (_, i) => ({
|
||
id: `deep-${rawPage}-${i}`,
|
||
fileCreatedAt: '2024-06-01T10:00:00.000Z',
|
||
localDateTime: '2024-06-01T12:00:00.000Z',
|
||
})),
|
||
},
|
||
}),
|
||
body: null,
|
||
} as never;
|
||
});
|
||
|
||
let res: request.Response;
|
||
try {
|
||
res = await request(app)
|
||
.post(`${IMMICH}/search`)
|
||
.set('Cookie', authCookie(user.id))
|
||
.send({ from: '2024-06-01', to: '2024-06-01', page: 21, size: 200 });
|
||
} finally {
|
||
if (previous) vi.mocked(safeFetch).mockImplementation(previous);
|
||
}
|
||
|
||
expect(res.status).toBe(200);
|
||
expect(res.body.assets).toHaveLength(200);
|
||
expect(res.body.assets[0].id).toMatch(/^deep-21-/);
|
||
expect(res.body.hasMore).toBe(true);
|
||
expect(vi.mocked(safeFetch)).toHaveBeenCalledTimes(21);
|
||
const sizes = vi
|
||
.mocked(safeFetch)
|
||
.mock.calls.map((c) => JSON.parse(String((c[1] as { body?: unknown }).body)).size);
|
||
expect(new Set(sizes)).toEqual(new Set([200]));
|
||
});
|
||
|
||
it('IMMICH-093 — POST /search requests timeline visibility so Immich v3 never returns hidden assets (#1474)', async () => {
|
||
const { user } = createUser(testDb);
|
||
setImmichCredentials(testDb, user.id, 'https://immich.example.com', 'test-api-key');
|
||
|
||
// A sibling test installs a permanent mockResolvedValue on safeFetch, so
|
||
// assert on the spy's recorded call rather than immichState.searchCalls.
|
||
vi.mocked(safeFetch).mockClear();
|
||
vi.mocked(safeFetch).mockResolvedValue({
|
||
ok: true,
|
||
status: 200,
|
||
headers: { get: () => null },
|
||
json: () => Promise.resolve({ assets: { items: [] } }),
|
||
body: null,
|
||
} as any);
|
||
|
||
await request(app)
|
||
.post(`${IMMICH}/search`)
|
||
.set('Cookie', authCookie(user.id))
|
||
.send({ from: '2024-06-01', to: '2024-06-14' });
|
||
|
||
// Immich v2 hard-defaulted metadata search to `timeline` visibility; v3
|
||
// defaults to "any except locked", which is what started surfacing Live
|
||
// Photo motion parts. Asking for `timeline` explicitly restores v2
|
||
// semantics on both, so hidden assets never cross the wire.
|
||
const callBody = JSON.parse(vi.mocked(safeFetch).mock.calls[0][1]!.body as string);
|
||
expect(callBody.visibility).toBe('timeline');
|
||
});
|
||
|
||
it('IMMICH-092 — POST /search filters hidden Live Photo motion assets (#1474)', async () => {
|
||
const { user } = createUser(testDb);
|
||
setImmichCredentials(testDb, user.id, 'https://immich.example.com', 'test-api-key');
|
||
|
||
// A Live Photo pair (visible still + hidden motion video) plus a legacy
|
||
// hidden asset — only the still should survive, but hasMore reflects the
|
||
// raw page count (4 >= size 4).
|
||
const mixedResponse = {
|
||
ok: true,
|
||
status: 200,
|
||
headers: { get: () => null },
|
||
json: () =>
|
||
Promise.resolve({
|
||
assets: {
|
||
items: [
|
||
{
|
||
id: 'still-1',
|
||
type: 'IMAGE',
|
||
visibility: 'timeline',
|
||
fileCreatedAt: '2024-06-01T10:00:00.000Z',
|
||
exifInfo: { city: 'Kyoto', country: 'Japan' },
|
||
livePhotoVideoId: 'motion-1',
|
||
},
|
||
{ id: 'motion-1', type: 'VIDEO', visibility: 'hidden', fileCreatedAt: '2024-06-01T10:00:00.000Z' },
|
||
{ id: 'legacy-hidden', type: 'VIDEO', isVisible: false, fileCreatedAt: '2024-06-01T10:00:00.000Z' },
|
||
{ id: 'video-visible', type: 'VIDEO', visibility: 'timeline', fileCreatedAt: '2024-06-01T10:00:00.000Z' },
|
||
],
|
||
},
|
||
}),
|
||
body: null,
|
||
} as any;
|
||
|
||
vi.mocked(safeFetch).mockResolvedValue(mixedResponse);
|
||
|
||
const res = await request(app)
|
||
.post(`${IMMICH}/search`)
|
||
.set('Cookie', authCookie(user.id))
|
||
.send({ page: 1, size: 4 });
|
||
|
||
expect(res.status).toBe(200);
|
||
// motion-1 (hidden) and legacy-hidden (isVisible:false) are dropped.
|
||
expect(res.body.assets.map((a: any) => a.id)).toEqual(['still-1', 'video-visible']);
|
||
// Ordinary visible video survives, tagged as video.
|
||
expect(res.body.assets.find((a: any) => a.id === 'video-visible').mediaType).toBe('video');
|
||
// hasMore stays on raw page length so pagination advances past a filtered page.
|
||
expect(res.body.hasMore).toBe(true);
|
||
});
|
||
});
|
||
|
||
// ── saveImmichSettings clearing credentials ───────────────────────────────────
|
||
|
||
describe('Immich saveImmichSettings clearing URL', () => {
|
||
it('IMMICH-095 — PUT /settings with no URL clears immich_url but preserves (updates) api key', async () => {
|
||
const { user } = createUser(testDb);
|
||
setImmichCredentials(testDb, user.id, 'https://immich.example.com', 'old-key');
|
||
|
||
// Send without immich_url to trigger the else branch (clear URL path)
|
||
const res = await request(app)
|
||
.put(`${IMMICH}/settings`)
|
||
.set('Cookie', authCookie(user.id))
|
||
.send({ immich_api_key: 'new-key' });
|
||
|
||
expect(res.status).toBe(200);
|
||
expect(res.body.success).toBe(true);
|
||
|
||
expect((await readUser(orm, user.id)).immich_url).toBeNull();
|
||
});
|
||
|
||
it('IMMICH-096 — PUT /settings with empty string URL clears immich_url', async () => {
|
||
const { user } = createUser(testDb);
|
||
setImmichCredentials(testDb, user.id, 'https://immich.example.com', 'old-key');
|
||
|
||
const res = await request(app)
|
||
.put(`${IMMICH}/settings`)
|
||
.set('Cookie', authCookie(user.id))
|
||
.send({ immich_url: '', immich_api_key: 'old-key' });
|
||
|
||
expect(res.status).toBe(200);
|
||
expect(res.body.success).toBe(true);
|
||
|
||
expect((await readUser(orm, user.id)).immich_url).toBeNull();
|
||
});
|
||
});
|
||
|
||
// ── testConnection canonical URL detection ────────────────────────────────────
|
||
|
||
describe('Immich testConnection canonical URL detection', () => {
|
||
it('IMMICH-100 — POST /test with http URL that gets upgraded to https returns canonicalUrl', async () => {
|
||
const { user } = createUser(testDb);
|
||
|
||
// Mock safeFetch so the response.url reflects https upgrade
|
||
vi.mocked(safeFetch).mockResolvedValueOnce({
|
||
ok: true,
|
||
status: 200,
|
||
url: 'https://immich.example.com/api/users/me',
|
||
headers: { get: (h: string) => (h === 'content-type' ? 'application/json' : null) } as any,
|
||
json: async () => ({ name: 'Redirect User', email: 'redirect@immich.local' }),
|
||
body: null,
|
||
} as any);
|
||
|
||
const res = await request(app)
|
||
.post(`${IMMICH}/test`)
|
||
.set('Cookie', authCookie(user.id))
|
||
.send({ immich_url: 'http://immich.example.com', immich_api_key: 'valid-key' });
|
||
|
||
expect(res.status).toBe(200);
|
||
expect(res.body.connected).toBe(true);
|
||
expect(res.body.canonicalUrl).toBe('https://immich.example.com');
|
||
});
|
||
|
||
it('IMMICH-101 — POST /test with https URL that stays https does not return canonicalUrl', async () => {
|
||
const { user } = createUser(testDb);
|
||
|
||
// The default mock returns a response without .url property — no upgrade
|
||
const res = await request(app)
|
||
.post(`${IMMICH}/test`)
|
||
.set('Cookie', authCookie(user.id))
|
||
.send({ immich_url: 'https://immich.example.com', immich_api_key: 'valid-key' });
|
||
|
||
expect(res.status).toBe(200);
|
||
expect(res.body.connected).toBe(true);
|
||
expect(res.body.canonicalUrl).toBeUndefined();
|
||
});
|
||
});
|
||
|
||
// ── Self-signed certificates (#2475) ─────────────────────────────────────────
|
||
|
||
describe('Immich self-signed certificate switch (#2475)', () => {
|
||
const LAX = { rejectUnauthorized: false };
|
||
const STRICT = { rejectUnauthorized: true };
|
||
|
||
/** Only what the service and the asset proxy read off a response. */
|
||
function okJson(json: unknown): Response {
|
||
return {
|
||
ok: true,
|
||
status: 200,
|
||
url: '',
|
||
headers: { get: () => null },
|
||
json: async () => json,
|
||
body: null,
|
||
} as unknown as Response;
|
||
}
|
||
|
||
async function allowInsecureTls(userId: number): Promise<number> {
|
||
return (await readUser(orm, userId)).immich_allow_insecure_tls;
|
||
}
|
||
|
||
beforeEach(() => {
|
||
// Earlier cases leave a fixed response behind; these need a plain answer per path.
|
||
vi.mocked(safeFetch).mockReset();
|
||
vi.mocked(safeFetch).mockImplementation(async (url: string) =>
|
||
String(url).includes('/api/search/metadata') ? okJson({ assets: { items: [] } }) : okJson({}),
|
||
);
|
||
});
|
||
|
||
it('IMMICH-102: PUT /settings stores the switch and GET /settings reports it', async () => {
|
||
const { user } = createUser(testDb);
|
||
|
||
const put = await request(app)
|
||
.put(`${IMMICH}/settings`)
|
||
.set('Cookie', authCookie(user.id))
|
||
.send({ immich_url: 'https://immich.example.com', immich_api_key: 'k', allow_insecure_tls: true });
|
||
expect(put.status).toBe(200);
|
||
|
||
const get = await request(app).get(`${IMMICH}/settings`).set('Cookie', authCookie(user.id));
|
||
expect(get.status).toBe(200);
|
||
expect(get.body.allow_insecure_tls).toBe(true);
|
||
});
|
||
|
||
it('IMMICH-103: a save without the switch keeps it for the same server, a new server or disconnecting clears it', async () => {
|
||
const { user } = createUser(testDb);
|
||
const put = (body: Record<string, unknown>) =>
|
||
request(app).put(`${IMMICH}/settings`).set('Cookie', authCookie(user.id)).send(body);
|
||
|
||
await put({ immich_url: 'https://immich.example.com', immich_api_key: 'k', allow_insecure_tls: true });
|
||
expect(await allowInsecureTls(user.id)).toBe(1);
|
||
|
||
// What a client that predates the switch sends.
|
||
await put({ immich_url: 'https://immich.example.com', immich_api_key: 'k' });
|
||
expect(await allowInsecureTls(user.id)).toBe(1);
|
||
|
||
// A different server is a different trust decision: without the switch it starts off.
|
||
await put({ immich_url: 'https://photos.example.com', immich_api_key: 'k' });
|
||
expect(await allowInsecureTls(user.id)).toBe(0);
|
||
await put({ immich_url: 'https://photos.example.com', immich_api_key: 'k', allow_insecure_tls: true });
|
||
expect(await allowInsecureTls(user.id)).toBe(1);
|
||
|
||
await put({ immich_url: '', immich_api_key: 'k', allow_insecure_tls: true });
|
||
expect(await allowInsecureTls(user.id)).toBe(0);
|
||
});
|
||
|
||
it('IMMICH-104: browse, search and the thumbnail proxy follow the stored switch', async () => {
|
||
const { user } = createUser(testDb);
|
||
const trip = createTrip(testDb, user.id);
|
||
setImmichCredentials(testDb, user.id, 'https://immich.example.com', 'test-api-key');
|
||
addTripPhoto(testDb, trip.id, user.id, 'asset-tls', 'immich', { shared: false });
|
||
const cookie = authCookie(user.id);
|
||
|
||
const hitEveryPath = async () => {
|
||
expect((await request(app).get(`${IMMICH}/browse`).set('Cookie', cookie)).status).toBe(200);
|
||
expect(
|
||
(await request(app).post(`${IMMICH}/search`).set('Cookie', cookie).send({ page: 1, size: 10 })).status,
|
||
).toBe(200);
|
||
expect(
|
||
(await request(app).get(`${IMMICH}/assets/${trip.id}/asset-tls/${user.id}/thumbnail`).set('Cookie', cookie))
|
||
.status,
|
||
).toBe(200);
|
||
};
|
||
|
||
await updateRows(orm, Users, { id: user.id }, { immich_allow_insecure_tls: 1 });
|
||
await hitEveryPath();
|
||
expect(vi.mocked(safeFetch).mock.calls).toHaveLength(3);
|
||
for (const call of vi.mocked(safeFetch).mock.calls) expect(call[2]).toMatchObject(LAX);
|
||
|
||
vi.mocked(safeFetch).mockClear();
|
||
await updateRows(orm, Users, { id: user.id }, { immich_allow_insecure_tls: 0 });
|
||
await hitEveryPath();
|
||
expect(vi.mocked(safeFetch).mock.calls).toHaveLength(3);
|
||
for (const call of vi.mocked(safeFetch).mock.calls) expect(call[2]).toMatchObject(STRICT);
|
||
});
|
||
|
||
it('IMMICH-105: POST /test probes with the switch in the form, and refuses a value that is not a boolean', async () => {
|
||
const { user } = createUser(testDb);
|
||
const test = (allow_insecure_tls: unknown) =>
|
||
request(app)
|
||
.post(`${IMMICH}/test`)
|
||
.set('Cookie', authCookie(user.id))
|
||
.send({ immich_url: 'https://immich.example.com', immich_api_key: 'k', allow_insecure_tls });
|
||
|
||
const lax = await test(true);
|
||
expect(lax.status).toBe(200);
|
||
expect(lax.body.connected).toBe(true);
|
||
expect(vi.mocked(safeFetch).mock.calls[0][2]).toMatchObject(LAX);
|
||
|
||
const strict = await test(false);
|
||
expect(strict.status).toBe(200);
|
||
expect(vi.mocked(safeFetch).mock.calls[1][2]).toMatchObject(STRICT);
|
||
|
||
// Only a real boolean: the form has always sent one, and anything else
|
||
// must not be read as either answer.
|
||
for (const value of ['true', 'yes']) {
|
||
expect((await test(value)).status).toBe(400);
|
||
}
|
||
expect(vi.mocked(safeFetch)).toHaveBeenCalledTimes(2);
|
||
});
|
||
});
|