fix: withhold the cover image of a locked album

A locked album listed its cover like any other, so the grid showed a
photo from inside an album whose whole point is that you need a password
to see inside it. The lock badge sat on top of the very content it was
meant to be gating.

Both reads now send no cover path for a locked album, and skip the lookup
rather than fetching a path they will not return. The card already falls
back to the placeholder when the path is absent.

Author: rohan-pandeyy

backend/app/routes/albums.py

@@ -41,14 +41,19 @@ def get_albums():
         # Get image count for each album
         image_ids = db_get_album_images(album[0])
         image_count = len(image_ids)
+        is_locked = bool(album[3])
 
         album_list.append(
             Album(
                 album_id=album[0],
                 album_name=album[1],
                 description=album[2] or "",
-                is_locked=bool(album[3]),
-                cover_image_path=db_get_album_cover_path(album[0]),
+                is_locked=is_locked,
+                # A locked album's cover would show the very content the
+                # password is protecting, so never send it.
+                cover_image_path=(
+                    None if is_locked else db_get_album_cover_path(album[0])
+                ),
                 image_count=image_count,
             )
         )
@@ -103,12 +108,14 @@ def get_album(album_id: str = Path(...)):
         image_ids = db_get_album_images(album_id)
         image_count = len(image_ids)
 
+        is_locked = bool(album[3])
         album_obj = Album(
             album_id=album[0],
             album_name=album[1],
             description=album[2] or "",
-            is_locked=bool(album[3]),
-            cover_image_path=db_get_album_cover_path(album_id),
+            is_locked=is_locked,
+            # Same reasoning as the listing: the cover gives away the contents.
+            cover_image_path=(None if is_locked else db_get_album_cover_path(album_id)),
             image_count=image_count,
         )
         return GetAlbumResponse(success=True, data=album_obj)

backend/tests/test_albums.py

@@ -184,6 +184,63 @@ def test_get_all_albums_include_hidden(self, mock_db_album, mock_db_locked_album
 
             mock_get_all.assert_called_once()
 
+    def test_locked_album_cover_is_withheld(self, mock_db_album, mock_db_locked_album):
+        """A locked album's cover would reveal the content the password gates."""
+        with patch("app.routes.albums.db_get_all_albums") as mock_get_all, patch(
+            "app.routes.albums.db_get_album_cover_path"
+        ) as mock_cover:
+            mock_get_all.return_value = [
+                (
+                    mock_db_album["album_id"],
+                    mock_db_album["album_name"],
+                    mock_db_album["description"],
+                    mock_db_album["is_locked"],
+                    mock_db_album["password_hash"],
+                    None,
+                ),
+                (
+                    mock_db_locked_album["album_id"],
+                    mock_db_locked_album["album_name"],
+                    mock_db_locked_album["description"],
+                    mock_db_locked_album["is_locked"],
+                    mock_db_locked_album["password_hash"],
+                    None,
+                ),
+            ]
+            mock_cover.return_value = "/photos/secret.jpg"
+
+            response = client.get("/albums/")
+            assert response.status_code == 200
+
+            covers = {
+                album["album_id"]: album["cover_image_path"]
+                for album in response.json()["albums"]
+            }
+            assert covers[mock_db_album["album_id"]] == "/photos/secret.jpg"
+            assert covers[mock_db_locked_album["album_id"]] is None
+            # The path is never even looked up for a locked album
+            mock_cover.assert_called_once_with(mock_db_album["album_id"])
+
+    def test_get_album_by_id_withholds_a_locked_cover(self, mock_db_locked_album):
+        """The single-album read must not leak what the listing hides."""
+        with patch("app.routes.albums.db_get_album") as mock_get_album, patch(
+            "app.routes.albums.db_get_album_cover_path"
+        ) as mock_cover:
+            mock_get_album.return_value = (
+                mock_db_locked_album["album_id"],
+                mock_db_locked_album["album_name"],
+                mock_db_locked_album["description"],
+                mock_db_locked_album["is_locked"],
+                mock_db_locked_album["password_hash"],
+                None,
+            )
+            mock_cover.return_value = "/photos/secret.jpg"
+
+            response = client.get(f"/albums/{mock_db_locked_album['album_id']}")
+            assert response.status_code == 200
+            assert response.json()["data"]["cover_image_path"] is None
+            mock_cover.assert_not_called()
+
     def test_get_all_albums_empty_list(self):
         """
         Test fetching albums when none exist.

frontend/src/pages/__tests__/Album.test.tsx

@@ -109,6 +109,26 @@ describe('Albums page', () => {
     );
   };
 
+  // The backend withholds cover_image_path for locked albums; the card has to
+  // fall back to the placeholder rather than render a broken or empty tile.
+  test('shows a placeholder instead of a cover for a locked album', async () => {
+    serverAlbums = [
+      {
+        album_id: 'a2',
+        album_name: 'Private',
+        description: '',
+        is_locked: true,
+        cover_image_path: null,
+        image_count: 4,
+      },
+    ];
+
+    render(<AlbumsWithGlobalOverlays />);
+
+    const cover = await screen.findByAltText('Private');
+    expect(cover.getAttribute('src')).toMatch(/placeholder-album/);
+  }, 30000);
+
   test('shows skeletons while loading instead of a blocking loader', async () => {
     let releaseAlbums: (value: unknown) => void = () => {};
     mockGetAllAlbums.mockImplementation(