chore(deps): update dependency @types/node to ^24.13.3

Co-authored-by: shenlong-tanwen <139912620+shalong-tanwen@users.noreply.github.com>
Co-authored-by: Alex <alex.tran1502@gmail.com>

.github/workflows/fdroid.yml

@@ -0,0 +1,56 @@
+name: Update F-Droid Repo
+
+on:
+  release:
+    types: [published]
+
+permissions: {}
+
+jobs:
+  update-index:
+    runs-on: ubuntu-latest
+    if: ${{ !github.event.release.prerelease }}
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout pubspec for versionCode
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        with:
+          ref: ${{ github.event.release.tag_name }}
+          persist-credentials: false
+          sparse-checkout: mobile/pubspec.yaml
+          sparse-checkout-cone-mode: false
+
+      - name: Update F-Droid repo
+        env:
+          GITLAB_TOKEN: ${{ secrets.FDROID_REPO_TOKEN }}
+          RELEASE: ${{ toJSON(github.event.release) }}
+          TAG: ${{ github.event.release.tag_name }}
+        run: |
+          VERSION_CODE=$(yq '.version' mobile/pubspec.yaml | cut -d+ -f2)
+          export VERSION_CODE
+
+          NEW_ENTRY=$(yq -P '
+            [.assets[] | select(.name == "app-release.apk")] as $matches |
+            with(select($matches | length == 0); error("app-release.apk not found in release assets")) |
+            {
+              "url": $matches[0].browser_download_url,
+              "sha256sum": ($matches[0].digest | sub("^sha256:", "")),
+              "date": (.published_at | split("T") | .[0]),
+              "version-code": env(VERSION_CODE)
+            } | .date tag= "!!timestamp"
+          ' <<< "$RELEASE")
+          export NEW_ENTRY
+
+          git clone --depth 1 "https://oauth2:${GITLAB_TOKEN}@gitlab.futo.org/fdroid/repo-v2.git" fdroid-repo
+          cd fdroid-repo
+
+          yq -i '
+            with(select([.apks[] | select(."version-code" == env(VERSION_CODE))] | length > 0); error("version-code already in index")) |
+            .apks = [env(NEW_ENTRY)] + .apks
+          ' apps/Immich/index.yml
+
+          git config user.name "Immich Release Bot"
+          git config user.email "bot@immich.app"
+          git commit -am "Immich: add version-code ${VERSION_CODE} (${TAG})"
+          git push

CODEOWNERS

@@ -4,4 +4,4 @@
 /web/ @danieldietzler
 /machine-learning/ @mertalev
 /e2e/ @danieldietzler
-/mobile/ @shenlong-tanwen @santoshakil
+/mobile/ @shenlong-tanwen @santoshakil @agg23

e2e/package.json

@@ -32,7 +32,7 @@
     "@playwright/test": "^1.44.1",
     "@socket.io/component-emitter": "^3.1.2",
     "@types/luxon": "^3.4.2",
-    "@types/node": "^24.13.2",
+    "@types/node": "^24.13.3",
     "@types/pg": "^8.15.1",
     "@types/pngjs": "^6.0.4",
     "@types/supertest": "^7.0.0",

e2e/src/specs/server/api/album.e2e-spec.ts

@@ -796,5 +796,22 @@ describe('/albums', () => {
       expect(status).toBe(400);
       expect(body).toEqual(errorDto.badRequest('Not found or no album.share access'));
     });
+
+    it('should not allow an editor to change the role of an owner', async () => {
+      const album = await utils.createAlbum(user1.accessToken, {
+        albumName: 'testAlbum',
+        albumUsers: [{ userId: user2.userId, role: AlbumUserRole.Editor }],
+      });
+
+      expect(album.albumUsers[1].role).toEqual(AlbumUserRole.Editor);
+
+      const { status, body } = await request(app)
+        .put(`/albums/${album.id}/user/${user1.userId}`)
+        .set('Authorization', `Bearer ${user2.accessToken}`)
+        .send({ role: AlbumUserRole.Editor });
+
+      expect(status).toBe(400);
+      expect(body).toEqual(errorDto.badRequest('User is owner'));
+    });
   });
 });

i18n/en.json

@@ -1621,7 +1621,7 @@
   "person": "Person",
   "person_age_months": "{months, plural, one {# month} other {# months}} old",
   "person_age_year_months": "1 year, {months, plural, one {# month} other {# months}} old",
-  "person_age_years": "{years, plural, other {# years}} old",
+  "person_age_years": "{years, plural, one {# year} other {# years}} old",
   "person_birthdate": "Born on {date}",
   "person_hidden": "{name}{hidden, select, true { (hidden)} other {}}",
   "person_recognized": "Person recognized",

mobile/lib/constants/constants.dart

@@ -26,7 +26,6 @@ const String kDownloadGroupLivePhoto = 'group_livephoto';
 const String kShareDownloadGroup = 'group_share';
 
 // Timeline constants
-const int kTimelineNoneSegmentSize = 120;
 const int kTimelineAssetLoadBatchSize = 1024;
 const int kTimelineAssetLoadOppositeSize = 64;
 

mobile/lib/infrastructure/repositories/timeline.repository.dart

@@ -2,7 +2,6 @@ import 'dart:async';
 
 import 'package:drift/drift.dart';
 import 'package:easy_localization/easy_localization.dart';
-import 'package:immich_mobile/constants/constants.dart';
 import 'package:immich_mobile/domain/models/album/album.model.dart';
 import 'package:immich_mobile/domain/models/asset/base_asset.model.dart';
 import 'package:immich_mobile/domain/models/timeline.model.dart';
@@ -685,16 +684,7 @@ class DriftTimelineRepository extends DriftDatabaseRepository {
   }
 }
 
-List<Bucket> _generateBuckets(int count) {
-  final buckets = List.filled(
-    (count / kTimelineNoneSegmentSize).ceil(),
-    const Bucket(assetCount: kTimelineNoneSegmentSize),
-  );
-  if (count % kTimelineNoneSegmentSize != 0) {
-    buckets[buckets.length - 1] = Bucket(assetCount: count % kTimelineNoneSegmentSize);
-  }
-  return buckets;
-}
+List<Bucket> _generateBuckets(int count) => count == 0 ? const [] : [Bucket(assetCount: count)];
 
 extension on Expression<DateTime> {
   Expression<String> dateFmt(GroupAssetsBy groupBy, {bool toLocal = false}) {

mobile/lib/presentation/widgets/asset_viewer/asset_viewer.page.dart

@@ -81,6 +81,12 @@ class AssetViewer extends ConsumerStatefulWidget {
 }
 
 class _AssetViewerState extends ConsumerState<AssetViewer> {
+  static const _viewerOverlayStyle = SystemUiOverlayStyle(
+    statusBarIconBrightness: Brightness.light,
+    statusBarBrightness: Brightness.dark,
+    systemNavigationBarIconBrightness: Brightness.light,
+  );
+
   late final _heroOffset = widget.heroOffset ?? TabsRouterScope.of(context)?.controller.activeIndex ?? 0;
   late final _pageController = PageController(initialPage: widget.initialIndex);
   late final _preloader = AssetPreloader(timelineService: ref.read(timelineServiceProvider), mounted: () => mounted);
@@ -280,49 +286,52 @@ class _AssetViewerState extends ConsumerState<AssetViewer> {
       _setSystemUIMode(controls, details);
     });
 
-    return Scaffold(
-      backgroundColor: backgroundColor,
-      resizeToAvoidBottomInset: false,
-      appBar: const ViewerTopAppBar(),
-      extendBody: true,
-      extendBodyBehindAppBar: true,
-      floatingActionButton: IgnorePointer(
-        ignoring: !showingControls,
-        child: AnimatedOpacity(
-          opacity: showingControls ? 1.0 : 0.0,
-          duration: Durations.short2,
-          child: const DownloadStatusFloatingButton(),
-        ),
-      ),
-      bottomNavigationBar: const ViewerBottomAppBar(),
-      body: Stack(
-        children: [
-          NotificationListener<ScrollEndNotification>(
-            onNotification: _onScrollEnd,
-            child: PhotoViewGestureDetectorScope(
-              axis: Axis.horizontal,
-              child: PageView.builder(
-                controller: _pageController,
-                physics: isZoomed
-                    ? const NeverScrollableScrollPhysics()
-                    : CurrentPlatform.isIOS
-                    ? const FastScrollPhysics()
-                    : const FastClampingScrollPhysics(),
-                itemCount: _totalAssets,
-                itemBuilder: (context, index) =>
-                    AssetPage(index: index, heroOffset: _heroOffset, onTapNavigate: _onTapNavigate),
-              ),
-            ),
+    return AnnotatedRegion(
+      value: _viewerOverlayStyle,
+      child: Scaffold(
+        backgroundColor: backgroundColor,
+        resizeToAvoidBottomInset: false,
+        appBar: const ViewerTopAppBar(),
+        extendBody: true,
+        extendBodyBehindAppBar: true,
+        floatingActionButton: IgnorePointer(
+          ignoring: !showingControls,
+          child: AnimatedOpacity(
+            opacity: showingControls ? 1.0 : 0.0,
+            duration: Durations.short2,
+            child: const DownloadStatusFloatingButton(),
           ),
-          if (!CurrentPlatform.isIOS)
-            IgnorePointer(
-              child: AnimatedContainer(
-                duration: Durations.short2,
-                color: Colors.black.withValues(alpha: showingDetails ? 0.6 : 0.0),
-                height: context.padding.top,
+        ),
+        bottomNavigationBar: const ViewerBottomAppBar(),
+        body: Stack(
+          children: [
+            NotificationListener<ScrollEndNotification>(
+              onNotification: _onScrollEnd,
+              child: PhotoViewGestureDetectorScope(
+                axis: Axis.horizontal,
+                child: PageView.builder(
+                  controller: _pageController,
+                  physics: isZoomed
+                      ? const NeverScrollableScrollPhysics()
+                      : CurrentPlatform.isIOS
+                      ? const FastScrollPhysics()
+                      : const FastClampingScrollPhysics(),
+                  itemCount: _totalAssets,
+                  itemBuilder: (context, index) =>
+                      AssetPage(index: index, heroOffset: _heroOffset, onTapNavigate: _onTapNavigate),
+                ),
               ),
             ),
-        ],
+            if (!CurrentPlatform.isIOS)
+              IgnorePointer(
+                child: AnimatedContainer(
+                  duration: Durations.short2,
+                  color: Colors.black.withValues(alpha: showingDetails ? 0.6 : 0.0),
+                  height: context.padding.top,
+                ),
+              ),
+          ],
+        ),
       ),
     );
   }

mobile/lib/services/background_upload.service.dart

@@ -317,6 +317,8 @@ class BackgroundUploadService {
       priority: priority,
       isFavorite: asset.isFavorite,
       requiresWiFi: requiresWiFi,
+      // Visibility hidden on upload to prevent the server from running regular jobs on the live photo asset
+      fields: entity.isLivePhoto ? {'visibility': api.AssetVisibility.hidden.value} : null,
       cloudId: entity.isLivePhoto ? null : asset.cloudId,
       adjustmentTime: entity.isLivePhoto ? null : asset.adjustmentTime?.toIso8601String(),
       latitude: entity.isLivePhoto ? null : asset.latitude?.toString(),
@@ -336,8 +338,7 @@ class BackgroundUploadService {
       return null;
     }
 
-    // Visibility hidden on upload to prevent the server from running regular jobs on the live photo asset
-    final fields = {'livePhotoVideoId': livePhotoVideoId, 'visibility': api.AssetVisibility.hidden.value};
+    final fields = {'livePhotoVideoId': livePhotoVideoId};
 
     final requiresWiFi = _shouldRequireWiFi(asset);
     final originalFileName = await _assetMediaRepository.getOriginalFilename(asset.id) ?? asset.name;

mobile/lib/services/foreground_upload.service.dart

@@ -2,6 +2,7 @@ import 'dart:async';
 import 'dart:convert';
 import 'dart:io';
 
+import 'package:flutter/foundation.dart';
 import 'package:hooks_riverpod/hooks_riverpod.dart';
 import 'package:immich_mobile/domain/models/asset/asset_metadata.model.dart';
 import 'package:immich_mobile/domain/models/asset/base_asset.model.dart' hide AssetVisibility;
@@ -100,7 +101,7 @@ class ForegroundUploadService {
           final requireWifi = _shouldRequireWiFi(asset);
           return requireWifi && !hasWifi;
         },
-        processItem: (asset) => _uploadSingleAsset(asset, cancelToken, callbacks: callbacks),
+        processItem: (asset) => uploadSingleAsset(asset, cancelToken, callbacks: callbacks),
       );
     }
   }
@@ -126,7 +127,7 @@ class ForegroundUploadService {
         continue;
       }
 
-      await _uploadSingleAsset(asset, cancelToken, callbacks: callbacks);
+      await uploadSingleAsset(asset, cancelToken, callbacks: callbacks);
     }
   }
 
@@ -143,7 +144,7 @@ class ForegroundUploadService {
     await _executeWithWorkerPool<LocalAsset>(
       items: localAssets,
       cancelToken: cancelToken,
-      processItem: (asset) => _uploadSingleAsset(asset, cancelToken, callbacks: callbacks),
+      processItem: (asset) => uploadSingleAsset(asset, cancelToken, callbacks: callbacks),
     );
   }
 
@@ -233,7 +234,8 @@ class ForegroundUploadService {
     await Future.wait(workerFutures);
   }
 
-  Future<void> _uploadSingleAsset(
+  @visibleForTesting
+  Future<void> uploadSingleAsset(
     LocalAsset asset,
     Completer<void>? cancelToken, {
     required UploadCallbacks callbacks,

mobile/test/api.mocks.dart

@@ -1,3 +1,4 @@
+import 'package:immich_mobile/platform/connectivity_api.g.dart';
 import 'package:immich_mobile/repositories/partner_api.repository.dart';
 import 'package:mocktail/mocktail.dart';
 import 'package:openapi/api.dart';
@@ -7,3 +8,5 @@ class MockSyncApi extends Mock implements SyncApi {}
 class MockServerApi extends Mock implements ServerApi {}
 
 class MockPartnerApiRepository extends Mock implements PartnerApiRepository {}
+
+class MockConnectivityApi extends Mock implements ConnectivityApi {}

mobile/test/presentation/widgets/asset_viewer/asset_viewer_system_ui_test.dart

@@ -0,0 +1,85 @@
+import 'dart:async';
+
+import 'package:easy_localization/easy_localization.dart';
+import 'package:flutter/material.dart';
+import 'package:flutter/services.dart';
+import 'package:flutter_test/flutter_test.dart';
+import 'package:hooks_riverpod/hooks_riverpod.dart';
+import 'package:immich_mobile/constants/locales.dart';
+import 'package:immich_mobile/domain/models/timeline.model.dart';
+import 'package:immich_mobile/domain/services/timeline.service.dart';
+import 'package:immich_mobile/generated/codegen_loader.g.dart';
+import 'package:immich_mobile/presentation/widgets/asset_viewer/asset_viewer.page.dart';
+import 'package:immich_mobile/providers/asset_viewer/asset_viewer.provider.dart';
+import 'package:immich_mobile/providers/infrastructure/timeline.provider.dart';
+
+import '../../../fixtures/asset.stub.dart';
+
+class _SeededAssetViewerNotifier extends AssetViewerStateNotifier {
+  @override
+  AssetViewerState build() {
+    super.build();
+    return AssetViewerState(currentAsset: LocalAssetStub.image1);
+  }
+}
+
+TimelineService _stubTimelineService() {
+  return TimelineService((
+    assetSource: (index, count) async => [LocalAssetStub.image1],
+    bucketSource: () => Stream.value(const [Bucket(assetCount: 1)]),
+    origin: TimelineOrigin.main,
+  ));
+}
+
+void main() {
+  testWidgets('status bar icons are light while the asset viewer is open in light mode', (tester) async {
+    // Emulate arriving from a light-themed page whose AppBar set dark status
+    // bar icons (the state the viewer is opened from in light mode).
+    SystemChrome.setSystemUIOverlayStyle(SystemUiOverlayStyle.dark);
+
+    await tester.pumpWidget(
+      EasyLocalization(
+        supportedLocales: locales.values.toList(),
+        path: translationsPath,
+        startLocale: locales.values.first,
+        fallbackLocale: locales.values.first,
+        saveLocale: false,
+        useFallbackTranslations: true,
+        assetLoader: const CodegenLoader(),
+        child: ProviderScope(
+          overrides: [
+            timelineServiceProvider.overrideWithValue(_stubTimelineService()),
+            assetViewerProvider.overrideWith(_SeededAssetViewerNotifier.new),
+          ],
+          child: Builder(
+            builder: (context) => MaterialApp(
+              debugShowCheckedModeBanner: false,
+              localizationsDelegates: context.localizationDelegates,
+              supportedLocales: context.supportedLocales,
+              locale: context.locale,
+              home: const Material(child: AssetViewer(initialIndex: 0)),
+            ),
+          ),
+        ),
+      ),
+    );
+
+    // Let post-frame callbacks and the initial frames run without waiting for
+    // infinite animations (loading spinners) to settle.
+    await tester.pump();
+    await tester.pump(const Duration(milliseconds: 600));
+
+    // Asset thumbnails cannot load in the test environment (no platform
+    // channels / real HTTP). Those image errors are irrelevant to the system
+    // chrome behaviour under test, so drain them.
+    tester.takeException();
+
+    expect(
+      SystemChrome.latestStyle?.statusBarIconBrightness,
+      Brightness.light,
+      reason:
+          'The asset viewer draws over a black background, so status bar '
+          'icons must be light regardless of the app theme',
+    );
+  });
+}

mobile/test/services/background_upload.service_test.dart

@@ -118,8 +118,24 @@ void main() {
       expect(task, isNotNull);
       // For live photos, extension should be changed to match the video file
       expect(task!.fields['filename'], equals('OriginalLivePhoto.mov'));
+      expect(task.fields['visibility'], equals('hidden'));
       verify(() => mockAssetMediaRepository.getOriginalFilename(asset.id)).called(1);
     });
+
+    test('should not set visibility for a regular photo', () async {
+      final asset = LocalAssetStub.image1;
+      final mockEntity = MockAssetEntity();
+      final mockFile = File('/path/to/file.jpg');
+
+      when(() => mockEntity.isLivePhoto).thenReturn(false);
+      when(() => mockStorageRepository.getAssetEntityForAsset(asset)).thenAnswer((_) async => mockEntity);
+      when(() => mockStorageRepository.getFileForAsset(asset.id)).thenAnswer((_) async => mockFile);
+      when(() => mockAssetMediaRepository.getOriginalFilename(asset.id)).thenAnswer((_) async => 'Regular.jpg');
+
+      final task = await sut.getUploadTask(asset);
+      expect(task, isNotNull);
+      expect(task!.fields.containsKey('visibility'), isFalse);
+    });
   });
 
   group('getLivePhotoUploadTask', () {
@@ -140,7 +156,7 @@ void main() {
       expect(task, isNotNull);
       expect(task!.fields['filename'], equals('OriginalLivePhoto.HEIC'));
       expect(task.fields['livePhotoVideoId'], equals('video-id-123'));
-      expect(task.fields['visibility'], equals('hidden'));
+      expect(task.fields.containsKey('visibility'), isFalse);
       verify(() => mockAssetMediaRepository.getOriginalFilename(asset.id)).called(1);
     });
 
@@ -334,7 +350,7 @@ void main() {
       expect(task, isNotNull);
       expect(task!.fields.containsKey('metadata'), isTrue);
       expect(task.fields['livePhotoVideoId'], equals('video-123'));
-      expect(task.fields['visibility'], equals('hidden'));
+      expect(task.fields.containsKey('visibility'), isFalse);
 
       final metadata = jsonDecode(task.fields['metadata']!) as List;
       expect(metadata, hasLength(1));

mobile/test/services/foreground_upload.service_test.dart

@@ -0,0 +1,128 @@
+import 'dart:io';
+
+import 'package:drift/drift.dart' hide isNull, isNotNull;
+import 'package:drift/native.dart';
+import 'package:flutter/services.dart';
+import 'package:flutter_test/flutter_test.dart';
+import 'package:immich_mobile/domain/models/store.model.dart';
+import 'package:immich_mobile/domain/services/store.service.dart';
+import 'package:immich_mobile/entities/store.entity.dart';
+import 'package:immich_mobile/infrastructure/repositories/db.repository.dart';
+import 'package:immich_mobile/infrastructure/repositories/settings.repository.dart';
+import 'package:immich_mobile/infrastructure/repositories/store.repository.dart';
+import 'package:immich_mobile/repositories/upload.repository.dart';
+import 'package:immich_mobile/services/foreground_upload.service.dart';
+import 'package:mocktail/mocktail.dart';
+
+import '../api.mocks.dart';
+import '../fixtures/asset.stub.dart';
+import '../infrastructure/repository.mock.dart';
+import '../mocks/asset_entity.mock.dart';
+import '../repository.mocks.dart';
+
+void main() {
+  late ForegroundUploadService sut;
+  late MockUploadRepository mockUploadRepository;
+  late MockStorageRepository mockStorageRepository;
+  late MockDriftBackupRepository mockBackupRepository;
+  late MockConnectivityApi mockConnectivityApi;
+  late MockAssetMediaRepository mockAssetMediaRepository;
+  late Drift db;
+
+  setUpAll(() async {
+    TestWidgetsFlutterBinding.ensureInitialized();
+    TestDefaultBinaryMessengerBinding.instance.defaultBinaryMessenger.setMockMethodCallHandler(
+      const MethodChannel('plugins.flutter.io/path_provider'),
+      (MethodCall methodCall) async => 'test',
+    );
+    db = Drift(DatabaseConnection(NativeDatabase.memory(), closeStreamsSynchronously: true));
+    await StoreService.init(storeRepository: DriftStoreRepository(db));
+    await SettingsRepository.ensureInitialized(db);
+
+    await Store.put(StoreKey.serverEndpoint, 'http://demo.immich.app');
+    await Store.put(StoreKey.deviceId, 'device-id');
+
+    registerFallbackValue(File('file'));
+    registerFallbackValue(<String, String>{});
+  });
+
+  setUp(() {
+    mockUploadRepository = MockUploadRepository();
+    mockStorageRepository = MockStorageRepository();
+    mockBackupRepository = MockDriftBackupRepository();
+    mockConnectivityApi = MockConnectivityApi();
+    mockAssetMediaRepository = MockAssetMediaRepository();
+
+    sut = ForegroundUploadService(
+      mockUploadRepository,
+      mockStorageRepository,
+      mockBackupRepository,
+      mockConnectivityApi,
+      mockAssetMediaRepository,
+    );
+  });
+
+  List<Map<String, String>> captureFields() {
+    final captured = <Map<String, String>>[];
+    when(
+      () => mockUploadRepository.uploadFile(
+        file: any(named: 'file'),
+        originalFileName: any(named: 'originalFileName'),
+        fields: any(named: 'fields'),
+        cancelToken: any(named: 'cancelToken'),
+        onProgress: any(named: 'onProgress'),
+        logContext: any(named: 'logContext'),
+      ),
+    ).thenAnswer((invocation) async {
+      final fields = invocation.namedArguments[#fields] as Map<String, String>;
+      captured.add(Map.of(fields));
+      return UploadResult.success(remoteAssetId: 'remote-${captured.length}');
+    });
+    return captured;
+  }
+
+  group('uploadSingleAsset', () {
+    test('should upload the motion part hidden and keep the still image visible', () async {
+      final asset = LocalAssetStub.image1;
+      final mockEntity = MockAssetEntity();
+      final stillFile = File('/path/to/still.heic');
+      final videoFile = File('/path/to/motion.mov');
+
+      when(() => mockEntity.isLivePhoto).thenReturn(true);
+      when(() => mockStorageRepository.getAssetEntityForAsset(asset)).thenAnswer((_) async => mockEntity);
+      when(() => mockStorageRepository.isAssetAvailableLocally(asset.id)).thenAnswer((_) async => true);
+      when(() => mockStorageRepository.getFileForAsset(asset.id)).thenAnswer((_) async => stillFile);
+      when(() => mockStorageRepository.getMotionFileForAsset(asset)).thenAnswer((_) async => videoFile);
+      when(() => mockAssetMediaRepository.getOriginalFilename(asset.id)).thenAnswer((_) async => 'live.heic');
+
+      final captured = captureFields();
+
+      await sut.uploadSingleAsset(asset, null, callbacks: const UploadCallbacks());
+
+      expect(captured, hasLength(2));
+      expect(captured[0]['visibility'], equals('hidden'));
+      expect(captured[0].containsKey('livePhotoVideoId'), isFalse);
+      expect(captured[1].containsKey('visibility'), isFalse);
+      expect(captured[1]['livePhotoVideoId'], equals('remote-1'));
+    });
+
+    test('should not set visibility for a regular photo', () async {
+      final asset = LocalAssetStub.image1;
+      final mockEntity = MockAssetEntity();
+      final stillFile = File('/path/to/photo.jpg');
+
+      when(() => mockEntity.isLivePhoto).thenReturn(false);
+      when(() => mockStorageRepository.getAssetEntityForAsset(asset)).thenAnswer((_) async => mockEntity);
+      when(() => mockStorageRepository.isAssetAvailableLocally(asset.id)).thenAnswer((_) async => true);
+      when(() => mockStorageRepository.getFileForAsset(asset.id)).thenAnswer((_) async => stillFile);
+      when(() => mockAssetMediaRepository.getOriginalFilename(asset.id)).thenAnswer((_) async => 'photo.jpg');
+
+      final captured = captureFields();
+
+      await sut.uploadSingleAsset(asset, null, callbacks: const UploadCallbacks());
+
+      expect(captured, hasLength(1));
+      expect(captured[0].containsKey('visibility'), isFalse);
+    });
+  });
+}

packages/cli/package.json

@@ -25,7 +25,7 @@
     "@types/lodash-es": "^4.17.12",
     "@types/micromatch": "^4.0.9",
     "@types/mock-fs": "^4.13.1",
-    "@types/node": "^24.13.2",
+    "@types/node": "^24.13.3",
     "@vitest/coverage-v8": "^4.0.0",
     "byte-size": "^9.0.0",
     "cli-progress": "^3.12.0",

packages/plugin-sdk/package.json

@@ -31,7 +31,7 @@
   "devDependencies": {
     "@extism/js-pdk": "^1.1.1",
     "@immich/sdk": "workspace:*",
-    "@types/node": "^24.13.2",
+    "@types/node": "^24.13.3",
     "esbuild": "^0.28.0",
     "tsc-alias": "^1.8.16",
     "typescript": "^6.0.0"

packages/scripts/package.json

@@ -27,7 +27,7 @@
     "semver": "^7.8.1"
   },
   "devDependencies": {
-    "@types/node": "^24.13.2",
+    "@types/node": "^24.13.3",
     "@types/semver": "^7.7.1",
     "vite": "^8.0.16",
     "vitest": "^4.1.8"

packages/sdk/package.json

@@ -24,7 +24,7 @@
     "@oazapfts/runtime": "^1.0.2"
   },
   "devDependencies": {
-    "@types/node": "^24.13.2",
+    "@types/node": "^24.13.3",
     "typescript": "^6.0.0"
   }
 }

server/package.json

@@ -138,7 +138,7 @@
     "@types/luxon": "^3.6.2",
     "@types/mock-fs": "^4.13.1",
     "@types/multer": "^2.0.0",
-    "@types/node": "^24.13.2",
+    "@types/node": "^24.13.3",
     "@types/nodemailer": "^8.0.0",
     "@types/picomatch": "^4.0.0",
     "@types/pngjs": "^6.0.5",

server/src/schema/migrations/1782500000000-RestoreLivePhotoStillVisibility.ts

@@ -0,0 +1,16 @@
+import { Kysely, sql } from 'kysely';
+
+export async function up(db: Kysely<any>): Promise<void> {
+  // (#29836) Reset the visibility of any still images that are hidden and have a motion part
+  await sql`
+    UPDATE "asset"
+    SET "visibility" = 'timeline'
+    WHERE "type" = 'IMAGE'
+      AND "visibility" = 'hidden'
+      AND "livePhotoVideoId" IS NOT NULL
+  `.execute(db);
+}
+
+export async function down(): Promise<void> {
+  // Not implemented: the previous 'hidden' value was itself the bug.
+}

server/src/services/album.service.spec.ts

@@ -663,6 +663,7 @@ describe(AlbumService.name, () => {
       const album = AlbumFactory.from().albumUser({ userId: user.id }).build();
       const { user: owner } = album.albumUsers.find(({ role }) => role === AlbumUserRole.Owner)!;
       mocks.access.album.checkOwnerAccess.mockResolvedValue(new Set([album.id]));
+      mocks.album.getById.mockResolvedValue(getForAlbum(album));
       mocks.albumUser.update.mockResolvedValue();
 
       await sut.updateUser(AuthFactory.create(owner), album.id, user.id, { role: AlbumUserRole.Viewer });

server/src/services/album.service.ts

@@ -335,6 +335,14 @@ export class AlbumService extends BaseService {
 
   async updateUser(auth: AuthDto, id: string, userId: string, dto: UpdateAlbumUserDto): Promise<void> {
     await this.requireAccess({ auth, permission: Permission.AlbumShare, ids: [id] });
+
+    const album = await this.findOrFail(id, userId, { withAssets: false });
+    const owner = album.albumUsers[0];
+
+    if (owner.user.id === userId) {
+      throw new BadRequestException('User is owner');
+    }
+
     await this.albumUserRepository.update({ albumId: id, userId }, { role: dto.role });
   }
 

server/src/services/search.service.ts

@@ -118,7 +118,11 @@ export class SearchService extends BaseService {
     }
 
     const userIds = await this.getUserIdsToSearch(auth, dto.visibility);
-    const items = await this.searchRepository.searchRandom(dto.size || 250, { ...dto, userIds });
+    const items = await this.searchRepository.searchRandom(dto.size || 250, {
+      ...dto,
+      visibility: dto.visibility ?? (auth.session?.hasElevatedPermission ? undefined : 'not-locked'),
+      userIds,
+    });
     return items.map((item) => mapAsset(item, { auth }));
   }
 

server/test/medium/specs/services/search.service.spec.ts

@@ -196,4 +196,19 @@ describe(SearchService.name, () => {
       expect(suggestions).toEqual(['Canon', null]);
     });
   });
+
+  describe('searchRandom', () => {
+    it('should filter out locked assets in a default session', async () => {
+      const { sut, ctx } = setup();
+      const { user } = await ctx.newUser();
+
+      await ctx.newAsset({ ownerId: user.id, visibility: AssetVisibility.Locked });
+
+      const auth = factory.auth({ user: { id: user.id } });
+
+      const response = await sut.searchRandom(auth, {});
+
+      expect(response.length).toBe(0);
+    });
+  });
 });

web/src/lib/components/asset-viewer/AssetViewerNavBar.spec.ts

@@ -7,6 +7,16 @@ import { preferencesFactory } from '@test-data/factories/preferences-factory';
 import { userAdminFactory } from '@test-data/factories/user-factory';
 import AssetViewerNavBar from './AssetViewerNavBar.svelte';
 
+vi.mock(import('$lib/managers/feature-flags-manager.svelte'), function () {
+  return {
+    featureFlagsManager: {
+      init: vi.fn(),
+      loadFeatureFlags: vi.fn(),
+      value: { smartSearch: true, trash: true },
+    } as never,
+  };
+});
+
 describe('AssetViewerNavBar component', () => {
   const additionalProps = {
     preAction: () => {},
@@ -24,15 +34,6 @@ describe('AssetViewerNavBar component', () => {
       };
     });
     vi.stubGlobal('ResizeObserver', getResizeObserverMock());
-    vi.mock(import('$lib/managers/feature-flags-manager.svelte'), function () {
-      return {
-        featureFlagsManager: {
-          init: vi.fn(),
-          loadFeatureFlags: vi.fn(),
-          value: { smartSearch: true, trash: true },
-        } as never,
-      };
-    });
   });
 
   afterEach(() => {

web/src/lib/components/asset-viewer/actions/DeleteAction.spec.ts

@@ -4,16 +4,14 @@ import { renderWithTooltips } from '$tests/helpers';
 import { assetFactory } from '@test-data/factories/asset-factory';
 import DeleteAction from './DeleteAction.svelte';
 
+vi.mock(import('$lib/managers/feature-flags-manager.svelte'), () => {
+  // eslint-disable-next-line @typescript-eslint/no-explicit-any
+  return { featureFlagsManager: { init: vi.fn(), loadFeatureFlags: vi.fn(), value: { trash: true } } as any };
+});
+
 let asset: AssetResponseDto;
 
 describe('DeleteAction component', () => {
-  beforeEach(() => {
-    vi.mock(import('$lib/managers/feature-flags-manager.svelte'), () => {
-      // eslint-disable-next-line @typescript-eslint/no-explicit-any
-      return { featureFlagsManager: { init: vi.fn(), loadFeatureFlags: vi.fn(), value: { trash: true } } as any };
-    });
-  });
-
   describe('given an asset which is not trashed yet', () => {
     beforeEach(() => {
       asset = assetFactory.build({ isTrashed: false });

web/src/lib/components/assets/thumbnail/__test__/Thumbnail.spec.ts

@@ -4,6 +4,11 @@ import Thumbnail from '$lib/components/assets/thumbnail/Thumbnail.svelte';
 import { getTabbable } from '$lib/utils/focus-util';
 import { assetFactory } from '@test-data/factories/asset-factory';
 
+vi.mock('$lib/utils/navigation', () => ({
+  currentUrlReplaceAssetId: vi.fn(),
+  isSharedLinkRoute: vi.fn().mockReturnValue(false),
+}));
+
 vi.hoisted(() => {
   Object.defineProperty(globalThis, 'matchMedia', {
     writable: true,
@@ -26,10 +31,6 @@ vi.hoisted(() => {
 describe('Thumbnail component', () => {
   beforeAll(() => {
     vi.stubGlobal('IntersectionObserver', getIntersectionObserverMock());
-    vi.mock('$lib/utils/navigation', () => ({
-      currentUrlReplaceAssetId: vi.fn(),
-      isSharedLinkRoute: vi.fn().mockReturnValue(false),
-    }));
   });
 
   it('should only contain a single tabbable element (the container)', () => {

web/src/lib/components/shared-components/side-bar/RecentAlbums.spec.ts

@@ -16,7 +16,7 @@ describe('RecentAlbums component', () => {
     sdkMock.getAllAlbums.mockResolvedValueOnce([...albums]);
     render(RecentAlbums);
 
-    expect(sdkMock.getAllAlbums).toBeCalledTimes(1);
+    expect(sdkMock.getAllAlbums).toHaveBeenCalledOnce();
 
     // wtf
     await tick();

web/src/lib/elements/__test__/FormatMessage.spec.ts

@@ -35,7 +35,7 @@ describe('FormatMessage component', () => {
 
   it('throws an error when locale is empty', async () => {
     await locale.set(undefined);
-    expect(() => render(FormatMessage, { key: '' as Translations })).toThrowError();
+    expect(() => render(FormatMessage, { key: '' as Translations })).toThrow();
     await locale.set('en');
   });
 

web/src/lib/managers/timeline-manager/timeline-manager.svelte.spec.ts

@@ -70,7 +70,7 @@ describe('TimelineManager', () => {
     });
 
     it('should load months in viewport', () => {
-      expect(sdkMock.getTimeBuckets).toBeCalledTimes(1);
+      expect(sdkMock.getTimeBuckets).toHaveBeenCalledOnce();
       expect(sdkMock.getTimeBucket).toHaveBeenCalledTimes(2);
     });
 
@@ -133,13 +133,13 @@ describe('TimelineManager', () => {
     it('loads a month', async () => {
       expect(getTimelineMonthByDate(timelineManager, { year: 2024, month: 1 })?.getAssets().length).toEqual(0);
       await timelineManager.loadTimelineMonth({ year: 2024, month: 1 });
-      expect(sdkMock.getTimeBucket).toBeCalledTimes(1);
+      expect(sdkMock.getTimeBucket).toHaveBeenCalledOnce();
       expect(getTimelineMonthByDate(timelineManager, { year: 2024, month: 1 })?.getAssets().length).toEqual(3);
     });
 
     it('ignores invalid months', async () => {
       await timelineManager.loadTimelineMonth({ year: 2023, month: 1 });
-      expect(sdkMock.getTimeBucket).toBeCalledTimes(0);
+      expect(sdkMock.getTimeBucket).not.toHaveBeenCalled();
     });
 
     it('cancels month loading', async () => {
@@ -147,7 +147,7 @@ describe('TimelineManager', () => {
       void timelineManager.loadTimelineMonth({ year: 2024, month: 1 });
       const abortSpy = vi.spyOn(month!.loader!.cancelToken!, 'abort');
       month?.cancel();
-      expect(abortSpy).toBeCalledTimes(1);
+      expect(abortSpy).toHaveBeenCalledOnce();
       await timelineManager.loadTimelineMonth({ year: 2024, month: 1 });
       expect(getTimelineMonthByDate(timelineManager, { year: 2024, month: 1 })?.getAssets().length).toEqual(3);
     });
@@ -157,10 +157,10 @@ describe('TimelineManager', () => {
         timelineManager.loadTimelineMonth({ year: 2024, month: 1 }),
         timelineManager.loadTimelineMonth({ year: 2024, month: 1 }),
       ]);
-      expect(sdkMock.getTimeBucket).toBeCalledTimes(1);
+      expect(sdkMock.getTimeBucket).toHaveBeenCalledOnce();
 
       await timelineManager.loadTimelineMonth({ year: 2024, month: 1 });
-      expect(sdkMock.getTimeBucket).toBeCalledTimes(1);
+      expect(sdkMock.getTimeBucket).toHaveBeenCalledOnce();
     });
 
     it('allows loading a canceled month', async () => {
@@ -283,7 +283,7 @@ describe('TimelineManager', () => {
       const asset = deriveLocalDateTimeFromFileCreatedAt(timelineAssetFactory.build());
       timelineManager.upsertAssets([asset]);
 
-      expect(updateAssetsSpy).toBeCalledWith([asset]);
+      expect(updateAssetsSpy).toHaveBeenCalledWith([asset]);
       expect(timelineManager.assetCount).toEqual(1);
     });
 
@@ -642,8 +642,8 @@ describe('TimelineManager', () => {
       const previousMonthSpy = vi.spyOn(previousMonth!.loader!, 'execute');
       const previous = await timelineManager.getLaterAsset(a);
       expect(previous).toEqual(b);
-      expect(loadTimelineMonthSpy).toBeCalledTimes(0);
-      expect(previousMonthSpy).toBeCalledTimes(0);
+      expect(loadTimelineMonthSpy).not.toHaveBeenCalled();
+      expect(previousMonthSpy).not.toHaveBeenCalled();
     });
 
     it('skips removed assets', async () => {

web/src/lib/modals/PluginMethodPicker.svelte

@@ -12,7 +12,7 @@
   const { trigger, selectedKey, onClose }: Props = $props();
 </script>
 
-<BasicModal title={$t('add_step')} {onClose} size="medium">
+<BasicModal title={$t('add_step')} onClose={() => onClose()} size="medium">
   {#await searchPluginMethods({ trigger })}
     <div class="flex w-full place-content-center place-items-center">
       <LoadingSpinner />

web/src/lib/services/shared-link.service.spec.ts

@@ -2,17 +2,15 @@ import type { ServerConfigDto } from '@immich/sdk';
 import { asUrl } from '$lib/services/shared-link.service';
 import { sharedLinkFactory } from '@test-data/factories/shared-link-factory';
 
-describe('SharedLinkService', () => {
-  beforeAll(() => {
-    vi.mock(import('$lib/managers/server-config-manager.svelte'), () => ({
-      serverConfigManager: {
-        value: { externalDomain: 'http://localhost:2283' } as ServerConfigDto,
-        init: vi.fn(),
-        loadServerConfig: vi.fn(),
-      },
-    }));
-  });
+vi.mock(import('$lib/managers/server-config-manager.svelte'), () => ({
+  serverConfigManager: {
+    value: { externalDomain: 'http://localhost:2283' } as ServerConfigDto,
+    init: vi.fn(),
+    loadServerConfig: vi.fn(),
+  },
+}));
 
+describe('SharedLinkService', () => {
   describe('asUrl', () => {
     it('should properly encode characters in slug', () => {
       expect(asUrl(sharedLinkFactory.build({ slug: 'foo/bar' }))).toBe('http://localhost:2283/s/foo%2Fbar');

web/src/lib/utils/date-time.spec.ts

@@ -1,6 +1,10 @@
 import { writable } from 'svelte/store';
 import { getAlbumDateRange, getShortDateRange } from './date-time';
 
+vitest.mock('$lib/stores/preferences.store', () => ({
+  locale: writable('en'),
+}));
+
 describe('getShortDateRange', () => {
   beforeEach(() => {
     vi.stubEnv('TZ', 'UTC');
@@ -41,10 +45,6 @@ describe('getShortDateRange', () => {
 describe('getAlbumDate', () => {
   beforeAll(() => {
     process.env.TZ = 'UTC';
-
-    vitest.mock('$lib/stores/preferences.store', () => ({
-      locale: writable('en'),
-    }));
   });
 
   it('should work with only a start date', () => {

web/src/lib/utils/executor-queue.spec.ts

@@ -34,7 +34,7 @@ describe('Executor Queue test', function () {
     // The last task will be executed after 200ms and will finish at 400ms
     void eq.addTask(() => timeoutPromiseBuilder(200, 'T4'));
 
-    expect(finished).not.toBeCalled();
+    expect(finished).not.toHaveBeenCalled();
     expect(started).toHaveBeenCalledTimes(3);
 
     vi.advanceTimersByTime(100);