fix: calendar heatmap api key permissions (#30314)

e2e/src/specs/server/api/user-admin.e2e-spec.ts

@@ -1,5 +1,6 @@
 import {
   LoginResponseDto,
+  Permission,
   QueueName,
   createStack,
   deleteUserAdmin,
@@ -372,6 +373,15 @@ describe('/admin/users', () => {
       expect(status).toBe(403);
       expect(body).toEqual(errorDto.forbidden);
     });
+
+    it('should require the AdminUserRead permission', async () => {
+      const { secret } = await utils.createApiKey(admin.accessToken, [Permission.UserRead]);
+      const { status, body } = await request(app)
+        .get(`/admin/users/${nonAdmin.userId}/calendar-heatmap`)
+        .set('x-api-key', secret);
+      expect(status).toBe(403);
+      expect(body).toEqual(errorDto.forbidden);
+    });
   });
 
   describe('POST /admin/users/:id/restore', () => {

open-api/immich-openapi-specs.json

@@ -1650,7 +1650,7 @@
             "state": "Stable"
           }
         ],
-        "x-immich-permission": "user.read",
+        "x-immich-permission": "adminUser.read",
         "x-immich-state": "Stable"
       }
     },

server/src/controllers/user-admin.controller.ts

@@ -102,7 +102,7 @@ export class UserAdminController {
   }
 
   @Get(':id/calendar-heatmap')
-  @Authenticated({ permission: Permission.UserRead, admin: true })
+  @Authenticated({ permission: Permission.AdminUserRead, admin: true })
   @Endpoint({
     summary: 'Retrieve calendar heatmap activity',
     description: 'Retrieve activity counts for a specified period, in a calendar heatmap format.',