Cloud Photo Sources

Cloud photo sources

Import photos straight from OneDrive, Google Drive and Synology Photos. Imported photos go through the same pipeline as uploads (HEIC→JPEG, metadata) and land in a screen/album you pick.

Where you find it:

• Gallery → Add photos (or the Upload ▾ menu) → choose a source. Cloud options only appear when that source is set up/connected.
• Account page → connect/disconnect your own account per source.
• Settings → Cloud photo sources (admin) → configure OneDrive/Google apps.

All stored secrets (OAuth refresh tokens, client secrets, the Synology password + device token) are AES‑256‑GCM encrypted at rest.

Prerequisite for OneDrive & Google: set your Public dashboard URL first — the redirect URI is built from it.

---

OneDrive (Microsoft)

OneDrive uses delegated OAuth with PKCE — no client secret needed. One admin registers an app once; then every user connects their own account. Personal (Outlook/Hotmail) and work/school accounts are supported.

Admin: register the app (once)

1. Settings → Cloud photo sources → OneDrive import. Note the Redirect URI shown (e.g. https://photos.example.com/api/sources/onedrive/callback).
2. Microsoft Entra admin center → App registrations → New registration.
3. Supported account types: choose one that includes personal Microsoft accounts (for Outlook/Hotmail).
4. Authentication → Add a platform → Single‑page application → paste the Redirect URI.
5. API permissions → Microsoft Graph → Delegated → Files.Read → Add.
6. Copy the Application (client) ID into PhotoDock. Leave the client secret blank. Set the Tenant to common (personal + work) or consumers (personal only). Save.

Users: connect

Account → Microsoft 365 → Connect → sign in → Allow. Then use Add photos → Import from OneDrive.

Non‑admins / "bring your own app"

A user without admin rights can register their own app: Account → Microsoft 365 → Use my own app, which walks through the same steps and takes only a Client ID (PKCE).

Troubleshooting

• AADSTS9002327 (SPA token redemption): handled automatically — PhotoDock sends the required Origin header. If a strict tenant still rejects it, add a Web platform redirect + a client secret in Azure and paste the secret into PhotoDock; it switches to the confidential flow.
• Redirect URI mismatch: it must match exactly (scheme, host, path, no trailing slash). Re‑copy it from the settings page after setting the Public dashboard URL.

---

Google Drive

Google uses OAuth with a client ID + secret (a Google "Web application" client). This is admin‑configured only (Google's setup is too heavy for per‑user).

Admin: set up (once)

1. Settings → Cloud photo sources → Google Drive import. Note the Redirect URI.
2. Google Cloud Console → enable the Google Drive API.
3. OAuth consent screen → User type: External. While the app is unverified, add each user (incl. personal Gmail) under Test users.
4. Credentials → Create credentials → OAuth client ID → Web application → add the Redirect URI as an Authorized redirect URI.
5. Copy the Client ID and Client secret into PhotoDock → Save.

Users: connect

Account → Google Drive → Connect → choose account → Allow. Then Add photos → Import from Google Drive.

Personal Gmail accounts work as long as they're listed under Test users (until you publish/verify the app).

---

Synology Photos

Synology is per‑user — each user enters their own NAS. No OAuth, no admin setup. Works with Personal Space and the Shared Space.

Connect

Account → Synology Photos → Connect (or the picker) and enter:

• NAS URL — e.g. https://mynas.synology.me:5001 (self‑signed certs are accepted). Use https:// so your password isn't sent in clear text.
• Account + Password.
• 2FA code — if your account has 2‑step verification (authenticator‑code type).

How 2FA is handled

On a successful login PhotoDock stores a device token (a "remembered device"), so future browses/imports log in silently — no code needed again. The password and device token are encrypted at rest.

• If the device token later expires or is revoked (e.g. you change your NAS password or remove the trusted device), you're asked for just a fresh 2FA code — your URL/account/password stay saved.
• Changing your NAS password requires a full reconnect.

Importing

In the picker, switch Space → Personal / Shared, browse folders, multi‑select photos, pick a target screen/album, and Import.

---

How importing works

1. You pick photos and a target screen (+ optional album).
2. PhotoDock downloads each file from the provider (server‑side, using your encrypted token/credentials).
3. Each image is ingested like an upload (HEIC→JPEG, unique filename, metadata tagged with its source).
4. The photos appear in that screen/album and are served to the paired device.

See also: Single sign‑on (the same Microsoft/Google apps also power "Sign in with…").