# immich — parity map (Phase 2 P2) + recipe-specific tests (P3)

Reference corpus: `references/recipe-maintainer/recipe-info/immich/tests/` (health_check.py, oidc_login.py).

## Parity ports
| recipe-maintainer test | cc-ci test | what's verified |
|---|---|---|
| `health_check.py` | `tests/immich/functional/test_health_check.py::test_immich_returns_200` | HTTP 200/301/302 from `/` (immich web SPA served). |

## Recipe-specific functional tests (P3, ≥2 separate tests — characteristic behavior)
1. **`test_asset_upload.py::test_immich_upload_asset_readback_and_thumbnail`** — the §4.3
   create-an-object + read-it-back: admin-sign-up → login → **upload an asset**
   (`POST /api/assets` multipart, 201 created with unique content) → **read it back**
   (`GET /api/assets/{id}` → 200, type IMAGE) → **immich generated a thumbnail/derivative**
   (`GET /api/assets/{id}/thumbnail` → 200, polled for the async generation). Asserts stored app
   state + the generated derivative — immich's whole purpose (photo ingest + derivatives).
2. **`test_asset_processing.py::test_immich_processes_uploaded_asset_metadata_and_statistics`** —
   immich's **asset-processing pipeline**, a distinct microservice path from thumbnailing: after
   upload, poll `GET /api/assets/{id}` until the **metadata-extraction** job populated `exifInfo`
   with the image dimensions (exifImageWidth/Height == 1 for the 1x1 PNG) → **proves the extraction
   pipeline ran**; then `GET /api/assets/statistics` → the asset is **catalogued into the owner's
   library** (images/total >= 1). Real assertions on processed state, not a 200 stand-in.

Both verified against immich app version 2.7.5.

Backup data-integrity (P4): Phase-1d/1e lifecycle overlays — `ops.py` seeds a postgres `ci_marker`
(postgres/immich DB); `test_upgrade/backup/restore.py` assert it survives. **P4 requires the
recipe-PR `recipe-maintainers/immich#1`** — the *published* recipe backed up NO database
(`backupbot.backup` sat only on the `app` service with all its volumes excluded; the
`database`/postgres service had no backup hook), so a restore yielded an empty DB. The PR adds a
`database`-service `/pg_backup.sh` config-mount + backupbot pre/restore hooks (matrix-synapse
convention); with it the ci_marker survives the recipe's real backup→restore. See DECISIONS.md
"immich postgres backup recipe-PR".

## Non-ports (documented — §7.1)
- **`oidc_login.py`** — authentik-specific in the corpus. Per the operator SSO policy (DECISIONS
  "SSO-provider policy"), **keycloak is the default** and **Phase-2 DONE is NOT gated on authentik**;
  immich's OIDC is **optional** (immich boots + the §4.3 asset flow works with a local admin, no SSO).
  Porting an OIDC login test (under keycloak) is possible but not required for immich's gate; the
  §4.3 functional depth above is met without it. Recorded rather than silently omitted.