From 6a61901e79972bbfe5690636a995e156219b9a8f Mon Sep 17 00:00:00 2001
From: Daniel Dietzler <36593685+danieldietzler@users.noreply.github.com>
Date: Fri, 14 Aug 2026 22:04:32 +0200
Subject: [PATCH] fix: shared link create validation (#30762)

---
 .../specs/server/api/shared-link.e2e-spec.ts  |  6 ++---
 .../shared-link.controller.spec.ts            | 26 +++++++++++++++++--
 server/src/dtos/shared-link.dto.ts            | 25 +++++++++++++++++-
 3 files changed, 51 insertions(+), 6 deletions(-)

diff --git a/e2e/src/specs/server/api/shared-link.e2e-spec.ts b/e2e/src/specs/server/api/shared-link.e2e-spec.ts
index b9f695b48e..af189f49ac 100644
--- a/e2e/src/specs/server/api/shared-link.e2e-spec.ts
+++ b/e2e/src/specs/server/api/shared-link.e2e-spec.ts
@@ -313,17 +313,17 @@ describe('/shared-links', () => {
         .send({ type: SharedLinkType.Album });
 
       expect(status).toBe(400);
-      expect(body).toEqual(expect.objectContaining({ message: 'Invalid albumId' }));
+      expect(body).toEqual(errorDto.validationError([{ path: [], message: 'albumId is required for type ALBUM' }]));
     });
 
     it('should require a valid asset id', async () => {
       const { status, body } = await request(app)
         .post('/shared-links')
         .set('Authorization', `Bearer ${user1.accessToken}`)
-        .send({ type: SharedLinkType.Individual, assetId: uuidDto.notFound });
+        .send({ type: SharedLinkType.Individual, assetIds: [uuidDto.notFound] });
 
       expect(status).toBe(400);
-      expect(body).toEqual(expect.objectContaining({ message: 'Invalid assetIds' }));
+      expect(body).toEqual(expect.objectContaining({ message: 'Not found or no asset.share access' }));
     });
 
     it('should create a shared link', async () => {
diff --git a/server/src/controllers/shared-link.controller.spec.ts b/server/src/controllers/shared-link.controller.spec.ts
index dc069ad267..731baa673f 100644
--- a/server/src/controllers/shared-link.controller.spec.ts
+++ b/server/src/controllers/shared-link.controller.spec.ts
@@ -3,7 +3,7 @@ import { Permission, SharedLinkType } from 'src/enum';
 import { SharedLinkService } from 'src/services/shared-link.service';
 import request from 'supertest';
 import { errorDto } from 'test/medium/responses';
-import { factory } from 'test/small.factory';
+import { factory, newUuid } from 'test/small.factory';
 import { ControllerContext, controllerSetup, mockBaseService } from 'test/utils';
 
 describe(SharedLinkController.name, () => {
@@ -43,9 +43,31 @@ describe(SharedLinkController.name, () => {
     it('should allow an null expiresAt', async () => {
       await request(ctx.getHttpServer())
         .post('/shared-links')
-        .send({ expiresAt: null, type: SharedLinkType.Individual });
+        .send({ expiresAt: null, type: SharedLinkType.Individual, assetIds: [newUuid()] });
       expect(service.create).toHaveBeenCalledWith(undefined, expect.objectContaining({ expiresAt: null }));
     });
+
+    it('should not allow an albumId for share type Individual', async () => {
+      const { status, body } = await request(ctx.getHttpServer())
+        .post('/shared-links')
+        .send({ type: SharedLinkType.Individual, assetIds: [newUuid()], albumId: newUuid() });
+      expect(status).toBe(400);
+      expect(body).toEqual(
+        errorDto.validationError([{ path: [], message: 'albumId can only be used with type ALBUM' }]),
+      );
+      expect(service.create).not.toHaveBeenCalled();
+    });
+
+    it('should not allow assetIds for share type Album', async () => {
+      const { status, body } = await request(ctx.getHttpServer())
+        .post('/shared-links')
+        .send({ type: SharedLinkType.Album, assetIds: [newUuid()], albumId: newUuid() });
+      expect(status).toBe(400);
+      expect(body).toEqual(
+        errorDto.validationError([{ path: [], message: 'assetIds can only be used with type INDIVIDUAL' }]),
+      );
+      expect(service.create).not.toHaveBeenCalled();
+    });
   });
 
   describe('DELETE /shared-links/:id/assets', () => {
diff --git a/server/src/dtos/shared-link.dto.ts b/server/src/dtos/shared-link.dto.ts
index 6763f6ab74..d22875f286 100644
--- a/server/src/dtos/shared-link.dto.ts
+++ b/server/src/dtos/shared-link.dto.ts
@@ -3,7 +3,7 @@ import { SharedLink } from 'src/database';
 import { HistoryBuilder } from 'src/decorators';
 import { AlbumResponseSchema, mapAlbum } from 'src/dtos/album.dto';
 import { AssetResponseSchema, mapAsset } from 'src/dtos/asset-response.dto';
-import { SharedLinkTypeSchema } from 'src/enum';
+import { SharedLinkType, SharedLinkTypeSchema } from 'src/enum';
 import { isoDatetimeToDate } from 'src/validation';
 import z from 'zod';
 
@@ -31,6 +31,29 @@ const SharedLinkCreateSchema = z
     allowDownload: z.boolean().default(true).optional().describe('Allow downloads'),
     showMetadata: z.boolean().default(true).optional().describe('Show metadata'),
   })
+  .superRefine(({ type, albumId, assetIds }, ctx) => {
+    switch (type) {
+      case SharedLinkType.Album: {
+        if (!albumId) {
+          ctx.addIssue(`albumId is required for type ${SharedLinkType.Album}`);
+        }
+        if (assetIds) {
+          ctx.addIssue(`assetIds can only be used with type ${SharedLinkType.Individual}`);
+        }
+        return;
+      }
+      case SharedLinkType.Individual: {
+        if (!assetIds || assetIds.length === 0) {
+          ctx.addIssue(`assetIds are required for type ${SharedLinkType.Individual}`);
+        }
+
+        if (albumId) {
+          ctx.addIssue(`albumId can only be used with type ${SharedLinkType.Album}`);
+        }
+        return;
+      }
+    }
+  })
   .meta({ id: 'SharedLinkCreateDto' });
 
 const SharedLinkEditSchema = z