The scoped /api/v1 proxy let unauthenticated traffic through for a
guessed "oauth/" path prefix, but PhotoPrism's actual OIDC routes are
/api/v1/oidc/login and /api/v1/oidc/redirect. The Authentik callback
(oidc/redirect) has no session token yet — it IS what establishes one —
so it fell through to the authenticated branch and got rejected with
401 "invalid session" before the session existed. Since the sidecar
registers /api/v1/*rest as the catch-all for all PhotoPrism API
traffic, this broke SSO login entirely.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Batch archive/restore/delete/approve/private validate every UID against
the PhotoPrism DB in one query. Per-photo PUT/approve/like/stack-file
ops are ownership-checked. Admin-role sessions pass through fully so
settings/users/index dialogs keep working. Paths are unescaped+cleaned
before classification so encoded dot-segments can't smuggle past the
allowlist. Full httptest coverage of the routing decisions.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
PhotoPrism CE doesn't enforce auth_users.base_path on API reads (any
user can q=path:"other/*"). New /api/v1/* proxy forwards to PhotoPrism
with per-session enforcement: search queries get their path filter
validated/injected, single-photo reads and like are ownership-checked,
hash-addressed media and session/config pass through, everything else
is 403 for scoped users. Admins (empty BasePath) pass through fully.
prism.hubris.network will route here instead of straight to PhotoPrism.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
