feat: cluster group admin permission for regenerate people (#32787)

(cherry picked from commit 9f273a604d5bdbd9583758c3a79d2fc0141c7a77)

server/src/controllers/cluster-group.controller.ts

@@ -94,7 +94,7 @@ export class ClusterGroupController {
   }
 
   @Post(':id/regenerate-people')
-  @Authenticated({ permission: Permission.ClusterGroupRead })
+  @Authenticated({ permission: Permission.ClusterGroupAdmin })
   @HttpCode(HttpStatus.NO_CONTENT)
   @Endpoint({
     summary: 'Regenerate people of users in cluster group',

server/src/enum.ts

@@ -193,6 +193,7 @@ export enum Permission {
 
   ClusterGroupRead = 'clusterGroup.read',
   ClusterGroupLeave = 'clusterGroup.leave',
+  ClusterGroupAdmin = 'clusterGroup.admin',
   ClusterGroupRequestCreate = 'clusterGroupRequest.create',
   ClusterGroupRequestRead = 'clusterGroupRequest.read',
   ClusterGroupRequestDelete = 'clusterGroupRequest.delete',

server/src/services/cluster-group.service.ts

@@ -73,7 +73,7 @@ export class ClusterGroupService extends BaseService {
   }
 
   async regeneratePeople(auth: AuthDto, id: string) {
-    await this.requireAccess({ auth, permission: Permission.ClusterGroupRead, ids: [id] });
+    await this.requireAccess({ auth, permission: Permission.ClusterGroupAdmin, ids: [id] });
 
     await this.jobRepository.queue({
       name: JobName.FacialRecognitionQueueAll,

server/src/utils/access.ts

@@ -356,6 +356,10 @@ const checkOtherAccess = async (access: AccessRepository, request: OtherAccessRe
       return access.person.checkFaceOwnerAccess(auth.user.id, ids);
     }
 
+    case Permission.ClusterGroupAdmin: {
+      return access.clusterGroup.checkOwnerAccess(auth.user.id, ids);
+    }
+
     case Permission.ClusterGroupRead: {
       const isMember = await access.clusterGroup.checkOwnerAccess(auth.user.id, ids);
       const isInvited = await access.clusterGroup.checkInviteAccess(auth.user.id, setDifference(ids, isMember));