fix(server): add permission for server stats api (#854)

server/apps/immich/src/api-v1/server-info/server-info.controller.ts

@@ -1,4 +1,4 @@
-import { Controller, Get } from '@nestjs/common';
+import { Controller, Get, UseGuards } from '@nestjs/common';
 import { ServerInfoService } from './server-info.service';
 import { serverVersion } from '../../constants/server_version.constant';
 import { ApiTags } from '@nestjs/swagger';
@@ -6,6 +6,8 @@ import { ServerPingResponse } from './response-dto/server-ping-response.dto';
 import { ServerVersionReponseDto } from './response-dto/server-version-response.dto';
 import { ServerInfoResponseDto } from './response-dto/server-info-response.dto';
 import { ServerStatsResponseDto } from './response-dto/server-stats-response.dto';
+import { JwtAuthGuard } from '../../modules/immich-jwt/guards/jwt-auth.guard';
+import { AdminRolesGuard } from '../../middlewares/admin-role-guard.middleware';
 
 @ApiTags('Server Info')
 @Controller('server-info')
@@ -27,6 +29,8 @@ export class ServerInfoController {
     return serverVersion;
   }
 
+  @UseGuards(JwtAuthGuard)
+  @UseGuards(AdminRolesGuard)
   @Get('/stats')
   async getStats(): Promise<ServerStatsResponseDto> {
     return await this.serverInfoService.getStats();

server/apps/immich/src/api-v1/server-info/server-info.module.ts

@@ -3,9 +3,11 @@ import { ServerInfoService } from './server-info.service';
 import { ServerInfoController } from './server-info.controller';
 import { AssetEntity } from '@app/database/entities/asset.entity';
 import { TypeOrmModule } from '@nestjs/typeorm';
+import { ImmichJwtModule } from '../../modules/immich-jwt/immich-jwt.module';
+import { UserEntity } from '@app/database/entities/user.entity';
 
 @Module({
-  imports: [TypeOrmModule.forFeature([AssetEntity])],
+  imports: [TypeOrmModule.forFeature([AssetEntity, UserEntity]), ImmichJwtModule],
   controllers: [ServerInfoController],
   providers: [ServerInfoService],
 })

web/src/routes/admin/+page.server.ts

@@ -12,10 +12,8 @@ export const load: PageServerLoad = async ({ parent }) => {
 	}
 
 	const { data: allUsers } = await serverApi.userApi.getAllUsers(false);
-	const { data: stats } = await serverApi.serverInfoApi.getStats();
 	return {
 		user: user,
-		allUsers: allUsers,
+		allUsers: allUsers
-		stats: stats
 	};
 };

web/src/routes/admin/+page.svelte

@@ -13,7 +13,7 @@
 	import EditUserForm from '$lib/components/forms/edit-user-form.svelte';
 	import StatusBox from '$lib/components/shared-components/status-box.svelte';
 	import type { PageData } from './$types';
-	import { api, UserResponseDto } from '@api';
+	import { api, ServerStatsResponseDto, UserResponseDto } from '@api';
 	import JobsPanel from '$lib/components/admin-page/jobs/jobs-panel.svelte';
 	import ServerStats from '$lib/components/admin-page/server-stats.svelte';
 
@@ -26,6 +26,7 @@
 	let shouldShowEditUserForm = false;
 	let shouldShowCreateUserForm = false;
 	let shouldShowInfoPanel = false;
+	let serverStat: ServerStatsResponseDto;
 
 	const onButtonClicked = (buttonType: CustomEvent) => {
 		selectedAction = buttonType.detail['actionType'] as AdminSideBarSelection;
@@ -33,6 +34,7 @@
 
 	onMount(() => {
 		selectedAction = AdminSideBarSelection.USER_MANAGEMENT;
+		getServerStats();
 	});
 
 	const onUserCreated = async () => {
@@ -59,6 +61,15 @@
 		shouldShowEditUserForm = false;
 		shouldShowInfoPanel = true;
 	};
+
+	const getServerStats = async () => {
+		try {
+			const res = await api.serverInfoApi.getStats();
+			serverStat = res.data;
+		} catch (e) {
+			console.log(e);
+		}
+	};
 </script>
 
 <svelte:head>
@@ -130,7 +141,6 @@
 			isSelected={selectedAction === AdminSideBarSelection.STATS}
 			on:selected={onButtonClicked}
 		/>
-
 		<div class="mb-6 mt-auto">
 			<StatusBox />
 		</div>
@@ -153,8 +163,8 @@
 				{#if selectedAction === AdminSideBarSelection.JOBS}
 					<JobsPanel />
 				{/if}
-				{#if selectedAction === AdminSideBarSelection.STATS}
+				{#if selectedAction === AdminSideBarSelection.STATS && serverStat}
-					<ServerStats stats={data.stats} allUsers={data.allUsers} />
+					<ServerStats stats={serverStat} allUsers={data.allUsers} />
 				{/if}
 			</section>
 		</section>