immich-app/immich
1
0
Fork 0
mirror of https://github.com/immich-app/immich.git synced 2026-07-25 14:00:45 +03:00
Code Issues 783 Packages Projects Releases 22 Wiki Activity

The owner can't refresh an external library using the API #3741

New Issue
Closed
opened 2026-02-05 09:12:27 +03:00 by OVERLORD · 0 comments
OVERLORD commented 2026-02-05 09:12:27 +03:00
Owner
Copy Link

Originally created by @ilopmar on GitHub (Jun 30, 2024).

The bug

I have created an external library and assigned a non-admin user as the owner. I have a script that new photos to that library, so the script triggers a library scan, I don't want to use the scheduled cron job to rescan libraries because I only want to re-scan this specific library.

I send the following request:

curl -X POST "https://immich.mydomain.com/api/libraries/${LIBRARY_ID}/scan" \
    -H "Content-Type: application/json" \
    -H "Accept: application/json" \
    -H "x-api-key: ${API_TOKEN}"

If the API_TOKEN is from the user that owns the library (remember, non-admin user), that API call returns 403. However, if I use a token from an admin user it works.
From the log message this seems to be done on purpose but it's not what I was expecting. If an admin creates a library for a user, that user should be able to "manage" the library.

The OS that Immich Server is running on

Ubunbu Server 22.04.4

Version of Immich Server

v1.106.4

Version of Immich Mobile App

v1.106

Platform with the issue

  • Server
  • Web
  • Mobile

Your docker-compose.yml content

Not relevant

Your .env content

Not relevant

Reproduction steps

Explain in the bug

Relevant log output

immich_server            | [Nest] 17  - 06/30/2024, 10:09:47 AM    WARN [Api:AuthGuard~i0cwj2jn] Denied access to admin only route: /api/libraries/ff330295-dc1a-4f3c-b161-d3f43f73f1d1/scan
immich_server            | [Nest] 17  - 06/30/2024, 10:09:47 AM   DEBUG [Api:HttpExceptionFilter~i0cwj2jn] HttpException(403) {"message":"Forbidden resource","error":"Forbidden","statusCode":403}

Additional information

No response

Originally created by @ilopmar on GitHub (Jun 30, 2024). ### The bug I have created an external library and assigned a non-admin user as the owner. I have a script that new photos to that library, so the script triggers a library scan, I don't want to use the scheduled cron job to rescan libraries because I only want to re-scan this specific library. I send the following request: ``` curl -X POST "https://immich.mydomain.com/api/libraries/${LIBRARY_ID}/scan" \ -H "Content-Type: application/json" \ -H "Accept: application/json" \ -H "x-api-key: ${API_TOKEN}" ``` If the `API_TOKEN` is from the user that owns the library (remember, non-admin user), that API call returns 403. However, if I use a token from an admin user it works. From the log message this seems to be done on purpose but it's not what I was expecting. If an admin creates a library for a user, that user should be able to "manage" the library. ### The OS that Immich Server is running on Ubunbu Server 22.04.4 ### Version of Immich Server v1.106.4 ### Version of Immich Mobile App v1.106 ### Platform with the issue - [X] Server - [ ] Web - [ ] Mobile ### Your docker-compose.yml content ```YAML Not relevant ``` ### Your .env content ```Shell Not relevant ``` ### Reproduction steps ```bash Explain in the bug ``` ### Relevant log output ```shell immich_server | [Nest] 17 - 06/30/2024, 10:09:47 AM WARN [Api:AuthGuard~i0cwj2jn] Denied access to admin only route: /api/libraries/ff330295-dc1a-4f3c-b161-d3f43f73f1d1/scan immich_server | [Nest] 17 - 06/30/2024, 10:09:47 AM DEBUG [Api:HttpExceptionFilter~i0cwj2jn] HttpException(403) {"message":"Forbidden resource","error":"Forbidden","statusCode":403} ``` ### Additional information _No response_
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
accessibility
changelog:enhancement
changelog:security
changelog:skip
changelog:translation
cli
date-time
dependencies
documentation
external-library
format
good first issue
mobile-beta
mobile-beta
mobile-beta
needs-answer
nice to have
pull-request
Mirrored from GitHub Pull Request
 sharing
tech-debt
📱mobile
🖥️web
🗄️server
🧠machine-learning
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
OVERLORD
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: immich-app/immich#3741
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?