Merge remote-tracking branch 'origin/main' into feat/yucca-integration

2026-05-18 03:10:24 +03:00 · 2026-04-20 10:55:40 +01:00
parent 4ded06dbb7 0eef15a3ab
commit 425abe510a
338 changed files with 4761 additions and 5589 deletions
@@ -1,5 +1,5 @@
 import { NestExpressApplication } from '@nestjs/platform-express';
-import { json } from 'body-parser';
+import { json, urlencoded } from 'body-parser';
 import compression from 'compression';
 import cookieParser from 'cookie-parser';
 import helmetMiddleware from 'helmet';
@@ -56,6 +56,7 @@ export async function configureExpress(

  app.use(cookieParser());
  app.use(json({ limit: '10mb' }));
+  app.use(urlencoded({ limit: '10mb' }));

  if (configRepository.isDev()) {
    app.enableCors();
@@ -104,13 +104,16 @@ export type SystemConfig = {
    defaultStorageQuota: number | null;
    enabled: boolean;
    issuerUrl: string;
+    endSessionEndpoint: string;
    mobileOverrideEnabled: boolean;
    mobileRedirectUri: string;
+    prompt: string;
    scope: string;
    signingAlgorithm: string;
    profileSigningAlgorithm: string;
    tokenEndpointAuthMethod: OAuthTokenEndpointAuthMethod;
    timeout: number;
+    allowInsecureRequests: boolean;
    storageLabelClaim: string;
    storageQuotaClaim: string;
    roleClaim: string;
@@ -295,8 +298,10 @@ export const defaults = Object.freeze<SystemConfig>({
    defaultStorageQuota: null,
    enabled: false,
    issuerUrl: '',
+    endSessionEndpoint: '',
    mobileOverrideEnabled: false,
    mobileRedirectUri: '',
+    prompt: '',
    scope: 'openid email profile',
    signingAlgorithm: 'RS256',
    profileSigningAlgorithm: 'none',
@@ -305,6 +310,7 @@ export const defaults = Object.freeze<SystemConfig>({
    roleClaim: 'immich_role',
    tokenEndpointAuthMethod: OAuthTokenEndpointAuthMethod.ClientSecretPost,
    timeout: 30_000,
+    allowInsecureRequests: false,
  },
  passwordLogin: {
    enabled: true,
@@ -12,7 +12,6 @@ const makeUploadDto = (options?: { omit: string }): Record<string, any> => {
    fileCreatedAt: new Date().toISOString(),
    fileModifiedAt: new Date().toISOString(),
    isFavorite: 'false',
-    duration: '0:00:00.000000',
  };

  const omit = options?.omit;
@@ -96,6 +96,12 @@ describe(MemoryController.name, () => {
      expect(status).toBe(400);
      expect(body).toEqual(errorDto.badRequest(['Invalid input: expected object, received undefined']));
    });
+
+    it('should require at least one field', async () => {
+      const { status, body } = await request(ctx.getHttpServer()).put(`/memories/${factory.uuid()}`).send({});
+      expect(status).toBe(400);
+      expect(body).toEqual(errorDto.badRequest(['At least one field must be provided']));
+    });
  });

  describe('DELETE /memories/:id', () => {
@@ -1,11 +1,12 @@
 import { Body, Controller, Get, HttpCode, HttpStatus, Post, Redirect, Req, Res } from '@nestjs/common';
-import { ApiTags } from '@nestjs/swagger';
+import { ApiConsumes, ApiTags } from '@nestjs/swagger';
 import { Request, Response } from 'express';
 import { Endpoint, HistoryBuilder } from 'src/decorators';
 import {
  AuthDto,
  LoginResponseDto,
  OAuthAuthorizeResponseDto,
+  OAuthBackchannelLogoutDto,
  OAuthCallbackDto,
  OAuthConfigDto,
 } from 'src/dtos/auth.dto';
@@ -112,4 +113,17 @@ export class OAuthController {
  unlinkOAuthAccount(@Auth() auth: AuthDto): Promise<UserAdminResponseDto> {
    return this.service.unlink(auth);
  }
+
+  @Post('backchannel-logout')
+  @HttpCode(HttpStatus.OK)
+  @ApiConsumes('application/x-www-form-urlencoded')
+  @Endpoint({
+    summary: 'Backchannel OAuth logout',
+    description:
+      'Logout the OAuth account and invalidate the session specified by the sid claim or all sessions if the sid claim is not present.',
+    history: new HistoryBuilder().added('v2'),
+  })
+  async logoutOAuth(@Body() dto: OAuthBackchannelLogoutDto): Promise<void> {
+    return this.service.backchannelLogout(dto);
+  }
 }
@@ -11,7 +11,6 @@ import {
  ServerPingResponse,
  ServerStatsResponseDto,
  ServerStorageResponseDto,
-  ServerThemeDto,
  ServerVersionHistoryResponseDto,
  ServerVersionResponseDto,
 } from 'src/dtos/server.dto';
@@ -104,16 +103,6 @@ export class ServerController {
    return this.service.getFeatures();
  }

-  @Get('theme')
-  @Endpoint({
-    summary: 'Get theme',
-    description: 'Retrieve the custom CSS, if existent.',
-    history: new HistoryBuilder().added('v1').beta('v1').stable('v2'),
-  })
-  getTheme(): Promise<ServerThemeDto> {
-    return this.service.getTheme();
-  }
-
  @Get('config')
  @Endpoint({
    summary: 'Get config',
@@ -47,7 +47,7 @@ const SanitizedAssetResponseSchema = z
      .describe(
        'The local date and time when the photo/video was taken, derived from EXIF metadata. This represents the photographer\'s local time regardless of timezone, stored as a timezone-agnostic timestamp. Used for timeline grouping by "local" days and months.',
      ),
-    duration: z.string().describe('Video duration (for videos)'),
+    duration: z.string().nullable().describe('Video/gif duration in hh:mm:ss.SSS format (null for static images)'),
    livePhotoVideoId: z.string().nullish().describe('Live photo video ID'),
    hasMetadata: z.boolean().describe('Whether asset has metadata'),
    width: z.number().min(0).nullable().describe('Asset width'),
@@ -221,7 +221,7 @@ export function mapAsset(entity: MaybeDehydrated<MapAsset>, options: AssetMapOpt
      originalMimeType: mimeTypes.lookup(entity.originalFileName),
      thumbhash: entity.thumbhash ? hexOrBufferToBase64(entity.thumbhash) : null,
      localDateTime: asDateString(entity.localDateTime),
-      duration: entity.duration ?? '0:00:00.00000',
+      duration: entity.duration,
      livePhotoVideoId: entity.livePhotoVideoId,
      hasMetadata: false,
      width: entity.width,
@@ -251,7 +251,7 @@ export function mapAsset(entity: MaybeDehydrated<MapAsset>, options: AssetMapOpt
    isArchived: entity.visibility === AssetVisibility.Archive,
    isTrashed: !!entity.deletedAt,
    visibility: entity.visibility,
-    duration: entity.duration ?? '0:00:00.00000',
+    duration: entity.duration,
    exifInfo: entity.exifInfo ? mapExif(entity.exifInfo) : undefined,
    livePhotoVideoId: entity.livePhotoVideoId,
    tags: entity.tags?.map((tag) => mapTag(tag)),
@@ -124,6 +124,10 @@ const OAuthAuthorizeResponseSchema = z
  })
  .meta({ id: 'OAuthAuthorizeResponseDto' });

+const OAuthBackchannelLogoutSchema = z
+  .object({ logout_token: z.string().describe('OAuth logout token') })
+  .meta({ id: 'OAuthBackchannelLogoutDto' });
+
 const AuthStatusResponseSchema = z
  .object({
    pinCode: z.boolean().describe('Has PIN code set'),
@@ -147,4 +151,5 @@ export class ValidateAccessTokenResponseDto extends createZodDto(ValidateAccessT
 export class OAuthCallbackDto extends createZodDto(OAuthCallbackSchema) {}
 export class OAuthConfigDto extends createZodDto(OAuthConfigSchema) {}
 export class OAuthAuthorizeResponseDto extends createZodDto(OAuthAuthorizeResponseSchema) {}
+export class OAuthBackchannelLogoutDto extends createZodDto(OAuthBackchannelLogoutSchema) {}
 export class AuthStatusResponseDto extends createZodDto(AuthStatusResponseSchema) {}
@@ -4,7 +4,7 @@ import { HistoryBuilder } from 'src/decorators';
 import { AssetResponseSchema, mapAsset } from 'src/dtos/asset-response.dto';
 import { AuthDto } from 'src/dtos/auth.dto';
 import { AssetOrderWithRandomSchema, MemoryType, MemoryTypeSchema } from 'src/enum';
-import { isoDatetimeToDate, stringToBool } from 'src/validation';
+import { isoDatetimeToDate, nonEmptyPartial, stringToBool } from 'src/validation';
 import z from 'zod';

 const MemorySearchSchema = z
@@ -26,13 +26,11 @@ const OnThisDaySchema = z

 type MemoryData = z.infer<typeof OnThisDaySchema>;

-const MemoryUpdateSchema = z
-  .object({
-    isSaved: z.boolean().optional().describe('Is memory saved'),
-    seenAt: isoDatetimeToDate.optional().describe('Date when memory was seen'),
-    memoryAt: isoDatetimeToDate.optional().describe('Memory date'),
-  })
-  .meta({ id: 'MemoryUpdateDto' });
+const MemoryUpdateSchema = nonEmptyPartial({
+  isSaved: z.boolean().describe('Is memory saved'),
+  seenAt: isoDatetimeToDate.describe('Date when memory was seen'),
+  memoryAt: isoDatetimeToDate.describe('Memory date'),
+}).meta({ id: 'MemoryUpdateDto' });

 const MemoryCreateSchema = z
  .object({
@@ -104,12 +104,6 @@ const ServerMediaTypesResponseSchema = z
  })
  .meta({ id: 'ServerMediaTypesResponseDto' });

-const ServerThemeSchema = z
-  .object({
-    customCss: z.string().describe('Custom CSS for theming'),
-  })
-  .meta({ id: 'ServerThemeDto' });
-
 const ServerConfigSchema = z
  .object({
    oauthButtonText: z.string().describe('OAuth button text'),
@@ -161,7 +155,6 @@ export class ServerVersionHistoryResponseDto extends createZodDto(ServerVersionH
 export class UsageByUserDto extends createZodDto(UsageByUserSchema) {}
 export class ServerStatsResponseDto extends createZodDto(ServerStatsResponseSchema) {}
 export class ServerMediaTypesResponseDto extends createZodDto(ServerMediaTypesResponseSchema) {}
-export class ServerThemeDto extends createZodDto(ServerThemeSchema) {}
 export class ServerConfigDto extends createZodDto(ServerConfigSchema) {}
 export class ServerFeaturesDto extends createZodDto(ServerFeaturesSchema) {}

@@ -179,6 +179,7 @@ const SystemConfigOAuthSchema = z
    clientSecret: z.string().describe('Client secret'),
    tokenEndpointAuthMethod: OAuthTokenEndpointAuthMethodSchema,
    timeout: z.int().min(1).describe('Timeout'),
+    allowInsecureRequests: configBool.describe('Allow insecure requests'),
    defaultStorageQuota: z.number().min(0).nullable().describe('Default storage quota'),
    enabled: configBool.describe('Enabled'),
    issuerUrl: z
@@ -188,6 +189,13 @@ const SystemConfigOAuthSchema = z
      })
      .describe('Issuer URL'),
    scope: z.string().describe('Scope'),
+    prompt: z.string().describe('OAuth prompt parameter (e.g. select_account, login, consent)'),
+    endSessionEndpoint: z
+      .string()
+      .refine((url) => url.length === 0 || z.url().safeParse(url).success, {
+        error: 'endSessionEndpoint must be an empty string or a valid URL',
+      })
+      .describe('End session endpoint'),
    signingAlgorithm: z.string().describe('Signing algorithm'),
    profileSigningAlgorithm: z.string().describe('Profile signing algorithm'),
    storageLabelClaim: z.string().describe('Storage label claim'),
@@ -88,7 +88,9 @@ const TimeBucketAssetResponseSchema = z
      .describe(
        "Array of UTC offset hours at the time each photo was taken. Positive values are east of UTC, negative values are west of UTC. Values may be fractional (e.g., 5.5 for +05:30, -9.75 for -09:45). Applying this offset to 'fileCreatedAt' will give you the time the photo was taken from the photographer's perspective.",
      ),
-    duration: z.array(z.string().nullable()).describe('Array of video durations in HH:MM:SS format (null for images)'),
+    duration: z
+      .array(z.string().nullable())
+      .describe('Array of video/gif durations in hh:mm:ss.SSS format (null for static images)'),
    stack: z
      .array(stackTupleSchema)
      .optional()
@@ -35,47 +35,22 @@ where
  and "asset"."deletedAt" is null

 -- SearchRepository.searchRandom
-(
-  select
-    "asset".*
-  from
-    "asset"
-    inner join "asset_exif" on "asset"."id" = "asset_exif"."assetId"
-  where
-    "asset"."visibility" = $1
-    and "asset"."fileCreatedAt" >= $2
-    and "asset_exif"."lensModel" = $3
-    and "asset"."ownerId" = any ($4::uuid[])
-    and "asset"."isFavorite" = $5
-    and "asset"."deletedAt" is null
-    and "asset"."id" < $6
-  order by
-    random()
-  limit
-    $7
-)
-union all
-(
-  select
-    "asset".*
-  from
-    "asset"
-    inner join "asset_exif" on "asset"."id" = "asset_exif"."assetId"
-  where
-    "asset"."visibility" = $8
-    and "asset"."fileCreatedAt" >= $9
-    and "asset_exif"."lensModel" = $10
-    and "asset"."ownerId" = any ($11::uuid[])
-    and "asset"."isFavorite" = $12
-    and "asset"."deletedAt" is null
-    and "asset"."id" > $13
-  order by
-    random()
-  limit
-    $14
-)
+select
+  "asset".*
+from
+  "asset"
+  inner join "asset_exif" on "asset"."id" = "asset_exif"."assetId"
+where
+  "asset"."visibility" = $1
+  and "asset"."fileCreatedAt" >= $2
+  and "asset_exif"."lensModel" = $3
+  and "asset"."ownerId" = any ($4::uuid[])
+  and "asset"."isFavorite" = $5
+  and "asset"."deletedAt" is null
+order by
+  random()
 limit
-  $15
+  $6

 -- SearchRepository.searchLargeAssets
 select
@@ -74,7 +74,7 @@ delete from "session"
 where
  "id" = $1::uuid

-- SessionRepository.invalidate
+-- SessionRepository.invalidateAll
 delete from "session"
 where
  "userId" = $1
@@ -1,6 +1,7 @@
 import { Injectable, InternalServerErrorException } from '@nestjs/common';
+import { createRemoteJWKSet, jwtVerify, JWTVerifyGetKey } from 'jose';
 import {
-  allowInsecureRequests,
+  allowInsecureRequests as allowInsecureRequestsExecute,
  authorizationCodeGrant,
  buildAuthorizationUrl,
  calculatePKCECodeChallenge,
@@ -21,13 +22,16 @@ export type OAuthConfig = {
  clientId: string;
  clientSecret?: string;
  issuerUrl: string;
+  endSessionEndpoint: string;
  mobileOverrideEnabled: boolean;
  mobileRedirectUri: string;
  profileSigningAlgorithm: string;
+  prompt: string;
  scope: string;
  signingAlgorithm: string;
  tokenEndpointAuthMethod: OAuthTokenEndpointAuthMethod;
  timeout: number;
+  allowInsecureRequests: boolean;
 };
 export type OAuthProfile = UserInfoResponse;

@@ -55,6 +59,10 @@ export class OAuthRepository {
      state,
    };

+    if (config.prompt) {
+      params.prompt = config.prompt;
+    }
+
    if (client.serverMetadata().supportsPKCE()) {
      params.code_challenge = codeChallenge;
      params.code_challenge_method = 'S256';
@@ -70,12 +78,12 @@ export class OAuthRepository {
    return client.serverMetadata().end_session_endpoint;
  }

-  async getProfile(
+  async getProfileAndOAuthSid(
    config: OAuthConfig,
    url: string,
    expectedState: string,
    codeVerifier: string,
-  ): Promise<OAuthProfile> {
+  ): Promise<{ profile: OAuthProfile; sid?: string }> {
    const client = await this.getClient(config);
    const pkceCodeVerifier = client.serverMetadata().supportsPKCE() ? codeVerifier : undefined;

@@ -95,7 +103,15 @@ export class OAuthRepository {
        throw new Error('Unexpected profile response, no `sub`');
      }

-      return profile;
+      let sid: string | undefined;
+      if (tokens.id_token) {
+        const claims = tokens.claims();
+        if (typeof claims?.sid === 'string') {
+          sid = claims.sid;
+        }
+      }
+
+      return { profile, sid };
    } catch (error: Error | any) {
      if (error.message.includes('unexpected JWT alg received')) {
        this.logger.warn(
@@ -125,6 +141,59 @@ export class OAuthRepository {
    };
  }

+  private jwksClients: Map<string, JWTVerifyGetKey> = new Map(); // useful for caching and performnce
+  async validateLogoutToken(config: OAuthConfig, logoutToken: string): Promise<{ sub?: string; sid?: string } | null> {
+    const client = await this.getClient(config);
+    const algorithm = client.clientMetadata().id_token_signed_response_alg ?? 'RS256';
+    let keyOrGetter: Uint8Array | JWTVerifyGetKey;
+
+    try {
+      if (algorithm.startsWith('HS')) {
+        keyOrGetter = new TextEncoder().encode(config.clientSecret);
+      } else {
+        const jwksUri = client.serverMetadata().jwks_uri;
+        if (!jwksUri) {
+          throw new Error('Unable to get JWKS URI');
+        }
+
+        if (!this.jwksClients.has(jwksUri)) {
+          this.jwksClients.set(jwksUri, createRemoteJWKSet(new URL(jwksUri)));
+        }
+        keyOrGetter = this.jwksClients.get(jwksUri) as JWTVerifyGetKey;
+      }
+
+      const { payload } = await jwtVerify(logoutToken, keyOrGetter as any, {
+        issuer: client.serverMetadata().issuer,
+        audience: config.clientId,
+        algorithms: [algorithm],
+        maxTokenAge: '2m',
+        clockTolerance: '5s',
+      });
+
+      // Validate specific Logout Token claims (RFC 8963):
+      // "events" claim must exist and contain the backchannel-logout event
+      const events = payload.events as Record<string, any> | undefined;
+      if (!events || !events['http://schemas.openid.net/event/backchannel-logout']) {
+        throw new Error('Missing backchannel-logout event claim');
+      }
+
+      // "nonce" must not be present
+      if (payload.nonce) {
+        throw new Error('Logout token must not contain a nonce');
+      }
+
+      return {
+        sub: payload.sub,
+        sid: payload.sid as string | undefined,
+      };
+    } catch (error: Error | any) {
+      this.logger.error(`Error validating JWT logout token: ${error.message}`);
+      this.logger.error(error);
+
+      throw new Error('Error validating JWT logout token', { cause: error });
+    }
+  }
+
  private async getClient({
    issuerUrl,
    clientId,
@@ -133,6 +202,7 @@ export class OAuthRepository {
    signingAlgorithm,
    tokenEndpointAuthMethod,
    timeout,
+    allowInsecureRequests,
  }: OAuthConfig) {
    try {
      return await discovery(
@@ -146,7 +216,7 @@ export class OAuthRepository {
        },
        this.getTokenAuthMethod(tokenEndpointAuthMethod, clientSecret),
        {
-          execute: [allowInsecureRequests],
+          execute: allowInsecureRequests ? [allowInsecureRequestsExecute] : [],
          timeout,
        },
      );
@@ -1,9 +1,7 @@
 import { Injectable } from '@nestjs/common';
 import { Kysely, OrderByDirection, Selectable, ShallowDehydrateObject, sql } from 'kysely';
 import { InjectKysely } from 'nestjs-kysely';
-import { randomUUID } from 'node:crypto';
 import { DummyValue, GenerateSql } from 'src/decorators';
-import { MapAsset } from 'src/dtos/asset-response.dto';
 import { AssetStatus, AssetType, AssetVisibility, VectorIndex } from 'src/enum';
 import { probes } from 'src/repositories/database.repository';
 import { DB } from 'src/schema';
@@ -236,20 +234,11 @@ export class SearchRepository {
    ],
  })
  async searchRandom(size: number, options: AssetSearchOptions) {
-    const uuid = randomUUID();
-    const builder = searchAssetBuilder(this.db, options);
-    const lessThan = builder
+    return searchAssetBuilder(this.db, options)
      .selectAll('asset')
-      .where('asset.id', '<', uuid)
      .orderBy(sql`random()`)
-      .limit(size);
-    const greaterThan = builder
-      .selectAll('asset')
-      .where('asset.id', '>', uuid)
-      .orderBy(sql`random()`)
-      .limit(size);
-    const { rows } = await sql<MapAsset>`${lessThan} union all ${greaterThan} limit ${size}`.execute(this.db);
-    return rows;
+      .limit(size)
+      .execute();
  }

  @GenerateSql({
@@ -102,7 +102,7 @@ export class SessionRepository {
  }

  @GenerateSql({ params: [{ userId: DummyValue.UUID, excludeId: DummyValue.UUID }] })
-  async invalidate({ userId, excludeId }: { userId: string; excludeId?: string }) {
+  async invalidateAll({ userId, excludeId }: { userId: string; excludeId?: string }) {
    await this.db
      .deleteFrom('session')
      .where('userId', '=', userId)
@@ -110,6 +110,28 @@ export class SessionRepository {
      .execute();
  }

+  @GenerateSql({ params: [DummyValue.STRING, DummyValue.STRING] })
+  async invalidateOAuth({ oauthSid, oauthId }: { oauthSid?: string; oauthId?: string }): Promise<string[]> {
+    let query = this.db.deleteFrom('session').returning('session.id');
+
+    if (oauthSid && oauthId) {
+      query = query
+        .using('user')
+        .whereRef('user.id', '=', 'session.userId')
+        .where('session.oauthSid', '=', oauthSid)
+        .where('user.oauthId', '=', oauthId);
+    } else if (!oauthSid && oauthId) {
+      query = query.using('user').whereRef('user.id', '=', 'session.userId').where('user.oauthId', '=', oauthId);
+    } else if (oauthSid && !oauthId) {
+      query = query.where('session.oauthSid', '=', oauthSid);
+    } else {
+      throw new Error('Invalid arguments: at least one of oauthSid or oauthId must be present');
+    }
+
+    const deletedRows = await query.execute();
+    return deletedRows.map((row) => row.id);
+  }
+
  @GenerateSql({ params: [DummyValue.UUID] })
  async lockAll(userId: string) {
    await this.db.updateTable('session').set({ pinExpiresAt: null }).where('userId', '=', userId).execute();
@@ -0,0 +1,22 @@
+import { Kysely, sql } from 'kysely';
+
+export async function up(db: Kysely<any>): Promise<void> {
+  await sql`
+    UPDATE system_metadata
+    SET value = jsonb_set(
+      value,
+      '{oauth,allowInsecureRequests}',
+      'true'::jsonb
+    )
+    WHERE key = 'system-config'
+    AND value->'oauth'->>'issuerUrl' LIKE 'http://%'
+  `.execute(db);
+}
+
+export async function down(db: Kysely<any>): Promise<void> {
+  await sql`
+    UPDATE system_metadata
+    SET value = value #- '{oauth,allowInsecureRequests}'
+    WHERE key = 'system-config'
+  `.execute(db);
+}
@@ -0,0 +1,11 @@
+import { Kysely, sql } from 'kysely';
+
+export async function up(db: Kysely<any>): Promise<void> {
+  await sql`ALTER TABLE "session" ADD "oauthSid" character varying;`.execute(db);
+  await sql`CREATE INDEX "session_oauthSid_idx" ON "session" ("oauthSid");`.execute(db);
+}
+
+export async function down(db: Kysely<any>): Promise<void> {
+  await sql`DROP INDEX "session_oauthSid_idx";`.execute(db);
+  await sql`ALTER TABLE "session" DROP COLUMN "oauthSid";`.execute(db);
+}
@@ -52,4 +52,7 @@ export class SessionTable {

  @Column({ type: 'timestamp with time zone', nullable: true })
  pinExpiresAt!: Timestamp | null;
+
+  @Column({ nullable: true, index: true })
+  oauthSid!: string | null;
 }
@@ -148,7 +148,6 @@ const createDto = Object.freeze({
  fileCreatedAt: new Date('2022-06-19T23:41:36.910Z'),
  fileModifiedAt: new Date('2022-06-19T23:41:36.910Z'),
  isFavorite: false,
-  duration: '0:00:00.000000',
 }) as AssetMediaCreateDto;

 const assetEntity = Object.freeze({
@@ -160,7 +159,7 @@ const assetEntity = Object.freeze({
  fileCreatedAt: new Date('2022-06-19T23:41:36.910Z'),
  updatedAt: new Date('2022-06-19T23:41:36.910Z'),
  isFavorite: false,
-  duration: '0:00:00.000000',
+  duration: null,
  files: [] as AssetFile[],
  exifInfo: {
    latitude: 49.533_547,
@@ -164,6 +164,32 @@ describe(AuthService.name, () => {
      });
    });

+    it('should return the custom end session endpoint if provided', async () => {
+      const auth = AuthFactory.create();
+
+      mocks.systemMetadata.get.mockResolvedValue({
+        oauth: { enabled: true, endSessionEndpoint: 'http://custom-logout-url' },
+      });
+
+      await expect(sut.logout(auth, AuthType.OAuth)).resolves.toEqual({
+        successful: true,
+        redirectUri: 'http://custom-logout-url',
+      });
+    });
+
+    it('should return the auto-discovered end session endpoint if custom endpoint is not provided', async () => {
+      const auth = AuthFactory.create();
+
+      mocks.systemMetadata.get.mockResolvedValue({
+        oauth: { enabled: true, endSessionEndpoint: '' },
+      });
+
+      await expect(sut.logout(auth, AuthType.OAuth)).resolves.toEqual({
+        successful: true,
+        redirectUri: 'http://end-session-endpoint',
+      });
+    });
+
    it('should return the default redirect', async () => {
      const auth = AuthFactory.create();

@@ -196,6 +222,64 @@ describe(AuthService.name, () => {
    });
  });

+  describe('backchannelLogout', () => {
+    const dto = { logout_token: 'fake-jwt-token' };
+
+    it('should throw a Bad Request Exception if OAuth is not enabled', async () => {
+      await expect(sut.backchannelLogout(dto)).rejects.toBeInstanceOf(BadRequestException);
+      await expect(sut.backchannelLogout(dto)).rejects.toThrow(
+        'Received backchannel logout request but OAuth is not enabled',
+      );
+    });
+
+    it('should throw a Bad Request Exception if the logout token validation fails', async () => {
+      mocks.systemMetadata.get.mockResolvedValue(systemConfigStub.oauthEnabled);
+      mocks.oauth.validateLogoutToken.mockRejectedValue(new Error('Token validation failed'));
+
+      await expect(sut.backchannelLogout(dto)).rejects.toBeInstanceOf(BadRequestException);
+      await expect(sut.backchannelLogout(dto)).rejects.toThrow('Error backchannel logout: token validation failed');
+    });
+
+    it('should throw a Bad Request Exception if there are no claims in the logout token', async () => {
+      mocks.systemMetadata.get.mockResolvedValue(systemConfigStub.oauthEnabled);
+      mocks.oauth.validateLogoutToken.mockResolvedValue(null);
+
+      await expect(sut.backchannelLogout(dto)).rejects.toBeInstanceOf(BadRequestException);
+      await expect(sut.backchannelLogout(dto)).rejects.toThrow('Invalid logout token: no claims found');
+    });
+
+    it('should throw a Bad Request Exception if there is neither the sub nor the sid claim', async () => {
+      mocks.systemMetadata.get.mockResolvedValue(systemConfigStub.oauthEnabled);
+      mocks.oauth.validateLogoutToken.mockResolvedValue({ sub: '', sid: '' });
+
+      await expect(sut.backchannelLogout(dto)).rejects.toBeInstanceOf(BadRequestException);
+      await expect(sut.backchannelLogout(dto)).rejects.toThrow(
+        'Invalid logout token: it must contain either a sub or a sid claim',
+      );
+    });
+
+    it('should invalidate the OAuth session(s) if the logout token is valid', async () => {
+      const claims = { sub: 'fake-sub', sid: 'fake-sid' };
+      const deletedSessionIds: string[] = ['fake-session-1', 'fake-session-2'];
+
+      mocks.systemMetadata.get.mockResolvedValue(systemConfigStub.oauthEnabled);
+      mocks.oauth.validateLogoutToken.mockResolvedValue(claims);
+      mocks.session.invalidateOAuth.mockResolvedValue(deletedSessionIds);
+      mocks.event.emit.mockResolvedValue(void 0);
+      mocks.event.emit.mockResolvedValue(void 0);
+
+      await sut.backchannelLogout(dto);
+
+      expect(mocks.session.invalidateOAuth).toHaveBeenCalledWith({
+        oauthSid: claims.sid,
+        oauthId: claims.sub,
+      });
+
+      expect(mocks.event.emit).toHaveBeenCalledWith('SessionDelete', { sessionId: 'fake-session-1' });
+      expect(mocks.event.emit).toHaveBeenCalledWith('SessionDelete', { sessionId: 'fake-session-2' });
+    });
+  });
+
  describe('adminSignUp', () => {
    const dto: SignUpDto = { email: 'test@immich.com', password: 'password', name: 'immich admin' };

@@ -250,6 +334,7 @@ describe(AuthService.name, () => {
        user: UserFactory.create(),
        pinExpiresAt: null,
        appVersion: null,
+        oauthSid: null,
      };

      mocks.session.getByToken.mockResolvedValue(sessionWithToken);
@@ -416,6 +501,7 @@ describe(AuthService.name, () => {
        user: UserFactory.create(),
        pinExpiresAt: null,
        appVersion: null,
+        oauthSid: null,
      };

      mocks.session.getByToken.mockResolvedValue(sessionWithToken);
@@ -444,6 +530,7 @@ describe(AuthService.name, () => {
        isPendingSyncReset: false,
        pinExpiresAt: null,
        appVersion: null,
+        oauthSid: null,
      };

      mocks.session.getByToken.mockResolvedValue(sessionWithToken);
@@ -466,6 +553,7 @@ describe(AuthService.name, () => {
        isPendingSyncReset: false,
        pinExpiresAt: null,
        appVersion: null,
+        oauthSid: null,
      };

      mocks.session.getByToken.mockResolvedValue(sessionWithToken);
@@ -601,7 +689,7 @@ describe(AuthService.name, () => {
    it('should not allow auto registering', async () => {
      mocks.systemMetadata.get.mockResolvedValue(systemConfigStub.oauthEnabled);
      mocks.user.getByEmail.mockResolvedValue(void 0);
-      mocks.oauth.getProfile.mockResolvedValue(OAuthProfileFactory.create());
+      mocks.oauth.getProfileAndOAuthSid.mockResolvedValue({ profile: OAuthProfileFactory.create() });

      await expect(
        sut.callback(
@@ -619,7 +707,7 @@ describe(AuthService.name, () => {
      const profile = OAuthProfileFactory.create();

      mocks.systemMetadata.get.mockResolvedValue(systemConfigStub.oauthEnabled);
-      mocks.oauth.getProfile.mockResolvedValue(profile);
+      mocks.oauth.getProfileAndOAuthSid.mockResolvedValue({ profile });
      mocks.user.getByEmail.mockResolvedValue(user);
      mocks.user.update.mockResolvedValue(user);
      mocks.session.create.mockResolvedValue(SessionFactory.create());
@@ -634,11 +722,31 @@ describe(AuthService.name, () => {
      expect(mocks.user.update).toHaveBeenCalledWith(user.id, { oauthId: profile.sub });
    });

+    it('should normalize the email from the OAuth profile before linking', async () => {
+      const user = UserFactory.create();
+      const profile = OAuthProfileFactory.create({ email: '  TEST@IMMICH.CLOUD  ' });
+
+      mocks.systemMetadata.get.mockResolvedValue(systemConfigStub.oauthEnabled);
+      mocks.oauth.getProfileAndOAuthSid.mockResolvedValue({ profile });
+      mocks.user.getByEmail.mockResolvedValue(user);
+      mocks.user.update.mockResolvedValue(user);
+      mocks.session.create.mockResolvedValue(SessionFactory.create());
+
+      await sut.callback(
+        { url: 'http://immich/auth/login?code=abc123', state: 'xyz789', codeVerifier: 'foobar' },
+        {},
+        loginDetails,
+      );
+
+      expect(mocks.user.getByEmail).toHaveBeenCalledWith('test@immich.cloud');
+      expect(mocks.user.update).toHaveBeenCalledWith(user.id, { oauthId: profile.sub });
+    });
+
    it('should not link to a user with a different oauth sub', async () => {
      const user = UserFactory.create({ oauthId: 'existing-sub' });

      mocks.systemMetadata.get.mockResolvedValue(systemConfigStub.oauthWithAutoRegister);
-      mocks.oauth.getProfile.mockResolvedValue(OAuthProfileFactory.create());
+      mocks.oauth.getProfileAndOAuthSid.mockResolvedValue({ profile: OAuthProfileFactory.create() });
      mocks.user.getByEmail.mockResolvedValueOnce(user);
      mocks.user.getAdmin.mockResolvedValue(UserFactory.create({ isAdmin: true }));

@@ -659,7 +767,7 @@ describe(AuthService.name, () => {
      mocks.user.getByEmail.mockResolvedValue(void 0);
      mocks.user.getAdmin.mockResolvedValue(UserFactory.create({ isAdmin: true }));
      mocks.user.create.mockResolvedValue(UserFactory.create({ oauthId: 'oauth-id' }));
-      mocks.oauth.getProfile.mockResolvedValue(OAuthProfileFactory.create());
+      mocks.oauth.getProfileAndOAuthSid.mockResolvedValue({ profile: OAuthProfileFactory.create() });
      mocks.session.create.mockResolvedValue(SessionFactory.create());

      await sut.callback(
@@ -678,7 +786,7 @@ describe(AuthService.name, () => {
      mocks.user.getAdmin.mockResolvedValue(UserFactory.create({ isAdmin: true }));
      mocks.user.create.mockResolvedValue(UserFactory.create());
      mocks.session.create.mockResolvedValue(SessionFactory.create());
-      mocks.oauth.getProfile.mockResolvedValue({ sub: 'sub' });
+      mocks.oauth.getProfileAndOAuthSid.mockResolvedValue({ profile: { sub: 'sub' } });

      await expect(
        sut.callback(
@@ -700,12 +808,12 @@ describe(AuthService.name, () => {
      it(`should use the mobile redirect override for a url of ${url}`, async () => {
        mocks.systemMetadata.get.mockResolvedValue(systemConfigStub.oauthWithMobileOverride);
        mocks.user.getByOAuthId.mockResolvedValue(UserFactory.create());
-        mocks.oauth.getProfile.mockResolvedValue(OAuthProfileFactory.create());
+        mocks.oauth.getProfileAndOAuthSid.mockResolvedValue({ profile: OAuthProfileFactory.create() });
        mocks.session.create.mockResolvedValue(SessionFactory.create());

        await sut.callback({ url, state: 'xyz789', codeVerifier: 'foo' }, {}, loginDetails);

-        expect(mocks.oauth.getProfile).toHaveBeenCalledWith(
+        expect(mocks.oauth.getProfileAndOAuthSid).toHaveBeenCalledWith(
          expect.objectContaining({}),
          'http://mobile-redirect?code=abc123',
          'xyz789',
@@ -718,7 +826,7 @@ describe(AuthService.name, () => {
      mocks.systemMetadata.get.mockResolvedValue(systemConfigStub.oauthWithStorageQuota);
      mocks.user.getByEmail.mockResolvedValue(void 0);
      mocks.user.getAdmin.mockResolvedValue(UserFactory.create({ isAdmin: true }));
-      mocks.oauth.getProfile.mockResolvedValue(OAuthProfileFactory.create());
+      mocks.oauth.getProfileAndOAuthSid.mockResolvedValue({ profile: OAuthProfileFactory.create() });
      mocks.user.create.mockResolvedValue(UserFactory.create({ oauthId: 'oauth-id' }));
      mocks.session.create.mockResolvedValue(SessionFactory.create());

@@ -733,9 +841,9 @@ describe(AuthService.name, () => {

    it('should infer name from given and family names', async () => {
      mocks.systemMetadata.get.mockResolvedValue(systemConfigStub.enabled);
-      mocks.oauth.getProfile.mockResolvedValue(
-        OAuthProfileFactory.create({ name: undefined, given_name: 'Given', family_name: 'Family' }),
-      );
+      mocks.oauth.getProfileAndOAuthSid.mockResolvedValue({
+        profile: OAuthProfileFactory.create({ name: undefined, given_name: 'Given', family_name: 'Family' }),
+      });
      mocks.user.getByEmail.mockResolvedValue(void 0);
      mocks.user.getAdmin.mockResolvedValue(UserFactory.create({ isAdmin: true }));
      mocks.user.create.mockResolvedValue(UserFactory.create());
@@ -754,7 +862,7 @@ describe(AuthService.name, () => {
      const profile = OAuthProfileFactory.create({ name: undefined, given_name: undefined, family_name: undefined });

      mocks.systemMetadata.get.mockResolvedValue(systemConfigStub.enabled);
-      mocks.oauth.getProfile.mockResolvedValue(profile);
+      mocks.oauth.getProfileAndOAuthSid.mockResolvedValue({ profile });
      mocks.user.getByEmail.mockResolvedValue(void 0);
      mocks.user.getAdmin.mockResolvedValue(UserFactory.create({ isAdmin: true }));
      mocks.user.create.mockResolvedValue(UserFactory.create());
@@ -771,7 +879,9 @@ describe(AuthService.name, () => {

    it('should ignore an invalid storage quota', async () => {
      mocks.systemMetadata.get.mockResolvedValue(systemConfigStub.oauthWithStorageQuota);
-      mocks.oauth.getProfile.mockResolvedValue(OAuthProfileFactory.create({ immich_quota: 'abc' }));
+      mocks.oauth.getProfileAndOAuthSid.mockResolvedValue({
+        profile: OAuthProfileFactory.create({ immich_quota: 'abc' }),
+      });
      mocks.user.getAdmin.mockResolvedValue(UserFactory.create({ isAdmin: true }));
      mocks.user.getByEmail.mockResolvedValue(void 0);
      mocks.user.create.mockResolvedValue(UserFactory.create({ oauthId: 'oauth-id' }));
@@ -788,7 +898,9 @@ describe(AuthService.name, () => {

    it('should ignore a negative quota', async () => {
      mocks.systemMetadata.get.mockResolvedValue(systemConfigStub.oauthWithStorageQuota);
-      mocks.oauth.getProfile.mockResolvedValue(OAuthProfileFactory.create({ immich_quota: -5 }));
+      mocks.oauth.getProfileAndOAuthSid.mockResolvedValue({
+        profile: OAuthProfileFactory.create({ immich_quota: -5 }),
+      });
      mocks.user.getAdmin.mockResolvedValue(UserFactory.create({ isAdmin: true }));
      mocks.user.getByEmail.mockResolvedValue(void 0);
      mocks.user.create.mockResolvedValue(UserFactory.create({ oauthId: 'oauth-id' }));
@@ -805,7 +917,7 @@ describe(AuthService.name, () => {

    it('should set quota for 0 quota', async () => {
      mocks.systemMetadata.get.mockResolvedValue(systemConfigStub.oauthWithStorageQuota);
-      mocks.oauth.getProfile.mockResolvedValue(OAuthProfileFactory.create({ immich_quota: 0 }));
+      mocks.oauth.getProfileAndOAuthSid.mockResolvedValue({ profile: OAuthProfileFactory.create({ immich_quota: 0 }) });
      mocks.user.getAdmin.mockResolvedValue(UserFactory.create({ isAdmin: true }));
      mocks.user.getByEmail.mockResolvedValue(void 0);
      mocks.user.create.mockResolvedValue(UserFactory.create({ oauthId: 'oauth-id' }));
@@ -822,7 +934,7 @@ describe(AuthService.name, () => {

    it('should use a valid storage quota', async () => {
      mocks.systemMetadata.get.mockResolvedValue(systemConfigStub.oauthWithStorageQuota);
-      mocks.oauth.getProfile.mockResolvedValue(OAuthProfileFactory.create({ immich_quota: 5 }));
+      mocks.oauth.getProfileAndOAuthSid.mockResolvedValue({ profile: OAuthProfileFactory.create({ immich_quota: 5 }) });
      mocks.user.getByEmail.mockResolvedValue(void 0);
      mocks.user.getAdmin.mockResolvedValue(UserFactory.create({ isAdmin: true }));
      mocks.user.getByOAuthId.mockResolvedValue(void 0);
@@ -842,14 +954,15 @@ describe(AuthService.name, () => {
      const fileId = newUuid();
      const user = UserFactory.create({ oauthId: 'oauth-id' });
      const profile = OAuthProfileFactory.create({ picture: 'https://auth.immich.cloud/profiles/1.jpg' });
+      const pictureBytes = new Uint8Array([1, 2, 3, 4, 5]);

      mocks.systemMetadata.get.mockResolvedValue(systemConfigStub.oauthEnabled);
-      mocks.oauth.getProfile.mockResolvedValue(profile);
+      mocks.oauth.getProfileAndOAuthSid.mockResolvedValue({ profile });
      mocks.user.getByOAuthId.mockResolvedValue(user);
      mocks.crypto.randomUUID.mockReturnValue(fileId);
      mocks.oauth.getProfilePicture.mockResolvedValue({
        contentType: 'image/jpeg',
-        data: new Uint8Array([1, 2, 3, 4, 5]).buffer,
+        data: pictureBytes.buffer,
      });
      mocks.user.update.mockResolvedValue(user);
      mocks.session.create.mockResolvedValue(SessionFactory.create());
@@ -861,23 +974,54 @@ describe(AuthService.name, () => {
      );

      expect(mocks.user.update).toHaveBeenCalledWith(user.id, {
-        profileImagePath: expect.stringContaining(`/data/profile/${user.id}/${fileId}.jpg`),
+        profileImagePath: expect.stringContaining(`/data/profile/${user.id}/${fileId}.webp`),
        profileChangedAt: expect.any(Date),
      });
      expect(mocks.oauth.getProfilePicture).toHaveBeenCalledWith(profile.picture);
+      expect(mocks.media.generateThumbnail).toHaveBeenCalledWith(
+        Buffer.from(pictureBytes.buffer),
+        expect.objectContaining({ format: 'webp', processInvalidImages: false }),
+        expect.stringContaining(`/data/profile/${user.id}/${fileId}.webp`),
+      );
+    });
+
+    it('should not update the user when thumbnail processing fails on the OAuth picture', async () => {
+      const user = UserFactory.create({ oauthId: 'oauth-id' });
+      const profile = OAuthProfileFactory.create({ picture: 'https://auth.immich.cloud/profiles/1.jpg' });
+
+      mocks.systemMetadata.get.mockResolvedValue(systemConfigStub.oauthEnabled);
+      mocks.oauth.getProfileAndOAuthSid.mockResolvedValue({ profile });
+      mocks.user.getByOAuthId.mockResolvedValue(user);
+      mocks.oauth.getProfilePicture.mockResolvedValue({
+        contentType: 'text/html',
+        data: new Uint8Array([1, 2, 3, 4, 5]).buffer,
+      });
+      mocks.media.generateThumbnail.mockRejectedValue(new Error('not an image'));
+      mocks.session.create.mockResolvedValue(SessionFactory.create());
+
+      await expect(
+        sut.callback(
+          { url: 'http://immich/auth/login?code=abc123', state: 'xyz789', codeVerifier: 'foo' },
+          {},
+          loginDetails,
+        ),
+      ).resolves.toBeDefined();
+
+      expect(mocks.user.update).not.toHaveBeenCalled();
+      expect(mocks.job.queue).not.toHaveBeenCalled();
    });

    it('should not sync the profile picture if the user already has one', async () => {
      const user = UserFactory.create({ oauthId: 'oauth-id', profileImagePath: 'not-empty' });

      mocks.systemMetadata.get.mockResolvedValue(systemConfigStub.oauthEnabled);
-      mocks.oauth.getProfile.mockResolvedValue(
-        OAuthProfileFactory.create({
+      mocks.oauth.getProfileAndOAuthSid.mockResolvedValue({
+        profile: OAuthProfileFactory.create({
          sub: user.oauthId,
          email: user.email,
          picture: 'https://auth.immich.cloud/profiles/1.jpg',
        }),
-      );
+      });
      mocks.user.getByOAuthId.mockResolvedValue(user);
      mocks.user.update.mockResolvedValue(user);
      mocks.session.create.mockResolvedValue(SessionFactory.create());
@@ -894,7 +1038,9 @@ describe(AuthService.name, () => {

    it('should only allow "admin" and "user" for the role claim', async () => {
      mocks.systemMetadata.get.mockResolvedValue(systemConfigStub.oauthWithAutoRegister);
-      mocks.oauth.getProfile.mockResolvedValue(OAuthProfileFactory.create({ immich_role: 'foo' }));
+      mocks.oauth.getProfileAndOAuthSid.mockResolvedValue({
+        profile: OAuthProfileFactory.create({ immich_role: 'foo' }),
+      });
      mocks.user.getByEmail.mockResolvedValue(void 0);
      mocks.user.getAdmin.mockResolvedValue(UserFactory.create({ isAdmin: true }));
      mocks.user.getByOAuthId.mockResolvedValue(void 0);
@@ -912,7 +1058,9 @@ describe(AuthService.name, () => {

    it('should create an admin user if the role claim is set to admin', async () => {
      mocks.systemMetadata.get.mockResolvedValue(systemConfigStub.oauthWithAutoRegister);
-      mocks.oauth.getProfile.mockResolvedValue(OAuthProfileFactory.create({ immich_role: 'admin' }));
+      mocks.oauth.getProfileAndOAuthSid.mockResolvedValue({
+        profile: OAuthProfileFactory.create({ immich_role: 'admin' }),
+      });
      mocks.user.getByEmail.mockResolvedValue(void 0);
      mocks.user.getByOAuthId.mockResolvedValue(void 0);
      mocks.user.create.mockResolvedValue(UserFactory.create({ oauthId: 'oauth-id' }));
@@ -931,7 +1079,9 @@ describe(AuthService.name, () => {
      mocks.systemMetadata.get.mockResolvedValue({
        oauth: { ...systemConfigStub.oauthWithAutoRegister.oauth, roleClaim: 'my_role' },
      });
-      mocks.oauth.getProfile.mockResolvedValue(OAuthProfileFactory.create({ my_role: 'admin' }));
+      mocks.oauth.getProfileAndOAuthSid.mockResolvedValue({
+        profile: OAuthProfileFactory.create({ my_role: 'admin' }),
+      });
      mocks.user.getByEmail.mockResolvedValue(void 0);
      mocks.user.getByOAuthId.mockResolvedValue(void 0);
      mocks.user.create.mockResolvedValue(UserFactory.create({ oauthId: 'oauth-id' }));
@@ -954,7 +1104,7 @@ describe(AuthService.name, () => {
      const profile = OAuthProfileFactory.create();

      mocks.systemMetadata.get.mockResolvedValue(systemConfigStub.enabled);
-      mocks.oauth.getProfile.mockResolvedValue(profile);
+      mocks.oauth.getProfileAndOAuthSid.mockResolvedValue({ profile });
      mocks.user.update.mockResolvedValue(user);

      await sut.link(
@@ -966,13 +1116,36 @@ describe(AuthService.name, () => {
      expect(mocks.user.update).toHaveBeenCalledWith(auth.user.id, { oauthId: profile.sub });
    });

+    it('should link an account and update the session with the oauthSid', async () => {
+      const user = UserFactory.create();
+      const session = SessionFactory.create();
+      const auth = AuthFactory.from(user).session(session).build();
+
+      mocks.systemMetadata.get.mockResolvedValue(systemConfigStub.enabled);
+      mocks.oauth.getProfileAndOAuthSid.mockResolvedValue({
+        profile: { sub: 'sub' },
+        sid: session.oauthSid ?? undefined,
+      });
+      mocks.user.update.mockResolvedValue(user);
+      mocks.session.update.mockResolvedValue(session);
+
+      await sut.link(
+        auth,
+        { url: 'http://immich/user-settings?code=abc123', state: 'xyz789', codeVerifier: 'foo' },
+        {},
+      );
+
+      expect(mocks.session.update).toHaveBeenCalledWith(session.id, { oauthSid: session.oauthSid });
+      expect(mocks.user.update).toHaveBeenCalledWith(auth.user.id, { oauthId: 'sub' });
+    });
+
    it('should not link an already linked oauth.sub', async () => {
      const authUser = UserFactory.create();
      const authApiKey = ApiKeyFactory.create({ permissions: [] });
      const auth = { user: authUser, apiKey: authApiKey };

      mocks.systemMetadata.get.mockResolvedValue(systemConfigStub.enabled);
-      mocks.oauth.getProfile.mockResolvedValue(OAuthProfileFactory.create());
+      mocks.oauth.getProfileAndOAuthSid.mockResolvedValue({ profile: OAuthProfileFactory.create() });
      mocks.user.getByOAuthId.mockResolvedValue({ id: 'other-user' } as UserAdmin);

      await expect(
@@ -995,6 +1168,21 @@ describe(AuthService.name, () => {

      expect(mocks.user.update).toHaveBeenCalledWith(auth.user.id, { oauthId: '' });
    });
+
+    it('should unlink an account and remove the oauthSid from the session', async () => {
+      const user = UserFactory.create();
+      const session = SessionFactory.create();
+      const auth = AuthFactory.from(user).session(session).build();
+
+      mocks.systemMetadata.get.mockResolvedValue(systemConfigStub.enabled);
+      mocks.session.update.mockResolvedValue(session);
+      mocks.user.update.mockResolvedValue(user);
+
+      await sut.unlink(auth);
+
+      expect(mocks.session.update).toHaveBeenCalledWith(session.id, { oauthSid: null });
+      expect(mocks.user.update).toHaveBeenCalledWith(auth.user.id, { oauthId: '' });
+    });
  });

  describe('setupPinCode', () => {
@@ -2,9 +2,7 @@ import { BadRequestException, ForbiddenException, Injectable, UnauthorizedExcept
 import { parse } from 'cookie';
 import { DateTime } from 'luxon';
 import { IncomingHttpHeaders } from 'node:http';
-import { join } from 'node:path';
 import { LOGIN_URL, MOBILE_REDIRECT, SALT_ROUNDS } from 'src/constants';
-import { StorageCore } from 'src/cores/storage.core';
 import { AuthSharedLink, AuthUser, UserAdmin } from 'src/database';
 import {
  AuthDto,
@@ -12,6 +10,7 @@ import {
  ChangePasswordDto,
  LoginCredentialDto,
  LogoutResponseDto,
+  OAuthBackchannelLogoutDto,
  OAuthCallbackDto,
  OAuthConfigDto,
  PinCodeChangeDto,
@@ -22,12 +21,12 @@ import {
  mapLoginResponse,
 } from 'src/dtos/auth.dto';
 import { UserAdminResponseDto, mapUserAdmin } from 'src/dtos/user.dto';
-import { AuthType, ImmichCookie, ImmichHeader, ImmichQuery, JobName, Permission, StorageFolder } from 'src/enum';
+import { AuthType, ImmichCookie, ImmichHeader, ImmichQuery, JobName, Permission } from 'src/enum';
 import { OAuthProfile } from 'src/repositories/oauth.repository';
 import { BaseService } from 'src/services/base.service';
 import { isGranted } from 'src/utils/access';
 import { HumanReadableSize } from 'src/utils/bytes';
-import { mimeTypes } from 'src/utils/mime-types';
+import { generateProfileImage } from 'src/utils/profile-image';
 import { getUserAgentDetails } from 'src/utils/request';
 export interface LoginDetails {
  isSecure: boolean;
@@ -91,6 +90,40 @@ export class AuthService extends BaseService {
    };
  }

+  async backchannelLogout(dto: OAuthBackchannelLogoutDto): Promise<void> {
+    const { oauth } = await this.getConfig({ withCache: false });
+    if (!oauth.enabled) {
+      throw new BadRequestException('Received backchannel logout request but OAuth is not enabled');
+    }
+
+    let claims;
+    try {
+      claims = await this.oauthRepository.validateLogoutToken(oauth, dto.logout_token);
+    } catch (error: Error | any) {
+      this.logger.error(`Error backchannel logout: ${error.message}`);
+      this.logger.error(error);
+
+      throw new BadRequestException('Error backchannel logout: token validation failed');
+    }
+
+    if (!claims) {
+      throw new BadRequestException('Invalid logout token: no claims found');
+    }
+
+    if (!claims.sub && !claims.sid) {
+      throw new BadRequestException('Invalid logout token: it must contain either a sub or a sid claim');
+    }
+
+    const deletedSessionIds = await this.sessionRepository.invalidateOAuth({
+      oauthSid: claims.sid,
+      oauthId: claims.sub,
+    });
+
+    for (const sessionId of deletedSessionIds) {
+      await this.eventRepository.emit('SessionDelete', { sessionId });
+    }
+  }
+
  async changePassword(auth: AuthDto, dto: ChangePasswordDto): Promise<UserAdminResponseDto> {
    const { password, newPassword } = dto;
    const user = await this.userRepository.getForChangePassword(auth.user.id);
@@ -276,14 +309,20 @@ export class AuthService extends BaseService {
    }

    const url = this.resolveRedirectUri(oauth, dto.url);
-    const profile = await this.oauthRepository.getProfile(oauth, url, expectedState, codeVerifier);
+    const { profile, sid: oauthSid } = await this.oauthRepository.getProfileAndOAuthSid(
+      oauth,
+      url,
+      expectedState,
+      codeVerifier,
+    );
+    const normalizedEmail = profile.email ? profile.email.trim().toLowerCase() : undefined;
    const { autoRegister, defaultStorageQuota, storageLabelClaim, storageQuotaClaim, roleClaim } = oauth;
    this.logger.debug(`Logging in with OAuth: ${JSON.stringify(profile)}`);
    let user: UserAdmin | undefined = await this.userRepository.getByOAuthId(profile.sub);

    // link by email
-    if (!user && profile.email) {
-      const emailUser = await this.userRepository.getByEmail(profile.email);
+    if (!user && normalizedEmail) {
+      const emailUser = await this.userRepository.getByEmail(normalizedEmail);
      if (emailUser) {
        if (emailUser.oauthId) {
          throw new BadRequestException('User already exists, but is linked to another account.');
@@ -296,17 +335,16 @@ export class AuthService extends BaseService {
    if (!user) {
      if (!autoRegister) {
        this.logger.warn(
-          `Unable to register ${profile.sub}/${profile.email || '(no email)'}. To enable set OAuth Auto Register to true in admin settings.`,
+          `Unable to register ${profile.sub}/${normalizedEmail || '(no email)'}. To enable set OAuth Auto Register to true in admin settings.`,
        );
        throw new BadRequestException(`User does not exist and auto registering is disabled.`);
      }

-      const email = profile.email;
-      if (!email) {
+      if (!normalizedEmail) {
        throw new BadRequestException('OAuth profile does not have an email address');
      }

-      this.logger.log(`Registering new user: ${profile.sub}/${profile.email}`);
+      this.logger.log(`Registering new user: ${profile.sub}/${normalizedEmail}`);

      const storageLabel = this.getClaim(profile, {
        key: storageLabelClaim,
@@ -329,8 +367,8 @@ export class AuthService extends BaseService {
          profile.name ||
          `${profile.given_name || ''} ${profile.family_name || ''}`.trim() ||
          profile.preferred_username ||
-          email,
-        email,
+          normalizedEmail,
+        email: normalizedEmail,
        oauthId: profile.sub,
        quotaSizeInBytes: storageQuota === null ? null : storageQuota * HumanReadableSize.GiB,
        storageLabel: storageLabel || null,
@@ -342,22 +380,22 @@ export class AuthService extends BaseService {
      await this.syncProfilePicture(user, profile.picture);
    }

-    return this.createLoginResponse(user, loginDetails);
+    return this.createLoginResponse(user, loginDetails, oauthSid);
  }

  private async syncProfilePicture(user: UserAdmin, url: string) {
    try {
      const oldPath = user.profileImagePath;
+      const { data } = await this.oauthRepository.getProfilePicture(url);

-      const { contentType, data } = await this.oauthRepository.getProfilePicture(url);
-      const extensionWithDot = mimeTypes.toExtension(contentType || 'image/jpeg') ?? 'jpg';
-      const profileImagePath = join(
-        StorageCore.getFolderLocation(StorageFolder.Profile, user.id),
-        `${this.cryptoRepository.randomUUID()}${extensionWithDot}`,
+      const config = await this.getConfig({ withCache: true });
+      const profileImagePath = await generateProfileImage(
+        { media: this.mediaRepository, crypto: this.cryptoRepository, storageCore: this.storageCore },
+        config,
+        user.id,
+        Buffer.from(data),
      );

-      this.storageCore.ensureFolders(profileImagePath);
-      await this.storageRepository.createFile(profileImagePath, Buffer.from(data));
      await this.userRepository.update(user.id, { profileImagePath, profileChangedAt: new Date() });

      if (oldPath) {
@@ -380,18 +418,29 @@ export class AuthService extends BaseService {
    }

    const { oauth } = await this.getConfig({ withCache: false });
-    const { sub: oauthId } = await this.oauthRepository.getProfile(oauth, dto.url, expectedState, codeVerifier);
+    const {
+      profile: { sub: oauthId },
+      sid,
+    } = await this.oauthRepository.getProfileAndOAuthSid(oauth, dto.url, expectedState, codeVerifier);
    const duplicate = await this.userRepository.getByOAuthId(oauthId);
    if (duplicate && duplicate.id !== auth.user.id) {
      this.logger.warn(`OAuth link account failed: sub is already linked to another user (${duplicate.email}).`);
      throw new BadRequestException('This OAuth account has already been linked to another user.');
    }

+    if (auth.session) {
+      await this.sessionRepository.update(auth.session.id, { oauthSid: sid });
+    }
+
    const user = await this.userRepository.update(auth.user.id, { oauthId });
    return mapUserAdmin(user);
  }

  async unlink(auth: AuthDto): Promise<UserAdminResponseDto> {
+    if (auth.session) {
+      await this.sessionRepository.update(auth.session.id, { oauthSid: null });
+    }
+
    const user = await this.userRepository.update(auth.user.id, { oauthId: '' });
    return mapUserAdmin(user);
  }
@@ -406,6 +455,10 @@ export class AuthService extends BaseService {
      return LOGIN_URL;
    }

+    if (config.oauth.endSessionEndpoint) {
+      return config.oauth.endSessionEndpoint;
+    }
+
    return (await this.oauthRepository.getLogoutEndpoint(config.oauth)) || LOGIN_URL;
  }

@@ -548,7 +601,7 @@ export class AuthService extends BaseService {
    await this.sessionRepository.update(auth.session.id, { pinExpiresAt: null });
  }

-  private async createLoginResponse(user: UserAdmin, loginDetails: LoginDetails) {
+  private async createLoginResponse(user: UserAdmin, loginDetails: LoginDetails, oauthSid?: string) {
    const token = this.cryptoRepository.randomBytesAsText(32);
    const hashed = this.cryptoRepository.hashSha256(token);

@@ -558,6 +611,7 @@ export class AuthService extends BaseService {
      deviceType: loginDetails.deviceType,
      appVersion: loginDetails.appVersion,
      userId: user.id,
+      oauthSid: oauthSid ?? null,
    });

    return mapLoginResponse(user, token);
@@ -142,6 +142,61 @@ describe(DownloadService.name, () => {
      expect(archiveMock.addFile).toHaveBeenNthCalledWith(2, '/data/library/IMG_123.jpg', 'IMG_123+1.jpg');
    });

+    it.each([
+      { input: '../../../../tmp/pwn.jpg', expected: '........tmppwn.jpg' },
+      { input: String.raw`C:\temp\abs3.jpg`, expected: 'Ctempabs3.jpg' },
+      { input: 'a/../../b.jpg', expected: 'a....b.jpg' },
+      { input: String.raw`..\..\win1.jpg`, expected: '....win1.jpg' },
+      { input: '/etc/passwd', expected: 'etcpasswd' },
+      { input: '..', expected: 'unnamed' },
+      { input: '', expected: 'unnamed' },
+    ])('should sanitize unsafe originalFileName "$input" to "$expected"', async ({ input, expected }) => {
+      const archiveMock = {
+        addFile: vitest.fn(),
+        finalize: vitest.fn(),
+        stream: new Readable(),
+      };
+      const asset = AssetFactory.create({ originalFileName: input, originalPath: '/data/library/safe.jpg' });
+
+      mocks.access.asset.checkOwnerAccess.mockResolvedValue(new Set([asset.id]));
+      mocks.asset.getForOriginals.mockResolvedValue([asset]);
+      mocks.storage.createZipStream.mockReturnValue(archiveMock);
+
+      await expect(sut.downloadArchive(authStub.admin, { assetIds: [asset.id] })).resolves.toEqual({
+        stream: archiveMock.stream,
+      });
+
+      expect(archiveMock.addFile).toHaveBeenCalledWith('/data/library/safe.jpg', expected);
+    });
+
+    it('should dedupe sanitized duplicate unsafe filenames', async () => {
+      const archiveMock = {
+        addFile: vitest.fn(),
+        finalize: vitest.fn(),
+        stream: new Readable(),
+      };
+      const asset1 = AssetFactory.create({
+        originalFileName: '../../../tmp/pwn.jpg',
+        originalPath: '/data/library/a.jpg',
+      });
+      const asset2 = AssetFactory.create({
+        originalFileName: '../../../tmp/pwn.jpg',
+        originalPath: '/data/library/b.jpg',
+      });
+
+      mocks.access.asset.checkOwnerAccess.mockResolvedValue(new Set([asset1.id, asset2.id]));
+      mocks.asset.getForOriginals.mockResolvedValue([asset1, asset2]);
+      mocks.storage.createZipStream.mockReturnValue(archiveMock);
+
+      await expect(sut.downloadArchive(authStub.admin, { assetIds: [asset1.id, asset2.id] })).resolves.toEqual({
+        stream: archiveMock.stream,
+      });
+
+      expect(archiveMock.addFile).toHaveBeenCalledTimes(2);
+      expect(archiveMock.addFile).toHaveBeenNthCalledWith(1, '/data/library/a.jpg', '......tmppwn.jpg');
+      expect(archiveMock.addFile).toHaveBeenNthCalledWith(2, '/data/library/b.jpg', '......tmppwn+1.jpg');
+    });
+
    it('should resolve symlinks', async () => {
      const archiveMock = {
        addFile: vitest.fn(),
@@ -1,5 +1,6 @@
 import { BadRequestException, Injectable } from '@nestjs/common';
 import { parse } from 'node:path';
+import sanitize from 'sanitize-filename';
 import { StorageCore } from 'src/cores/storage.core';
 import { AuthDto } from 'src/dtos/auth.dto';
 import { DownloadArchiveDto, DownloadArchiveInfo, DownloadInfoDto, DownloadResponseDto } from 'src/dtos/download.dto';
@@ -95,11 +96,11 @@ export class DownloadService extends BaseService {

      const { originalPath, editedPath, originalFileName } = asset;

-      let filename = originalFileName;
+      let filename = sanitize(originalFileName) || 'unnamed';
      const count = paths[filename] || 0;
      paths[filename] = count + 1;
      if (count !== 0) {
-        const parsedFilename = parse(originalFileName);
+        const parsedFilename = parse(filename);
        filename = `${parsedFilename.name}+${count}${parsedFilename.ext}`;
      }

@@ -109,11 +109,6 @@ export class ServerService extends BaseService {
    };
  }

-  async getTheme() {
-    const { theme } = await this.getConfig({ withCache: false });
-    return theme;
-  }
-
  async getSystemConfig(): Promise<ServerConfigDto> {
    const { setup } = this.configRepository.getEnv();
    const config = await this.getConfig({ withCache: false });
@@ -46,11 +46,14 @@ describe('SessionService', () => {
      const currentSession = SessionFactory.create();
      const auth = AuthFactory.from().session(currentSession).build();

-      mocks.session.invalidate.mockResolvedValue();
+      mocks.session.invalidateAll.mockResolvedValue();

      await sut.deleteAll(auth);

-      expect(mocks.session.invalidate).toHaveBeenCalledWith({ userId: auth.user.id, excludeId: currentSession.id });
+      expect(mocks.session.invalidateAll).toHaveBeenCalledWith({
+        userId: auth.user.id,
+        excludeId: currentSession.id,
+      });
    });
  });

@@ -73,7 +73,7 @@ export class SessionService extends BaseService {
  async deleteAll(auth: AuthDto): Promise<void> {
    const userId = auth.user.id;
    const currentSessionId = auth.session?.id;
-    await this.sessionRepository.invalidate({ userId, excludeId: currentSessionId });
+    await this.sessionRepository.invalidateAll({ userId, excludeId: currentSessionId });
  }

  async lock(auth: AuthDto, id: string): Promise<void> {
@@ -83,6 +83,6 @@ export class SessionService extends BaseService {

  @OnEvent({ name: 'AuthChangePassword' })
  async onAuthChangePassword({ userId, currentSessionId }: ArgOf<'AuthChangePassword'>): Promise<void> {
-    await this.sessionRepository.invalidate({ userId, excludeId: currentSessionId });
+    await this.sessionRepository.invalidateAll({ userId, excludeId: currentSessionId });
  }
 }
@@ -138,13 +138,16 @@ const updatedConfig = Object.freeze<SystemConfig>({
    defaultStorageQuota: null,
    enabled: false,
    issuerUrl: '',
+    endSessionEndpoint: '',
    mobileOverrideEnabled: false,
    mobileRedirectUri: '',
+    prompt: '',
    scope: 'openid email profile',
    signingAlgorithm: 'RS256',
    profileSigningAlgorithm: 'none',
    tokenEndpointAuthMethod: OAuthTokenEndpointAuthMethod.ClientSecretPost,
    timeout: 30_000,
+    allowInsecureRequests: false,
    storageLabelClaim: 'preferred_username',
    storageQuotaClaim: 'immich_quota',
    roleClaim: 'immich_role',
@@ -113,20 +113,34 @@ describe(UserService.name, () => {
      await expect(sut.createProfileImage(authStub.admin, file)).rejects.toThrowError(InternalServerErrorException);
    });

-    it('should delete the previous profile image', async () => {
+    it('should throw BadRequestException and clean up raw upload when thumbnail processing fails', async () => {
+      const file = { path: '/profile/path' } as Express.Multer.File;
+      const user = UserFactory.create({ profileImagePath: '/path/to/profile.jpg' });
+
+      mocks.user.get.mockResolvedValue(user);
+      mocks.media.generateThumbnail.mockRejectedValue(new Error('not an image'));
+
+      await expect(sut.createProfileImage(authStub.admin, file)).rejects.toThrowError(BadRequestException);
+
+      expect(mocks.user.update).not.toHaveBeenCalled();
+      expect(mocks.job.queue.mock.calls).toEqual([[{ name: JobName.FileDelete, data: { files: [file.path] } }]]);
+    });
+
+    it('should delete the raw upload and the previous profile image', async () => {
      const user = UserFactory.create({ profileImagePath: '/path/to/profile.jpg' });
      const file = { path: '/profile/path' } as Express.Multer.File;
-      const files = [user.profileImagePath];

      mocks.user.get.mockResolvedValue(user);
      mocks.user.update.mockResolvedValue({ ...userStub.admin, profileImagePath: file.path });

      await sut.createProfileImage(authStub.admin, file);

-      expect(mocks.job.queue.mock.calls).toEqual([[{ name: JobName.FileDelete, data: { files } }]]);
+      expect(mocks.job.queue.mock.calls).toEqual([
+        [{ name: JobName.FileDelete, data: { files: [file.path, user.profileImagePath] } }],
+      ]);
    });

-    it('should not delete the profile image if it has not been set', async () => {
+    it('should delete only the raw upload if no previous profile image is set', async () => {
      const file = { path: '/profile/path' } as Express.Multer.File;

      mocks.user.get.mockResolvedValue(userStub.admin);
@@ -134,7 +148,7 @@ describe(UserService.name, () => {

      await sut.createProfileImage(authStub.admin, file);

-      expect(mocks.job.queue).not.toHaveBeenCalled();
+      expect(mocks.job.queue.mock.calls).toEqual([[{ name: JobName.FileDelete, data: { files: [file.path] } }]]);
      expect(mocks.job.queueAll).not.toHaveBeenCalled();
    });
  });
@@ -192,6 +206,19 @@ describe(UserService.name, () => {

      expect(mocks.user.get).toHaveBeenCalledWith(user.id, {});
    });
+
+    it('should return the profile picture with the content-type matching the stored file', async () => {
+      const user = UserFactory.create({ profileImagePath: '/path/to/profile.webp' });
+      mocks.user.get.mockResolvedValue(user);
+
+      await expect(sut.getProfileImage(user.id)).resolves.toEqual(
+        new ImmichFileResponse({
+          path: '/path/to/profile.webp',
+          contentType: 'image/webp',
+          cacheControl: CacheControl.None,
+        }),
+      );
+    });
  });

  describe('handleQueueUserDelete', () => {
@@ -16,7 +16,9 @@ import { UserTable } from 'src/schema/tables/user.table';
 import { BaseService } from 'src/services/base.service';
 import { JobOf, UserMetadataItem } from 'src/types';
 import { ImmichFileResponse } from 'src/utils/file';
+import { mimeTypes } from 'src/utils/mime-types';
 import { getPreferences, getPreferencesPartial, mergePreferences } from 'src/utils/preferences';
+import { generateProfileImage } from 'src/utils/profile-image';

@Injectable()
 export class UserService extends BaseService {
@@ -91,16 +93,29 @@ export class UserService extends BaseService {
  }

  async createProfileImage(auth: AuthDto, file: Express.Multer.File): Promise<CreateProfileImageResponseDto> {
-    const { profileImagePath: oldpath } = await this.findOrFail(auth.user.id, { withDeleted: false });
+    const { profileImagePath: oldPath } = await this.findOrFail(auth.user.id, { withDeleted: false });
+
+    let profileImagePath: string;
+    try {
+      const config = await this.getConfig({ withCache: true });
+      profileImagePath = await generateProfileImage(
+        { media: this.mediaRepository, crypto: this.cryptoRepository, storageCore: this.storageCore },
+        config,
+        auth.user.id,
+        file.path,
+      );
+    } catch (error) {
+      await this.jobRepository.queue({ name: JobName.FileDelete, data: { files: [file.path] } });
+      throw new BadRequestException('Unable to process profile image', { cause: error });
+    }

    const user = await this.userRepository.update(auth.user.id, {
-      profileImagePath: file.path,
+      profileImagePath,
      profileChangedAt: new Date(),
    });

-    if (oldpath !== '') {
-      await this.jobRepository.queue({ name: JobName.FileDelete, data: { files: [oldpath] } });
-    }
+    const toDelete = [file.path, ...(oldPath ? [oldPath] : [])];
+    await this.jobRepository.queue({ name: JobName.FileDelete, data: { files: toDelete } });

    return {
      userId: user.id,
@@ -126,7 +141,7 @@ export class UserService extends BaseService {

    return new ImmichFileResponse({
      path: user.profileImagePath,
-      contentType: 'image/jpeg',
+      contentType: mimeTypes.lookup(user.profileImagePath),
      cacheControl: CacheControl.None,
    });
  }
@@ -91,14 +91,14 @@ export class BaseConfig implements VideoCodecSWConfig {
  ) {
    const options = {
      inputOptions: this.getBaseInputOptions(videoStream, format),
-      outputOptions: [...this.getBaseOutputOptions(target, videoStream, audioStream), '-v verbose'],
+      outputOptions: [...this.getBaseOutputOptions(target, videoStream, audioStream), '-v', 'verbose'],
      twoPass: this.eligibleForTwoPass(),
      progress: { frameCount: videoStream.frameCount, percentInterval: 5 },
    } as TranscodeCommand;
    if ([TranscodeTarget.All, TranscodeTarget.Video].includes(target)) {
      const filters = this.getFilterOptions(videoStream);
      if (filters.length > 0) {
-        options.outputOptions.push(`-vf ${filters.join(',')}`);
+        options.outputOptions.push('-vf', filters.join(','));
      }
    }

@@ -121,36 +121,40 @@ export class BaseConfig implements VideoCodecSWConfig {
    const audioCodec = [TranscodeTarget.All, TranscodeTarget.Audio].includes(target) ? this.getAudioEncoder() : 'copy';

    const options = [
-      `-c:v ${videoCodec}`,
-      `-c:a ${audioCodec}`,
+      '-c:v',
+      videoCodec,
+      '-c:a',
+      audioCodec,
      // Makes a second pass moving the moov atom to the
      // beginning of the file for improved playback speed.
-      '-movflags faststart',
-      '-fps_mode passthrough',
-      // explicitly selects the video stream instead of leaving it up to FFmpeg
-      `-map 0:${videoStream.index}`,
-      // Strip metadata like capture date, camera, and GPS
-      '-map_metadata -1',
+      '-movflags',
+      'faststart',
+      '-fps_mode',
+      'passthrough',
+      '-map',
+      `0:${videoStream.index}`,
+      '-map_metadata',
+      '-1',
    ];

    if (audioStream) {
-      options.push(`-map 0:${audioStream.index}`);
+      options.push('-map', `0:${audioStream.index}`);
    }
    if (this.getBFrames() > -1) {
-      options.push(`-bf ${this.getBFrames()}`);
+      options.push('-bf', `${this.getBFrames()}`);
    }
    if (this.getRefs() > 0) {
-      options.push(`-refs ${this.getRefs()}`);
+      options.push('-refs', `${this.getRefs()}`);
    }
    if (this.getGopSize() > 0) {
-      options.push(`-g ${this.getGopSize()}`);
+      options.push('-g', `${this.getGopSize()}`);
    }

    if (
      this.config.targetVideoCodec === VideoCodec.Hevc &&
      (videoCodec !== 'copy' || videoStream.codecName === 'hevc')
    ) {
-      options.push('-tag:v hvc1');
+      options.push('-tag:v', 'hvc1');
    }

    return options;
@@ -173,26 +177,32 @@ export class BaseConfig implements VideoCodecSWConfig {
  }

  getPresetOptions() {
-    return [`-preset ${this.config.preset}`];
+    return ['-preset', this.config.preset];
  }

  getBitrateOptions() {
    const bitrates = this.getBitrateDistribution();
    if (this.eligibleForTwoPass()) {
      return [
-        `-b:v ${bitrates.target}${bitrates.unit}`,
-        `-minrate ${bitrates.min}${bitrates.unit}`,
-        `-maxrate ${bitrates.max}${bitrates.unit}`,
+        '-b:v',
+        `${bitrates.target}${bitrates.unit}`,
+        '-minrate',
+        `${bitrates.min}${bitrates.unit}`,
+        '-maxrate',
+        `${bitrates.max}${bitrates.unit}`,
      ];
    } else if (bitrates.max > 0) {
      // -bufsize is the peak possible bitrate at any moment, while -maxrate is the max rolling average bitrate
      return [
-        `-${this.useCQP() ? 'q:v' : 'crf'} ${this.config.crf}`,
-        `-maxrate ${bitrates.max}${bitrates.unit}`,
-        `-bufsize ${bitrates.max * 2}${bitrates.unit}`,
+        `-${this.useCQP() ? 'q:v' : 'crf'}`,
+        `${this.config.crf}`,
+        '-maxrate',
+        `${bitrates.max}${bitrates.unit}`,
+        '-bufsize',
+        `${bitrates.max * 2}${bitrates.unit}`,
      ];
    } else {
-      return [`-${this.useCQP() ? 'q:v' : 'crf'} ${this.config.crf}`];
+      return [`-${this.useCQP() ? 'q:v' : 'crf'}`, `${this.config.crf}`];
    }
  }

@@ -204,7 +214,7 @@ export class BaseConfig implements VideoCodecSWConfig {
    if (this.config.threads <= 0) {
      return [];
    }
-    return [`-threads ${this.config.threads}`];
+    return ['-threads', `${this.config.threads}`];
  }

  eligibleForTwoPass() {
@@ -395,8 +405,8 @@ export class ThumbnailConfig extends BaseConfig {
    // skip_frame nointra skips all frames for some MPEG-TS files. Look at ffmpeg tickets 7950 and 7895 for more details.
    const options =
      format?.formatName === 'mpegts'
-        ? ['-sws_flags accurate_rnd+full_chroma_int']
-        : ['-skip_frame nointra', '-sws_flags accurate_rnd+full_chroma_int'];
+        ? ['-sws_flags', 'accurate_rnd+full_chroma_int']
+        : ['-skip_frame', 'nointra', '-sws_flags', 'accurate_rnd+full_chroma_int'];

    const metadataOverrides = [];
    if (videoStream.colorPrimaries === 'reserved') {
@@ -413,14 +423,14 @@ export class ThumbnailConfig extends BaseConfig {

    if (metadataOverrides.length > 0) {
      // workaround for https://fftrac-bg.ffmpeg.org/ticket/11020
-      options.push(`-bsf:v ${videoStream.codecName}_metadata=${metadataOverrides.join(':')}`);
+      options.push('-bsf:v', `${videoStream.codecName}_metadata=${metadataOverrides.join(':')}`);
    }

    return options;
  }

  getBaseOutputOptions() {
-    return ['-fps_mode vfr', '-frames:v 1', '-update 1'];
+    return ['-fps_mode', 'vfr', '-frames:v', '1', '-update', '1'];
  }

  getFilterOptions(videoStream: VideoStreamInfo): string[] {
@@ -455,7 +465,7 @@ export class H264Config extends BaseConfig {
  getOutputThreadOptions() {
    const options = super.getOutputThreadOptions();
    if (this.config.threads === 1) {
-      options.push('-x264-params frame-threads=1:pools=none');
+      options.push('-x264-params', 'frame-threads=1:pools=none');
    }

    return options;
@@ -466,7 +476,7 @@ export class HEVCConfig extends BaseConfig {
  getOutputThreadOptions() {
    const options = super.getOutputThreadOptions();
    if (this.config.threads === 1) {
-      options.push('-x265-params frame-threads=1:pools=none');
+      options.push('-x265-params', 'frame-threads=1:pools=none');
    }

    return options;
@@ -477,7 +487,7 @@ export class VP9Config extends BaseConfig {
  getPresetOptions() {
    const speed = Math.min(this.getPresetIndex(), 5); // values over 5 require realtime mode, which is its own can of worms since it overrides -crf and -threads
    if (speed >= 0) {
-      return [`-cpu-used ${speed}`];
+      return ['-cpu-used', `${speed}`];
    }
    return [];
  }
@@ -486,17 +496,20 @@ export class VP9Config extends BaseConfig {
    const bitrates = this.getBitrateDistribution();
    if (bitrates.max > 0 && this.eligibleForTwoPass()) {
      return [
-        `-b:v ${bitrates.target}${bitrates.unit}`,
-        `-minrate ${bitrates.min}${bitrates.unit}`,
-        `-maxrate ${bitrates.max}${bitrates.unit}`,
+        '-b:v',
+        `${bitrates.target}${bitrates.unit}`,
+        '-minrate',
+        `${bitrates.min}${bitrates.unit}`,
+        '-maxrate',
+        `${bitrates.max}${bitrates.unit}`,
      ];
    }

-    return [`-${this.useCQP() ? 'q:v' : 'crf'} ${this.config.crf}`, `-b:v ${bitrates.max}${bitrates.unit}`];
+    return [`-${this.useCQP() ? 'q:v' : 'crf'}`, `${this.config.crf}`, '-b:v', `${bitrates.max}${bitrates.unit}`];
  }

  getOutputThreadOptions() {
-    return ['-row-mt 1', ...super.getOutputThreadOptions()];
+    return ['-row-mt', '1', ...super.getOutputThreadOptions()];
  }

  eligibleForTwoPass() {
@@ -512,13 +525,13 @@ export class AV1Config extends BaseConfig {
  getPresetOptions() {
    const speed = this.getPresetIndex() + 4; // Use 4 as slowest, giving us an effective range of 4-12 which is far more useful than 0-8
    if (speed >= 0) {
-      return [`-preset ${speed}`];
+      return ['-preset', `${speed}`];
    }
    return [];
  }

  getBitrateOptions() {
-    const options = [`-crf ${this.config.crf}`];
+    const options = ['-crf', `${this.config.crf}`];
    const bitrates = this.getBitrateDistribution();
    const svtparams = [];
    if (this.config.threads > 0) {
@@ -528,7 +541,7 @@ export class AV1Config extends BaseConfig {
      svtparams.push(`mbr=${bitrates.max}${bitrates.unit}`);
    }
    if (svtparams.length > 0) {
-      options.push(`-svtav1-params ${svtparams.join(':')}`);
+      options.push('-svtav1-params', svtparams.join(':'));
    }
    return options;
  }
@@ -552,23 +565,27 @@ export class NvencSwDecodeConfig extends BaseHWConfig {
  }

  getBaseInputOptions() {
-    return [`-init_hw_device cuda=cuda:${this.device}`, '-filter_hw_device cuda'];
+    return ['-init_hw_device', `cuda=cuda:${this.device}`, '-filter_hw_device', 'cuda'];
  }

  getBaseOutputOptions(target: TranscodeTarget, videoStream: VideoStreamInfo, audioStream?: AudioStreamInfo) {
    const options = [
      // below settings recommended from https://docs.nvidia.com/video-technologies/video-codec-sdk/12.0/ffmpeg-with-nvidia-gpu/index.html#command-line-for-latency-tolerant-high-quality-transcoding
-      '-tune hq',
-      '-qmin 0',
-      '-rc-lookahead 20',
-      '-i_qfactor 0.75',
+      '-tune',
+      'hq',
+      '-qmin',
+      '0',
+      '-rc-lookahead',
+      '20',
+      '-i_qfactor',
+      '0.75',
      ...super.getBaseOutputOptions(target, videoStream, audioStream),
    ];
    if (this.getBFrames() > 0) {
-      options.push('-b_ref_mode middle', '-b_qfactor 1.1');
+      options.push('-b_ref_mode', 'middle', '-b_qfactor', '1.1');
    }
    if (this.config.temporalAQ) {
-      options.push('-temporal-aq 1');
+      options.push('-temporal-aq', '1');
    }
    return options;
  }
@@ -589,26 +606,33 @@ export class NvencSwDecodeConfig extends BaseHWConfig {
      return [];
    }
    presetIndex = 7 - Math.min(6, presetIndex); // map to p1-p7; p7 is the highest quality, so reverse index
-    return [`-preset p${presetIndex}`];
+    return ['-preset', `p${presetIndex}`];
  }

  getBitrateOptions() {
    const bitrates = this.getBitrateDistribution();
    if (bitrates.max > 0 && this.config.twoPass) {
      return [
-        `-b:v ${bitrates.target}${bitrates.unit}`,
-        `-maxrate ${bitrates.max}${bitrates.unit}`,
-        `-bufsize ${bitrates.target}${bitrates.unit}`,
-        '-multipass 2',
+        '-b:v',
+        `${bitrates.target}${bitrates.unit}`,
+        '-maxrate',
+        `${bitrates.max}${bitrates.unit}`,
+        '-bufsize',
+        `${bitrates.target}${bitrates.unit}`,
+        '-multipass',
+        '2',
      ];
    } else if (bitrates.max > 0) {
      return [
-        `-cq:v ${this.config.crf}`,
-        `-maxrate ${bitrates.max}${bitrates.unit}`,
-        `-bufsize ${bitrates.target}${bitrates.unit}`,
+        '-cq:v',
+        `${this.config.crf}`,
+        '-maxrate',
+        `${bitrates.max}${bitrates.unit}`,
+        '-bufsize',
+        `${bitrates.target}${bitrates.unit}`,
      ];
    } else {
-      return [`-cq:v ${this.config.crf}`];
+      return ['-cq:v', `${this.config.crf}`];
    }
  }

@@ -627,7 +651,7 @@ export class NvencSwDecodeConfig extends BaseHWConfig {

 export class NvencHwDecodeConfig extends NvencSwDecodeConfig {
  getBaseInputOptions() {
-    return ['-hwaccel cuda', '-hwaccel_output_format cuda', '-noautorotate', ...this.getInputThreadOptions()];
+    return ['-hwaccel', 'cuda', '-hwaccel_output_format', 'cuda', '-noautorotate', ...this.getInputThreadOptions()];
  }

  getFilterOptions(videoStream: VideoStreamInfo) {
@@ -664,7 +688,7 @@ export class NvencHwDecodeConfig extends NvencSwDecodeConfig {
  }

  getInputThreadOptions() {
-    return [`-threads 1`];
+    return ['-threads', '1'];
  }

  getOutputThreadOptions() {
@@ -674,14 +698,14 @@ export class NvencHwDecodeConfig extends NvencSwDecodeConfig {

 export class QsvSwDecodeConfig extends BaseHWConfig {
  getBaseInputOptions() {
-    return [`-init_hw_device qsv=hw,child_device=${this.device}`, '-filter_hw_device hw'];
+    return ['-init_hw_device', `qsv=hw,child_device=${this.device}`, '-filter_hw_device', 'hw'];
  }

  getBaseOutputOptions(target: TranscodeTarget, videoStream: VideoStreamInfo, audioStream?: AudioStreamInfo) {
    const options = super.getBaseOutputOptions(target, videoStream, audioStream);
    // VP9 requires enabling low power mode https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/33583803e107b6d532def0f9d949364b01b6ad5a
    if (this.config.targetVideoCodec === VideoCodec.Vp9) {
-      options.push('-low_power 1');
+      options.push('-low_power', '1');
    }
    return options;
  }
@@ -701,14 +725,14 @@ export class QsvSwDecodeConfig extends BaseHWConfig {
      return [];
    }
    presetIndex = Math.min(6, presetIndex) + 1; // 1 to 7
-    return [`-preset ${presetIndex}`];
+    return ['-preset', `${presetIndex}`];
  }

  getBitrateOptions() {
-    const options = [`-${this.useCQP() ? 'q:v' : 'global_quality:v'} ${this.config.crf}`];
+    const options = [`-${this.useCQP() ? 'q:v' : 'global_quality:v'}`, `${this.config.crf}`];
    const bitrates = this.getBitrateDistribution();
    if (bitrates.max > 0) {
-      options.push(`-maxrate ${bitrates.max}${bitrates.unit}`, `-bufsize ${bitrates.max * 2}${bitrates.unit}`);
+      options.push('-maxrate', `${bitrates.max}${bitrates.unit}`, '-bufsize', `${bitrates.max * 2}${bitrates.unit}`);
    }
    return options;
  }
@@ -744,11 +768,15 @@ export class QsvSwDecodeConfig extends BaseHWConfig {
 export class QsvHwDecodeConfig extends QsvSwDecodeConfig {
  getBaseInputOptions() {
    return [
-      '-hwaccel qsv',
-      '-hwaccel_output_format qsv',
-      '-async_depth 4',
+      '-hwaccel',
+      'qsv',
+      '-hwaccel_output_format',
+      'qsv',
+      '-async_depth',
+      '4',
      '-noautorotate',
-      `-qsv_device ${this.device}`,
+      '-qsv_device',
+      this.device,
      ...this.getInputThreadOptions(),
    ];
  }
@@ -791,13 +819,13 @@ export class QsvHwDecodeConfig extends QsvSwDecodeConfig {
  }

  getInputThreadOptions() {
-    return [`-threads 1`];
+    return ['-threads', '1'];
  }
 }

 export class VaapiSwDecodeConfig extends BaseHWConfig {
  getBaseInputOptions() {
-    return [`-init_hw_device vaapi=accel:${this.device}`, '-filter_hw_device accel'];
+    return ['-init_hw_device', `vaapi=accel:${this.device}`, '-filter_hw_device', 'accel'];
  }

  getFilterOptions(videoStream: VideoStreamInfo) {
@@ -816,7 +844,7 @@ export class VaapiSwDecodeConfig extends BaseHWConfig {
      return [];
    }
    presetIndex = Math.min(6, presetIndex) + 1; // 1 to 7
-    return [`-compression_level ${presetIndex}`];
+    return ['-compression_level', `${presetIndex}`];
  }

  getBitrateOptions() {
@@ -824,21 +852,25 @@ export class VaapiSwDecodeConfig extends BaseHWConfig {
    const options = [];

    if (this.config.targetVideoCodec === VideoCodec.Vp9) {
-      options.push('-bsf:v vp9_raw_reorder,vp9_superframe');
+      options.push('-bsf:v', 'vp9_raw_reorder,vp9_superframe');
    }

    // VAAPI doesn't allow setting both quality and max bitrate
    if (bitrates.max > 0) {
      options.push(
-        `-b:v ${bitrates.target}${bitrates.unit}`,
-        `-maxrate ${bitrates.max}${bitrates.unit}`,
-        `-minrate ${bitrates.min}${bitrates.unit}`,
-        '-rc_mode 3',
+        '-b:v',
+        `${bitrates.target}${bitrates.unit}`,
+        '-maxrate',
+        `${bitrates.max}${bitrates.unit}`,
+        '-minrate',
+        `${bitrates.min}${bitrates.unit}`,
+        '-rc_mode',
+        '3',
      ); // variable bitrate
    } else if (this.useCQP()) {
-      options.push(`-qp:v ${this.config.crf}`, `-global_quality:v ${this.config.crf}`, '-rc_mode 1');
+      options.push('-qp:v', `${this.config.crf}`, '-global_quality:v', `${this.config.crf}`, '-rc_mode', '1');
    } else {
-      options.push(`-global_quality:v ${this.config.crf}`, '-rc_mode 4');
+      options.push('-global_quality:v', `${this.config.crf}`, '-rc_mode', '4');
    }

    return options;
@@ -856,10 +888,13 @@ export class VaapiSwDecodeConfig extends BaseHWConfig {
 export class VaapiHwDecodeConfig extends VaapiSwDecodeConfig {
  getBaseInputOptions() {
    return [
-      '-hwaccel vaapi',
-      '-hwaccel_output_format vaapi',
+      '-hwaccel',
+      'vaapi',
+      '-hwaccel_output_format',
+      'vaapi',
      '-noautorotate',
-      `-hwaccel_device ${this.device}`,
+      '-hwaccel_device',
+      this.device,
      ...this.getInputThreadOptions(),
    ];
  }
@@ -902,7 +937,7 @@ export class VaapiHwDecodeConfig extends VaapiSwDecodeConfig {
  }

  getInputThreadOptions() {
-    return [`-threads 1`];
+    return ['-threads', '1'];
  }
 }

@@ -919,11 +954,11 @@ export class RkmppSwDecodeConfig extends BaseHWConfig {
    switch (this.config.targetVideoCodec) {
      case VideoCodec.H264: {
        // from ffmpeg_mpp help, commonly referred to as H264 level 5.1
-        return ['-level 51'];
+        return ['-level', '51'];
      }
      case VideoCodec.Hevc: {
        // from ffmpeg_mpp help, commonly referred to as HEVC level 5.1
-        return ['-level 153'];
+        return ['-level', '153'];
      }
      default: {
        throw new Error(`Incompatible video codec for RKMPP: ${this.config.targetVideoCodec}`);
@@ -935,10 +970,10 @@ export class RkmppSwDecodeConfig extends BaseHWConfig {
    const bitrate = this.getMaxBitrateValue();
    if (bitrate > 0) {
      // -b:v specifies max bitrate, average bitrate is derived automatically...
-      return ['-rc_mode AVBR', `-b:v ${bitrate}${this.getBitrateUnit()}`];
+      return ['-rc_mode', 'AVBR', '-b:v', `${bitrate}${this.getBitrateUnit()}`];
    }
    // use CRF value as QP value
-    return ['-rc_mode CQP', `-qp_init ${this.config.crf}`];
+    return ['-rc_mode', 'CQP', '-qp_init', `${this.config.crf}`];
  }

  getSupportedCodecs() {
@@ -952,7 +987,7 @@ export class RkmppSwDecodeConfig extends BaseHWConfig {

 export class RkmppHwDecodeConfig extends RkmppSwDecodeConfig {
  getBaseInputOptions() {
-    return ['-hwaccel rkmpp', '-hwaccel_output_format drm_prime', '-afbc rga', '-noautorotate'];
+    return ['-hwaccel', 'rkmpp', '-hwaccel_output_format', 'drm_prime', '-afbc', 'rga', '-noautorotate'];
  }

  getFilterOptions(videoStream: VideoStreamInfo) {
@@ -0,0 +1,40 @@
+import { join } from 'node:path';
+import { SystemConfig } from 'src/config';
+import { StorageCore } from 'src/cores/storage.core';
+import { StorageFolder } from 'src/enum';
+import { CryptoRepository } from 'src/repositories/crypto.repository';
+import { MediaRepository } from 'src/repositories/media.repository';
+
+type Repos = {
+  media: MediaRepository;
+  crypto: CryptoRepository;
+  storageCore: StorageCore;
+};
+
+export const generateProfileImage = async (
+  { media, crypto, storageCore }: Repos,
+  { image }: SystemConfig,
+  userId: string,
+  input: string | Buffer,
+): Promise<string> => {
+  const outputPath = join(
+    StorageCore.getFolderLocation(StorageFolder.Profile, userId),
+    `${crypto.randomUUID()}.${image.thumbnail.format}`,
+  );
+  storageCore.ensureFolders(outputPath);
+
+  await media.generateThumbnail(
+    input,
+    {
+      colorspace: image.colorspace,
+      format: image.thumbnail.format,
+      quality: image.thumbnail.quality,
+      progressive: image.thumbnail.progressive,
+      size: image.thumbnail.size,
+      processInvalidImages: false,
+    },
+    outputPath,
+  );
+
+  return outputPath;
+};
@@ -32,6 +32,22 @@ export function IsIPRange(options?: IsIPRangeOptions) {
    .refine((arr) => arr.every((item) => isIPOrRange(item, options)), 'Must be an ip address or ip address range');
 }

+/**
+ * Like z.object().partial(), but rejects objects where every field is undefined.
+ * Use for update/patch DTOs where at least one field must be provided.
+ *
+ * @example
+ * nonEmptyPartial({ name: z.string(), bio: z.string() }).meta({ id: 'UpdateDto' });
+ */
+export function nonEmptyPartial<T extends z.ZodRawShape>(shape: T) {
+  return z
+    .object(shape)
+    .partial()
+    .refine((data) => Object.values(data as Record<string, unknown>).some((value) => value !== undefined), {
+      message: 'At least one field must be provided',
+    });
+}
+
 /**
 * Zod schema that validates sibling-exclusion for object schemas.
 * Validation passes when the target property is missing, or when none of the sibling properties are present.