Other user can't share photos from shared album

[jwefers]

The bug

My partner is added as user to a shared album. She'd like to multi-select and share several photos as public link from that album - containg only photos i uploaded. Error:

ApiException 400:
{"message":"Not found or no asset.share access",
"error":"Bad Request","statusCode":400,"correlationId":"pdw1dz7r"}

While i imagine that this might be somewhat desired ("don't forward the pictures i gave you!!"), i'd like to at least make this a configurable option on an album, i.e. "Allow others to share photos from this album".

The OS that Immich Server is running on

Debian

Version of Immich Server

v1.108.0

Version of Immich Mobile App

v1.180.0 build.148

Platform with the issue

• [X] Server
• [X] Web
• [X] Mobile

Your docker-compose.yml content

--

Your .env content

--

Reproduction steps

1. Create shared album
2. stuff it with photos
3. add other user
4. let other user try to create share link for multiple photos from album
5. error
...

Relevant log output

No response

Additional information

No response

[TopherMayor]

Think it's related to this only checking for owner access and not including partner access in the returned id sets. Seems like users users added to shared albums are not given access to the assets within the album if it wasn't added by them.

[Tronix117]

Permission management on shared album is quite light, until there is better permission support, a user which can add photos should also be able to share album imho

[Funk66]

I'll add that adding non-owned photos to a different album fails silently with a misleading error message. On mobile, it says "added 0 photos to album"; on web it's either "Asset was already part of the album" for existing albums, or "Added 1 asset to new album" when creating a new one, when in fact these photos are not being added to any album. Until we can re-share photos from other users, we should make sure to display a more helpful message, like "Cannot add photos from other users to album".