Update Asset Mac setup

[ildyria]

Summary by CodeRabbit

• New Features

  • Added rotating security codes for temporary photo links.
  • Added an endpoint to retrieve the current temporary-link code.
  • Photo asset requests now attach the code automatically and retry once when needed.

• Changes

  • Temporary-link validation now uses the code alone, with a brief grace period for rotation.
  • Concurrent code requests are consolidated to reduce duplicate network calls.
  • Code requests fetch the latest value when the configured lifetime expires.

• Bug Fixes

  • Improved handling of expired or invalid temporary-link codes.
  • Disabled temporary-link protection now correctly follows standard album and photo access rules.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Team

Run ID: fc2b11fe-151f-4874-ac52-b6adcb204d3d

📥 Commits

Reviewing files that changed from the base of the PR and between 4588852 and 64b3f49.

📒 Files selected for processing (1)

• resources/js/services/init-service.ts

🚧 Files skipped from review as they are similar to previous changes (1)

• resources/js/services/init-service.ts

Included review availability: Your plan provides up to 8 included reviews per hour; 5 remain after this review.

---

📝 Walkthrough

Walkthrough

The temporary-link signature scheme now uses rotating 12-digit MAC codes. The backend exposes the current code, validates X-Mac, and the client fetches, caches, attaches, and refreshes the code for asset requests.

Changes

Temporary link MAC

Layer / File(s)	Summary
Rotating code signer and unit coverage app/Services/TemporaryLinkSigner.php, tests/Unit/Services/TemporaryLinkSignerTest.php	TemporaryLinkSigner generates 12-digit codes from time-step counters and verifies the current or previous step. Tests cover valid, tampered, and unrelated codes.
Backend MAC endpoint and asset validation app/Http/Requests/Photo/GetPhotoAssetRequest.php, app/Http/Resources/GalleryConfigs/TemporaryLinkMacConfig.php, app/Http/Controllers/Gallery/ConfigController.php, routes/api_v2.php, tests/Feature_v2/Gallery/TemporaryLinkMacConfigTest.php, tests/Feature_v3/Photo/PhotoAssetV3Test.php, docs/specs/4-architecture/features/056-api-v3-asset-retrieval/spec.md	The backend exposes Gallery::getMac, returns an empty or current MAC based on configuration, and validates only X-Mac for asset requests. Tests and the specification cover disabled-feature access and stale, invalid, and valid codes.
Client MAC fetching and retry resources/js/services/init-service.ts, resources/js/config/axios-config.ts, resources/js/lychee.d.ts	The client coalesces concurrent MAC requests, disables response caching for MAC retrieval, adds X-Mac to asset requests, and refreshes the MAC for one retry after a 401 response.

Estimated code review effort: 4 (Complex) | ~45 minutes

Merge Risk: 🟡 Moderate · up to 64b3f

Asset requests now use a rotating MAC header, but the normative API specification still documents an obsolete timestamp-plus-MAC contract. Consumers following the specification may send incompatible requests, so the documentation contract should be corrected before merge.

Poem

I’m a rabbit with a code to hop,
Twelve bright digits never stop.
Headers carry what they know,
Fresh on retry, stale codes go.
The gallery gate now checks the flow.

🚥 Pre-merge checks | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 75.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 28 functions across 11 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

• Fix all pre-merge checks with AI

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 2

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Team

Run ID: 06b9fecb-4b09-4cfc-9abf-c2b6ef11f066

📥 Commits

Reviewing files that changed from the base of the PR and between 338e6da and 0c33d4e.

📒 Files selected for processing (11)

• app/Http/Controllers/Gallery/ConfigController.php
• app/Http/Requests/Photo/GetPhotoAssetRequest.php
• app/Http/Resources/GalleryConfigs/TemporaryLinkMacConfig.php
• app/Services/TemporaryLinkSigner.php
• resources/js/config/axios-config.ts
• resources/js/lychee.d.ts
• resources/js/services/init-service.ts
• routes/api_v2.php
• tests/Feature_v2/Gallery/TemporaryLinkMacConfigTest.php
• tests/Feature_v3/Photo/PhotoAssetV3Test.php
• tests/Unit/Services/TemporaryLinkSignerTest.php

Included review availability: Your plan provides up to 8 included reviews per hour; 7 remain after this review.

[coderabbitai]

Actionable comments posted: 1

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Team

Run ID: 3306e098-dee9-4d1f-9a37-dc48f13c6add

📥 Commits

Reviewing files that changed from the base of the PR and between 0c33d4e and 4588852.

📒 Files selected for processing (3)

• app/Http/Requests/Photo/GetPhotoAssetRequest.php
• docs/specs/4-architecture/features/056-api-v3-asset-retrieval/spec.md
• tests/Feature_v3/Photo/PhotoAssetV3Test.php

🚧 Files skipped from review as they are similar to previous changes (1)

• app/Http/Requests/Photo/GetPhotoAssetRequest.php

Included review availability: Your plan provides up to 8 included reviews per hour; 7 remain after this review.