Show album cover art while password-protected - #4704
Conversation
Adds a per-album 'grants_cover_access' toggle so a locked album can still display its cover thumbnail to anonymous visitors, without revealing photo contents. Defaults to off for every existing album.
📝 WalkthroughWalkthroughThe change adds ChangesAlbum cover-access permission
Estimated code review effort: 3 (Moderate) | ~25 minutes Merge Risk: ⚪ Minimal · up to The PR opt-in behavior shows album cover art while keeping protected photos hidden; no actionable merge-blocking risk remains after normal checks and review. Poem
🚥 Pre-merge checks | ❌ 1❌ Failed checks (1 warning)
Full details: Docstring CoverageExplanation Docstring coverage is 52.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 25 functions across 41 files. (6 skipped: 6 unsupported.)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
🧹 Nitpick comments (1)
tests/Feature_v2/Album/AlbumsTest.php (1)
229-250: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winUse snake_case for the locked album variable.
Rename
$lockedAlbumto$locked_albumin both tests. Update all references in each test.
tests/Feature_v2/Album/AlbumsTest.php#L229-L250: Rename$lockedAlbumand its references to$locked_album.tests/Feature_v2/Album/AlbumsTest.php#L254-L276: Rename$lockedAlbumand its references to$locked_album.As per coding guidelines: “Variable names should be in snake_case.”
Source: Coding guidelines
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Team
Run ID: 8d7ad47d-68b4-448e-afe3-12c2b33ae587
📒 Files selected for processing (47)
app/Actions/Admin/BulkEditAlbumsAction.phpapp/Actions/Album/SetProtectionPolicy.phpapp/Constants/AccessPermissionConstants.phpapp/Contracts/Http/Requests/RequestAttribute.phpapp/Http/Requests/Album/SetAlbumProtectionPolicyRequest.phpapp/Http/Resources/Models/ThumbAlbumResource.phpapp/Http/Resources/Models/Utils/AlbumProtectionPolicy.phpapp/Models/AccessPermission.phpdatabase/factories/AccessPermissionFactory.phpdatabase/migrations/2026_08_31_000000_add_grants_cover_access_to_access_permissions_table.phplang/ar/dialogs.phplang/bg/dialogs.phplang/cz/dialogs.phplang/de/dialogs.phplang/el/dialogs.phplang/en/dialogs.phplang/es/dialogs.phplang/fa/dialogs.phplang/fr/dialogs.phplang/hu/dialogs.phplang/it/dialogs.phplang/ja/dialogs.phplang/nl/dialogs.phplang/no/dialogs.phplang/pl/dialogs.phplang/pt/dialogs.phplang/ru/dialogs.phplang/sk/dialogs.phplang/sv/dialogs.phplang/tr/dialogs.phplang/vi/dialogs.phplang/zh_CN/dialogs.phplang/zh_TW/dialogs.phpresources/js/lychee.d.tsresources/js/services/album-service.tsresources/js/v7/components/forms/album/AlbumVisibility.vueresources/js/v7/components/gallery/albumModule/AlbumListItem.vueresources/js/v7/components/gallery/albumModule/thumbs/AlbumThumb.vueresources/js/v8/components/forms/album/AlbumVisibility.vueresources/js/v8/components/gallery/albumModule/AlbumListItem.vueresources/js/v8/components/gallery/albumModule/thumbs/AlbumThumb.vuetests/Feature_v2/Album/AlbumUpdateTest.phptests/Feature_v2/Album/AlbumsTest.phptests/Feature_v2/SmartAlbums/OverridePermissionsTest.phptests/Precomputing/CoverSelection/EventPropagationIntegrationTest.phptests/Unit/Actions/Album/SetProtectionPolicyTest.phptests/Unit/Http/Requests/Album/SetAlbumProtectionPolicyRequestTest.php
Included review availability: Your plan provides up to 8 included reviews per hour; 7 remain after this review.
|
Hi @matthewbolding I am currently in the middle of a huge refactoring of the way albums are actually being displayed in the front-end. Do you mind we wait for it to be merged as it will have a LOT of changes with regard to your proposition? PS: I really like the idea BTW, it is just that it arrives at the worse moment and I don't want you to waste your time on something which is going to be removed soon. See here for what is coming: #4705 And yes, I am planning the same change for the photo display... |
Codecov Report✅ All modified and coverable lines are covered by tests. 🚀 New features to boost your workflow:
|
Hi @ildyria. Thanks for the reply. Yes, I have no issue waiting on other changes to the codebase to be applied before this feature gets incorporated. I'll likely reach out to you on Discord late on. Glad you like the idea! Another idea I had was to permit fully custom album covers, i.e., the system shall accept a new image file to be used for the sole purpose of an album cover. |
2 participants
Adds a "Show cover when locked" toggle to the Visibility tab (v7 and
v8) for password-protected albums. When enabled, the album's cover
thumbnail is shown to anonymous visitors on gallery listings even
before they enter the password — the photos themselves stay hidden
until unlock. This replaces the need for a custom-JS workaround some
users (myself included) had resorted to.
change unless an admin explicitly opts an album in.
ThumbAlbumResource. The embed endpoint is intentionally out of
scope for this PR: EmbededRequest::authorize() already rejects any
password-protected album outright before the resource layer is
ever reached, and the embed DTO doesn't carry a cover/thumbnail
concept in the first place. Wiring cover-while-locked into that
flow is a separate design decision, not a small addition.
AlbumListItem.vue (v7 + v8) inferred "is this album locked" from
thumb === null, which was only ever true by coincidence — theold ThumbAlbumResource had exactly one code path that nulled out
thumb, and it was the same path that ran when the album waslocked, so the two facts always lined up. This PR breaks that
coincidence on purpose: a locked album with the new toggle on now
has
is_password_required = trueand a non-nullthumbat thesame time. Run that state through the old badge logic and it shows
the green "unlocked" badge on an album that still requires a
password to view any photos — a real, user-visible bug that simply
had no way to occur before now. Fixed by adding an explicit
is_lockedfield on ThumbAlbumResource and pointing all fourcomponents at it instead of inferring from
thumb.Note for anyone driving the API directly:
grants_cover_accessisnow a required field on
Album::updateProtectionPolicy, matchingthe existing validation on
grants_full_photo_access.Tests added:
AlbumsTest::testLockedAlbumHidesThumbByDefaultand::testLockedAlbumWithGrantsCoverAccessShowsThumb, plus updates toexisting protection-policy tests for the new required field.
Summary by CodeRabbit
New Features
Bug Fixes
Documentation