* feat: workflow asset tag trigger and filter
* feat(web): show tag names in workflow editor
* fix(web): tag picker in schema config editor
* fix: invalid plugin manifest
* chore: update workflow method wrapper type
* chore: update tag filter method declaration
* feat: workflow action to add tags to assets
Addresses the first column of issue #28832: album.description now stores
and returns null instead of an empty string.
Co-authored-by: Giacomo Pinato <giacomo.pinato@gmail.com>
- HEVC is not related to format, removed condition
- scale_vaapi takes care of the format
Co-authored-by: Mert <101130780+mertalev@users.noreply.github.com>
Places 'format=nv12' before 'hwupload' in the VAAPI video filter chain only when the input codec is HEVC and hardware decoding is disabled. This resolves filtergraph/driver issues observed on Intel Haswell GPUs when transcoding HEVC->H.264 VAAPI via software decode, ensuring the encoder receives the expected NV12 surface. Retains default filter logic for other codecs. Addresses issues discussed in GitHub issue #18103
* fix(server): re-evaluate OIDC role claim on every login and support array values
Previously the OIDC role claim (immich_role) was only read at user
auto-registration time and only accepted as a scalar string, so admin
status never updated after the first login and array-valued role/group
claims (common with Keycloak, Entra ID, etc.) were silently ignored.
Now the role claim is normalized from either a string or an array of
strings, and existing users have their isAdmin flag synced from the
claim on every login, keeping the IdP as the source of truth for
privileges while leaving isAdmin untouched when the claim is blank.
* fix(server): use .includes() instead of .some() for role claim check
Satisfies unicorn/prefer-includes lint rule flagged by CI.
* fix(server): resolve missing role claim to standard user and fix test mock
Default the OIDC role claim to 'user' when the IdP omits it so
auto-registration doesn't crash, and add the missing getAdmin mock in the
auth.service test so it correctly simulates an existing admin rather than
the first-user-registration path.
* fix: claim sync logic
---------
Co-authored-by: Jason Rasmussen <jrasm91@gmail.com>
