From 2fcdd07d1e5d331ad02b723f1c45603a0989c264 Mon Sep 17 00:00:00 2001 From: Christophe Besson Date: Tue, 25 Aug 2026 11:46:17 +0200 Subject: feat: add Photos group app MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit A new group application (docs/apps.md's plug-in mechanism), following the plan in docs/photos.md. Unlike Videos/Music: several photo roots per group instead of one (photo_roots is a set, one signed op replaces it whole), a single album-grid view with no third-party matching step, and per-photo info read from the file's own EXIF at index time — no metadata service, no credential, no outbound network call at all. Protocol (meshbay-common, MNP 0.10 -> 0.11, additive): `taken_at`/`camera` on IndexEntry; `photo_roots`/`photo_roots_ack`; `OP_PHOTO_ROOTS`. Node: roster.py stores photo_roots as a group_settings entry (JSON list, same shape as enabled_apps); ops.py/webrtc_server.py validate and sign the whole set in one op, same pattern as apps_enabled; a new PhotoEnricher (indexer/enrich_photo.py) runs Pillow in its own small bounded pool, separate from the video/audio pools, producing a resized thumbnail plus the two EXIF fields — never GPS, checked by a grep-based regression test. Client: photos-app.js — one album card per directory containing images, a per-album photo grid, and a lightbox with next/previous (keyboard and buttons), zoom in/out/fit/100% starting from the actual on-screen fit percentage, and a "zip this album" button reusing files-app.js's own zip mechanism (lifted into file-utils.js's downloadDirectory so both call the same implementation). group-settings.js gets an add/remove multi-root picker, distinct from Videos/Music's single-value one. Bugs found and fixed before this ever shipped, worth keeping the story of: - enrich_photo.py read width/height from the raw image *before* applying EXIF orientation correction, and read DateTimeOriginal off the plain 0th-IFD Exif object — a real camera stores it in the Exif sub-IFD, which Pillow only exposes via get_ifd(Exif). A flat, hand-built EXIF dict round-trips through Pillow either way, which is exactly what would have hidden both bugs; the regression test builds EXIF with piexif instead, matching what real hardware produces. - photos-app.js's album grouping stripped a trailing path segment from entry.path under the assumption it still carried a filename — it doesn't (files-app.js's own convention: e.path is already the containing directory), so every album collapsed one level into its parent. Found live against a real multi-folder library. - transport.js's ADMIN_OP_TYPES allowlist (already the fix for an identical bug on video_root/apps_enabled, see 4783d81) was missing photo_roots: its admin_challenge matched no pending request and was silently dropped, so saving a photo root just timed out after 30s with no error. - daemon.py pruned a thumbnail when its file left the index (root removed or reconfigured) but never forgot the content hash was "already attempted" — the same bytes reappearing under a renamed/relocated root (an operator's real workflow) were then permanently skipped, forever, with nothing to indicate why. Discarding the attempt alongside the cache entry on prune is what makes pruning actually reversible. - packages/meshbay-client's app:// protocol handler served every file with no Cache-Control header, so Chromium was free to serve a stale cached copy indefinitely — none of several `npm run sync-ui` + reload cycles during development actually picked up the new code until the renderer's disk cache was cleared by hand. Now sends Cache-Control: no-store. - the lightbox's zoomed image used flex centering (align-items/ justify-content: center) combined with overflow: auto — a well-known trap where the browser centers overflowing content by shifting it, and the leading half of that overflow (here, the top of a zoomed photo) sits outside what the scrollport can actually reach. Reported live as "unusable". Fixed by switching to top/left alignment once zoomed. Co-Authored-By: Claude Sonnet 5 Claude-Session: https://claude.ai/code/session_01TiZG4AuSnxHohQMpwTHTyL --- .../src/meshbay_node/transport/webrtc_server.py | 76 +++++++++++++++++++++- 1 file changed, 75 insertions(+), 1 deletion(-) (limited to 'packages/meshbay-node/src/meshbay_node/transport') diff --git a/packages/meshbay-node/src/meshbay_node/transport/webrtc_server.py b/packages/meshbay-node/src/meshbay_node/transport/webrtc_server.py index 6d21175..b4db051 100644 --- a/packages/meshbay-node/src/meshbay_node/transport/webrtc_server.py +++ b/packages/meshbay-node/src/meshbay_node/transport/webrtc_server.py @@ -73,6 +73,7 @@ from meshbay_common.adminop import ( OP_MUSICBRAINZ_CONFIG, OP_MUSICBRAINZ_ENABLED, OP_AUDIO_ROOT, + OP_PHOTO_ROOTS, OP_ROOT_ADD, OP_ROOT_REMOVE, OP_GROUP_ATTACH, @@ -401,6 +402,8 @@ class WebRTCPeerSession: self._do_video_root(msg) elif mtype == MNP.AUDIO_ROOT: self._do_audio_root(msg) + elif mtype == MNP.PHOTO_ROOTS: + self._do_photo_roots(msg) elif mtype == MNP.MEDIA_META_REQ: self._spawn(self._do_media_meta_request(msg)) elif mtype == MNP.SEASON_META_REQ: @@ -692,6 +695,11 @@ class WebRTCPeerSession: # group — same shape as video_root above, "" means unset (the # Music tab shows nothing yet). "audio_root": self._group_ctx().get("audio_root") or "", + # Which folder(s) the Photos app treats as its entry points for + # this group — a *list*, unlike video_root/audio_root above + # (docs/photos.md §2.1). Empty means unset (the Photos tab shows + # nothing yet). + "photo_roots": list(self._group_ctx().get("photo_roots") or []), # So a client that connects mid-scan shows the indexing state # immediately, instead of waiting for the next periodic # INDEX_PROGRESS push. Never a path or filename — see @@ -1655,7 +1663,7 @@ class WebRTCPeerSession: # network calls (TMDB, MusicBrainz) once enabled, so an operator opts a # group in explicitly rather than getting it for free # (docs/mediacenter.md §5.6, docs/musicbay.md §4.4). - ALLOWED_APPS = frozenset({"chat", "files", "video", "music"}) + ALLOWED_APPS = frozenset({"chat", "files", "video", "music", "photo"}) def _do_apps_enabled(self, msg: dict) -> None: """ @@ -1901,6 +1909,69 @@ class WebRTCPeerSession: except Exception: pass + def _do_photo_roots(self, msg: dict) -> None: + """ + Which folder(s) the Photos app treats as its entry points for this + group (docs/photos.md §2.1) — a *set*, replaced whole in one signed + op, same shape as apps_enabled rather than one op per root the way + video_root/audio_root are single values. + + An empty list is always accepted (nothing configured yet, today's + "Photos shows nothing" state). Every non-empty path must resolve to + a real, currently-readable directory, and no root may be nested + inside another in the same submitted set — both checked, and + refused, before a signature is ever asked for, same principle as + video_root's path check and apps_enabled's "empty set refused up + front". + """ + roots = msg.get("roots") + if not isinstance(roots, list) or not all(isinstance(r, str) for r in roots): + self._send({"type": "error", "detail": "Missing or invalid 'roots'"}) + return + roots = sorted({r.strip("/") for r in roots if r.strip("/")}) + ctx = self._group_ctx() + for path in roots: + resolved = ctx["roots"].resolve(path) if ctx.get("roots") else None + if not resolved or not resolved.is_dir(): + self._send({"type": "error", + "detail": f"Not a directory in this group: {path}"}) + return + # Case-insensitive nesting check (§6.8) — a root may not be a folder + # itself sitting inside another root in the same set. + folded = [r.casefold() for r in roots] + for i, a in enumerate(folded): + for j, b in enumerate(folded): + if i != j and (a == b or a.startswith(b + "/")): + self._send({"type": "error", + "detail": f"Root nested inside another: {roots[i]}"}) + return + if not self._has_admin_authority(): + self._send({"type": "error", "detail": "No authorized key for this"}) + return + self._issue_admin_challenge(OP_PHOTO_ROOTS, ",".join(roots)) + + async def _admin_exec_photo_roots( + self, pending: dict, transcript: bytes, sig: bytes, + ) -> None: + roots = pending["subject"].split(",") if pending["subject"] else [] + if not await self._verify_admin_sig(transcript, sig): + self._send({"type": "error", "detail": "Signature verification failed"}) + self._audit("admin_auth_failed", f"photo_roots:{pending['subject']}") + return + try: + await self._run_op(ops.set_photo_roots, self._group_id or "", roots) + except ops.OpError as e: + self._send({"type": "error", "detail": e.message}) + return + self._audit("photo_roots", pending["subject"]) + + notice = {"type": MNP.PHOTO_ROOTS_ACK, "v": MNP_VERSION, "roots": roots} + for uid, session in list(self._peer_registry().items()): + try: + session._send(notice) + except Exception: + pass + def _do_musicbrainz_config(self, msg: dict) -> None: """ Set (or clear) the node-wide MusicBrainz User-Agent contact string @@ -3603,6 +3674,9 @@ class WebRTCPeerSession: elif pending["op"] == OP_AUDIO_ROOT: self._spawn( self._admin_exec_audio_root(pending, transcript, sig_bytes)) + elif pending["op"] == OP_PHOTO_ROOTS: + self._spawn( + self._admin_exec_photo_roots(pending, transcript, sig_bytes)) elif pending["op"] == OP_ROOT_ADD: self._spawn( self._admin_exec_root_add(pending, transcript, sig_bytes)) -- cgit v1.2.3