jfmcarreira/immich-power-tools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge pull request #295 from jonvdveen/fix/immich-v3-api-key-permissions

Browse Source 
fix: API key permissions for Immich v3 (albumAsset.*, tag.asset) and honor "all" in key validation
This commit is contained in:
Sai charan Guntupalli
2026-07-03 08:38:36 +05:30
committed by GitHub
parent f0d8a88c27 1cc5d44e76
commit c1ab7c6099
2 changed files with 12 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/config/permissions.ts
+7 -3
View File
@@ -8,7 +8,8 @@ export const IMPORT_PERMISSIONS: Permission[] = [
{ name: "asset.upload", description: "Upload new assets" },
{ name: "album.read", description: "Read album data" },
{ name: "album.create", description: "Create new albums" },
{ name: "album.update", description: "Add assets to albums" },
{ name: "album.update", description: "Update album metadata" },
{ name: "albumAsset.create", description: "Add assets to albums" },
{ name: "tag.create", description: "Tag imported assets" },
{ name: "tag.asset", description: "Assign tags to assets" },
];
@@ -18,8 +19,11 @@ export const WORKFLOW_PERMISSIONS: Permission[] = [
{ name: "asset.update", description: "Favorite, archive, update metadata" },
{ name: "album.read", description: "Read album data" },
{ name: "album.create", description: "Create new albums" },
{ name: "album.update", description: "Add/remove assets from albums" },
{ name: "tag.create", description: "Create and assign tags" },
{ name: "album.update", description: "Update album metadata" },
{ name: "albumAsset.create", description: "Add assets to albums" },
{ name: "albumAsset.delete", description: "Remove assets from albums" },
{ name: "tag.create", description: "Create tags" },
{ name: "tag.asset", description: "Assign tags to assets" },
];
export const getPermissionNames = (permissions: Permission[]): string[] =>
src/pages/api/settings/validate-api-key.ts
+5 -1
View File
@@ -30,7 +30,11 @@ export default async function handler(req: NextApiRequest, res: NextApiResponse)
const keyData = await keyRes.json();
const granted: string[] = keyData.permissions ?? [];
const missing = REQUIRED_PERMISSIONS.filter((p) => !granted.includes(p));
// A key created with the "All" checkbox reports its permissions as ["all"],
// which grants every permission without listing them individually.
const missing = granted.includes("all")
? []
: REQUIRED_PERMISSIONS.filter((p) => !granted.includes(p));
return res.status(200).json({
valid: missing.length === 0,