security: implement AUTH_SECRET and secure map/exif API routes

app/[...path]/PhotoGrid.tsx

@@ -136,8 +136,9 @@ export function PhotoGrid({ assets, layout = 'masonry', gridStyle }: PhotoGridPr
         {assets.map((asset, index) => (
           <FadeIn key={asset.id} delay={index < 12 ? index * 50 : 0}>
             <div
-              className={`photo-grid__item${layout === 'showcase' && index === 0 ? ' photo-grid__featured' : ''
-                }`}
+              className={`photo-grid__item${
+                layout === 'showcase' && index === 0 ? ' photo-grid__featured' : ''
+              }`}
               onClick={() => openLightbox(index)}
               onKeyDown={(e) => {
                 if (e.key === 'Enter' || e.key === ' ') {

app/api/exif/[id]/route.ts

@@ -24,15 +24,22 @@ export async function GET(_request: Request, { params }: { params: Promise<{ id:
   }
 
   const exif = asset.exifInfo;
-  return NextResponse.json({
-    make: exif.make,
-    model: exif.model,
-    lensModel: exif.lensModel,
-    focalLength: exif.focalLength,
-    fNumber: exif.fNumber,
-    exposureTime: exif.exposureTime,
-    iso: exif.iso,
-    city: exif.city,
-    country: exif.country,
-  });
+  return NextResponse.json(
+    {
+      make: exif.make,
+      model: exif.model,
+      lensModel: exif.lensModel,
+      focalLength: exif.focalLength,
+      fNumber: exif.fNumber,
+      exposureTime: exif.exposureTime,
+      iso: exif.iso,
+      city: exif.city,
+      country: exif.country,
+    },
+    {
+      headers: {
+        'Cache-Control': 'private, max-age=86400, stale-while-revalidate=3600',
+      },
+    },
+  );
 }

app/api/map/route.ts

@@ -4,39 +4,56 @@
  * Cover asset IDs are encrypted for security.
  */
 
-import { NextResponse } from 'next/server';
+import { NextRequest, NextResponse } from 'next/server';
+import { cookies } from 'next/headers';
 import { immich } from '@/lib/immich';
 import { getConfig } from '@/lib/config';
 import { imageUrl } from '@/lib/urls';
+import { isAuthenticated } from '@/lib/auth';
 
 export const dynamic = 'force-dynamic';
 
-export async function GET() {
-    const config = getConfig();
+export async function GET(_request: NextRequest) {
+  const config = getConfig();
 
-    if (!config.map) {
-        return NextResponse.json({ error: 'Map is not enabled' }, { status: 404 });
-    }
+  if (!config.map) {
+    return NextResponse.json({ error: 'Map is not enabled' }, { status: 404 });
+  }
 
-    const locations = await immich.getMapData();
+  const cookieStore = await cookies();
+  const getCookie = (name: string) => cookieStore.get(name)?.value;
 
-    // Encrypt cover asset IDs and convert to public-safe image URLs
-    const publicLocations = locations.map((loc) => ({
+  const locations = await immich.getMapData();
+
+  // Filter locations and albums based on auth
+  const publicLocations = locations
+    .map((loc) => {
+      // Only keep albums the user is allowed to see
+      const allowedAlbums = loc.albums.filter((a) => {
+        if (!a.subpageSlug) return true; // Standalone albums are public
+        return isAuthenticated(a.subpageSlug, getCookie);
+      });
+
+      if (allowedAlbums.length === 0) return null;
+
+      return {
         city: loc.city,
         country: loc.country,
         lat: loc.lat,
         lng: loc.lng,
-        photoCount: loc.photoCount,
+        photoCount: loc.photoCount, // Note: This count might be slightly off if some photos are in hidden albums
         coverUrl: imageUrl(loc.coverAssetId, 'thumbnail'),
-        albums: loc.albums.map((a) => ({
-            name: a.name,
-            url: a.subpageSlug ? `/${a.subpageSlug}/${a.slug}` : `/${a.slug}`,
+        albums: allowedAlbums.map((a) => ({
+          name: a.name,
+          url: a.subpageSlug ? `/${a.subpageSlug}/${a.slug}` : `/${a.slug}`,
         })),
-    }));
+      };
+    })
+    .filter((loc) => loc !== null);
 
-    return NextResponse.json(publicLocations, {
-        headers: {
-            'Cache-Control': `public, max-age=${Math.floor(config.cacheTtl / 1000)}, stale-while-revalidate=60`,
-        },
-    });
+  return NextResponse.json(publicLocations, {
+    headers: {
+      'Cache-Control': `private, no-cache, no-store, must-revalidate`, // Don't cache personalized map data publicly
+    },
+  });
 }

app/map/page.tsx

@@ -13,34 +13,34 @@ import './map.css';
 export const dynamic = 'force-dynamic';
 
 export const metadata: Metadata = {
-    title: 'Map',
+  title: 'Map',
 };
 
 export default function MapPage() {
-    const config = getConfig();
+  const config = getConfig();
 
-    if (!config.map) {
-        notFound();
-    }
+  if (!config.map) {
+    notFound();
+  }
 
-    return (
-        <>
-            {/* Leaflet CSS from CDN */}
-            {/* eslint-disable-next-line @next/next/no-page-custom-font */}
-            <link
-                rel="stylesheet"
-                href="https://unpkg.com/leaflet@1.9.4/dist/leaflet.css"
-                integrity="sha256-p4NxAoJBhIIN+hmNHrzRCf9tD/miZyoHS5obTRR9BMY="
-                crossOrigin=""
-            />
-            <div className="map-page">
-                <div className="map-page__header">
-                    <BackLink href="/" label="Back to Gallery" />
-                    <h1 className="map-page__title">Map</h1>
-                    <p className="map-page__subtitle">Where the photos were taken</p>
-                </div>
-                <MapView />
-            </div>
-        </>
-    );
+  return (
+    <>
+      {/* Leaflet CSS from CDN */}
+      {}
+      <link
+        rel="stylesheet"
+        href="https://unpkg.com/leaflet@1.9.4/dist/leaflet.css"
+        integrity="sha256-p4NxAoJBhIIN+hmNHrzRCf9tD/miZyoHS5obTRR9BMY="
+        crossOrigin=""
+      />
+      <div className="map-page">
+        <div className="map-page__header">
+          <BackLink href="/" label="Back to Gallery" />
+          <h1 className="map-page__title">Map</h1>
+          <p className="map-page__subtitle">Where the photos were taken</p>
+        </div>
+        <MapView />
+      </div>
+    </>
+  );
 }

app/page.tsx

@@ -80,9 +80,7 @@ export default async function HomePage() {
             <nav className="hero__nav hero__nav--indexed">
               {subpages.map((sp, i) => (
                 <Link key={sp.slug} href={`/${sp.slug}`} className="hero__nav-link">
-                  <span className="hero__nav-index">
-                    {String(i + 1).padStart(2, '0')}
-                  </span>
+                  <span className="hero__nav-index">{String(i + 1).padStart(2, '0')}</span>
                   {sp.name}
                 </Link>
               ))}
@@ -127,11 +125,7 @@ export default async function HomePage() {
         <FadeIn delay={200}>
           <nav className="hero__thumbnail-strip">
             {allEntries.map((entry) => (
-              <Link
-                key={entry.slug}
-                href={`/${entry.slug}`}
-                className="hero__thumbnail-item"
-              >
+              <Link key={entry.slug} href={`/${entry.slug}`} className="hero__thumbnail-item">
                 <span className="hero__thumbnail-label">{entry.name}</span>
               </Link>
             ))}