feat: cluster group admin permission for regenerate people (#32787)

(cherry picked from commit 9f273a604d5bdbd9583758c3a79d2fc0141c7a77)

open-api/immich-openapi-specs.json

@@ -6343,7 +6343,7 @@
             "state": "Added"
           }
         ],
-        "x-immich-permission": "clusterGroup.read"
+        "x-immich-permission": "clusterGroup.admin"
       }
     },
     "/cluster-groups/{id}/requests": {
@@ -25811,6 +25811,7 @@
           "backup.delete",
           "clusterGroup.read",
           "clusterGroup.leave",
+          "clusterGroup.admin",
           "clusterGroupRequest.create",
           "clusterGroupRequest.read",
           "clusterGroupRequest.delete",

packages/sdk/src/fetch-client.ts

@@ -8351,6 +8351,7 @@ export enum Permission {
     BackupDelete = "backup.delete",
     ClusterGroupRead = "clusterGroup.read",
     ClusterGroupLeave = "clusterGroup.leave",
+    ClusterGroupAdmin = "clusterGroup.admin",
     ClusterGroupRequestCreate = "clusterGroupRequest.create",
     ClusterGroupRequestRead = "clusterGroupRequest.read",
     ClusterGroupRequestDelete = "clusterGroupRequest.delete",

server/src/controllers/cluster-group.controller.ts

@@ -94,7 +94,7 @@ export class ClusterGroupController {
   }
 
   @Post(':id/regenerate-people')
-  @Authenticated({ permission: Permission.ClusterGroupRead })
+  @Authenticated({ permission: Permission.ClusterGroupAdmin })
   @HttpCode(HttpStatus.NO_CONTENT)
   @Endpoint({
     summary: 'Regenerate people of users in cluster group',

server/src/enum.ts

@@ -193,6 +193,7 @@ export enum Permission {
 
   ClusterGroupRead = 'clusterGroup.read',
   ClusterGroupLeave = 'clusterGroup.leave',
+  ClusterGroupAdmin = 'clusterGroup.admin',
   ClusterGroupRequestCreate = 'clusterGroupRequest.create',
   ClusterGroupRequestRead = 'clusterGroupRequest.read',
   ClusterGroupRequestDelete = 'clusterGroupRequest.delete',

server/src/services/cluster-group.service.ts

@@ -73,7 +73,7 @@ export class ClusterGroupService extends BaseService {
   }
 
   async regeneratePeople(auth: AuthDto, id: string) {
-    await this.requireAccess({ auth, permission: Permission.ClusterGroupRead, ids: [id] });
+    await this.requireAccess({ auth, permission: Permission.ClusterGroupAdmin, ids: [id] });
 
     await this.jobRepository.queue({
       name: JobName.FacialRecognitionQueueAll,

server/src/utils/access.ts

@@ -356,6 +356,10 @@ const checkOtherAccess = async (access: AccessRepository, request: OtherAccessRe
       return access.person.checkFaceOwnerAccess(auth.user.id, ids);
     }
 
+    case Permission.ClusterGroupAdmin: {
+      return access.clusterGroup.checkOwnerAccess(auth.user.id, ids);
+    }
+
     case Permission.ClusterGroupRead: {
       const isMember = await access.clusterGroup.checkOwnerAccess(auth.user.id, ids);
       const isInvited = await access.clusterGroup.checkInviteAccess(auth.user.id, setDifference(ids, isMember));