From a91bb399f0f9088fc706bb96a5725d1a386492d3 Mon Sep 17 00:00:00 2001
From: Michael <35783820+mib1185@users.noreply.github.com>
Date: Tue, 5 Aug 2025 00:39:05 +0200
Subject: [PATCH] feat: add server.versionCheck permission (#20555)

* add server.versionCheck permission

* getVersionCheck is no admin-route
---
 mobile/openapi/lib/api/server_api.dart      | Bin 22275 -> 22379 bytes
 mobile/openapi/lib/model/permission.dart    | Bin 23652 -> 23843 bytes
 open-api/immich-openapi-specs.json          |   5 ++++-
 open-api/typescript-sdk/src/fetch-client.ts |   4 ++++
 server/src/controllers/server.controller.ts |   2 +-
 server/src/enum.ts                          |   1 +
 6 files changed, 10 insertions(+), 2 deletions(-)

diff --git a/mobile/openapi/lib/api/server_api.dart b/mobile/openapi/lib/api/server_api.dart
index 9e250b83b57b23bf3bb7f34a856635bfef31c758..9fa8f2016d96ef1a663e25cd1be0a2d480f29203 100644
GIT binary patch
delta 69
zcmZo($M||3<A!^7lWkP_CckGD<ta-oD$dN$bIwRj&YtY37r)uvUV~|J9g7gA>_!gp
J&1H_gq5!X}8Vvvd

delta 35
tcmV+;0NnrUt^tFt0kGaalix%plioiDlb#Vhvur;o0+S9r2eaNmjTInf4vGK(

diff --git a/mobile/openapi/lib/model/permission.dart b/mobile/openapi/lib/model/permission.dart
index ec67d81be4564b14f75a6eba894d837cc528c668..b0903e8f19e45bc40ec685155c14f37d04c0d125 100644
GIT binary patch
delta 130
zcmaE|gK_aL#tre}LIJ5onfWPUsYS(^`FYM6sma-s8Ks1UQj5w`i}ZjPA$&kWbaS-$
pMNuqTHY?~FC~zYwpPc9~Ioa2TiwDKv+rILXCy29dj`d~d2LOm{FSP&w

delta 24
gcmZ3yi}A@0#tre}o7an<72P~bS4Cknzn=&{0Ew3gZU6uP

diff --git a/open-api/immich-openapi-specs.json b/open-api/immich-openapi-specs.json
index d97585a39..7d3feb24a 100644
--- a/open-api/immich-openapi-specs.json
+++ b/open-api/immich-openapi-specs.json
@@ -6506,7 +6506,9 @@
         ],
         "tags": [
           "Server"
-        ]
+        ],
+        "x-immich-permission": "server.versionCheck",
+        "description": "This endpoint requires the `server.versionCheck` permission."
       }
     },
     "/server/version-history": {
@@ -12631,6 +12633,7 @@
           "server.apkLinks",
           "server.storage",
           "server.statistics",
+          "server.versionCheck",
           "serverLicense.read",
           "serverLicense.update",
           "serverLicense.delete",
diff --git a/open-api/typescript-sdk/src/fetch-client.ts b/open-api/typescript-sdk/src/fetch-client.ts
index d26d14aa4..8b2ed427b 100644
--- a/open-api/typescript-sdk/src/fetch-client.ts
+++ b/open-api/typescript-sdk/src/fetch-client.ts
@@ -3552,6 +3552,9 @@ export function getServerVersion(opts?: Oazapfts.RequestOpts) {
         ...opts
     }));
 }
+/**
+ * This endpoint requires the `server.versionCheck` permission.
+ */
 export function getVersionCheck(opts?: Oazapfts.RequestOpts) {
     return oazapfts.ok(oazapfts.fetchJson<{
         status: 200;
@@ -4616,6 +4619,7 @@ export enum Permission {
     ServerApkLinks = "server.apkLinks",
     ServerStorage = "server.storage",
     ServerStatistics = "server.statistics",
+    ServerVersionCheck = "server.versionCheck",
     ServerLicenseRead = "serverLicense.read",
     ServerLicenseUpdate = "serverLicense.update",
     ServerLicenseDelete = "serverLicense.delete",
diff --git a/server/src/controllers/server.controller.ts b/server/src/controllers/server.controller.ts
index 9a1004c28..0c184ba30 100644
--- a/server/src/controllers/server.controller.ts
+++ b/server/src/controllers/server.controller.ts
@@ -109,7 +109,7 @@ export class ServerController {
   }
 
   @Get('version-check')
-  @Authenticated()
+  @Authenticated({ permission: Permission.ServerVersionCheck })
   getVersionCheck(): Promise<VersionCheckStateResponseDto> {
     return this.systemMetadataService.getVersionCheckState();
   }
diff --git a/server/src/enum.ts b/server/src/enum.ts
index 93d271f19..8a6d361d3 100644
--- a/server/src/enum.ts
+++ b/server/src/enum.ts
@@ -172,6 +172,7 @@ export enum Permission {
   ServerApkLinks = 'server.apkLinks',
   ServerStorage = 'server.storage',
   ServerStatistics = 'server.statistics',
+  ServerVersionCheck = 'server.versionCheck',
 
   ServerLicenseRead = 'serverLicense.read',
   ServerLicenseUpdate = 'serverLicense.update',