Allow multiple albums in --album-locked option

[Copilot]

The --album-locked option previously restricted to a single album, hiding the album selector entirely. This enhancement allows specifying multiple albums while maintaining security restrictions.

Changes

Argument parsing (args.py)

• Changed --album-locked to accept multiple arguments via nargs='+'
• Albums stored as comma-separated list in environment variable

Backend logic (routers/album.py, photomap_server.py)

• Added get_locked_albums() helper to parse locked album list
• Updated check_album_lock() to validate against album list
• Modified /available_albums/ to return only locked albums when restricted
• Main route validates URL album parameter against locked list
• Startup validation: Server validates all album keys exist in configuration before starting
  • Exits with error code 1 if any invalid album keys are specified
  • Exits with error code 1 if no albums are configured but --album-locked is used
  • Displays clear error messages listing invalid albums and available albums

Frontend (templates/modules/settings.html)

• Album selector shown when multiple albums locked, hidden for single album
• "Manage Albums" button hidden when any lock active

Behavior:

# Single album - selector hidden, management disabled
start_photomap --album-locked vacation

# Multiple albums - selector shows locked albums only, management still disabled  
start_photomap --album-locked vacation work_photos family

# URL parameter works with locked albums
http://localhost:8050?album=work_photos

# Invalid album - server exits with error
start_photomap --album-locked vacation nonexistent_album
# Error: The following album(s) specified in --album-locked do not exist in the configuration:
#   - nonexistent_album
# Available albums: vacation, work_photos, family

All filesystem operations, album management, and export functions remain disabled when any album lock is active.

Testing:

• Added unit test for validation logic
• All 49 backend tests pass
• Security scan completed with 0 alerts

Original prompt

---

This section details on the original issue you should resolve

<issue_title>[enhancement]: Allow locking of multiple albums</issue_title>
<issue_description>Currently the --album-locked command-line option makes a single album available to the user. The album selection popup in settings disappears, and only the album indicated in the command-line option can be selected via URL. This enhancement will allow the user to provide a list of album keys using the argparse nargs='+' syntax. When two or more album keys are provided, the album selection popup reappears in the settings dialog, and the user can choose among the albums specified. In addition, the user will be able to select one of the specified albums using the album=XXXXX URL parameter.

As before, whenever the --album-locked option is provided, all options that potentially modify the server's filesystem, including the curator export function, the file delete function, album editing, the favorites move, delete and export functions, should remain disabled both on the frontend and the backend.</issue_description>

Comments on the Issue (you are @copilot in this section)

• Fixes [enhancement]: Allow locking of multiple albums #184

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.

[lstein]

When the list of albums passed to --album-locked includes an album key that is not in the configuration file, then the command should fail with a suitable error message. The server should not run.

[Copilot]

When the list of albums passed to --album-locked includes an album key that is not in the configuration file, then the command should fail with a suitable error message. The server should not run.

Implemented in commit 6e68989. The server now validates all album keys specified in --album-locked at startup:

• If any album doesn't exist in the configuration, server exits with error code 1
• Error message lists invalid albums and shows available albums
• If no albums are configured, server exits with clear error message
• Validation happens before server starts to prevent incorrect state

Example error output:

Error: The following album(s) specified in --album-locked do not exist in the configuration:
  - nonexistent_album
Available albums: vacation_2024, work_photos, family

[lstein]

Looks good.