# Phase 5: Album Public Link Validation

**Status:** ⬜ Not Started
**Parent plan:** [PLAN.md](./PLAN.md)
**Domain:** fullstack

## Objective
When saving/updating a tracker with album selections, check if the selected albums have valid public shared links. Warn the user about missing links and offer to auto-create them.

## Tasks

- [ ] Task 1: Add GET /api/providers/{id}/albums/{album_id}/shared-links endpoint that wraps ImmichClient.get_shared_links()
- [ ] Task 2: Add POST /api/providers/{id}/albums/{album_id}/shared-links endpoint that wraps ImmichClient.create_shared_link()
- [ ] Task 3: In trackers/+page.svelte, after album selection changes (on save), call shared-links endpoint for each newly selected album
- [ ] Task 4: Show a warning dialog/section listing albums without valid public links (expired, password-protected, or missing)
- [ ] Task 5: Add "Auto-create public links" button in the warning dialog that calls the create endpoint for each missing album
- [ ] Task 6: Add hints explaining implications: "Public links allow anyone with the URL to view album contents" and "Albums without public links will have limited notification features (no clickable links in messages)"
- [ ] Task 7: Allow user to proceed without creating links (dismiss warning and save anyway)

## Files to Modify/Create
- `packages/server/src/notify_bridge_server/api/trackers.py` or new `providers.py` routes — shared link endpoints
- `frontend/src/routes/trackers/+page.svelte` — validation UI, warning dialog, auto-create flow

## Acceptance Criteria
- On tracker save with new albums, shared links are checked
- Albums without valid links are highlighted with a warning
- User can auto-create links with one click
- User can dismiss and proceed without links
- Hints explain security/privacy implications
- Already-valid links are not re-created
- Expired or password-protected links are flagged as problematic

## Notes
- ImmichClient already has: get_shared_links(album_id), create_shared_link(album_id, ...), delete_shared_link(), set_shared_link_password()
- SharedLinkInfo model has: id, key, has_password, is_expired, is_accessible
- A "valid" link = exists AND not expired AND is_accessible (has_password is a warning, not a blocker)
- The check should only run for NEWLY selected albums (not all albums on every save)
- Use a modal/dialog for the warning — follows project convention of fixed-position overlays

## Review Checklist
- [ ] All tasks completed
- [ ] Code follows project conventions
- [ ] No unintended side effects
- [ ] Build passes
- [ ] Tests pass (new + existing)

## Handoff to Next Phase
<!-- Filled in after completion -->