Maurice 630e8efca1 fix(journey): stop unshared trip photos leaking into journeys, and gate the link ...

Two things found while reading the domain for discussion #1614.

A photo a trip member left unshared is denied on the trip path — memories-access
requires tp.shared = 1 — but linking that trip to a journey copied every row of
trip_photos into the gallery regardless. From there it was readable by every
journey contributor, and with an open gallery by anonymous visitors of the share
link. journey_photos.shared cannot gate that after the fact: a direct upload
writes 0 into the same column, so filtering on it would empty most galleries.
The fix is at the door instead — only shared rows are copied in.

addTripToJourney checked that the caller could reach the trip but never that
they could reach the journey, so any logged-in user could link a trip of theirs
into a stranger's journey and seed skeleton entries and photos there. The MCP
tool has always checked this; only the REST route was open. Now the service
checks it, which covers both and the internal call from createJourney.

Neither path had a test. They do now.

2026-08-18 20:17:57 +02:00

..

airports

refactor(server): fold airports and distance, drop the boot-time backfill cycle (#1834)

2026-08-07 21:07:14 +02:00

auth

refactor(server): fold the ephemeral-token store and the in-app action registry (#1836)

2026-08-07 22:18:14 +02:00

booking-import

Finish the contract ratchet, the upload bridge and the client leftovers

2026-08-10 19:54:46 +02:00

common

refactor(server): consolidate trip access and fold the query helpers into the container (#1824)

2026-08-07 16:00:12 +02:00

llm-parse

feat(config): put the operator-owned surfaces behind TREK_MANAGED (#1946)

2026-08-15 16:42:27 +02:00

notifications

refactor(server): fold the ephemeral-token store and the in-app action registry (#1836)

2026-08-07 22:18:14 +02:00

place-photos

refactor(server): make the place-photo cache a provider (#1833)

2026-08-07 20:27:19 +02:00

places

refactor(server): move the KML importer and place-image helpers into places/ (#1832)

2026-08-07 19:58:12 +02:00

settings

fix(maps): resolve the Places key per instance, not per whoever is asking

2026-08-17 14:48:23 +02:00

trip-membership

refactor(server): delete trips.bridge via leaf membership reads and prompt relocation

2026-08-11 20:28:49 +02:00

unsplash

fix(maps): resolve the Places key per instance, not per whoever is asking

2026-08-17 14:48:23 +02:00

weather

refactor(server): move weather out of services/, give its cache sweep a lifecycle (#1835)

2026-08-07 21:47:21 +02:00

accommodations.controller.test.ts

fix: eleven reported bugs across atlas, budget, collections, journey, vacay and the LLM settings (#1923)

2026-08-13 14:06:35 +02:00

accommodations.service.test.ts

fix: eleven reported bugs across atlas, budget, collections, journey, vacay and the LLM settings (#1923)

2026-08-13 14:06:35 +02:00

addon-guard.test.ts

Put the reservation imports behind one door

2026-08-10 17:08:54 +02:00

addons.controller.test.ts

Release 3.1.0 (#1185)

2026-06-16 22:22:45 +02:00

addons.service.test.ts

Give the ephemeral tokens a provider, and clear the next wave of type errors

2026-08-10 19:54:46 +02:00

admin-default-user-settings.controller.test.ts

feat(config): put the operator-owned surfaces behind TREK_MANAGED (#1946)

2026-08-15 16:42:27 +02:00

admin-jobs.test.ts

feat(config): put the operator-owned surfaces behind TREK_MANAGED (#1946)

2026-08-15 16:42:27 +02:00

admin-notification-preferences.controller.test.ts

Give three more admin surfaces back to the domains that own them

2026-08-09 20:54:39 +02:00

admin-packing-templates.controller.test.ts

Finish the contract ratchet, the upload bridge and the client leftovers

2026-08-10 19:54:46 +02:00

admin.controller.test.ts

Finish the contract ratchet, the upload bridge and the client leftovers

2026-08-10 19:54:46 +02:00

admin.service.test.ts

feat(config): put the operator-owned surfaces behind TREK_MANAGED (#1946)

2026-08-15 16:42:27 +02:00

admin.version-notification.test.ts

refactor(server): let user-cleanup inject BudgetService and delete budget.bridge

2026-08-11 16:42:49 +02:00

airports.controller.test.ts

Release 3.1.0 (#1185)

2026-06-16 22:22:45 +02:00

app-config.test.ts

feat(server): add nest AppConfigModule bound to @nestjs/config

2026-07-25 15:12:38 +02:00

assignments.controller.test.ts

fix(assignments): confine day participants to the trip roster

2026-08-16 23:17:50 +02:00

assignments.service.test.ts

fix(assignments): confine day participants to the trip roster

2026-08-16 23:17:50 +02:00

atlas-transfer-endpoints.test.ts

fix(atlas): stop counting a connection airport as a country visited

2026-08-17 14:48:23 +02:00

atlas.controller.test.ts

fix: eleven reported bugs across atlas, budget, collections, journey, vacay and the LLM settings (#1923)

2026-08-13 14:06:35 +02:00

atlas.service.test.ts

fix(atlas): stop counting a connection airport as a country visited

2026-08-17 14:48:23 +02:00

audit-log.logger.test.ts

fix(server): fix the quirks preserved by the permissions and auditLog DI migrations

2026-07-27 22:34:41 +02:00

audit.service.test.ts

fix(maps): resolve the Places key per instance, not per whoever is asking

2026-08-17 14:48:23 +02:00

auth-guard.test.ts

refactor(server): move the JWT verify into nest/auth, delete four dead middlewares (#1828)

2026-08-07 18:01:24 +02:00

auth.controller.test.ts

fix(maps): resolve the Places key per instance, not per whoever is asking

2026-08-17 14:48:23 +02:00

auth.helpers.test.ts

refactor(server): move the stateless helpers into nest/common (#1823)

2026-08-07 15:14:14 +02:00

auth.service.test.ts

feat(auth): sliding session renewal past half the token lifetime (#1927)

2026-08-15 22:48:16 +02:00

auto-backup-settings.test.ts

refactor(server): migrate plugin jobs off node-cron

2026-08-10 22:16:22 +02:00

backup.controller.test.ts

feat(config): put the operator-owned surfaces behind TREK_MANAGED (#1946)

2026-08-15 16:42:27 +02:00

backup.impl.test.ts

refactor(server): move the auto-backup cron into the backup domain

2026-08-10 21:33:48 +02:00

budget.controller.test.ts

Roll TripAccessGuard onto the remaining trip-scoped controllers

2026-08-09 19:46:00 +02:00

budget.service.calc.test.ts

fix: eleven reported bugs across atlas, budget, collections, journey, vacay and the LLM settings (#1923)

2026-08-13 14:06:35 +02:00

budget.service.db.test.ts

fix(budget): confine payers, split members and settlement parties to the trip

2026-08-16 23:17:50 +02:00

budget.service.test.ts

fix(budget): confine payers, split members and settlement parties to the trip

2026-08-16 23:17:50 +02:00

cache-sweep-jobs.test.ts

refactor(server): move the cache sweeps, idempotency purge and airtrail poll in-container

2026-08-10 22:02:54 +02:00

calendar.service.test.ts

fix(planner): keep a parked car off the days between drop-off and pickup

2026-08-17 14:48:23 +02:00

categories.controller.test.ts

Finish the contract ratchet, the upload bridge and the client leftovers

2026-08-10 19:54:46 +02:00

categories.service.test.ts

refactor(plugins): wire PluginHostDepsFactory through DI, drop tags/categories bridges

2026-07-26 15:28:55 +02:00

channel-override.test.ts

refactor(server): delete airtrail.bridge and notifications.instance via a core/pull split

2026-08-11 21:13:32 +02:00

channel-registry.test.ts

Keep the mobile FX widget off the network after unmount

2026-08-10 19:54:46 +02:00

city-from-address.test.ts

feat(atlas): search by place, and count cities that are actually cities (#1908)

2026-08-12 14:14:37 +02:00

collab.controller.test.ts

Roll TripAccessGuard onto the remaining trip-scoped controllers

2026-08-09 19:46:00 +02:00

collab.service.test.ts

Keep the mobile FX widget off the network after unmount

2026-08-10 19:54:46 +02:00

collections.controller.test.ts

refactor(server): one addon guard, one demo-mode condition (#1829)

2026-08-07 18:42:53 +02:00

collections.service.test.ts

fix: eleven reported bugs across atlas, budget, collections, journey, vacay and the LLM settings (#1923)

2026-08-13 14:06:35 +02:00

config.controller.test.ts

Release 3.1.0 (#1185)

2026-06-16 22:22:45 +02:00

cron-registrar.service.test.ts

refactor(server): move the reminder crons onto the injected notifications

2026-08-10 21:49:27 +02:00

database-service.delegation.test.ts

feat(db): provide better-sqlite3 connection via DI token and complete DatabaseService surface

2026-07-25 18:14:37 +02:00

database-service.test.ts

feat(db): provide better-sqlite3 connection via DI token and complete DatabaseService surface

2026-07-25 18:14:37 +02:00

day-notes.service.test.ts

Rich formatting and colours for notes (#1889)

2026-08-11 22:14:12 +02:00

days.controller.test.ts

Rich formatting and colours for notes (#1889)

2026-08-11 22:14:12 +02:00

days.service.test.ts

Delete four bridges with no consumer, and gate what runs outside the container

2026-08-11 09:58:37 +02:00

demo-write.test.ts

refactor(server): one addon guard, one demo-mode condition (#1829)

2026-08-07 18:42:53 +02:00

discovery.controller.test.ts

refactor(server): move health, discovery and consent-COOP behind the container

2026-08-11 22:23:51 +02:00

exception-filter.test.ts

Release 3.1.0 (#1185)

2026-06-16 22:22:45 +02:00

exchange-rates.service.test.ts

refactor(server): let user-cleanup inject BudgetService and delete budget.bridge

2026-08-11 16:42:49 +02:00

features.controller.test.ts

refactor(server): move health, discovery and consent-COOP behind the container

2026-08-11 22:23:51 +02:00

feeds.service.test.ts

Require share_manage for the two public credentials (#1883)

2026-08-11 11:15:32 +02:00

files.controller.test.ts

Give the ephemeral tokens a provider, and clear the next wave of type errors

2026-08-10 19:54:46 +02:00

files.service.test.ts

Finish the contract ratchet, the upload bridge and the client leftovers

2026-08-10 19:54:46 +02:00

geo.nominatim.test.ts

Make a bind failure fatal again, and undo four contract tightenings

2026-08-11 09:58:37 +02:00

gpx-export.helpers.test.ts

feat(places): export a trip as GPX (#1907)

2026-08-12 12:45:29 +02:00

idempotency.interceptor.test.ts

Release 3.1.0 (#1185)

2026-06-16 22:22:45 +02:00

immich.service.test.ts

Write the 404 Immich streaming only returned

2026-08-10 17:08:54 +02:00

journey-domain.service.test.ts

fix(journey): stop unshared trip photos leaking into journeys, and gate the link

2026-08-18 20:17:57 +02:00

journey-share.service.test.ts

Fold the journey domain into Nest and finish the MCP migration

2026-08-08 23:25:57 +02:00

journey.controller.test.ts

One photo provider interface instead of three switches

2026-08-10 17:08:54 +02:00

managed-ext.test.ts

feat(config): put the operator-owned surfaces behind TREK_MANAGED (#1946)

2026-08-15 16:42:27 +02:00

managed-inert.test.ts

feat(config): put the operator-owned surfaces behind TREK_MANAGED (#1946)

2026-08-15 16:42:27 +02:00

managed-keys.test.ts

feat(config): put the operator-owned surfaces behind TREK_MANAGED (#1946)

2026-08-15 16:42:27 +02:00

managed.guard.test.ts

feat(config): put the operator-owned surfaces behind TREK_MANAGED (#1946)

2026-08-15 16:42:27 +02:00

managed.test.ts

feat(config): put the operator-owned surfaces behind TREK_MANAGED (#1946)

2026-08-15 16:42:27 +02:00

maps.controller.test.ts

feat(maps): bill a place search as one session instead of per keystroke

2026-08-14 23:42:51 +02:00

maps.curated-images.test.ts

Ask the sources that know the place before the ones that know the area

2026-08-10 12:24:15 +02:00

maps.identity.test.ts

Match a place name across its inflected forms, and forget an empty answer quickly

2026-08-10 12:24:15 +02:00

maps.service.test.ts

fix(places): keep the Google feature id, and give list imports the free address lookup

2026-08-18 17:40:56 +02:00

mcp-addon-gate.test.ts

refactor(server): providerize the OAuth SDK adapter behind the container

2026-08-11 22:44:20 +02:00

mcp-shared.service.test.ts

refactor(server): fold the _shared MCP helpers into an injectable guards provider; delete the last bridge

2026-08-11 23:11:34 +02:00

mcp-transport.service.test.ts

feat(mcp): audit MCP tool calls at the registry seam

2026-08-11 23:19:39 +02:00

memories-access.service.test.ts

refactor(server): fold the memories domain into providers

2026-08-08 22:27:56 +02:00

memories.controller.test.ts

Finish the contract ratchet, the upload bridge and the client leftovers

2026-08-10 19:54:46 +02:00

memories.service.test.ts

refactor(server): fold the memories domain into providers

2026-08-08 22:27:56 +02:00

mfa-policy.guard.test.ts

Enforce the MFA policy as a guard, and stop 403ing public routes

2026-08-10 13:38:26 +02:00

notification-preferences.service.test.ts

refactor(server): fold the notifications domain out of services/

2026-08-08 12:09:56 +02:00

notification-transports.test.ts

refactor(server): fold the notifications domain out of services/

2026-08-08 12:09:56 +02:00

notifications.controller.test.ts

feat(server): validate notification request bodies

2026-08-02 11:36:36 +02:00

notifications.inapp-prefs.test.ts

refactor(server): fold the notifications domain out of services/

2026-08-08 12:09:56 +02:00

notifications.service.test.ts

refactor(server): delete airtrail.bridge and notifications.instance via a core/pull split

2026-08-11 21:13:32 +02:00

oauth-sdk.provider.test.ts

refactor(server): providerize the OAuth SDK adapter behind the container

2026-08-11 22:44:20 +02:00

oauth.controller.test.ts

Finish the contract ratchet, the upload bridge and the client leftovers

2026-08-10 19:54:46 +02:00

oauth.service.test.ts

feat: six community requests — import dedup, accommodations in the feed, OAuth refresh race, visited-from-trip, journal jumps, phone packing rows (#1915)

2026-08-12 17:43:22 +02:00

oidc-ssrf.test.ts

feat(config): put the operator-owned surfaces behind TREK_MANAGED (#1946)

2026-08-15 16:42:27 +02:00

oidc.controller.test.ts

feat(oidc): honor remember-me in SSO login (#1927)

2026-08-15 22:48:03 +02:00

oidc.service.test.ts

feat(oidc): honor remember-me in SSO login (#1927)

2026-08-15 22:48:03 +02:00

packing.controller.test.ts

Replace the copied requireTrip helpers with a TripAccessGuard

2026-08-09 19:13:21 +02:00

packing.service.test.ts

fix(trips): confine assignee writes to the people on the trip

2026-08-16 23:17:50 +02:00

passkey.service.test.ts

refactor(server): let user-cleanup inject BudgetService and delete budget.bridge

2026-08-11 16:42:49 +02:00

permissions.service.test.ts

refactor(server): fold the _shared MCP helpers into an injectable guards provider; delete the last bridge

2026-08-11 23:11:34 +02:00

photo-provider.test.ts

Write the 404 Immich streaming only returned

2026-08-10 17:08:54 +02:00

photo-resolver.service.test.ts

One photo provider interface instead of three switches

2026-08-10 17:08:54 +02:00

place-enrichment.brand.test.ts

Finish the contract ratchet, the upload bridge and the client leftovers

2026-08-10 19:54:46 +02:00

place-enrichment.controller.test.ts

Make the detail column useful for places no encyclopaedia describes

2026-08-10 12:24:15 +02:00

place-enrichment.description.test.ts

Finish the contract ratchet, the upload bridge and the client leftovers

2026-08-10 19:54:46 +02:00

place-enrichment.service.test.ts

Give the ephemeral tokens a provider, and clear the next wave of type errors

2026-08-10 19:54:46 +02:00

places.controller.test.ts

fix(places): pin the image and website URL fields on the way in

2026-08-16 21:57:21 +02:00

places.enrichment.test.ts

chore: move place backend to proper DI

2026-07-30 17:07:12 +02:00

places.helpers.test.ts

feat: six community requests — import dedup, accommodations in the feed, OAuth refresh race, visited-from-trip, journal jumps, phone packing rows (#1915)

2026-08-12 17:43:22 +02:00

places.service.test.ts

fix(places): keep the Google feature id, and give list imports the free address lookup

2026-08-18 17:40:56 +02:00

platform.controller.test.ts

refactor(server): serve /mcp from a Nest controller; delete auth, audit, addons and oauth bridges

2026-08-11 23:01:19 +02:00

realtime.gateway.test.ts

Make a bind failure fatal again, and undo four contract tightenings

2026-08-11 09:58:37 +02:00

realtime.service.test.ts

Keep the mobile FX widget off the network after unmount

2026-08-10 19:54:46 +02:00

registration-invites.service.test.ts

Return the registration invites to the domain that consumes them

2026-08-09 22:43:05 +02:00

reminder-jobs.service.test.ts

refactor(server): move the reminder crons onto the injected notifications

2026-08-10 21:49:27 +02:00

reservations.controller.test.ts

refactor(server): delete airtrail.bridge and notifications.instance via a core/pull split

2026-08-11 21:13:32 +02:00

reservations.service.test.ts

fix(dashboard): keep hotels out of the upcoming reservations widget

2026-08-14 13:34:13 +02:00

route-inventory.test.ts

Turn protection from opt-in into default-deny

2026-08-10 13:38:26 +02:00

session-renewal.interceptor.test.ts

feat(auth): sliding session renewal past half the token lifetime (#1927)

2026-08-15 22:48:16 +02:00

settings.controller.test.ts

feat(config): put the operator-owned surfaces behind TREK_MANAGED (#1946)

2026-08-15 16:42:27 +02:00

settings.service.test.ts

refactor(server): move the stateless helpers into nest/common (#1823)

2026-08-07 15:14:14 +02:00

share.controller.test.ts

Require share_manage for the two public credentials (#1883)

2026-08-11 11:15:32 +02:00

share.service.test.ts

refactor(server): make the place-photo cache a provider (#1833)

2026-08-07 20:27:19 +02:00

synology.service.test.ts

refactor(server): move the reminder crons onto the injected notifications

2026-08-10 21:49:27 +02:00

system-notices.controller.test.ts

Release 3.1.0 (#1185)

2026-06-16 22:22:45 +02:00

system-notices.service.test.ts

feat(config): put the operator-owned surfaces behind TREK_MANAGED (#1946)

2026-08-15 16:42:27 +02:00

tags.controller.test.ts

Finish the contract ratchet, the upload bridge and the client leftovers

2026-08-10 19:54:46 +02:00

tags.service.test.ts

refactor(plugins): wire PluginHostDepsFactory through DI, drop tags/categories bridges

2026-07-26 15:28:55 +02:00

thumbnail.service.test.ts

refactor(server): fold the memories domain into providers

2026-08-08 22:27:56 +02:00

todo.controller.test.ts

Replace the copied requireTrip helpers with a TripAccessGuard

2026-08-09 19:13:21 +02:00

todo.service.test.ts

fix(trips): confine assignee writes to the people on the trip

2026-08-16 23:17:50 +02:00

token.service.test.ts

Give the ephemeral tokens a provider, and clear the next wave of type errors

2026-08-10 19:54:46 +02:00

transit-itinerary.helpers.test.ts

chore: move transitItineraryService into nest/transit as pure helpers

2026-08-01 12:45:35 +02:00

transit.service.test.ts

chore: move transit backend to proper DI

2026-07-29 21:39:51 +02:00

travel-stats.service.test.ts

fix(atlas): stop counting a connection airport as a country visited

2026-08-17 14:48:23 +02:00

trek-photo-cache.service.test.ts

refactor(server): move the cache sweeps, idempotency purge and airtrail poll in-container

2026-08-10 22:02:54 +02:00

trek-ws-adapter.test.ts

Make a bind failure fatal again, and undo four contract tightenings

2026-08-11 09:58:37 +02:00

trip-access.guard.test.ts

Replace the copied requireTrip helpers with a TripAccessGuard

2026-08-09 19:13:21 +02:00

trip-invite.service.test.ts

Keep the mobile FX widget off the network after unmount

2026-08-10 19:54:46 +02:00

trip-members.controller.test.ts

Make ownership a guard instead of four hand-written checks

2026-08-10 13:38:26 +02:00

trip-members.service.test.ts

refactor(server): let user-cleanup inject BudgetService and delete budget.bridge

2026-08-11 16:42:49 +02:00

trip-owner.guard.test.ts

Make ownership a guard instead of four hand-written checks

2026-08-10 13:38:26 +02:00

trip-read-model.service.test.ts

refactor(server): delete airtrail.bridge and notifications.instance via a core/pull split

2026-08-11 21:13:32 +02:00

trips.controller.test.ts

Give the ephemeral tokens a provider, and clear the next wave of type errors

2026-08-10 19:54:46 +02:00

trips.service.test.ts

fix(packing): authorize every single-item path against the item, not just the trip

2026-08-14 22:09:21 +02:00

unified-memories.service.test.ts

refactor(server): move the reminder crons onto the injected notifications

2026-08-10 21:49:27 +02:00

uploads-root.test.ts

refactor(server): lift the memories vocabulary and the uploads anchor into nest

2026-08-08 22:27:56 +02:00

user-cleanup.service.test.ts

refactor(server): let user-cleanup inject BudgetService and delete budget.bridge

2026-08-11 16:42:49 +02:00

user-profile.service.test.ts

fix(maps): resolve the Places key per instance, not per whoever is asking

2026-08-17 14:48:23 +02:00

vacay.controller.test.ts

fix(vacay): enforce weekend blocking in toggleEntry service

2026-08-12 00:38:41 +02:00

vacay.service.test.ts

fix(vacay): enforce weekend blocking in toggleEntry service

2026-08-12 00:38:41 +02:00

validate-body-contracts.test.ts

feat(server): adopt nestjs-zod with a fail-closed body-contract boot gate

2026-07-26 14:55:13 +02:00

validate-managed-routes.test.ts

feat(config): put the operator-owned surfaces behind TREK_MANAGED (#1946)

2026-08-15 16:42:27 +02:00

weather.controller.test.ts

refactor(server): move weather out of services/, give its cache sweep a lifecycle (#1835)

2026-08-07 21:47:21 +02:00

webauthn-config.service.test.ts

refactor(server): fold webauthn, account erasure, oauth and the wiki out of services/ (#1840)

2026-08-08 11:14:24 +02:00

wiki.test.ts

refactor(server): fold webauthn, account erasure, oauth and the wiki out of services/ (#1840)

2026-08-08 11:14:24 +02:00

wiring.test.ts

Hand the feeds calendar parts instead of a document to re-parse

2026-08-10 13:38:26 +02:00

ws-bind-failure.test.ts

Make a bind failure fatal again, and undo four contract tightenings

2026-08-11 09:58:37 +02:00

zod-pipe.test.ts

Release 3.1.0 (#1185)

2026-06-16 22:22:45 +02:00