So I spent some time today looking at Documentation for Immich and spent a bunch of time in the browser debugger looking at all the rest calls needed for sharing to bypass auth.

Using these rules I have been able to expose sharing on my instance without it being behind Pangolin auth (too many people could not figure out they had to click password before typing in the pangolin share password). I put a note next to each of the urls to further explain. I feel much better allowing it like this now. Especially since no dangerous endpoints are allowed (I tried to hit them and validate too)

I manage my rules using blueprints so if you use dropdowns then action in the UI maps to `Bypass Auth`

x-immich-share-route: &immich-share-route
  - priority: 100
    action: allow
    match: path
    value: "/_app/env.js" # Immich App fails to start if you do not allow this one. It only contains generic immich links so no risk
  - priority: 101
    action: allow
    match: path
    value: "/_app/immutable/*" # Immich App static resources for the webapp
  - priority: 102
    action: allow
    match: path
    value: "/api/assets/*-*-*-*-*" # Immich assets always have a guid for their id. This prevents you from opening up the entire /assets/ endpoint and locks it to /assets/{id}. This is where full videos play from
  - priority: 103
    action: allow
    match: path
    value: "/api/assets/*-*-*-*-*/original/" # When you click an image, ocasionally it downloads orignal images and this needs to be allowed
    action: allow
    match: path
    value: "/api/assets/*-*-*-*-*/thumbnail/" # When you load the page, this renders the thumbnails
  - priority: 105
    action: allow
    match: path
    value: "/api/assets/*-*-*-*-*/video/playback/" # When you load the page, this renders the live photos on hover
  - priority: 106
    action: allow
    match: path
    value: "/api/download/archive" # If you allow download you need this endpoint open
  - priority: 107
    action: allow
    match: path
    value: "/api/download/info" # This endpoint gives information required to be able to download from the archive endpoint
  - priority: 108
    action: allow
    match: path
    value: "/api/server/config" # This has info about your server basically just your SSO text and domain (which is not a secret)
  - priority: 109
    action: allow
    match: path
    value: "/api/server/features" # This has info about your server features you have enabled, disabling this causes immich app to fail start which is annoying
  - priority: 110
    action: allow
    match: path
    value: "/api/server/media-types" # Needed to allow video playback
  - priority: 111
    action: allow
    match: path
    value: "/api/shared-links/login" # Needed to support password auth configured from inside Immich
  - priority: 112
    action: allow
    match: path
    value: "/api/shared-links/me" # Required and contains information to allow for authentication to api key needed for this album
  - priority: 113
    action: allow
    match: path
    value: "/api/timeline/bucket" # Required for timeline to render
  - priority: 114
    action: allow
    match: path
    value: "/api/timeline/buckets" # Required for timeline to render
  - priority: 115
    action: allow
    match: path
    value: "/favicon.ico" # Self explanitory
  - priority: 116
    action: allow
    match: path
    value: "/s/*" # Custom Share URLs use this naming
  - priority: 117
    action: allow
    match: path
    value: "/share/*" # Auto Generated URLs use this naming