Add read-only Synology Photos people filtering

2026-10-05 08:43:07 +08:00
parent 9e14adcb1f
commit f3d9a1ae97
12 changed files with 1405 additions and 5 deletions
@@ -63,6 +63,11 @@ from pigway_frame_flow.providers.photo_sources import (
    PhotoSourceInput,
    PhotoSourceView,
 )
+from pigway_frame_flow.providers.synology_photos import (
+    PhotosConnection,
+    PhotosLogin,
+    PhotosPerson,
+)
 from pigway_frame_flow.providers.weather import ConfigurableWeatherProvider
 from pigway_frame_flow.renderers.images import Assets, convert
 from pigway_frame_flow.renderers.templates import TemplateRenderer
@@ -543,6 +548,46 @@ def create_app(settings=None, start_worker=True):
    def asset_file(asset_id: str):
        return FileResponse(assets.path(asset_id), media_type="image/jpeg")

+    @app.get(
+        "/api/v1/integrations/synology-photos",
+        response_model=PhotosConnection,
+        tags=["Photo sources"],
+        dependencies=[Depends(require("admin"))],
+    )
+    def photos_connection():
+        return service.photo_sources.synology.status()
+
+    @app.post(
+        "/api/v1/integrations/synology-photos",
+        response_model=PhotosConnection,
+        tags=["Photo sources"],
+        dependencies=[Depends(require("admin"))],
+    )
+    def connect_photos(payload: PhotosLogin):
+        result = service.photo_sources.synology.connect(payload)
+        service.photo_sources.cache.clear()
+        return result
+
+    @app.delete(
+        "/api/v1/integrations/synology-photos",
+        response_model=PhotosConnection,
+        tags=["Photo sources"],
+        dependencies=[Depends(require("admin"))],
+    )
+    def disconnect_photos():
+        result = service.photo_sources.synology.disconnect()
+        service.photo_sources.cache.clear()
+        return result
+
+    @app.get(
+        "/api/v1/integrations/synology-photos/people",
+        response_model=list[PhotosPerson],
+        tags=["Photo sources"],
+        dependencies=[Depends(require("admin"))],
+    )
+    def photos_people():
+        return service.photo_sources.synology.people()
+
    @app.get(
        "/api/v1/photo-sources",
        response_model=list[PhotoSourceView],
@@ -18,6 +18,7 @@ from pigway_frame_flow.errors import ErrorCode as E
 from pigway_frame_flow.errors import FlowError
 from pigway_frame_flow.models import StrictModel
 from pigway_frame_flow.providers.photo_names import path_caption
+from pigway_frame_flow.providers.synology_photos import SynologyPhotos
 from pigway_frame_flow.settings import secret
 from pigway_frame_flow.storage.database import encode

@@ -32,6 +33,9 @@ class PhotoSourceInput(StrictModel):
    synology_previews: bool = False
    organized_only: bool = False
    folder_caption: bool = False
+    people_filter: bool = False
+    person_ids: list[int] = Field(default_factory=list, max_length=50)
+    person_match: Literal["any", "all"] = "any"
    credential_env: str | None = Field(
        default=None, pattern=r"^FRAME_FLOW_SOURCE_[A-Z0-9_]+$"
    )
@@ -62,6 +66,7 @@ class PhotoSources:
    def __init__(self, db, settings, assets):
        self.db, self.settings, self.assets = db, settings, assets
        self.cache = {}
+        self.synology = SynologyPhotos(settings)
        # Register provider secrets before request IDs or errors can be reflected.
        for row in self.list():
            if row["kind"] == "webdav" and row.get("credential_env"):
@@ -91,6 +96,19 @@ class PhotoSources:
        return PhotoSourceInput.model_validate_json(row["payload"])

    def save(self, source_id, source):
+        if source.people_filter and source.kind != "local":
+            raise FlowError(
+                E.INVALID_REQUEST,
+                "Person filtering requires a local Synology photo source",
+            )
+        if any(i <= 0 for i in source.person_ids) or len(set(source.person_ids)) != len(
+            source.person_ids
+        ):
+            raise FlowError(
+                E.INVALID_REQUEST, "Person IDs must be unique positive integers"
+            )
+        if source.people_filter and not source.person_ids:
+            raise FlowError(E.INVALID_REQUEST, "Select at least one person")
        if source.kind == "local":
            self.local_directory(source.location)
            if source.credential_env:
@@ -226,6 +244,11 @@ class PhotoSources:
        cached = self.cache.get(source_id)
        if cached and not refresh and time.monotonic() - cached[0] < 60:
            return cached[1]
+        allowed = (
+            self.synology.paths(source.person_ids, source.person_match, refresh=refresh)
+            if source.people_filter
+            else None
+        )
        items = []
        if source.kind == "local":
            directory = self.local_directory(source.location)
@@ -267,6 +290,8 @@ class PhotoSources:
                        if large and not preview:
                            continue
                        relative = path.relative_to(root).as_posix()
+                        if allowed is not None and relative not in allowed:
+                            continue
                        items.append(
                            {
                                "id": relative,
@@ -0,0 +1,263 @@
+"""Optional, read-only Synology Photos person catalog with pinned TLS."""
+
+import hashlib
+import http.client
+import json
+import os
+import ssl
+import threading
+import time
+from urllib.parse import urlencode, urlsplit
+
+from pydantic import Field, SecretStr
+
+from pigway_frame_flow.errors import ErrorCode as E
+from pigway_frame_flow.errors import FlowError
+from pigway_frame_flow.models import StrictModel
+
+
+class PhotosLogin(StrictModel):
+    username: str = Field(min_length=1, max_length=120)
+    password: SecretStr = Field(min_length=1, max_length=256)
+
+
+class PhotosConnection(StrictModel):
+    configured: bool
+    connected: bool
+
+
+class PhotosPerson(StrictModel):
+    id: int
+    name: str
+    count: int = 0
+    named: bool = False
+
+
+class SynologyPhotos:
+    def __init__(self, settings):
+        self.settings = settings
+        self.path = settings.config_dir / "synology-photos-session.json"
+        self.lock = threading.RLock()
+        self.cache = {}
+        if self.path.is_file():
+            try:
+                self.sid()
+            except FlowError:
+                pass
+
+    def endpoint(self):
+        url = urlsplit(os.getenv("SYNOLOGY_PHOTOS_URL", ""))
+        pin = os.getenv("SYNOLOGY_PHOTOS_CERT_SHA256", "").lower().replace(":", "")
+        if (
+            url.scheme != "https"
+            or not url.hostname
+            or url.username
+            or url.password
+            or url.query
+            or url.fragment
+            or url.path not in ("", "/")
+            or len(pin) != 64
+            or any(c not in "0123456789abcdef" for c in pin)
+        ):
+            raise FlowError(
+                E.CONFIG_REQUIRED,
+                "Configure Synology Photos URL and certificate fingerprint",
+                503,
+            )
+        return url, pin
+
+    def status(self):
+        try:
+            self.endpoint()
+            configured = True
+        except FlowError:
+            configured = False
+        return {
+            "configured": configured,
+            "connected": configured and self.path.is_file(),
+        }
+
+    def request(self, api, method, version, **params):
+        # No arbitrary RPC forwarding or mutation methods, even for administrators.
+        if (api, method) not in {
+            ("SYNO.API.Auth", "login"),
+            ("SYNO.API.Auth", "logout"),
+            ("SYNO.FotoTeam.Browse.Person", "list"),
+            ("SYNO.FotoTeam.Browse.Item", "list"),
+            ("SYNO.FotoTeam.Browse.Folder", "get"),
+        }:
+            raise FlowError(E.FORBIDDEN, "Unsupported Photos query", 403)
+        url, pin = self.endpoint()
+        connection = http.client.HTTPSConnection(
+            url.hostname,
+            url.port or 443,
+            timeout=30,
+            context=ssl._create_unverified_context(),
+        )
+        try:
+            connection.connect()
+            certificate = connection.sock.getpeercert(binary_form=True)
+            if not certificate or hashlib.sha256(certificate).hexdigest() != pin:
+                raise FlowError(E.FORBIDDEN, "Synology Photos certificate changed", 403)
+            # Check the certificate on this exact socket BEFORE transmitting a secret.
+            data = urlencode(
+                {"api": api, "method": method, "version": version, **params}
+            )
+            connection.request(
+                "POST",
+                "/webapi/entry.cgi",
+                data,
+                {"Content-Type": "application/x-www-form-urlencoded"},
+            )
+            response = connection.getresponse()
+            raw = response.read(4 * 1024 * 1024 + 1)
+            if response.status != 200 or len(raw) > 4 * 1024 * 1024:
+                raise ValueError()
+            result = json.loads(raw)
+            if not result.get("success"):
+                code = result.get("error", {}).get("code")
+                if api == "SYNO.API.Auth" or code in (105, 106, 107, 119):
+                    if api != "SYNO.API.Auth":
+                        self.disconnect()
+                    raise FlowError(
+                        E.CONFIG_REQUIRED, "Reconnect Synology Photos account", 409
+                    )
+                raise FlowError(
+                    E.CLOUD_UNAVAILABLE, "Synology Photos query was rejected", 502
+                )
+            return result.get("data", {})
+        except (OSError, ValueError, http.client.HTTPException):
+            raise FlowError(
+                E.CLOUD_UNAVAILABLE, "Synology Photos is unavailable", 502
+            ) from None
+        finally:
+            connection.close()
+
+    def sid(self):
+        try:
+            sid = json.loads(self.path.read_text())["sid"]
+            if not isinstance(sid, str) or not sid:
+                raise ValueError()
+        except (OSError, ValueError, KeyError):
+            raise FlowError(
+                E.CONFIG_REQUIRED, "Connect Synology Photos account first", 409
+            ) from None
+        if sid not in self.settings.additional_secrets:
+            self.settings.additional_secrets.append(sid)
+        return sid
+
+    def connect(self, payload):
+        password = payload.password.get_secret_value()
+        self.settings.additional_secrets.extend([payload.username, password])
+        with self.lock:
+            sid = self.request(
+                "SYNO.API.Auth",
+                "login",
+                7,
+                account=payload.username,
+                passwd=password,
+                session="SynologyPhotos",
+                format="sid",
+            )["sid"]
+            self.settings.additional_secrets.append(sid)
+            self.path.parent.mkdir(parents=True, exist_ok=True)
+            temporary = self.path.with_suffix(".tmp")
+            fd = os.open(temporary, os.O_WRONLY | os.O_CREAT | os.O_TRUNC, 0o600)
+            with os.fdopen(fd, "w") as stream:
+                json.dump({"sid": sid}, stream)
+            os.chmod(temporary, 0o600)
+            temporary.replace(self.path)
+            self.cache.clear()
+        return self.status()
+
+    def disconnect(self):
+        with self.lock:
+            self.path.unlink(missing_ok=True)
+            self.cache.clear()
+        return self.status()
+
+    def pages(self, api, version, **params):
+        rows = []
+        for offset in range(0, 100000, 500):
+            page = self.request(
+                api,
+                "list",
+                version,
+                offset=offset,
+                limit=500,
+                _sid=self.sid(),
+                **params,
+            ).get("list", [])
+            rows.extend(page)
+            if len(page) < 500:
+                return rows
+        raise FlowError(E.CONFLICT, "Photos catalog exceeds query limit", 409)
+
+    def people(self):
+        with self.lock:
+            rows = self.pages("SYNO.FotoTeam.Browse.Person", 3)
+            return [
+                {
+                    "id": r["id"],
+                    "name": r.get("name") or str(r["id"]),
+                    "count": r.get("item_count", 0),
+                    "named": bool(r.get("name")),
+                }
+                for r in rows
+            ]
+
+    def paths(self, person_ids, mode, refresh=False):
+        key = (tuple(sorted(person_ids)), mode)
+        with self.lock:
+            cached = self.cache.get(key)
+            if cached and not refresh and time.monotonic() - cached[0] < 900:
+                return cached[1]
+            known = {p["id"] for p in self.people()}
+            ids = person_ids or sorted(known)
+            if not set(ids) <= known:
+                raise FlowError(E.INVALID_REQUEST, "Selected person no longer exists")
+            sets = []
+            folders = {}
+            for person in ids:
+                paths = set()
+                for row in self.pages(
+                    "SYNO.FotoTeam.Browse.Item",
+                    7,
+                    person_id=person,
+                    additional=json.dumps(["folder"]),
+                ):
+                    folder = row.get("additional", {}).get("folder", {})
+                    if isinstance(folder, str):
+                        name = folder
+                    elif isinstance(folder, dict) and folder.get("name"):
+                        name = folder["name"]
+                    else:
+                        folder_id = row.get("folder_id")
+                        if folder_id is None:
+                            raise FlowError(
+                                E.CLOUD_UNAVAILABLE,
+                                "Photos response has no folder identity",
+                                502,
+                            )
+                        if folder_id not in folders:
+                            folders[folder_id] = self.request(
+                                "SYNO.FotoTeam.Browse.Folder",
+                                "get",
+                                2,
+                                id=folder_id,
+                                _sid=self.sid(),
+                            )["folder"]["name"]
+                        name = folders[folder_id]
+                    if "filename" not in row:
+                        raise FlowError(
+                            E.CLOUD_UNAVAILABLE, "Photos response has no filename", 502
+                        )
+                    paths.add(name.strip("/") + "/" + row["filename"])
+                sets.append(paths)
+            selected = (
+                (set.intersection(*sets) if mode == "all" else set.union(*sets))
+                if sets
+                else set()
+            )
+            self.cache[key] = (time.monotonic(), selected)
+            return selected
@@ -105,10 +105,24 @@ async function officialConnectionPanel(info){
 try{render(await api(path));}catch{panel.textContent=zh?'官方账号连接由管理员管理':'Official account connection is managed by an administrator';}
 }

+async function photosPeoplePicker(selected){
+ const target=$('#source-people-panel'),path='/api/v1/integrations/synology-photos';
+ const status=await api(path);
+ if(!status.configured){target.innerHTML=`<p class="hint">${t('photosConfigure')}</p>`;return;}
+ if(!status.connected){
+ target.innerHTML=`<div class="field"><label for="photos-username">${t('username')}</label><input id="photos-username" autocomplete="username"></div><div class="field"><label for="photos-password">${t('password')}</label><input id="photos-password" type="password" autocomplete="current-password"></div><p class="hint">${t('photosSessionHint')}</p><button type="button" id="photos-connect">${t('photosConnect')}</button>`;
+ $('#photos-connect').onclick=busy(async()=>{const password=$('#photos-password').value;$('#photos-password').value='';await api(path,{method:'POST',body:{username:$('#photos-username').value,password}});await photosPeoplePicker(selected);});return;
+ }
+ const people=await api(path+'/people');
+ target.innerHTML=`<div class="field"><label for="people-search">${t('peopleSearch')}</label><input id="people-search" type="search"></div><label class="check-row"><input id="people-unnamed" type="checkbox">${t('peopleUnnamed')}</label><div id="people-list" style="max-height:260px;overflow:auto"></div><p id="people-selected" class="hint"></p><button type="button" id="photos-disconnect">${t('photosDisconnect')}</button>`;
+ const render=()=>{const query=$('#people-search').value.toLowerCase();const rows=people.filter(p=>(p.named||selected.has(p.id)||$('#people-unnamed').checked)&&(p.name.toLowerCase().includes(query)||String(p.id).includes(query)));$('#people-list').innerHTML=rows.map(p=>`<label class="check-row"><input type="checkbox" data-person="${p.id}" ${selected.has(p.id)?'checked':''}>${esc(p.name)} · ${p.count}</label>`).join('');$('#people-selected').textContent=t('peopleSelected')+selected.size;$('#people-list').querySelectorAll('[data-person]').forEach(box=>box.onchange=()=>{const id=Number(box.dataset.person);box.checked?selected.add(id):selected.delete(id);$('#people-selected').textContent=t('peopleSelected')+selected.size;});};
+ $('#people-search').oninput=render;$('#people-unnamed').onchange=render;$('#photos-disconnect').onclick=busy(async()=>{await api(path,{method:'DELETE'});await photosPeoplePicker(selected);});render();
+}
+
 async function photoSourcesPanel(){
 const section=document.createElement('section');section.className='card photo-sources-panel';$('#main').append(section);
 const sources=await api('/api/v1/photo-sources');if(!section.isConnected)return;
- section.innerHTML=`<div class="section-heading"><div><h3>${t('photoSources')}</h3><p class="hint">${t('sourceHint')}</p></div>${buttons('add-photo-source','addSource')}</div><div class="source-list">${sources.length?sources.map(s=>`<article class="source-card"><h4>${esc(s.name)}</h4><p class="hint">${esc(s.kind)} · ${t(s.enabled?'enabled':'disabled')}</p><div class="actions"><button data-source-browse="${esc(s.id)}">${t('browse')}</button><button data-source-random="${esc(s.id)}" ${s.enabled?'':'disabled'}>${t('randomPreview')}</button><button data-source-job="${esc(s.id)}">${t('sourceJob')}</button><button data-source-edit="${esc(s.id)}">${t('edit')}</button><button class="danger" data-source-delete="${esc(s.id)}">${t('remove')}</button></div></article>`).join(''):`<p class="hint">${t('noSources')}</p>`}</div><div id="source-browser"></div>`;
+ section.innerHTML=`<div class="section-heading"><div><h3>${t('photoSources')}</h3><p class="hint">${t('sourceHint')}</p></div>${buttons('add-photo-source','addSource')}</div><div class="source-list">${sources.length?sources.map(s=>`<article class="source-card"><h4>${esc(s.name)}</h4><p class="hint">${esc(s.kind)} · ${t(s.enabled?'enabled':'disabled')}${s.people_filter?' · '+t('peopleFilter'):''}</p><div class="actions"><button data-source-browse="${esc(s.id)}">${t('browse')}</button><button data-source-random="${esc(s.id)}" ${s.enabled?'':'disabled'}>${t('randomPreview')}</button><button data-source-job="${esc(s.id)}">${t('sourceJob')}</button><button data-source-edit="${esc(s.id)}">${t('edit')}</button><button class="danger" data-source-delete="${esc(s.id)}">${t('remove')}</button></div></article>`).join(''):`<p class="hint">${t('noSources')}</p>`}</div><div id="source-browser"></div>`;
 bind('add-photo-source',()=>photoSourceForm());
 section.querySelectorAll('[data-source-edit]').forEach(b=>b.onclick=()=>photoSourceForm(sources.find(s=>s.id===b.dataset.sourceEdit)));
 section.querySelectorAll('[data-source-delete]').forEach(b=>b.onclick=()=>confirmDialog(t('removeConfirm'),async()=>{await api('/api/v1/photo-sources/'+b.dataset.sourceDelete,{method:'DELETE'});await navigate('gallery');}));
@@ -116,10 +130,10 @@ async function photoSourcesPanel(){
 section.querySelectorAll('[data-source-browse]').forEach(b=>b.onclick=busy(()=>browseSource(b.dataset.sourceBrowse)));
 section.querySelectorAll('[data-source-job]').forEach(b=>b.onclick=()=>sourceJobForm(b.dataset.sourceJob));
 }
-function photoSourceForm(source=null){
- showModal(`<h2>${t(source?'edit':'addSource')}</h2><form id="photo-source-form"><div class="field"><label for="source-id">ID</label><input id="source-id" pattern="[a-z0-9-]{1,60}" required value="${esc(source?.id||'')}" ${source?'readonly':''}></div><div class="field"><label for="source-name">${t('name')}</label><input id="source-name" required maxlength="120" value="${esc(source?.name||'')}"></div><div class="field"><label for="source-kind">${t('sourceKind')}</label><select id="source-kind"><option value="local">${t('nasDirectory')}</option><option value="webdav">WebDAV</option></select></div><div class="field"><label for="source-location">${t('sourceLocation')}</label><input id="source-location" required maxlength="2048" value="${esc(source?.location||'.')}"><p class="hint">${t('sourceLocationHint')}</p></div><div class="field"><label for="source-credential">${t('sourceCredential')}</label><input id="source-credential" pattern="FRAME_FLOW_SOURCE_[A-Z0-9_]+" value="${esc(source?.credential_env||'')}" placeholder="FRAME_FLOW_SOURCE_CLOUD"><p class="hint">${t('sourceCredentialHint')}</p></div><div class="field"><label class="check-row"><input id="source-organized" type="checkbox" ${source?.organized_only?'checked':''}>${t('organizedPhotos')}</label><label class="check-row"><input id="source-caption" type="checkbox" ${source?.folder_caption?'checked':''}>${t('folderCaption')}</label><label class="check-row"><input id="source-synology-previews" type="checkbox" ${source?.synology_previews?'checked':''}>${t('synologyPreviews')}</label><p class="hint">${t('folderCaptionHint')}</p></div><div class="field"><label class="check-row"><input id="source-recursive" type="checkbox" ${source?.recursive===false?'':'checked'}>${t('sourceRecursive')}</label><label class="check-row"><input id="source-enabled" type="checkbox" ${source?.enabled===false?'':'checked'}>${t('enabled')}</label></div><div class="modal-actions">${buttons('modal-cancel','cancel')}<button type="submit" class="primary">${t('save')}</button></div></form>`);
- $('#source-kind').value=source?.kind||'local';const update=()=>{const dav=$('#source-kind').value==='webdav';$('#source-credential').disabled=!dav;$('#source-recursive').disabled=dav;$('#source-synology-previews').disabled=dav;};update();$('#source-kind').onchange=update;
- $('#photo-source-form').onsubmit=busy(async e=>{e.preventDefault();const dav=$('#source-kind').value==='webdav';await api('/api/v1/photo-sources/'+$('#source-id').value,{method:'PUT',body:{name:$('#source-name').value,kind:$('#source-kind').value,location:$('#source-location').value,recursive:!dav&&$('#source-recursive').checked,synology_previews:!dav&&$('#source-synology-previews').checked,catalog_limit:$('#source-organized').checked?100000:(source?.catalog_limit||10000),organized_only:$('#source-organized').checked,folder_caption:$('#source-caption').checked,enabled:$('#source-enabled').checked,credential_env:dav?($('#source-credential').value||null):null}});$('#modal').close();await navigate('gallery');});
+async function photoSourceForm(source=null){
+ showModal(`<h2>${t(source?'edit':'addSource')}</h2><form id="photo-source-form"><div class="field"><label for="source-id">ID</label><input id="source-id" pattern="[a-z0-9-]{1,60}" required value="${esc(source?.id||'')}" ${source?'readonly':''}></div><div class="field"><label for="source-name">${t('name')}</label><input id="source-name" required maxlength="120" value="${esc(source?.name||'')}"></div><div class="field"><label for="source-kind">${t('sourceKind')}</label><select id="source-kind"><option value="local">${t('nasDirectory')}</option><option value="webdav">WebDAV</option></select></div><div class="field"><label for="source-location">${t('sourceLocation')}</label><input id="source-location" required maxlength="2048" value="${esc(source?.location||'.')}"><p class="hint">${t('sourceLocationHint')}</p></div><div class="field"><label for="source-credential">${t('sourceCredential')}</label><input id="source-credential" pattern="FRAME_FLOW_SOURCE_[A-Z0-9_]+" value="${esc(source?.credential_env||'')}" placeholder="FRAME_FLOW_SOURCE_CLOUD"><p class="hint">${t('sourceCredentialHint')}</p></div><div class="field"><label class="check-row"><input id="source-organized" type="checkbox" ${source?.organized_only?'checked':''}>${t('organizedPhotos')}</label><label class="check-row"><input id="source-caption" type="checkbox" ${source?.folder_caption?'checked':''}>${t('folderCaption')}</label><label class="check-row"><input id="source-synology-previews" type="checkbox" ${source?.synology_previews?'checked':''}>${t('synologyPreviews')}</label><p class="hint">${t('folderCaptionHint')}</p></div><div class="field"><label class="check-row"><input id="source-people-filter" type="checkbox" ${source?.people_filter?'checked':''}>${t('peopleFilter')}</label><p class="hint">${t('peopleHint')}</p><button id="source-people-load" type="button">${t('choosePeople')}</button><div id="source-people-panel"><p class="hint">${t('peopleSelected')}${(source?.person_ids||[]).length}</p></div><label for="source-person-match">${t('personMatch')}</label><select id="source-person-match"><option value="any">${t('personAny')}</option><option value="all">${t('personAll')}</option></select></div><div class="field"><label class="check-row"><input id="source-recursive" type="checkbox" ${source?.recursive===false?'':'checked'}>${t('sourceRecursive')}</label><label class="check-row"><input id="source-enabled" type="checkbox" ${source?.enabled===false?'':'checked'}>${t('enabled')}</label></div><div class="modal-actions">${buttons('modal-cancel','cancel')}<button type="submit" class="primary">${t('save')}</button></div></form>`);
+ const selectedPeople=new Set(source?.person_ids||[]);$('#source-person-match').value=source?.person_match||'any';$('#source-people-load').onclick=busy(async()=>{await photosPeoplePicker(selectedPeople);});$('#source-kind').value=source?.kind||'local';const update=()=>{const dav=$('#source-kind').value==='webdav';$('#source-credential').disabled=!dav;$('#source-recursive').disabled=dav;$('#source-synology-previews').disabled=dav;$('#source-people-filter').disabled=dav;$('#source-people-load').disabled=dav;};update();$('#source-kind').onchange=update;
+ $('#photo-source-form').onsubmit=busy(async e=>{e.preventDefault();const dav=$('#source-kind').value==='webdav';await api('/api/v1/photo-sources/'+$('#source-id').value,{method:'PUT',body:{name:$('#source-name').value,kind:$('#source-kind').value,location:$('#source-location').value,recursive:!dav&&$('#source-recursive').checked,synology_previews:!dav&&$('#source-synology-previews').checked,catalog_limit:$('#source-organized').checked?100000:(source?.catalog_limit||10000),organized_only:$('#source-organized').checked,folder_caption:$('#source-caption').checked,people_filter:!dav&&$('#source-people-filter').checked,person_ids:[...selectedPeople],person_match:$('#source-person-match').value,enabled:$('#source-enabled').checked,credential_env:dav?($('#source-credential').value||null):null}});$('#modal').close();await navigate('gallery');});
 }
 async function browseSource(id,offset=0,refresh=false){
 const result=await api('/api/v1/photo-sources/'+id+'/images?offset='+offset+'&limit=50&refresh='+refresh);const box=$('#source-browser');if(!box)return;
@@ -24,3 +24,6 @@ Object.assign(MESSAGES.zh,{organizedPhotos:'仅日期开头文件夹中的照片
 Object.assign(MESSAGES.en,{organizedPhotos:'Only photos in date-prefixed folders',folderCaption:'Show folder caption below the photo',folderCaptionHint:'Line 1: title without date/place. Line 2: date. Line 3: place after @, omitted when absent. Subfolders inherit their nearest dated folder.'});

 Object.assign(MESSAGES.zh,{synologyPreviews:'超大图片使用 Synology Photos 的现有预览图'});Object.assign(MESSAGES.en,{synologyPreviews:'Use existing Synology Photos previews for oversized images'});
+
+Object.assign(MESSAGES.zh,{peopleFilter:'按 Synology Photos 人物筛选',peopleHint:'只在当前目录和所选人物的交集中选图；不会退回全图库。需要共享空间人物相册授权。',choosePeople:'连接 / 选择人物',personMatch:'人物匹配方式',personAny:'包含任意所选人物',personAll:'同时包含所有所选人物',photosConfigure:'管理员需配置 SYNOLOGY_PHOTOS_URL 和 SYNOLOGY_PHOTOS_CERT_SHA256，并将共享 photo 目录挂载为照片根目录。',photosSessionHint:'仅保存受保护的登录会话，不保存 NAS 密码。会话失效后需要重新连接。',photosConnect:'连接 Synology Photos',photosDisconnect:'断开连接',peopleSearch:'搜索人物名称或 ID',peopleUnnamed:'显示未命名人物分组',peopleSelected:'已选择：'});
+Object.assign(MESSAGES.en,{peopleFilter:'Filter by Synology Photos people',peopleHint:'Choose only from the intersection of this folder and selected people. Requires shared-space People access; never falls back to the full catalog.',choosePeople:'Connect / choose people',personMatch:'Person matching',personAny:'Any selected person',personAll:'All selected people together',photosConfigure:'Admin must configure SYNOLOGY_PHOTOS_URL and SYNOLOGY_PHOTOS_CERT_SHA256, and mount the shared photo folder as the photo root.',photosSessionHint:'Only a protected login session is stored, never your NAS password. Reconnect when the session expires.',photosConnect:'Connect Synology Photos',photosDisconnect:'Disconnect',peopleSearch:'Search person name or ID',peopleUnnamed:'Show unnamed person groups',peopleSelected:'Selected: '});