paul/picpeak
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 1 Wiki Activity

fix: enforce gallery access and consolidate gallery workflows (#1357)

Browse Source 
Harden gallery authentication and authorization, consolidate gallery workflows, and prevent token-bearing URLs from leaking through nginx request error logs.
This commit is contained in:
Paul Nothaft
2026-09-08 15:34:09 +02:00
committed by GitHub
parent 895e5ab3cc
commit f0e6d2dfb1
120 changed files with 7147 additions and 8525 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/usage-coverage.v5.json
+81 -26
View File
@@ -1413,32 +1413,7 @@
"decision": "excluded",
"signals": [],
"reason": "Public/customer/gallery/visitor surface or existing optional third-party analytics proxy: no product-usage middleware, callbacks, counters or report triggers.",
"route_signatures": [
"GET /resolve/:identifier",
"GET /:slug/verify-token/:token",
"GET /:slug/info",
"GET /:slug/show/:token/session",
"GET /:slug/show/:token/state",
"GET /:slug/photos",
"GET /:slug/people",
"PATCH /:slug/photos/:photoId/visibility",
"PATCH /:slug/photos/visibility/bulk",
"GET /:slug/download/:photoId",
"GET /:slug/download-all",
"POST /:slug/download-selected",
"POST /:slug/download-jobs",
"GET /:slug/download-jobs/:token",
"GET /:slug/download-jobs/:token/file",
"POST /:slug/photo/:photoId/view",
"GET /:slug/photo/:photoId",
"GET /:slug/thumbnail/:photoId",
"GET /:slug/hero/:photoId",
"GET /:slug/preview/:photoId",
"GET /:slug/stats",
"POST /:eventId/upload",
"GET /:slug/uploads/status",
"GET /:slug/css-template"
]
"route_signatures": []
},
"galleryFeedback.js": {
"decision": "excluded",
@@ -1603,6 +1578,86 @@
"GET /events/:id/share-link",
"GET /events/:id/photos"
]
},
"gallery/downloads.js": {
"decision": "excluded",
"signals": [],
"reason": "Public/customer/gallery/visitor surface or existing optional third-party analytics proxy: no product-usage middleware, callbacks, counters or report triggers.",
"route_signatures": [
"GET /:slug/download/:photoId",
"GET /:slug/download-all",
"POST /:slug/download-selected",
"POST /:slug/download-jobs",
"GET /:slug/download-jobs/:token",
"GET /:slug/download-jobs/:token/file"
]
},
"gallery/media.js": {
"decision": "excluded",
"signals": [],
"reason": "Public/customer/gallery/visitor surface or existing optional third-party analytics proxy: no product-usage middleware, callbacks, counters or report triggers.",
"route_signatures": [
"POST /:slug/photo/:photoId/view",
"GET /:slug/photo/:photoId",
"GET /:slug/thumbnail/:photoId",
"GET /:slug/hero/:photoId",
"GET /:slug/preview/:photoId"
]
},
"gallery/metadata.js": {
"decision": "excluded",
"signals": [],
"reason": "Public/customer/gallery/visitor surface or existing optional third-party analytics proxy: no product-usage middleware, callbacks, counters or report triggers.",
"route_signatures": [
"GET /resolve/:identifier",
"GET /:slug/verify-token/:token",
"GET /:slug/info"
]
},
"gallery/photos.js": {
"decision": "excluded",
"signals": [],
"reason": "Public/customer/gallery/visitor surface or existing optional third-party analytics proxy: no product-usage middleware, callbacks, counters or report triggers.",
"route_signatures": [
"GET /:slug/photos",
"GET /:slug/people",
"PATCH /:slug/photos/:photoId/visibility",
"PATCH /:slug/photos/visibility/bulk"
]
},
"gallery/slideshow.js": {
"decision": "excluded",
"signals": [],
"reason": "Public/customer/gallery/visitor surface or existing optional third-party analytics proxy: no product-usage middleware, callbacks, counters or report triggers.",
"route_signatures": [
"GET /:slug/show/:token/session",
"GET /:slug/show/:token/state"
]
},
"gallery/stats.js": {
"decision": "excluded",
"signals": [],
"reason": "Public/customer/gallery/visitor surface or existing optional third-party analytics proxy: no product-usage middleware, callbacks, counters or report triggers.",
"route_signatures": [
"GET /:slug/stats"
]
},
"gallery/styles.js": {
"decision": "excluded",
"signals": [],
"reason": "Public/customer/gallery/visitor surface or existing optional third-party analytics proxy: no product-usage middleware, callbacks, counters or report triggers.",
"route_signatures": [
"GET /:slug/css-template"
]
},
"gallery/uploads.js": {
"decision": "excluded",
"signals": [],
"reason": "Public/customer/gallery/visitor surface or existing optional third-party analytics proxy: no product-usage middleware, callbacks, counters or report triggers.",
"route_signatures": [
"POST /:eventId/upload",
"GET /:slug/uploads/status"
]
}
},
"feature_flags": {