iOS uploaded albums merging with other users - completely unexpected.

[rkroelin]

The bug

In testing I've noticed that iOS common folders (recents, live) which are set to upload merge with other users completely unexpectantly. If user two decides to share, Recents album with other users, user 1's personal recents folder suddenly uploads their images into the merged recents folder on immich.

Is this the behavior triggered by the "Sync Albums" toggle under select albums in Iphone? If so there is zero indication this feature will override any explicit share settings or merge more than one user's photos together if they too have the same album. I don't see any info in the documentation on this feature.

Awesome program! Unexpectedly merging albums with other users could be problematic.

The OS that Immich Server is running on

Ubuntu

Version of Immich Server

v1.123.0

Version of Immich Mobile App

1.123

Platform with the issue

• Server
• Web
• Mobile

Your docker-compose.yml content

Can share later if needed.

Your .env content

Can share later if needed.

Reproduction steps

1. User 1 Selects iOS album to Backup
2. "Sync Albums" setting is checked
3. User 2 Selects iOS album with the same name to backup
4. User 2 shares album with users 1, 3 4 etc
5. User 2 can see user 1's photos unexpectedly with no other sharing from user 1 to user two

Relevant log output

No response

Additional information

No response

[Tyris]

This looks like it's an issue with the getByName call when enabling syncing of albums which matches albums with the backend by name, but without specifying shared to false (explicitly).

It's also using just findFirst which seems a bit suss (it should probably be an "error" instead, though depends on context).

@rkroelin , did user2 set user1 as an editor for the Recents folder? Does the behaviour still occur with user1 set as viewer? (I'm expecting it will fail to upload the photos in that case - not sure what side-effect this will cause).

For anyone wanting to have a look into this:

• See call to getAlbumByName at album.provider.dart:58
• See definition of getByName at album.repository.dart:37

Easy fix is to probably expose the shared flag through to getAlbumByName and set to false - need to review what unexpected behaviour this may introduce.

[rkroelin]

Yes, user2 set user1 as an editor for the Recents folder. Thanks for taking a look at this!