nils
84323ab637
- images.rs: scope /api/img and /api/photos/{id}/original by album owner —
close the cross-tenant original/thumbnail leak (tenancy test now covers
these routes)
- migration 0003: refuse to run when albums exist and users != 1 instead of
silently reassigning every album to the oldest user
- Gallery: callback-ref ResizeObserver so a gallery mounted empty still
lays out once photos arrive (was permanently blank)
- upload dedup: re-uploading identical content whose photo is in 'error'
resets and re-enqueues it instead of returning the broken row
- client hashing: skip (and fall back to plain upload) above 512MB to avoid
whole-file arrayBuffer OOM / the ~2GiB cap
- zip: always spool each entry (no unread prefetched S3 body held across a
slow client stream) and backfill BOTH sha256 and crc32 for legacy photos
- tests/auth: share one session_payload builder instead of re-implementing
the cookie format in the test and mint_session
28 lines
1.2 KiB
SQL
28 lines
1.2 KiB
SQL
-- Albums gain an owner: the tenancy root. Photos, shares, ratings and tags
|
|
-- all hang off albums, so this single column scopes everything.
|
|
alter table albums add column owner_id uuid references users(id);
|
|
|
|
-- Backfill: pre-tenancy albums had no owner. Assigning them to "the" original
|
|
-- photographer is only unambiguous when exactly one user exists. With several
|
|
-- (v0.1.0 let every allowed email share all albums) the correct owner is
|
|
-- unknowable, so refuse rather than silently transfer everyone's work to one
|
|
-- account — the operator must assign ownership manually before migrating.
|
|
do $$
|
|
declare
|
|
n_users int;
|
|
n_albums int;
|
|
begin
|
|
select count(*) into n_users from users;
|
|
select count(*) into n_albums from albums;
|
|
if n_albums > 0 and n_users <> 1 then
|
|
raise exception
|
|
'multi-tenant migration: % albums exist but there are % users (need exactly 1 to auto-assign ownership); set albums.owner_id manually first',
|
|
n_albums, n_users;
|
|
end if;
|
|
update albums set owner_id = (select id from users order by created_at limit 1);
|
|
end $$;
|
|
|
|
alter table albums alter column owner_id set not null;
|
|
|
|
create index albums_owner_idx on albums (owner_id);
|