Koko210/immich-folio
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

release: v0.19.0

Browse Source 
Release v0.19.0. See the `## [0.19.0] — 2026-09-29` section of
[CHANGELOG.md](https://github.com/ralksta/immich-folio/blob/dev/CHANGELOG.md)
for the full list.

Highlights: client proofing links (#683), custom content pages (#738),
asset picker search (#740), concurrent-edit detection (#742), env-locked
settings (#739), an accessibility baseline (#741), three security fixes
with advisories (#737, #755, #759), and a pre-release quality pass
(#780–#797).

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
Co-authored-by: Ralf <rohlenbo79@gmail.com>
Co-authored-by: Paul Thies <110185070+ImScheinox@users.noreply.github.com>
Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
Co-authored-by: Lance Martin <lancetaylor95@gmail.com>
This commit is contained in:
Ralksta
2026-09-29 22:50:30 +02:00
committed by GitHub
parent 5f251923f0
commit ad8b09700b
297 changed files with 19398 additions and 1800 deletions
Download Patch File Download Diff File Expand all files Collapse all files

22
app/api/analytics/__tests__/track-route.test.ts
View File

@@ -108,6 +108,28 @@ describe('POST /api/analytics/track', () => {
expect(Object.keys(data.days[dateKey].pages)).toEqual(['/journal']);
});
it('records a client proofing link without its token', async () => {
// The token in /proof/<token> is the client's only credential; the counter
// must not copy it into a file that is neither 0600 nor meant to hold one.
const token = 'AbCdEfGhIjKlMnOpQrStUvWxYz012345';
for (const path of [`/proof/${token}`, `/proof/${token}/`, `/proof/${token}?x=1`]) {
await post({ path });
const data = savedData();
const [dateKey] = Object.keys(data.days);
expect(JSON.stringify(data), path).not.toContain(token);
expect(data.days[dateKey].pages, path).toEqual({ '/proof': 1 });
}
});
it('leaves paths that merely start with "proof" alone', async () => {
await post({ path: '/proofreading' });
const data = savedData();
const [dateKey] = Object.keys(data.days);
expect(Object.keys(data.days[dateKey].pages)).toEqual(['/proofreading']);
});
it('caps distinct page keys per day without dropping the pageview itself', async () => {
const dateKey = new Date().toISOString().split('T')[0];
const pages: Record<string, number> = {};

12
app/api/analytics/track/route.ts
View File

@@ -23,6 +23,16 @@ const MAX_PAGES_PER_DAY = 500;
/** Well past any real route on this app; anything longer is not a path someone navigated to. */
const MAX_PATH_LENGTH = 200;
/**
* The path as it is counted. A client proofing link's path carries its token
* (/proof/<token>), which is the client's only credential: proofing.json is
* written 0600 for that reason, and this file is not. Every link is counted as
* `/proof`, so the counter never holds a working link.
*/
function countedPath(pagePath: string): string {
return /^\/proof(?:\/|$)/.test(pagePath) ? '/proof' : pagePath;
}
interface AnalyticsData {
summary: {
totalViews: number;
@@ -92,7 +102,7 @@ export async function POST(req: NextRequest) {
const body = await req.json().catch(() => null);
const rawPath = typeof body?.path === 'string' ? body.path : '/';
const pagePath = (rawPath.split('?')[0].slice(0, MAX_PATH_LENGTH) || '/') as string;
const pagePath = countedPath(rawPath.split('?')[0].slice(0, MAX_PATH_LENGTH) || '/');
const userAgent = req.headers.get('user-agent') || '';
const isMobile = /mobile|iphone|ipad|android/i.test(userAgent);
const deviceType = isMobile ? 'mobile' : 'desktop';