release: v0.12.0 (#520)

Forty-one commits since v0.11.0. See CHANGELOG.md for the full list and the upgrade notes.

app/api/exif/[id]/route.ts

@@ -10,14 +10,16 @@ import { immich, ImmichUnavailableError } from '@/lib/immich';
 import { decodeAssetId } from '@/lib/tokens';
 import { getConfig } from '@/lib/config';
 import { checkRateLimit, getClientIp, retryAfterSeconds } from '@/lib/rate-limit';
+import { siteLockResponse } from '@/lib/auth';
 
 export async function GET(request: NextRequest, { params }: { params: Promise<{ id: string }> }) {
   const config = getConfig();
 
-  // exifOnHover only gates the *technical* fields below. The asset description
-  // (EXPERIMENTAL caption) is editorial content, so the route stays reachable
-  // and serves captions even when EXIF display is disabled.
-  const exifEnabled = config.exifOnHover;
+  // Which groups this site publishes. The description used to be served
+  // unconditionally as editorial caption, which made it the one field an
+  // operator could not switch off — the problem behind #506. It is a group like
+  // any other now.
+  const show = config.exif;
 
   // ── Rate limiting ──────────────────────────────────
   const ip = getClientIp(request);
@@ -35,6 +37,11 @@ export async function GET(request: NextRequest, { params }: { params: Promise<{
     );
   }
 
+  // The page-level gate does not cover route handlers — without this a locked
+  // site would still serve to anyone holding the URL.
+  const locked = siteLockResponse(request);
+  if (locked) return locked;
+
   const { id: token } = await params;
 
   // Decode the opaque token back to an Immich asset ID
@@ -64,28 +71,38 @@ export async function GET(request: NextRequest, { params }: { params: Promise<{
   }
 
   const exif = asset.exifInfo;
-  const caption = exif.description?.trim() || undefined;
-  return NextResponse.json(
-    {
-      ...(exifEnabled
-        ? {
-            make: exif.make,
-            model: exif.model,
-            lensModel: exif.lensModel,
-            focalLength: exif.focalLength,
-            fNumber: exif.fNumber,
-            exposureTime: exif.exposureTime,
-            iso: exif.iso,
-            city: exif.city,
-            country: exif.country,
-          }
-        : {}),
-      ...(caption ? { description: caption } : {}),
+  const caption = show.caption ? exif.description?.trim() || undefined : undefined;
+
+  const payload = {
+    ...(show.camera
+      ? {
+          make: exif.make,
+          model: exif.model,
+          lensModel: exif.lensModel,
+          focalLength: exif.focalLength,
+        }
+      : {}),
+    ...(show.settings
+      ? {
+          fNumber: exif.fNumber,
+          exposureTime: exif.exposureTime,
+          iso: exif.iso,
+        }
+      : {}),
+    ...(show.location ? { city: exif.city, country: exif.country } : {}),
+    ...(caption ? { description: caption } : {}),
+  };
+
+  // Every group is switched off, or this asset carries nothing from the ones
+  // that are on. Say "no data" rather than answering with an empty object, which
+  // the lightbox would render as a blank panel.
+  if (Object.values(payload).every((value) => value === null || value === undefined)) {
+    return NextResponse.json({ error: 'No EXIF data' }, { status: 404 });
+  }
+
+  return NextResponse.json(payload, {
+    headers: {
+      'Cache-Control': 'private, max-age=86400, stale-while-revalidate=3600',
     },
-    {
-      headers: {
-        'Cache-Control': 'private, max-age=86400, stale-while-revalidate=3600',
-      },
-    },
-  );
+  });
 }

app/api/exif/__tests__/exif-route.test.ts

@@ -1,10 +1,11 @@
 import { describe, it, expect, vi, beforeEach } from 'vitest';
 
 /**
- * EXPERIMENTAL captions (L10): the route serves the Immich asset description
- * as a caption. Captions are editorial, not technical — so exifOnHover: false
- * must strip the technical fields but still serve the caption, instead of the
- * old blanket 403.
+ * The route serves the Immich asset description as a caption. It used to do so
+ * unconditionally — captions were treated as editorial rather than technical —
+ * which left it as the one field an operator could not hide (#506). Each group
+ * is now switchable, and `exifOnHover: false` keeps meaning "no technical EXIF"
+ * without touching captions.
  */
 
 vi.mock('@/lib/config', () => ({
@@ -27,6 +28,8 @@ vi.mock('@/lib/rate-limit', () => ({
 }));
 
 import { GET } from '../[id]/route';
+// Not from '@/lib/config' — that module is mocked above.
+import { resolveExifDisplay, type ExifDisplayYaml } from '@/lib/config/schema';
 import { getConfig } from '@/lib/config';
 import { immich } from '@/lib/immich';
 import { NextRequest } from 'next/server';
@@ -55,6 +58,15 @@ function makeRequest() {
 
 const params = { params: Promise.resolve({ id: 'token123' }) };
 
+/** A config shaped the way getConfig() builds it, for the groups under test. */
+function configWith(raw?: ExifDisplayYaml, exifOnHover?: boolean) {
+  return {
+    exifOnHover: exifOnHover !== false,
+    exif: resolveExifDisplay(raw, exifOnHover),
+    rateLimitRpm: 120,
+  };
+}
+
 beforeEach(() => {
   vi.clearAllMocks();
   mockAssetInfo.mockResolvedValue(EXIF_ASSET);
@@ -62,7 +74,7 @@ beforeEach(() => {
 
 describe('GET /api/exif/[id] captions', () => {
   it('includes the trimmed description alongside technical fields', async () => {
-    mockConfig.mockReturnValue({ exifOnHover: true, rateLimitRpm: 120 });
+    mockConfig.mockReturnValue(configWith());
 
     const res = await GET(makeRequest(), params);
     expect(res.status).toBe(200);
@@ -72,7 +84,7 @@ describe('GET /api/exif/[id] captions', () => {
   });
 
   it('serves only the caption when exifOnHover is disabled', async () => {
-    mockConfig.mockReturnValue({ exifOnHover: false, rateLimitRpm: 120 });
+    mockConfig.mockReturnValue(configWith(undefined, false));
 
     const res = await GET(makeRequest(), params);
     expect(res.status).toBe(200);
@@ -83,7 +95,7 @@ describe('GET /api/exif/[id] captions', () => {
   });
 
   it('omits the description entirely when the asset has none', async () => {
-    mockConfig.mockReturnValue({ exifOnHover: true, rateLimitRpm: 120 });
+    mockConfig.mockReturnValue(configWith());
     mockAssetInfo.mockResolvedValue({
       exifInfo: { ...EXIF_ASSET.exifInfo, description: null },
     });
@@ -92,4 +104,51 @@ describe('GET /api/exif/[id] captions', () => {
     const body = await res.json();
     expect(body).not.toHaveProperty('description');
   });
+
+  it('drops the caption when the group is off', async () => {
+    mockConfig.mockReturnValue(configWith({ caption: false }));
+
+    const body = await (await GET(makeRequest(), params)).json();
+    expect(body).not.toHaveProperty('description');
+    expect(body.model).toBe('X-T5');
+  });
+
+  it('drops the location without touching the camera', async () => {
+    mockConfig.mockReturnValue(configWith({ location: false }));
+
+    const body = await (await GET(makeRequest(), params)).json();
+    expect(body).not.toHaveProperty('city');
+    expect(body).not.toHaveProperty('country');
+    expect(body.model).toBe('X-T5');
+    expect(body.iso).toBe(200);
+  });
+
+  it('drops the exposure settings without touching the camera', async () => {
+    mockConfig.mockReturnValue(configWith({ settings: false }));
+
+    const body = await (await GET(makeRequest(), params)).json();
+    expect(body).not.toHaveProperty('iso');
+    expect(body).not.toHaveProperty('fNumber');
+    expect(body.lensModel).toBe('XF 35mm');
+  });
+
+  /** An empty object would render as a blank panel rather than "no data". */
+  it('answers 404 when every group is switched off', async () => {
+    mockConfig.mockReturnValue(
+      configWith({ camera: false, settings: false, location: false, caption: false }),
+    );
+
+    const res = await GET(makeRequest(), params);
+    expect(res.status).toBe(404);
+  });
+
+  it('answers 404 when the enabled groups carry nothing for this asset', async () => {
+    mockConfig.mockReturnValue(configWith({ camera: false, settings: false, caption: false }));
+    mockAssetInfo.mockResolvedValue({
+      exifInfo: { ...EXIF_ASSET.exifInfo, city: null, country: null },
+    });
+
+    const res = await GET(makeRequest(), params);
+    expect(res.status).toBe(404);
+  });
 });