fix: calendar heatmap permissions (#30310)

e2e/src/specs/server/api/user-admin.e2e-spec.ts

@@ -358,6 +358,22 @@ describe('/admin/users', () => {
     });
   });
 
+  describe('GET /admin/users/:id/calendar-heatmap', () => {
+    it('should require authentication', async () => {
+      const { status, body } = await request(app).get(`/admin/users/${nonAdmin.userId}/calendar-heatmap`);
+      expect(status).toBe(401);
+      expect(body).toEqual(errorDto.unauthorized);
+    });
+
+    it('should require admin permissions', async () => {
+      const { status, body } = await request(app)
+        .get(`/admin/users/${nonAdmin.userId}/calendar-heatmap`)
+        .set('Authorization', `Bearer ${nonAdmin.accessToken}`);
+      expect(status).toBe(403);
+      expect(body).toEqual(errorDto.forbidden);
+    });
+  });
+
   describe('POST /admin/users/:id/restore', () => {
     it('should require authentication', async () => {
       const { status, body } = await request(app).post(`/admin/users/${userToDelete.userId}/restore`);

open-api/immich-openapi-specs.json

@@ -1639,6 +1639,7 @@
         "tags": [
           "Users (admin)"
         ],
+        "x-immich-admin-only": true,
         "x-immich-history": [
           {
             "version": "v3",

server/src/controllers/user-admin.controller.ts

@@ -102,7 +102,7 @@ export class UserAdminController {
   }
 
   @Get(':id/calendar-heatmap')
-  @Authenticated({ permission: Permission.UserRead })
+  @Authenticated({ permission: Permission.UserRead, admin: true })
   @Endpoint({
     summary: 'Retrieve calendar heatmap activity',
     description: 'Retrieve activity counts for a specified period, in a calendar heatmap format.',