Files
Immich/server/src/services/timeline.service.ts
T
bo0tzzandCodex f80be1030b fix(server): restrict partner timeline requests to timeline assets (#32565)
* fix(server): restrict partner timeline requests to timeline assets

* test(server): update medium timeline tests for consolidated check

(cherry picked from commit e9fb180f466a687cebda9b7e17cef403de4b81fa)
2026-10-22 05:21:00 +03:00

81 lines
2.9 KiB
TypeScript

import { BadRequestException, Injectable } from '@nestjs/common';
import { AuthDto, isMetadataHidden } from 'src/dtos/auth.dto.js';
import { TimeBucketAssetDto, TimeBucketDto, TimeBucketsResponseDto } from 'src/dtos/time-bucket.dto.js';
import { AssetVisibility, Permission } from 'src/enum.js';
import { TimeBucketOptions } from 'src/repositories/asset.repository.js';
import { BaseService } from 'src/services/base.service.js';
import { requireElevatedPermission } from 'src/utils/access.js';
import { getMyPartnerIds } from 'src/utils/asset.util.js';
@Injectable()
export class TimelineService extends BaseService {
async getTimeBuckets(auth: AuthDto, dto: TimeBucketDto): Promise<TimeBucketsResponseDto[]> {
await this.timeBucketChecks(auth, dto);
const timeBucketOptions = await this.buildTimeBucketOptions(auth, dto);
return await this.assetRepository.getTimeBuckets(timeBucketOptions, auth);
}
// pre-jsonified response
async getTimeBucket(auth: AuthDto, dto: TimeBucketAssetDto): Promise<string> {
await this.timeBucketChecks(auth, dto);
const timeBucketOptions = await this.buildTimeBucketOptions(auth, { ...dto });
// TODO: use id cursor for pagination
const bucket = await this.assetRepository.getTimeBucket(dto.timeBucket, timeBucketOptions, auth);
return bucket.assets;
}
private async buildTimeBucketOptions(auth: AuthDto, dto: TimeBucketDto): Promise<TimeBucketOptions> {
const { userId, ...options } = dto;
let userIds: string[] | undefined;
if (userId) {
userIds = [userId];
if (dto.withPartners) {
const partnerIds = await getMyPartnerIds({
userId: auth.user.id,
repository: this.partnerRepository,
timelineEnabled: !options.personId || undefined,
});
userIds.push(...partnerIds);
}
}
return { ...options, userIds };
}
private async timeBucketChecks(auth: AuthDto, dto: TimeBucketDto) {
if (dto.visibility === AssetVisibility.Locked) {
requireElevatedPermission(auth);
}
if (dto.albumId) {
await this.requireAccess({ auth, permission: Permission.AlbumRead, ids: [dto.albumId] });
} else {
dto.userId ||= auth.user.id;
}
if (dto.userId) {
await this.requireAccess({ auth, permission: Permission.TimelineRead, ids: [dto.userId] });
}
const includesOtherUsers = dto.withPartners || (dto.userId && dto.userId !== auth.user.id);
if (includesOtherUsers) {
dto.visibility ??= AssetVisibility.Timeline;
if (dto.visibility !== AssetVisibility.Timeline || dto.isTrashed || dto.isFavorite !== undefined) {
throw new BadRequestException(
'Only non-archived, non-trashed, non-favorited, non-locked assets can be requested for other users',
);
}
}
if (dto.tagId) {
await this.requireAccess({ auth, permission: Permission.TagRead, ids: [dto.tagId] });
}
if (isMetadataHidden(auth)) {
dto.withCoordinates = false;
}
}
}