- Galerien sind nun eine Entität - es kann mehrere geben

- Neues Sparkbooth-Upload-Feature: Endpoint /api/sparkbooth/upload (Token-basiert pro Galerie), Controller Api/SparkboothUploadController, Migration 2026_01_21_000001_add_upload_fields_to_galleries_table.php mit Upload-Flags/Token/Expiry;
    Galerie-Modell und Factory/Seeder entsprechend erweitert.
  - Filament: Neue Setup-Seite SparkboothSetup (mit View) zur schnellen Galerie- und Token-Erstellung inkl. QR/Endpoint/Snippet;
    Galerie-Link-Views nutzen jetzt simple-qrcode (Composer-Dependency hinzugefügt) und bieten PNG-Download.
  - Galerie-Tabelle: Slug/Pfad-Spalten entfernt, Action „Link-Details“ mit Modal; Created-at-Spalte hinzugefügt.
  - Zugriffshärtung: Galerie-IDs in API (ImageController, Download/Print) geprüft; GalleryAccess/Middleware + Gallery-Modell/Slug-UUID
    eingeführt; GalleryAccess-Inertia-Seite.
  - UI/UX: LoadingSpinner/StyledImageDisplay verbessert, Delete-Confirm, Übersetzungen ergänzt.

app/Http/Controllers/Api/ImageController.php

@@ -5,6 +5,7 @@ namespace App\Http\Controllers\Api;
 use App\Api\Plugins\PluginLoader;
 use App\Http\Controllers\Controller;
 use App\Models\ApiProvider;
+use App\Models\Gallery;
 use App\Models\Image;
 use App\Models\Style;
 use App\Settings\GeneralSettings;
@@ -19,35 +20,48 @@ class ImageController extends Controller
 
     public function index(Request $request)
     {
-        $publicUploadsPath = public_path('storage/uploads');
+        $gallery = $this->resolveGallery($request);
+
+        if (! $gallery) {
+            return response()->json(['error' => 'Gallery not found.'], 404);
+        }
+
+        $imagesPath = trim($gallery->images_path, '/');
+        $publicUploadsPath = public_path('storage/'.$imagesPath);
 
         // Ensure the directory exists
         if (! File::exists($publicUploadsPath)) {
             File::makeDirectory($publicUploadsPath, 0755, true);
         }
 
-        // Get files from the public/storage/uploads directory
+        // Get files from the gallery-specific directory
         $diskFiles = File::files($publicUploadsPath);
         $diskImagePaths = [];
         foreach ($diskFiles as $file) {
             // Store path relative to public/storage/
-            $diskImagePaths[] = 'uploads/'.$file->getFilename();
+            $diskImagePaths[] = $imagesPath.'/'.$file->getFilename();
         }
 
-        $dbImagePaths = Image::pluck('path')->toArray();
+        $dbImagePaths = Image::where('gallery_id', $gallery->id)->pluck('path')->toArray();
 
         // Add images from disk that are not in the database
         $imagesToAdd = array_diff($diskImagePaths, $dbImagePaths);
         foreach ($imagesToAdd as $path) {
-            Image::create(['path' => $path, 'is_public' => true]);
+            Image::create([
+                'gallery_id' => $gallery->id,
+                'path' => $path,
+                'is_public' => true,
+            ]);
         }
 
         // Remove images from database that are not on disk
         $imagesToRemove = array_diff($dbImagePaths, $diskImagePaths);
-        Image::whereIn('path', $imagesToRemove)->delete();
+        Image::where('gallery_id', $gallery->id)
+            ->whereIn('path', $imagesToRemove)
+            ->delete();
 
         // Fetch images from the database after synchronization
-        $query = Image::orderBy('updated_at', 'desc');
+        $query = Image::where('gallery_id', $gallery->id)->orderBy('updated_at', 'desc');
 
         // If user is not authenticated, filter by is_public, but also include their temporary images
         if (! auth()->check()) {
@@ -85,11 +99,15 @@ class ImageController extends Controller
     {
         $request->validate([
             'image' => 'required|image|mimes:jpeg,png,bmp,gif,webp|max:10240', // Max 10MB
+            'gallery' => 'required|string|exists:galleries,slug',
         ]);
 
+        $gallery = Gallery::where('slug', $request->string('gallery'))->firstOrFail();
+        $imagesPath = trim($gallery->images_path, '/');
+
         $file = $request->file('image');
         $fileName = uniqid().'.'.$file->getClientOriginalExtension();
-        $destinationPath = public_path('storage/uploads');
+        $destinationPath = public_path('storage/'.$imagesPath);
 
         // Ensure the directory exists
         if (! File::exists($destinationPath)) {
@@ -97,9 +115,10 @@ class ImageController extends Controller
         }
 
         $file->move($destinationPath, $fileName);
-        $relativePath = 'uploads/'.$fileName; // Path relative to public/storage/
+        $relativePath = $imagesPath.'/'.$fileName; // Path relative to public/storage/
 
         $image = Image::create([
+            'gallery_id' => $gallery->id,
             'path' => $relativePath,
             'is_public' => true,
         ]);
@@ -136,9 +155,19 @@ class ImageController extends Controller
         $request->validate([
             'image_id' => 'required|exists:images,id',
             'style_id' => 'nullable|exists:styles,id',
+            'gallery' => 'required|string|exists:galleries,slug',
         ]);
 
-        $image = Image::find($request->image_id);
+        $gallery = $this->resolveGallery($request);
+
+        $image = Image::query()
+            ->where('id', $request->integer('image_id'))
+            ->where('gallery_id', optional($gallery)->id)
+            ->first();
+
+        if (! $image) {
+            return response()->json(['error' => __('api.image_not_found')], 404);
+        }
         $style = null;
 
         if ($request->style_id) {
@@ -217,9 +246,13 @@ class ImageController extends Controller
     {
         $request->validate([
             'image_id' => 'required|exists:images,id',
+            'gallery' => 'required|string|exists:galleries,slug',
         ]);
 
-        $image = Image::find($request->image_id);
+        $gallery = $this->resolveGallery($request);
+        $image = Image::where('id', $request->integer('image_id'))
+            ->where('gallery_id', optional($gallery)->id)
+            ->first();
 
         if (! $image) {
             return response()->json(['error' => __('api.image_not_found')], 404);
@@ -233,6 +266,16 @@ class ImageController extends Controller
 
     public function deleteImage(Image $image)
     {
+        request()->validate([
+            'gallery' => 'required|string|exists:galleries,slug',
+        ]);
+
+        $gallery = $this->resolveGallery(request());
+
+        if ($gallery && (int) $image->gallery_id !== (int) $gallery->id) {
+            return response()->json(['error' => __('api.image_not_found')], 404);
+        }
+
         try {
             // Delete from the public/storage directory
             File::delete(public_path('storage/'.$image->path));
@@ -244,14 +287,46 @@ class ImageController extends Controller
         }
     }
 
+    public function deleteStyled(Request $request, Image $image)
+    {
+        $request->validate([
+            'gallery' => 'required|string|exists:galleries,slug',
+        ]);
+
+        $gallery = $this->resolveGallery($request);
+
+        if ($gallery && (int) $image->gallery_id !== (int) $gallery->id) {
+            return response()->json(['error' => __('api.image_not_found')], 404);
+        }
+
+        if (! $image->is_temp) {
+            return response()->json(['error' => __('api.image_not_found')], 404);
+        }
+
+        try {
+            File::delete(public_path('storage/'.$image->path));
+            $image->delete();
+
+            return response()->json(['message' => __('api.image_deleted_successfully')]);
+        } catch (\Exception $e) {
+            return response()->json(['error' => $e->getMessage()], 500);
+        }
+    }
+
     public function getStatus(Request $request)
     {
         $request->validate([
             'image_id' => 'required|exists:images,id',
             'api_provider_name' => 'required|string',
+            'gallery' => 'sometimes|string|exists:galleries,slug',
         ]);
 
-        $image = Image::find($request->image_id);
+        $gallery = $this->resolveGallery($request);
+
+        $image = Image::query()
+            ->where('id', $request->integer('image_id'))
+            ->when($gallery, fn ($q) => $q->where('gallery_id', $gallery->id))
+            ->first();
         $apiProvider = ApiProvider::where('name', $request->api_provider_name)->first();
 
         if (! $image || ! $apiProvider) {
@@ -268,14 +343,26 @@ class ImageController extends Controller
         }
     }
 
-    public function fetchStyledImage(string $promptId)
+    public function fetchStyledImage(Request $request, string $promptId)
     {
+        $request->validate([
+            'gallery' => 'required|string|exists:galleries,slug',
+        ]);
+
+        $gallery = $this->resolveGallery($request);
+
         Log::info('fetchStyledImage called.', ['prompt_id' => $promptId]);
         try {
             // Find the image associated with the prompt_id, eagerly loading relationships
-            $image = Image::with(['style.aiModel' => function ($query) {
+            $imageQuery = Image::with(['style.aiModel' => function ($query) {
                 $query->with('primaryApiProvider');
-            }])->where('comfyui_prompt_id', $promptId)->first();
+            }])->where('comfyui_prompt_id', $promptId);
+
+            if ($gallery) {
+                $imageQuery->where('gallery_id', $gallery->id);
+            }
+
+            $image = $imageQuery->first();
 
             if (! $image) {
                 Log::warning('fetchStyledImage: Image not found for prompt_id.', ['prompt_id' => $promptId]);
@@ -325,18 +412,20 @@ class ImageController extends Controller
             $decodedImage = base64_decode(preg_replace('#^data:image/\w+;base64, #i', '', $base64Image));
 
             $newImageName = 'styled_'.uniqid().'.png';
-            $newImagePathRelative = 'uploads/'.$newImageName;
+            $galleryPath = trim($image->gallery?->images_path ?: 'uploads', '/');
+            $newImagePathRelative = $galleryPath.'/'.$newImageName;
             $newImageFullPath = public_path('storage/'.$newImagePathRelative);
 
-            if (! File::exists(public_path('storage/uploads'))) {
-                File::makeDirectory(public_path('storage/uploads'), 0755, true);
-                Log::info('Created uploads directory.', ['path' => public_path('storage/uploads')]);
+            if (! File::exists(public_path('storage/'.$galleryPath))) {
+                File::makeDirectory(public_path('storage/'.$galleryPath), 0755, true);
+                Log::info('Created uploads directory.', ['path' => public_path('storage/'.$galleryPath)]);
             }
 
             File::put($newImageFullPath, $decodedImage); // Save using File facade
             Log::info('Image saved to disk.', ['path' => $newImageFullPath]);
 
             $newImage = Image::create([
+                'gallery_id' => $image->gallery_id,
                 'path' => $newImagePathRelative, // Store relative path
                 'original_image_id' => $image->id,
                 'style_id' => $style->id,
@@ -416,4 +505,25 @@ class ImageController extends Controller
 
         return response()->json(['comfyui_url' => rtrim($apiProvider->api_url, '/')]);
     }
+
+    private function resolveGallery(Request $request): ?Gallery
+    {
+        $routeGallery = $request->route('gallery');
+
+        if ($routeGallery instanceof Gallery) {
+            return $routeGallery;
+        }
+
+        $slug = $routeGallery;
+
+        if (! $slug) {
+            $slug = $request->query('gallery');
+        }
+
+        if (! $slug) {
+            return Gallery::first();
+        }
+
+        return Gallery::where('slug', $slug)->first();
+    }
 }

app/Http/Controllers/Api/SparkboothUploadController.php

@@ -0,0 +1,87 @@
+<?php
+
+namespace App\Http\Controllers\Api;
+
+use App\Http\Controllers\Controller;
+use App\Models\Gallery;
+use App\Models\Image;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\File;
+use Illuminate\Support\Facades\Hash;
+use Illuminate\Support\Str;
+use Symfony\Component\HttpFoundation\Response;
+
+class SparkboothUploadController extends Controller
+{
+    public function store(Request $request)
+    {
+        $request->validate([
+            'token' => ['required', 'string'],
+            'file' => ['required', 'file', 'mimes:jpeg,png,gif,bmp,webp', 'max:10240'],
+            'filename' => ['nullable', 'string'],
+        ]);
+
+        $gallery = $this->resolveGalleryByToken($request->string('token'));
+
+        if (! $gallery) {
+            return response()->json(['error' => 'Invalid token.'], Response::HTTP_FORBIDDEN);
+        }
+
+        if (! $gallery->upload_enabled) {
+            return response()->json(['error' => 'Uploads are disabled for this gallery.'], Response::HTTP_FORBIDDEN);
+        }
+
+        if ($gallery->upload_token_expires_at && now()->greaterThanOrEqualTo($gallery->upload_token_expires_at)) {
+            return response()->json(['error' => 'Upload token expired.'], Response::HTTP_FORBIDDEN);
+        }
+
+        $file = $request->file('file');
+        $safeName = $this->buildFilename($file->getClientOriginalExtension(), $request->input('filename'));
+        $relativePath = trim($gallery->images_path, '/').'/'.$safeName;
+        $destinationPath = public_path('storage/'.dirname($relativePath));
+
+        if (! File::exists($destinationPath)) {
+            File::makeDirectory($destinationPath, 0755, true);
+        }
+
+        $file->move($destinationPath, basename($relativePath));
+
+        $image = Image::create([
+            'gallery_id' => $gallery->id,
+            'path' => $relativePath,
+            'is_public' => true,
+        ]);
+
+        return response()->json([
+            'message' => 'Upload ok',
+            'image_id' => $image->id,
+            'url' => asset('storage/'.$relativePath),
+        ]);
+    }
+
+    private function resolveGalleryByToken(string $token): ?Gallery
+    {
+        $galleries = Gallery::query()
+            ->whereNotNull('upload_token_hash')
+            ->where('upload_enabled', true)
+            ->get();
+
+        foreach ($galleries as $gallery) {
+            if ($gallery->upload_token_hash && Hash::check($token, $gallery->upload_token_hash)) {
+                return $gallery;
+            }
+        }
+
+        return null;
+    }
+
+    private function buildFilename(string $extension, ?string $preferred = null): string
+    {
+        $extension = strtolower($extension ?: 'jpg');
+        $base = $preferred
+            ? Str::slug(pathinfo($preferred, PATHINFO_FILENAME))
+            : 'sparkbooth_'.now()->format('Ymd_His').'_'.Str::random(6);
+
+        return $base.'.'.$extension;
+    }
+}