From ac7d0ac2eb56810c0fac36c7f4f55eb45b2f8540 Mon Sep 17 00:00:00 2001 From: dtoro Date: Fri, 3 Jul 2026 13:10:59 +0200 Subject: [PATCH] docs: mobile & third-party app setup with per-user scoping Co-Authored-By: Claude Fable 5 --- README.md | 29 +++++++++++++++++++++++++++++ 1 file changed, 29 insertions(+) diff --git a/README.md b/README.md index 01aa999..b125515 100644 --- a/README.md +++ b/README.md @@ -102,6 +102,35 @@ labels still work; the following sidecar endpoints return an OS error: PhotoPrism's `PHOTOPRISM_READONLY` is controlled separately by `PP_READONLY` and gates its own backwrite / import paths. +## Mobile & third-party apps (per-user) + +PhotoPrism CE does **not** enforce `auth_users.base_path` on API reads — +any authenticated user can search the whole library. The sidecar +therefore ships a scoping proxy at `/api/v1/*` (see +[`sidecar/handlers_ppproxy.go`](sidecar/handlers_ppproxy.go)) and the +reverse proxy routes the public `/api/v1` there instead of straight to +PhotoPrism. Result: any PhotoPrism-compatible app pointed at the site +sees only the logged-in user's photos. + +- **Server URL for apps**: the site itself (e.g. + `https://photos.hubris.network`). Known-good client: + [Gallery for PhotoPrism](https://github.com/Radiokot/photoprism-android-client) + (Android/F-Droid). +- **Login**: the user's normal username/password. For OIDC accounts (no + password), mint an app password: + `docker exec pp-app photoprism auth add -n "gallery" -s "*" ` + and use it as the password in the app. +- **What's scoped**: photo/geo searches, per-photo reads and edits, + batch operations, downloads by UID. Hash-addressed media (thumbnails, + video streams, file downloads) is token-guarded and passes through. +- **What's shared** (CE has no per-user variants of these): album + *names*, labels, and people — the photos inside them stay scoped. + Album zip downloads are generated by PhotoPrism and are not scoped. +- **Uploads**: the reconciler mirrors `base_path` into `upload_path`, + so WebDAV/app uploads land inside the user's own subtree. +- Sessions with the `admin` role bypass the proxy scoping entirely (the + web client's settings/users/index dialogs need the raw API). + ## Dev iteration loop For fast iteration on the sidecar without rebuilding its image on every