feat!: more permissions (#20250)

feat: more api key permissions

server/src/controllers/album.controller.ts

@@ -67,7 +67,7 @@ export class AlbumController {
   }
 
   @Put(':id/assets')
-  @Authenticated({ sharedLink: true })
+  @Authenticated({ permission: Permission.AlbumAssetCreate, sharedLink: true })
   addAssetsToAlbum(
     @Auth() auth: AuthDto,
     @Param() { id }: UUIDParamDto,
@@ -77,7 +77,7 @@ export class AlbumController {
   }
 
   @Delete(':id/assets')
-  @Authenticated()
+  @Authenticated({ permission: Permission.AlbumAssetDelete })
   removeAssetFromAlbum(
     @Auth() auth: AuthDto,
     @Body() dto: BulkIdsDto,
@@ -87,7 +87,7 @@ export class AlbumController {
   }
 
   @Put(':id/users')
-  @Authenticated()
+  @Authenticated({ permission: Permission.AlbumUserCreate })
   addUsersToAlbum(
     @Auth() auth: AuthDto,
     @Param() { id }: UUIDParamDto,
@@ -97,7 +97,7 @@ export class AlbumController {
   }
 
   @Put(':id/user/:userId')
-  @Authenticated()
+  @Authenticated({ permission: Permission.AlbumUserUpdate })
   updateAlbumUser(
     @Auth() auth: AuthDto,
     @Param() { id }: UUIDParamDto,
@@ -108,7 +108,7 @@ export class AlbumController {
   }
 
   @Delete(':id/user/:userId')
-  @Authenticated()
+  @Authenticated({ permission: Permission.AlbumUserDelete })
   removeUserFromAlbum(
     @Auth() auth: AuthDto,
     @Param() { id }: UUIDParamDto,