2a75896274
PhotoPrism's OSS edition has no way to map OIDC claims to BasePath, so
every freshly-registered OIDC user lands with BasePath="" and either
sees the whole library (admin) or nothing (guest) — never their own
subfolder.
Introduces a sidecar-driven reconciler with a single env knob the
admin sets in docker-compose / .env.photoprism:
USER_BASEPATHS="test:test, alice:family/alice, bob:bob"
(`user:originals-relative-path` pairs, comma-separated.) On boot and
every 60s thereafter the sidecar:
- mkdir -p's the target subdirectory under ORIGINALS_ROOT so
PhotoPrism's path: ACL filter has somewhere real to point;
- UPDATEs photoprism.auth_users.base_path for the matching row
where it differs (idempotent, missing users skipped — they
materialise on first OIDC login and the next pass catches them).
The reconciler uses a separate gorm connection scoped to the
`photoprism` schema with PhotoPrism's own DB user, since the existing
`sidecar` user only has grants on `mule_sidecar.*`. Connection stays
dormant when PP_DB_PASSWORD is empty — the feature is opt-in via env.
Compose changes: thread PP_DB_* + USER_BASEPATHS through to the
sidecar service. New users.go file isolates the reconciler logic;
main.go calls startUserBasepathReconciler() during boot.
121 lines
3.5 KiB
Go
121 lines
3.5 KiB
Go
// mule-sidecar — Go service for endpoints PhotoPrism does not expose.
|
|
//
|
|
// Ports the Node prototype (server.mjs) to the stack the merge plan calls
|
|
// out: Go + Gin + GORM + MariaDB. Same wire contract as the prototype so
|
|
// the SvelteKit web client doesn't need to change.
|
|
//
|
|
// Auth model is unchanged: the caller's X-Auth-Token is the only authority.
|
|
// requireSession validates it against PhotoPrism's /api/v1/photos before
|
|
// any destructive op runs.
|
|
package main
|
|
|
|
import (
|
|
"context"
|
|
"errors"
|
|
"log/slog"
|
|
"net/http"
|
|
"os"
|
|
"os/signal"
|
|
"syscall"
|
|
"time"
|
|
|
|
"github.com/gin-gonic/gin"
|
|
)
|
|
|
|
func main() {
|
|
slog.SetDefault(slog.New(slog.NewTextHandler(os.Stdout, &slog.HandlerOptions{
|
|
Level: slog.LevelInfo,
|
|
})))
|
|
|
|
cfg, err := loadConfig()
|
|
if err != nil {
|
|
slog.Error("config", "err", err)
|
|
os.Exit(1)
|
|
}
|
|
|
|
db, err := openDB(cfg.DSN)
|
|
if err != nil {
|
|
slog.Error("db open", "err", err)
|
|
os.Exit(1)
|
|
}
|
|
pp := newPPClient(cfg.PhotoprismBaseURL)
|
|
|
|
// Apply any declared username→BasePath mapping to PhotoPrism's
|
|
// auth_users table. Runs immediately + every 60s thereafter so a
|
|
// user who logs in after the sidecar booted still gets their
|
|
// BasePath wired without an admin restart.
|
|
startUserBasepathReconciler(cfg)
|
|
|
|
gin.SetMode(gin.ReleaseMode)
|
|
r := gin.New()
|
|
// Keep `%2F` literal in path params so callers can pass URL-encoded
|
|
// nested folder paths (e.g. `foo%2Fbar`) without the router splitting
|
|
// them into separate segments. Handlers decode via url.PathUnescape.
|
|
r.UseRawPath = true
|
|
r.UnescapePathValues = false
|
|
r.Use(gin.Recovery())
|
|
|
|
// Health probe — unauthenticated so a process supervisor can call it
|
|
// without needing PhotoPrism to be reachable.
|
|
r.GET("/api/sidecar/healthz", func(c *gin.Context) {
|
|
c.JSON(http.StatusOK, gin.H{
|
|
"ok": true,
|
|
"originalsRoot": cfg.OriginalsRoot,
|
|
})
|
|
})
|
|
|
|
// Every other endpoint runs behind the session gate. Mounting them
|
|
// under one group keeps the middleware wiring obvious.
|
|
auth := r.Group("/api/sidecar", requireSession(pp))
|
|
{
|
|
auth.GET("/photos/marks", handleMarksAll(db))
|
|
auth.GET("/photos/:uid/marks", handleMarkGet(db))
|
|
auth.PUT("/photos/:uid/marks", handleMarkPut(db))
|
|
auth.POST("/photos/marks/bulk", handleMarkBulk(db))
|
|
|
|
auth.POST("/files/:uid/rename", handleRename(cfg, pp))
|
|
|
|
auth.POST("/folders", handleFolderCreate(cfg, pp))
|
|
auth.POST("/folders/counts", handleFolderCounts(pp))
|
|
auth.POST("/folders/:rel/rename", handleFolderRename(cfg, pp))
|
|
auth.DELETE("/folders/:rel", handleFolderDelete(cfg, pp))
|
|
|
|
auth.POST("/albums/:uid/convert", handleHeapConvert(cfg, pp))
|
|
|
|
auth.GET("/duplicates/scan", handleDupScan(cfg, pp))
|
|
auth.POST("/duplicates/archive", handleDupArchive(cfg, pp))
|
|
}
|
|
|
|
addr := cfg.ListenAddr + ":" + itoa(cfg.Port)
|
|
srv := &http.Server{
|
|
Addr: addr,
|
|
Handler: r,
|
|
ReadHeaderTimeout: 5 * time.Second,
|
|
}
|
|
|
|
// Graceful shutdown so an in-flight duplicate scan or heap convert
|
|
// gets a chance to finish (or at least flush logs) on SIGTERM.
|
|
idleClosed := make(chan struct{})
|
|
go func() {
|
|
sigs := make(chan os.Signal, 1)
|
|
signal.Notify(sigs, syscall.SIGINT, syscall.SIGTERM)
|
|
<-sigs
|
|
slog.Info("shutdown signal received")
|
|
ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
|
|
defer cancel()
|
|
_ = srv.Shutdown(ctx)
|
|
close(idleClosed)
|
|
}()
|
|
|
|
slog.Info("mule-sidecar listening",
|
|
"addr", "http://"+addr,
|
|
"originals", cfg.OriginalsRoot,
|
|
)
|
|
if err := srv.ListenAndServe(); err != nil && !errors.Is(err, http.ErrServerClosed) {
|
|
slog.Error("listen", "err", err)
|
|
os.Exit(1)
|
|
}
|
|
<-idleClosed
|
|
}
|
|
|