[pull] develop from photoprism:develop - #1798
Merged
Merged
Conversation
A person marked private or hidden has their name withheld from sessions that are not permitted to see private people. Subject.NameWithheld is the one predicate both flags feed, and Session.SeesPrivatePeople answers who may see them, reading the credential's scope alongside its role. The filtering happens in the queries each response is built from, through entity.VisiblePeopleFilter: two LEFT JOINs on unique keys and a positive condition, so the plan is an index lookup per row on both drivers and a row with no person joined is kept. entity.FindMarkers stays unscoped, since indexing and face clustering read through it. Names also stay out of generated titles, captions and search keywords, which are stored for every session to read, so Markers.SubjectNames keeps them out of the list all three derive from and a change to either flag refreshes the pictures that already carry one. FindWithheldPeople compares names in Go, the only way both drivers answer alike. The directory listing carries no markers at all: its response is cached across sessions, and the file browser has no use for them. It also asks for whole-library access rather than library reach alone. Every response that serializes a picture is shaped for the session first, after the sidecar and event writes, which TestPhotoResponses_AllRedact enforces for handlers added later.
GenerateTitle resolves the people once and generates the caption before it checks TitleSrc, so a picture whose title somebody typed still has its automatic caption kept current. The title and the caption answer for their own source, and GenerateCaption applies its own guard, so a caption somebody wrote is still left alone. Also notes that Subject.RefreshPhotos joins on markers.subj_uid, so a picture linked to a person only by marker_name waits for the ordinary age-based maintenance pass rather than the one a flag change schedules.
findFileMarker is the lookup UpdateMarker and ClearMarkerSubject share, and it now reports not found for a marker naming a person the session may not see - matching how the subject handlers answer for the same person, so a write cannot answer with an identity a read withholds. CreateMarker has no existing target and the session supplies the name, so its response only drops the subject uid it would otherwise resolve. Marker.WithheldFromSession classifies on the name as well as the link, the way the marker serialization resolves one. The structural check over picture responses now also rejects a shaping placed after the response it was meant to shape, alongside one placed above a call that persists the entity.
Returns each marker response through Marker.RedactForSession, so a create, update or unlink answers with the same identity a read of that marker would.
Photo, file and album responses are shaped from the role and scope a session carries, so a credential admitted on the library receives what an account receives and one admitted on less receives less. Session.SeesFullDetail reads what the handler authorization reads; Album.VisibleToSession is the single row policy the album endpoints and a picture's album records share.
A session may view album records when its role grants view of albums and its credential scope permits it. Reaching a record through a share or through its own account does not stand in for that, so a credential issued for pictures alone receives none, as a read of the album itself answers.
Keeps the invariant each one states and drops what the body says already. The structural check's three boundaries move to the spec that owns it.
Use a photos-scoped client and an isolated original to verify the ZIP entry name and contents. Keep scope and attached-account checks alongside the archive assertions.
Create a dedicated photo and subjects for the client response checks. Assert marker identities against a fresh admin control and clean up the test-owned records and face-update state.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
See Commits and Changes for more details.
Created by
pull[bot] (v2.0.0-alpha.4)
Can you help keep this open source service alive? 💖 Please sponsor : )