paul/picpeak
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 1 Wiki Activity

fix: enforce gallery access and consolidate gallery workflows

Browse Source 
Apply shared session, permission, ownership and lifecycle checks across
gallery access, media grants and session restoration. Validate mutation
origins, pin webhook DNS resolution and redact token-bearing request URLs.

Consolidate gallery creation and queries, extract frontend state hooks,
fix hook ordering and resource cleanup, and repair the fresh event schema.
Update affected dependencies and restore excluded CI suites with regression
and cross-database coverage.
This commit is contained in:
Paul Nothaft
2026-09-08 11:10:03 +02:00
parent 895e5ab3cc
commit d1c582396a
115 changed files with 6756 additions and 8512 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/usage-coverage.v5.json
+81 -26
View File
@@ -1413,32 +1413,7 @@
"decision": "excluded",
"signals": [],
"reason": "Public/customer/gallery/visitor surface or existing optional third-party analytics proxy: no product-usage middleware, callbacks, counters or report triggers.",
"route_signatures": [
"GET /resolve/:identifier",
"GET /:slug/verify-token/:token",
"GET /:slug/info",
"GET /:slug/show/:token/session",
"GET /:slug/show/:token/state",
"GET /:slug/photos",
"GET /:slug/people",
"PATCH /:slug/photos/:photoId/visibility",
"PATCH /:slug/photos/visibility/bulk",
"GET /:slug/download/:photoId",
"GET /:slug/download-all",
"POST /:slug/download-selected",
"POST /:slug/download-jobs",
"GET /:slug/download-jobs/:token",
"GET /:slug/download-jobs/:token/file",
"POST /:slug/photo/:photoId/view",
"GET /:slug/photo/:photoId",
"GET /:slug/thumbnail/:photoId",
"GET /:slug/hero/:photoId",
"GET /:slug/preview/:photoId",
"GET /:slug/stats",
"POST /:eventId/upload",
"GET /:slug/uploads/status",
"GET /:slug/css-template"
]
"route_signatures": []
},
"galleryFeedback.js": {
"decision": "excluded",
@@ -1603,6 +1578,86 @@
"GET /events/:id/share-link",
"GET /events/:id/photos"
]
},
"gallery/downloads.js": {
"decision": "excluded",
"signals": [],
"reason": "Public/customer/gallery/visitor surface or existing optional third-party analytics proxy: no product-usage middleware, callbacks, counters or report triggers.",
"route_signatures": [
"GET /:slug/download/:photoId",
"GET /:slug/download-all",
"POST /:slug/download-selected",
"POST /:slug/download-jobs",
"GET /:slug/download-jobs/:token",
"GET /:slug/download-jobs/:token/file"
]
},
"gallery/media.js": {
"decision": "excluded",
"signals": [],
"reason": "Public/customer/gallery/visitor surface or existing optional third-party analytics proxy: no product-usage middleware, callbacks, counters or report triggers.",
"route_signatures": [
"POST /:slug/photo/:photoId/view",
"GET /:slug/photo/:photoId",
"GET /:slug/thumbnail/:photoId",
"GET /:slug/hero/:photoId",
"GET /:slug/preview/:photoId"
]
},
"gallery/metadata.js": {
"decision": "excluded",
"signals": [],
"reason": "Public/customer/gallery/visitor surface or existing optional third-party analytics proxy: no product-usage middleware, callbacks, counters or report triggers.",
"route_signatures": [
"GET /resolve/:identifier",
"GET /:slug/verify-token/:token",
"GET /:slug/info"
]
},
"gallery/photos.js": {
"decision": "excluded",
"signals": [],
"reason": "Public/customer/gallery/visitor surface or existing optional third-party analytics proxy: no product-usage middleware, callbacks, counters or report triggers.",
"route_signatures": [
"GET /:slug/photos",
"GET /:slug/people",
"PATCH /:slug/photos/:photoId/visibility",
"PATCH /:slug/photos/visibility/bulk"
]
},
"gallery/slideshow.js": {
"decision": "excluded",
"signals": [],
"reason": "Public/customer/gallery/visitor surface or existing optional third-party analytics proxy: no product-usage middleware, callbacks, counters or report triggers.",
"route_signatures": [
"GET /:slug/show/:token/session",
"GET /:slug/show/:token/state"
]
},
"gallery/stats.js": {
"decision": "excluded",
"signals": [],
"reason": "Public/customer/gallery/visitor surface or existing optional third-party analytics proxy: no product-usage middleware, callbacks, counters or report triggers.",
"route_signatures": [
"GET /:slug/stats"
]
},
"gallery/styles.js": {
"decision": "excluded",
"signals": [],
"reason": "Public/customer/gallery/visitor surface or existing optional third-party analytics proxy: no product-usage middleware, callbacks, counters or report triggers.",
"route_signatures": [
"GET /:slug/css-template"
]
},
"gallery/uploads.js": {
"decision": "excluded",
"signals": [],
"reason": "Public/customer/gallery/visitor surface or existing optional third-party analytics proxy: no product-usage middleware, callbacks, counters or report triggers.",
"route_signatures": [
"POST /:eventId/upload",
"GET /:slug/uploads/status"
]
}
},
"feature_flags": {