Treat an album update as a patch, not a replacement

[lstein]

Fixes #371.

POST /update_album/ rebuilt the album from the request payload alone, so every field the payload left out was reset to its model default. Real callers send partial payloads — the bookmark menu sends five keys, the search dialog sends the album plus three overrides — and the worst thing that reset was source_type: an InvokeAI-board album came back as a directory album with every invokeai_* field cleared. After that its indexing walked InvokeAI's output directories as ordinary folders, and deletions stopped routing through InvokeAI's API, leaving dangling rows in its database.

Reproducing it took one bookmark: bookmark menu → Move to folder → pick a folder outside the album → "Yes, Add Folder".

What changed

An update is a patch. A key the payload does not carry keeps its stored value. Falsy values that real edits send — min_image_bytes: 0, use_query_optimization: false, an emptied description — still win. Null is treated as absent, because create_album turns a None into the model default rather than into a cleared field; honoring it would swap an album's encoder for the host default and silently invalidate its index. invokeai_username is the one field that genuinely needs clearing (InvokeAI leaving multi-user mode), so it goes through a helper that keys on presence instead.

Three things that needed handling beyond the plain rule:

• Board albums pass image_paths=None so the model re-derives them. Carrying the stored list over would suppress that derivation and pin the album to its old root the moment the user edits the root — the re-index would write under the new root while the access gate still pointed at the old one, 404ing every image in the album.
• min_search_score is left to the model to re-resolve when the encoder family changes. The floors differ by an order of magnitude (0.005 for SigLIP, 0.2 for CLIP), so carrying one across makes the new encoder look like it returns nothing — but swapping one CLIP model for another must not discard a score the user tuned by hand. The model and the router now read that rule from one default_min_search_score.
• A source_type that disagrees with the stored album is refused. The edit form branches on the stored kind and never offers to switch, so a disagreement is a partial payload being read as a replacement.

A board album's directories cannot be changed or added to, and saying so beats accepting the request and quietly deriving something else: a payload that changes them gets a 400, unless it merely echoes the album's paths — either the stored list or the one that same request derives, both of which callers legitimately send while a root edit is in flight. An HTTPException raised inside the handler is now re-raised rather than wrapped in a 500, so that 400 (and the 404 for an unknown key) survives as itself.

Frontend: the bookmark menu no longer offers to add a destination folder to a board album, since the backend has to refuse it, and its update payload carries only the keys it is changing.

Clearing the InvokeAI password

The same "blank means I did not touch this" rule left the password unclearable: the edit form never sees the stored one, so there was no way to say forget it. An InvokeAI that leaves multi-user mode kept a credential in config.yaml that only a text editor could remove, and has_invokeai_password kept reporting it to the form.

invokeai_password: null now clears it, while "" and an omitted key still keep what is stored. No existing caller can send that null by accident — _album_public_dict carries has_invokeai_password and never the password itself, so the search-settings persister's round trip cannot reach it, and the bookmark menu sends three keys. The only source is a new Forget saved password checkbox in the edit form, offered only when there is one to forget and reset every time the form opens; a password typed in the same edit wins over it.

That checkbox needed its own [hidden] rule. It lives in a <label> inside a .form-group, and that selector's display: block is an author rule, so it beats the UA stylesheet's [hidden] { display: none } — the box stayed on screen for albums with no stored password while the attribute reported otherwise. Same shape as the existing .video-player-*[hidden] rules.

Clearing or changing a credential now also invalidates the cached JWT. The token is keyed on (base_url, username), neither of which has to change when a password does, so a forgotten password would have kept working from cache until the token expired — up to a day later.

Tests

Eleven new backend cases: the demotion itself, the refused folder and source-type changes, a root change moving the derived paths, an explicit null neither clearing a tuning field nor surviving as one, the username clear, the encoder-family re-resolve and the same-family preservation, a blank index, and an unresolvable path being refused rather than crashing. Plus the password work: the three-way backend distinction (absent / blank / null), and on the frontend the payload matrix including "typed wins over the box", the row's visibility under the real CSS rule — asserting computed style, since the attribute alone reported hidden while the box was visible — and the reset on re-open. Each was checked by reverting its production hunk and confirming it fails.

Board-album tests also stopped deleting from the developer's real user data directory: default_board_index_path resolves against platformdirs.user_data_dir, which no fixture isolated, so a test album keyed like a real one removed the real index on cleanup — the same gap isolate_video_frame_cache already covers for the cache directory.

Backend 681 passed, frontend 587 passed, ruff and prettier clean.

Notes

Found during the adversarial review of #369; the bug predates it and reproduces on master. This branch is based on master and does not depend on #369.

Three adversarial review rounds ran against this change and turned up fourteen defects in it, all fixed here — the board root-change breakage, the username that could no longer be cleared, the encoder-swap score reset, and the symlink-loop 500 among them.

A fourth round reviewed the password commit on top and found two more, both fixed: the Forget saved password checkbox was always visible (the CSS specificity problem above), and a cleared password kept working from the JWT cache.

🤖 Generated with Claude Code