helpy4/immich
1
0
Fork 0
mirror of https://github.com/immich-app/immich synced 2026-08-15 13:03:57 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

fix: shared link create validation (#30762)

Browse source
This commit is contained in:
Daniel Dietzler 2026-08-14 22:04:32 +02:00 • committed by GitHub
parent b19c4a591e
commit 6a61901e79
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
3 changed files with 51 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

6
e2e/src/specs/server/api/shared-link.e2e-spec.ts
View file

@ -313,17 +313,17 @@ describe('/shared-links', () => {
.send({ type: SharedLinkType.Album });
expect(status).toBe(400);
expect(body).toEqual(expect.objectContaining({ message: 'Invalid albumId' }));
expect(body).toEqual(errorDto.validationError([{ path: [], message: 'albumId is required for type ALBUM' }]));
});
it('should require a valid asset id', async () => {
const { status, body } = await request(app)
.post('/shared-links')
.set('Authorization', `Bearer ${user1.accessToken}`)
.send({ type: SharedLinkType.Individual, assetId: uuidDto.notFound });
.send({ type: SharedLinkType.Individual, assetIds: [uuidDto.notFound] });
expect(status).toBe(400);
expect(body).toEqual(expect.objectContaining({ message: 'Invalid assetIds' }));
expect(body).toEqual(expect.objectContaining({ message: 'Not found or no asset.share access' }));
});
it('should create a shared link', async () => {

26
server/src/controllers/shared-link.controller.spec.ts
View file

@ -3,7 +3,7 @@ import { Permission, SharedLinkType } from 'src/enum';
import { SharedLinkService } from 'src/services/shared-link.service';
import request from 'supertest';
import { errorDto } from 'test/medium/responses';
import { factory } from 'test/small.factory';
import { factory, newUuid } from 'test/small.factory';
import { ControllerContext, controllerSetup, mockBaseService } from 'test/utils';
describe(SharedLinkController.name, () => {
@ -43,9 +43,31 @@ describe(SharedLinkController.name, () => {
it('should allow an null expiresAt', async () => {
await request(ctx.getHttpServer())
.post('/shared-links')
.send({ expiresAt: null, type: SharedLinkType.Individual });
.send({ expiresAt: null, type: SharedLinkType.Individual, assetIds: [newUuid()] });
expect(service.create).toHaveBeenCalledWith(undefined, expect.objectContaining({ expiresAt: null }));
});
it('should not allow an albumId for share type Individual', async () => {
const { status, body } = await request(ctx.getHttpServer())
.post('/shared-links')
.send({ type: SharedLinkType.Individual, assetIds: [newUuid()], albumId: newUuid() });
expect(status).toBe(400);
expect(body).toEqual(
errorDto.validationError([{ path: [], message: 'albumId can only be used with type ALBUM' }]),
);
expect(service.create).not.toHaveBeenCalled();
});
it('should not allow assetIds for share type Album', async () => {
const { status, body } = await request(ctx.getHttpServer())
.post('/shared-links')
.send({ type: SharedLinkType.Album, assetIds: [newUuid()], albumId: newUuid() });
expect(status).toBe(400);
expect(body).toEqual(
errorDto.validationError([{ path: [], message: 'assetIds can only be used with type INDIVIDUAL' }]),
);
expect(service.create).not.toHaveBeenCalled();
});
});
describe('DELETE /shared-links/:id/assets', () => {

25
server/src/dtos/shared-link.dto.ts
View file

@ -3,7 +3,7 @@ import { SharedLink } from 'src/database';
import { HistoryBuilder } from 'src/decorators';
import { AlbumResponseSchema, mapAlbum } from 'src/dtos/album.dto';
import { AssetResponseSchema, mapAsset } from 'src/dtos/asset-response.dto';
import { SharedLinkTypeSchema } from 'src/enum';
import { SharedLinkType, SharedLinkTypeSchema } from 'src/enum';
import { isoDatetimeToDate } from 'src/validation';
import z from 'zod';
@ -31,6 +31,29 @@ const SharedLinkCreateSchema = z
allowDownload: z.boolean().default(true).optional().describe('Allow downloads'),
showMetadata: z.boolean().default(true).optional().describe('Show metadata'),
})
.superRefine(({ type, albumId, assetIds }, ctx) => {
switch (type) {
case SharedLinkType.Album: {
if (!albumId) {
ctx.addIssue(`albumId is required for type ${SharedLinkType.Album}`);
}
if (assetIds) {
ctx.addIssue(`assetIds can only be used with type ${SharedLinkType.Individual}`);
}
return;
}
case SharedLinkType.Individual: {
if (!assetIds || assetIds.length === 0) {
ctx.addIssue(`assetIds are required for type ${SharedLinkType.Individual}`);
}
if (albumId) {
ctx.addIssue(`albumId can only be used with type ${SharedLinkType.Album}`);
}
return;
}
}
})
.meta({ id: 'SharedLinkCreateDto' });
const SharedLinkEditSchema = z