Add opt-in task emails and routable result pages #20
Loading…
Reference in a new issue
No description provided.
Delete branch "codex/issue-9-task-emails"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Long-running analysis, preview and import operations now offer a separate, explicit email choice beside their activity. Consent is bound to that run and its verified owner address, can be changed while work runs, and never carries to a retry. The panel masks the destination and explains missing relay/address support. Task messages use configured branding, never copy administrators, and contain only a broad outcome and an authenticated result URL.
A SQLite outbox schedules from authoritative terminal outcomes, distinguishes success, warnings, failure and interruption, and suppresses cancelled-operation milestones. It retries confirmed SMTP non-acceptance at bounded intervals, preserves one Message-ID, and leaves ambiguous handoffs visibly uncertain without automatically resending. Database recovery and fast analysis retries preserve delivery identity and the preceding outcome. Email failure cannot change the processing result.
Collections, analysis runs and individual import/preview attempts have routable URLs, including direct reload, Back/Forward and historical attempt selection. OIDC returns to an allowlisted application page after sign-in. Missing APIs/assets keep their HTTP errors; data remains owner-authorized.
Stack: based on PR #17 (
codex/issues-4-7-8-activity) and includes the existing #18 metadata changes through prerequisite merge54479e0. #15/#16 are transitive prerequisites. The issue #9 implementation is commitba40ae4. Issue #12 is on hold and its commits are excluded. Review this feature commit, then retarget to main after the prerequisites merge and recheck the resulting diff.Validation passed locally on Linux AMD64 Docker Desktop: full backend tests and vet; focused notification/authentication/SMTP/task lifecycle/deletion race checks; TLS and STARTTLS fake-relay tests including lost acceptance replies; UI lint/build and three focused browser suites; full disposable browser/queue/SQLite/upload-recovery walkthrough; final direct-route/unavailable-relay stack assertions; production HTTPS/proxy/readiness/resume checks; nine CI contract/policy tests and documentation/source-path checks; full-history secret scan with no leaks. The existing UI bundle-size advisory remains.
Related: #9 and coordination issue #14. Published for review, not merged or deployed. No pilot service or active work was restarted. Real-provider inbox delivery, native ARM64 and repository release CI remain unverified; keep #9 open through the coordinated pilot checkpoint.
Final security evidence: source gosec/govulncheck passed the unchanged policies (38 production files, 29 previously reviewed source findings, no suppressions or new exceptions). The final application image passed the existing advisory policy against a freshly updated database. Forgejo run https://git.sharedroot.net/jchapman/Immich-Bridge/actions/runs/9 is waiting; no passing native release gate is claimed.