Closes #357

Summary

The Google Photos Library API is deprecated and returns a 403 Forbidden error for new OAuth clients. This PR replaces it entirely with the Google Photos Picker API, which requires users to explicitly select photos in a Google-hosted popup before Nextcloud can access any data.

⚠️ New OAuth Scope Required

https://www.googleapis.com/auth/photospicker.mediaitems.readonly

This replaces photoslibrary.readonly. Existing connected users must disconnect and re-authenticate to grant the new scope. The can_access_photos flag is written to user config during the OAuth redirect and controls visibility of the Photos section in personal settings.

Admin setup: In the Google Cloud Console, enable the "Google Photos Picker API" (not the deprecated Photos Library API).

Changed Files

appinfo/routes.php

Six new routes:

lib/BackgroundJob/ImportPhotosJob.php (new)

A QueuedJob that delegates to GooglePhotosAPIService::importPhotosJob(). Re-queued by the service until all picked items are downloaded.

lib/Controller/ConfigController.php

• New PHOTOS_SCOPE constant
• INT_CONFIGS extended with nb_imported_photos, last_import_timestamp, photo_import_job_last_start
• New getConfig() endpoint (GET /config): returns user_name and user_scopes — used by the OAuth popup redirect to refresh the parent settings page state without a full reload
• oauthRedirect(): writes can_access_photos to the stored user_scopes array
• setConfig(): disconnect path now deletes user_scopes; cancel-import path routes through GooglePhotosAPIService::cancelImport()

lib/Controller/GoogleAPIController.php

Five new controller actions:

• createPickerSession() — POST /picker-session: creates a Picker session, returns id, pickerUri (with /autoclose appended), and pollingConfig
• getPickerSession() — GET /picker-session?sessionId=: polls session state, returns mediaItemsSet
• deletePickerSession() — DELETE /picker-session?sessionId=: deletes session; only clears the stored picker_session_id config key when it matches the deleted session, so cancelling a UI session cannot corrupt an active import
• importPhotos() — POST /import-photos: calls startImportPhotos(), returns targetPath (and queued: true if an import is already running)
• getImportPhotosInformation() — GET /import-photos-info: returns importing_photos, nb_imported_photos, last_import_timestamp, nb_queued_sessions

lib/Notification/Notifier.php

New import_photos_finished notification: correctly pluralised via $l->n(), links to the import folder in Files, uses the app's dark icon.

lib/Service/GooglePhotosAPIService.php (new)

Core Picker API client and import orchestrator:

Session management

• createPickerSession() — POST /v1/sessions; does not write picker_session_id (only startImportPhotos() does, to avoid overwriting an active import session when the user queues a second picker)
• getPickerSession() — GET /v1/sessions/{id}
• deletePickerSession() — DELETE /v1/sessions/{id}; only clears stored picker_session_id when it matches

Import orchestration

• startImportPhotos(): validates $sessionId, creates the output folder, stores session ID, resets counters, enqueues ImportPhotosJob. If an import is already running, appends to picker_session_queue and returns queued: true instead
• importPhotosJob(): runs under user + filesystem scope; concurrent-run guard via photo_import_running + photo_import_job_last_start; delegates to importFromPickerSession(); on finish sends notification + deletes session; on partial run re-queues itself. On successful completion with a non-empty queue, transitions atomically to the next queued session (never writes importing_photos=0 transiently)
• importFromPickerSession(): paginates GET /v1/mediaItems (100/page); per-item dedup via nodeExists + IFilesMetadataManager metadata (stores Google item ID as integration_google_photo_id); honours a 500 MB per-run cap and persists photo_next_page_token so subsequent job runs resume where they left off
• cancelImport(): removes the job, deletes the active picker session, clears the queue

Download (downloadPickerItem() → GoogleAPIService::downloadAndSaveFile())

• Full-quality URL (=d for images, =dv for video); mtime set from createTime
• Delegates file creation, streaming, mtime-setting, and cleanup to GoogleAPIService::downloadAndSaveFile()
• Stores Google item ID in file metadata for future dedup

lib/Settings/Personal.php

Reads photo_output_dir from user config (defaulting to /Google Photos) and injects it into the user-config initial state.

src/components/AdminSettings.vue

Updates setup instructions to reference the Google Photos Picker API in the Google Cloud Console.

src/components/PersonalSettings.vue

New Photos section:

lib/Service/GoogleAPIService.php

New downloadAndSaveFile() public method: creates a file in a folder, streams a download via simpleDownload(), sets mtime, and cleans up (deletes the empty file) on all failure paths including LockedException and fopen() returning false. Shared by both GoogleDriveAPIService and GooglePhotosAPIService.

Picker flow

1. "Open Google Photos picker" creates a session via POST /picker-session and opens it in a popup (noopener,noreferrer)
2. The frontend polls GET /picker-session every ~4 s; when mediaItemsSet becomes true, the import is triggered automatically
3. While waiting: shift-click hint, location-data warning, "import starts automatically" hint, reopen button, and "Cancel photo picking" button

Import progress UI

• NcLoadingIcon spinner
• "Import queued, starting soon…" when nb_imported_photos === 0 and cron hasn't run yet
• "{X} photos imported" once the job starts
• Queued session count hint when nb_queued_sessions > 0
• "You can close this page…" message
• "Queue another session" button to open a second picker while an import is running
• "Cancel importing all photos" button

Other

• Configurable import directory (pencil button, defaults to /Google Photos)
• Progress polling every 5 s
• OAuth popup uses BroadcastChannel('integration_google_oauth') exclusively for the success handshake; popupSuccess.js posts to the channel and closes. All popup windows use noopener,noreferrer

src/popupSuccess.js

Uses BroadcastChannel directly (no opener fallback): creates the channel, posts { username }, closes the channel, then closes the window unconditionally.

⚠️ Draft Status

Even though this implementation currently works. It was developed with AI assistance (GitHub Copilot / Claude Sonnet) and should be treated as draft quality. It works end-to-end in a local Docker environment but has not been through a thorough human review or extensive testing.

Feedback welcome on anything including:

• Correctness, security, or Nextcloud coding-standards issues
• UX flow
• PHP quality